1-1 1DT066 Distributed Information System Chapter 8 Network Security.
-
Upload
sheryl-robertson -
Category
Documents
-
view
219 -
download
4
Transcript of 1-1 1DT066 Distributed Information System Chapter 8 Network Security.
![Page 1: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/1.jpg)
1-1
1DT066Distributed Information System
Chapter 8Network Security
![Page 2: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/2.jpg)
Chapter 8: Network Security
8: Netw
ork Security
8-2
Chapter goals: understand principles of network security:
cryptography and its many uses beyond “confidentiality ”
authentication message integrity
security in practice: firewalls and intrusion detection systems security in application, transport, network, link layers
![Page 3: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/3.jpg)
Chapter 8 roadmap
8.1 What is network security?8.2 Principles of cryptography8.3 Message integrity8.4 Securing e-mail8.5 Operational security: firewalls and IDS
8-3
8: Netw
ork Security
![Page 4: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/4.jpg)
What is network security?
Confidentiality: only sender, intended receiver should “understand” message contents sender encrypts message receiver decrypts message
Authentication: sender, receiver want to confirm identity of each other
Message integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection
Access and availability: services must be accessible and available to users
8-4
8: Netw
ork Security
![Page 5: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/5.jpg)
FRIENDS AND ENEMIES: ALICE, BOB, TRUDY well-known in network security world Bob, Alice (lovers!) want to communicate “securely” Trudy (intruder) may intercept, delete, add messages 8: N
etwork S
ecurity
8-5
securesender
securereceiver
channel data, control messages
data data
Alice Bob
Trudy
![Page 6: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/6.jpg)
There are bad guys (and girls) out there!
Q: What can a “bad guy” do?
8-6
8: Netw
ork Security
![Page 7: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/7.jpg)
There are bad guys (and girls) out there!Q: What can a “bad guy” do?
A: a lot! eavesdrop: intercept messages actively insert messages into connection impersonation: can fake (spoof) source address in
packet (or any field in packet) hijacking: “take over” ongoing connection by
removing sender or receiver, inserting himself in place
denial of service: prevent service from being used by others (e.g., by overloading resources)
8-7
8: Netw
ork Security
![Page 8: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/8.jpg)
Chapter 8 roadmap
8.1 What is network security?8.2 Principles of cryptography8.3 Message integrity8.4 Securing e-mail8.5 Operational security: firewalls and IDS
8-8
8: Netw
ork Security
![Page 9: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/9.jpg)
THE LANGUAGE OF CRYPTOGRAPHY
symmetric key crypto: sender, receiver keys identicalpublic-key crypto: encryption key public, decryption
key secret (private)8-9
8: Netw
ork Security
plaintext plaintextciphertext
KA
encryptionalgorithm
decryption algorithm
Alice’s encryptionkey
Bob’s decryptionkey
KB
![Page 10: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/10.jpg)
SYMMETRIC KEY CRYPTOGRAPHYsubstitution cipher: substituting one thing for
another monoalphabetic cipher: substitute one letter for another
8-10
8: Netw
ork Security
plaintext: abcdefghijklmnopqrstuvwxyz
ciphertext: mnbvcxzasdfghjklpoiuytrewq
Plaintext: bob. i love you. aliceciphertext: nkn. s gktc wky. mgsbc
E.g.:
Q: How hard to break this simple cipher?: brute force (how hard?) other?
![Page 11: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/11.jpg)
SYMMETRIC KEY CRYPTOGRAPHY
symmetric key crypto: Bob and Alice share know same (symmetric) key: K
e.g., key is knowing substitution pattern in mono alphabetic substitution cipher
Q: how do Bob and Alice agree on key value?8-11
8: Netw
ork Security
plaintextciphertext
KA-B
encryptionalgorithm
decryption algorithm
A-B
KA-B
plaintextmessage, m
K (m)A-B
K (m)A-Bm = K ( )
A-B
![Page 12: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/12.jpg)
PUBLIC KEY CRYPTOGRAPHY
symmetric key crypto requires sender,
receiver know shared secret key
Q: how to agree on key in first place (particularly if never “met”)?
