Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding...
-
date post
18-Dec-2015 -
Category
Documents
-
view
217 -
download
1
Transcript of Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding...
![Page 1: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/1.jpg)
Internet Protocol SecurityAn Overview of IPSec
![Page 2: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/2.jpg)
Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security. IPSec Security Services. Modes of operation. IPSec Security Protocols. Outbound/Inbound IPSec Processing. Real World Deployment Examples.
![Page 3: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/3.jpg)
What Security Problem?
Today's Internet is primarily comprised of :
Public Un-trusted Unreliable IP networks
Because of this inherent lack of security, the Internet is subject to various types of threats…
![Page 4: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/4.jpg)
Internet Threats
Data integrityThe contents of a packet can be accidentally or deliberately modified.
Identity spoofingThe origin of an IP packet can be forged.
Anti-reply attacksUnauthorized data can be retransmitted.
Loss of privacyThe contents of a packet can be examined in transit.
![Page 5: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/5.jpg)
Understanding TCP/IPOSI Reference Model
Application Layer
Transport Layer
Network Layer
Physical Layer
Presentation Layer
Session Layer
Logical Link Layer
TCP, UDP
IP
Network Adapter
Device Driver
Application
HT
TP
SM
TP
FT
P
SN
MP
NF
S
FT
P
DN
S
![Page 6: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/6.jpg)
Understanding TCP/IPEncapsulation of Data for Network Delivery
Original Message
Application Layer
![Page 7: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/7.jpg)
Understanding TCP/IPEncapsulation of Data for Network Delivery
Original Message
Data 3
Application Layer
Transport Layer(TCP, UDP)
![Page 8: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/8.jpg)
Understanding TCP/IPEncapsulation of Data for Network Delivery
Original Message
Data 3Header 3Transport Layer(TCP, UDP)
Application Layer
![Page 9: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/9.jpg)
Understanding TCP/IPEncapsulation of Data for Network Delivery
Original Message
Data 3Header 3
Data 2
Transport Layer(TCP, UDP)
Network Layer(IP)
Application Layer
![Page 10: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/10.jpg)
Understanding TCP/IPEncapsulation of Data for Network Delivery
Original Message
Data 3Header 3
Data 2Header 2
Transport Layer(TCP, UDP)
Network Layer(IP)
Application Layer
![Page 11: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/11.jpg)
Understanding TCP/IPEncapsulation of Data for Network Delivery
Original Message
Data 3Header 3
Data 2Header 2
Transport Layer(TCP, UDP)
Network Layer(IP)
Data 1
Application Layer
Data Link Layer
![Page 12: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/12.jpg)
Understanding TCP/IPEncapsulation of Data for Network Delivery
Original Message
Data 3Header 3
Data 2Header 2
Transport Layer(TCP, UDP)
Network Layer(IP)
Data 1Header 1
Application Layer
Data Link Layer
![Page 13: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/13.jpg)
Understanding TCP/IP
Data 1Header 1
Packet
Packet Sent by Host A
Data Link Layer
![Page 14: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/14.jpg)
Understanding TCP/IP
Network Layer
Data Link Layer
Packet Received by intermediary Router
![Page 15: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/15.jpg)
Understanding TCP/IP
Data 1Header 1
Packet
Packet Received by Host B
Data Link Layer
![Page 16: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/16.jpg)
Understanding TCP/IP
Data 1Header 1
De-capsulation of Data from Network Delivery
Data Link Layer
![Page 17: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/17.jpg)
Understanding TCP/IPDe-capsulation of Data from Network Delivery
Data 1Data Link Layer
![Page 18: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/18.jpg)
Understanding TCP/IPDe-capsulation of Data from Network Delivery
Data 2Header 2Network Layer(IP)
![Page 19: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/19.jpg)
Understanding TCP/IPDe-capsulation of Data from Network Delivery
Data 2Network Layer(IP)
![Page 20: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/20.jpg)
Understanding TCP/IPDe-capsulation of Data from Network Delivery
Data 3Header 3Transport Layer(TCP, UDP)
![Page 21: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/21.jpg)
Understanding TCP/IPDe-capsulation of Data from Network Delivery
Data 3Transport Layer(TCP, UDP)
![Page 22: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/22.jpg)
Understanding TCP/IPDe-capsulation of Data from Network Delivery
Original Message
Application Layer
![Page 23: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/23.jpg)
Understanding TCP/IPDe-capsulation of Data from Network Delivery
Original Message
Application Layer
![Page 24: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/24.jpg)
Security at What Level?
Application Layer
Transport Layer
Network Layer
Data Link Layer
PGP, Kerberos, SSH, etc.
Transport Layer Security (TLS)
IP Security
Hardware encryption
![Page 25: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/25.jpg)
Security at Application Layer
(PGP, Kerberos, SSH, etc.)