8: Netw
ork Security
8-12
public key cryptography
radically different approach [Diffie-Hellman76, RSA78]
sender, receiver do not share secret key
public encryption key known to all
private decryption key known only to receiver
![Page 13: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/13.jpg)
PUBLIC KEY CRYPTOGRAPHY
8: Netw
ork Security
8-13
plaintextmessage, m
ciphertextencryptionalgorithm
decryption algorithm
Bob’s public key
plaintextmessageK (m)
B+
K B+
Bob’s privatekey
K B-
m = K (K (m))B+
B-
![Page 14: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/14.jpg)
PUBLIC KEY ENCRYPTION ALGORITHMS
need K ( ) and K ( ) such that
8-14
8: Netw
ork Security
B B. .
given public key K , it should be impossible to compute private key K B
B
Requirements:
1
2
RSA: Rivest, Shamir, Adleman algorithm
+ -
K (K (m)) = m BB
- +
+
-
![Page 15: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/15.jpg)
RSA: Encryption, decryption
8-15
8: Netw
ork Security
0. Given public key (n,e) and private key (n,d) as computed above
1. To encrypt bit pattern, m, compute
c = m mod n
e (i.e., remainder when m is divided by n)e
2. To decrypt received bit pattern, c, compute
m = c mod n
d (i.e., remainder when c is divided by n)d
m = (m mod n)
e mod n
dMagichappens!
c
![Page 16: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/16.jpg)
RSA example:
8-16
8: Netw
ork Security
Bob chooses p=5, q=7. Then n=35, z=24.e=5 (so e, z relatively prime).d=29 (so ed-1 exactly divisible by z.
letter m me c = m mod ne
l 12 1524832 17
c m = c mod nd
17 481968572106750915091411825223071697 12
cdletter
l
encrypt:
decrypt:
![Page 17: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/17.jpg)
RSA: ANOTHER IMPORTANT PROPERTY
8-17
8: Netw
ork Security
The following property will be very useful later:
K (K (m)) = m BB
- +K (K (m))
BB+ -
=
use public key first, followed
by private key
use private key first,
followed by public key
Result is the same!
![Page 18: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/18.jpg)
Chapter 8 roadmap
8.1 What is network security?8.2 Principles of cryptography8.3 Message integrity8.4 Securing e-mail8.5 Operational security: firewalls and IDS
8-18
8: Netw
ork Security
![Page 19: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/19.jpg)
MESSAGE INTEGRITY
8: Netw
ork Security
8-19
Bob receives msg from Alice, wants to ensure: message originally came from Alice message not changed since sent by Alice
Cryptographic Hash: takes input m, produces fixed length value, H(m)
e.g., as in Internet checksum computationally infeasible to find two different
messages, x, y such that H(x) = H(y) equivalently: given m = H(x), (x unknown), can not
determine x. note: Internet checksum fails this requirement!
![Page 20: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/20.jpg)
MESSAGE AUTHENTICATION CODE
8: Netw
ork Security
8-20
m
s(shared secret)
(message)
H(.)H(m+s)
publicInternetappend
m H(m+s)
s
compare
m
H(m+s)
H(.)
H(m+s)
(shared secret)
![Page 21: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/21.jpg)
DIGITAL SIGNATURES
8: Netw
ork Security
8-21
cryptographic technique analogous to hand-written signatures.
sender (Bob) digitally signs document, establishing he is document owner/creator.
verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document
![Page 22: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/22.jpg)
DIGITAL SIGNATURES
8: Netw
ork Security
8-22
simple digital signature for message m: Bob “signs” m by encrypting with his private
key KB, creating “signed” message, KB(m)--
Dear Alice
Oh, how I have missed you. I think of you all the time! …(blah blah blah)
Bob
Bob’s message, m
public keyencryptionalgorithm
Bob’s privatekey
K B-
Bob’s message, m, signed
(encrypted) with his private key
K B-(m)
![Page 23: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/23.jpg)
DIGITAL SIGNATURES (MORE)8: N
etwork S
ecurity
8-23
suppose Alice receives msg m, digital signature KB(m) Alice verifies m signed by Bob by applying Bob’s public
key KB to KB(m) then checks KB(KB(m) ) = m.
if KB(KB(m) ) = m, whoever signed m must have used Bob’s private key.
Alice thus verifies that: Bob signed m. No one else signed m. Bob signed m and not m’.
non-repudiation: Alice can take m, and signature KB(m) to court
and prove that Bob signed m.
+ +
-
-
- -
+
-
![Page 24: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/24.jpg)
Alice verifies signature and integrity of digitally signed message:
8: Netw
ork Security
8-24
large message
mH: hashfunction H(m)
digitalsignature(encrypt)
Bob’s private
key K B-
+
Bob sends digitally signed message:
KB(H(m))-
encrypted msg digest
KB(H(m))-
encrypted msg digest
large message
m
H: hashfunction
H(m)
digitalsignature(decrypt)
H(m)
Bob’s public
key K B+
equal ?
Digital signature = signed MAC
![Page 25: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/25.jpg)
PUBLIC KEY CERTIFICATION
8: Netw
ork Security
8-25
public key problem: When Alice obtains Bob’s public key (from web
site, e-mail, diskette), how does she know it is Bob’s public key, not Trudy’s?
solution: trusted certification authority (CA)
![Page 26: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/26.jpg)
Certification Authorities Certification Authority (CA): binds public key to
particular entity, E. E registers its public key with CA.
E provides “proof of identity” to CA. CA creates certificate binding E to its public key. certificate containing E’s public key digitally signed by
CA: CA says “This is E’s public key.”
8: Netw
ork Security
8-26
Bob’s public
key K B+
Bob’s identifying informatio
n
digitalsignature(encrypt)
CA private
key K CA-
K B+
certificate for Bob’s public
key, signed by CA
-K CA(K ) B+
![Page 27: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/27.jpg)
Certification Authorities when Alice wants Bob’s public key:
gets Bob’s certificate (Bob or elsewhere). apply CA’s public key to Bob’s certificate, get Bob’s
public key
8: Netw
ork Security
8-27
Bob’s public
key K B+
digitalsignature(decrypt)
CA public
key K CA+
K B+
-K CA(K ) B+
![Page 28: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/28.jpg)
Chapter 8 roadmap
8.1 What is network security?8.2 Principles of cryptography8.3 Message integrity8.4 Securing e-mail8.5 Operational security: firewalls and IDS
8-28
8: Netw
ork Security
![Page 29: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/29.jpg)
Secure e-mail
8-29
8: Netw
ork Security
Alice: generates random symmetric private key, KS. encrypts message with KS (for efficiency) also encrypts KS with Bob’s public key. sends both KS(m) and KB(KS) to Bob.
Alice wants to send confidential e-mail, m, to Bob.
KS( ).
KB( ).+
+ -
KS(m
)
KB(KS )+
m
KS
KS
KB+
Internet
KS( ).
KB( ).-
KB-
KS
mKS(m
)
KB(KS )+
![Page 30: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/30.jpg)
Secure e-mail
8-30
8: Netw
ork Security
Bob: uses his private key to decrypt and recover KS
uses KS to decrypt KS(m) to recover m
Alice wants to send confidential e-mail, m, to Bob.
KS( ).
KB( ).+
+ -
KS(m
)
KB(KS )+
m
KS
KS
KB+
Internet
KS( ).
KB( ).-
KB-
KS
mKS(m
)
KB(KS )+
![Page 31: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/31.jpg)
Chapter 8 roadmap
8.1 What is network security?8.2 Principles of cryptography8.3 Message integrity8.4 Securing e-mail8.5 Operational security: firewalls and IDS
8-31
8: Netw
ork Security
![Page 32: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/32.jpg)
FIREWALLS8: N
etwork S
ecurity
8-32
isolates organization’s internal net from larger Internet, allowing some packets to pass, blocking others.
firewall
administerednetwork
publicInternet
firewall
![Page 33: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/33.jpg)
FIREWALLS: WHY8: N
etwork S
ecurity
8-33
prevent denial of service attacks: SYN flooding: attacker establishes many bogus
TCP connections, no resources left for “real” connections
prevent illegal modification/access of internal data. e.g., attacker replaces CIA’s homepage with
something elseallow only authorized access to inside network (set of
authenticated users/hosts)
![Page 34: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/34.jpg)
Intrusion detection systems packet filtering:
operates on TCP/IP headers only no correlation check among sessions
IDS: intrusion detection system deep packet inspection: look at packet contents
(e.g., check character strings in packet against database of known virus, attack strings)
examine correlation among multiple packets port scanning network mapping DoS attack
8-34
8: Netw
ork Security
![Page 35: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/35.jpg)
Intrusion detection systems multiple IDSs: different types of checking at
different locations
8-35
8: Netw
ork Security
Webserver
FTPserver
DNSserver
applicationgateway
Internet
demilitarized zone
internalnetwork
firewall
IDS sensors
![Page 36: 1-1 1DT066 Distributed Information System Chapter 8 Network Security.](https://reader030.fdocuments.in/reader030/viewer/2022032707/56649e545503460f94b4a7dc/html5/thumbnails/36.jpg)
Network Security (summary)Basic techniques…...
cryptography (symmetric and public) message integrity digital signature
…. used in many different security scenarios secure email
Operational Security: firewalls and IDS
8-36
8: Netw
ork Security