Implemented in end-hosts Advantages- Extend application without involving operating system.- Application can understand the data and can provide the appropriate
security.
Disadvantages- Security mechanisms have to be designed independently of each
application.
![Page 26: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/26.jpg)
Security at Transport Layer
Transport Layer Security (TLS)
Implemented in end-hosts Advantages- Existing applications get security seamlessly
Disadvantages- Protocol specific
![Page 27: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/27.jpg)
Security at Network Layer
IP Security (IPSec)
Advantages- Provides seamless security to application and transport layers (ULPs).- Allows per flow or per connection security and thus allows for very
fine-grained security control.
Disadvantages- More difficult to to exercise on a per user basis on a multi-user
machine.
![Page 28: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/28.jpg)
Security at Data Link Layer
(Hardware encryption) Need a dedicated link between host/routers.
Advantages- Speed.
Disadvantages- Not scalable.- Need dedicated links.
![Page 29: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/29.jpg)
IP Security (IPSec)
IPSec is a framework of open standards developed by the Internet Engineering Task Force (IETF).
Creates secure, authenticated, reliable communications over IP networks
![Page 30: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/30.jpg)
IPSec Security Services
Connectionless integrity Assurance that received traffic has not been modified. Integrity includes anti-reply defenses.
Data origin authenticationAssurance that traffic is sent by legitimate party or parties.
Confidentiality (encryption)Assurance that user’s traffic is not examined by non-authorized parties.
Access controlPrevention of unauthorized use of a resource.
![Page 31: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/31.jpg)
IPSec Modes of Operation Transport Mode: protect the upper layer protocols
IP Header
TCPHeader
DataOriginal IP Datagram
IP Header
TCPHeader
IPSecHeader
DataTransport Mode protected packet
Tunnel Mode: protect the entire IP payload
Tunnel Mode protected packet
New IP Header
TCPHeader
IPSecHeader
DataOriginal IP Header
protected
protected
![Page 32: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/32.jpg)
Tunnel Mode
Host-to-Network, Network-to-Network
ProtectedData
IPSec
IP Layer
SG
InternetInternet
Transport Layer
Application Layer
IP Layer
Host B
ProtectedData
IPSec
IP Layer
SG
Transport Layer
Application Layer
IP Layer
Host A
SG = Security Gateway
![Page 33: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/33.jpg)
Transport Mode
Transport Layer
Application Layer
Host-to-Host
Transport Layer
Application Layer
IP Layer
Data Link Layer
IPSec
Host B
IP Layer
Data Link Layer
IPSec
Host A
![Page 34: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/34.jpg)
IPSec Security Protocols
Authentication Header (AH) Encapsulating Security Payload (ESP)
![Page 35: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/35.jpg)
IPSec Security Protocols Authentication Header (AH) provides:- Connectionless integrity- Data origin authentication- Protection against replay attacks
Encapsulating Security Payload (ESP) provides:- Confidentiality (encryption)- Connectionless integrity- Data origin authentication- Protection against reply attacks
Both protocols may be used alone or applied in combination with each other.
![Page 36: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/36.jpg)
Outbound/Inbound IPSec Processing The inbound and the outbound IPSec
processing are completely independent.
Packet
![Page 37: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/37.jpg)
SPDIPSec policies
SAD
SPD = Security Policy DatabaseSAD = Security Association DatabaseSA = Security Association
Packet
Outbound IPSec Processing
selector
1. Drop the packet.2. Bypass IPSec.3. Apply IPSec.
SAout
![Page 38: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/38.jpg)
SPDIPSec policies
Packet
Inbound IPSec ProcessingCase 1:If IPSec headers exists1. Headers are processed.2. SPD is consulted to
determine if the packet can be admitted based on the Sain.
SPD = Security Policy DatabaseSAD = Security Association DatabaseSA = Security Association
![Page 39: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/39.jpg)
SPDIPSec policies
Packet
Inbound IPSec ProcessingCase 2:If IPSec headers are absent1. SPD is consulted to
determine the type ofservice to afford this packet.
2. If certain traffic is required to be IPSec protected and its
not it must be dropped.
SPD = Security Policy DatabaseSAD = Security Association DatabaseSA = Security Association
![Page 40: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/40.jpg)
Real World Deployment Examples
VPNs
Wireless
Internet
SG
Internet
Encrypted / Authenticated
![Page 41: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/41.jpg)
Conclusion The Internet was not created with security in mind.
Communications can be altered, examined and exploited.
There is a growing need to protect private information crossing the public networks that make up the Internet infrastructure.
IPSec is a set of protocols and methodologies to create secure IP connections.
![Page 42: Internet Protocol Security An Overview of IPSec. Outline: What Security Problem? Understanding TCP/IP. Security at What Level? IP Security.](https://reader030.fdocuments.in/reader030/viewer/2022032703/56649d245503460f949fb28d/html5/thumbnails/42.jpg)
Questions?