internet security overview - mason academic research system
Post on 02-Jun-2015
498 Views
Preview:
TRANSCRIPT
04/12/2304/12/23 ms ms11
Overview of Network SecurityOverview of Network Security
Mohamed SharifMohamed Sharif
Lecture 7Lecture 7
04/12/2304/12/23 ms ms22
Presentation ContentPresentation Content
• What is Internet?What is Internet?
• What do we need to protect?What do we need to protect?
• Threat MotivationThreat Motivation
• Attack TypesAttack Types
• Security ObjectivesSecurity Objectives
• Security mechanismsSecurity mechanisms
• ReferencesReferences
04/12/2304/12/23 ms ms33
What is Internet?What is Internet?
• The Internet is a worldwide IP network, The Internet is a worldwide IP network, that links collection of different that links collection of different networks from various sources, networks from various sources, governmental, educational and governmental, educational and commercial.commercial.
04/12/2304/12/23 ms ms44
What do we need to protectWhat do we need to protect
• DataData
• ResourcesResources
• ReputationReputation
04/12/2304/12/23 ms ms55
Threat MotivationThreat Motivation
• Spy Spy
• JoyrideJoyride
• IgnoranceIgnorance
• Score KeeperScore Keeper
• RevengeRevenge
• GreedGreed
• TerroristTerrorist
04/12/2304/12/23 ms ms66
Types of AttacksTypes of Attacks
• PassivePassive
• ActiveActive– Denial of Services Denial of Services – Social EngineeringSocial Engineering
04/12/2304/12/23 ms ms77
TCP 3 way handshakeTCP 3 way handshake
ServerServer
SYN(X)SYN(X)
SYN(Y), ACK(X)SYN(Y), ACK(X)
ACK(Y)ACK(Y)
ClientClient
X, Y are sequence numbersX, Y are sequence numbers
Half openHalf open
Full openFull open
04/12/2304/12/23 ms ms88
TCP Session HijackTCP Session Hijack
ServerServer
SYN(X)SYN(X)
SYN(Y), ACK(X)SYN(Y), ACK(X)
AttackerAttacker
Client, 146.135.12.1Client, 146.135.12.1
Half openHalf open
Valid TCP ConnectionValid TCP Connection
Initiate TCP with 146.135.12.1 as sourceInitiate TCP with 146.135.12.1 as source
Complete TCP ConnectionComplete TCP Connection
04/12/2304/12/23 ms ms99
Security ObjectivesSecurity Objectives
• IdentificationIdentification
• AuthenticationAuthentication
• AuthorizationAuthorization
• Access ControlAccess Control
• Data IntegrityData Integrity
• ConfidentialityConfidentiality
• Non-repudiationNon-repudiation
04/12/2304/12/23 ms ms1010
IdentificationIdentification
• Something which uniquely identifies a Something which uniquely identifies a user and is called UserID.user and is called UserID.
• Sometime users can select their ID as Sometime users can select their ID as long as it is given too another user.long as it is given too another user.
• UserID can be one or combination of UserID can be one or combination of the following:the following:– User NameUser Name– User Student NumberUser Student Number– User SSNUser SSN
04/12/2304/12/23 ms ms1111
AuthenticationAuthentication
• The process of verifying the identity of The process of verifying the identity of a usera user
• Typically based onTypically based on– Something user knowsSomething user knows
• PasswordPassword
– Something user haveSomething user have• Key, smart card, disk, or other deviceKey, smart card, disk, or other device
– Something user isSomething user is• fingerprint, voice, or retinal scans fingerprint, voice, or retinal scans
04/12/2304/12/23 ms ms1212
Authentication Cont.Authentication Cont.
• Authentication procedureAuthentication procedure– Two-Party AuthenticationTwo-Party Authentication
• One-Way AuthenticationOne-Way Authentication• Two-Way AuthenticationTwo-Way Authentication
– Third-Party Authentication Third-Party Authentication • KerberosKerberos• X.509 X.509
– Single Sign ON Single Sign ON • User can access several network resources User can access several network resources
by logging on once to a security system. by logging on once to a security system.
04/12/2304/12/23 ms ms1313
Clie nt
Use rID & P a ssw ord
S e rve rID &P a ssw ord
Authe ntica te d
Authe ntica te d
S e rve r
One -w a y Authe ntica tion
Tw o-w a y Authe ntica tion
T w o -P arty A uthe ntic atio ns
04/12/2304/12/23 ms ms1414
Authentic
ated
Client I
D, Pass
word
Server ID, Password
Authenticated
Ex cha nge Ke ys
Ex cha nge Da ta
Clie nt S e rve r
S e curity S e rve r
T h ir d -P a r ty A u th e n tic a tio n s
04/12/2304/12/23 ms ms1515
AuthorizationAuthorization
• The process of assigning access right The process of assigning access right to userto user
04/12/2304/12/23 ms ms1616
Access ControlAccess Control
• The process of enforcing access rightThe process of enforcing access right
• and is based on following three entitiesand is based on following three entities– Subject Subject
• is entity that can access an objectis entity that can access an object
– ObjectObject• is entity to which access can be controlledis entity to which access can be controlled
– Access RightAccess Right• defines the ways in which a subject can defines the ways in which a subject can
access an object.access an object.
04/12/2304/12/23 ms ms1717
Access Control Cont.Access Control Cont.
• Access Control is divided into twoAccess Control is divided into two– Discretionary Access Control (DAC)Discretionary Access Control (DAC)
• The owner of the object is responsible for The owner of the object is responsible for setting the access right. setting the access right.
– Mandatory Access Control (MAC)Mandatory Access Control (MAC)• The system defines access right based on The system defines access right based on
how the subject and object are classified. how the subject and object are classified.
04/12/2304/12/23 ms ms1818
Data Integrity.Data Integrity.
• Assurance that the data that Assurance that the data that arrives is the same as when it was arrives is the same as when it was sent.sent.
04/12/2304/12/23 ms ms1919
ConfidentialityConfidentiality
• Assurance that sensitive Assurance that sensitive information is not visible to an information is not visible to an eavesdropper. This is usually eavesdropper. This is usually achieved using encryption.achieved using encryption.
04/12/2304/12/23 ms ms2020
Non-repudiationNon-repudiation
• Assurance that any transaction Assurance that any transaction that takes place can subsequently that takes place can subsequently be proved to have taken place. be proved to have taken place. Both the sender and the receiver Both the sender and the receiver agree that the exchange took agree that the exchange took place. place.
04/12/2304/12/23 ms ms2121
Security MechanismsSecurity Mechanisms
• Web SecurityWeb Security
• Cryptographic techniquesCryptographic techniques
• Internet FirewallsInternet Firewalls
04/12/2304/12/23 ms ms2222
Web SecurityWeb Security
• Basic AuthenticationBasic Authentication
• Secure Socket Layer (SSL)Secure Socket Layer (SSL)
04/12/2304/12/23 ms ms2323
Basic AuthenticationBasic Authentication
A simple user ID and password-based A simple user ID and password-based authentication scheme, and provides the authentication scheme, and provides the following:following:
– To identify which user is accessing the server To identify which user is accessing the server – To limit users to accessing specific pages To limit users to accessing specific pages
(identified as Universal Resource Locators, URLs(identified as Universal Resource Locators, URLs
04/12/2304/12/23 ms ms2424
Secure Socket Layer (SSL)Secure Socket Layer (SSL)
• Netscape Inc. originally created the SSL protocol, but Netscape Inc. originally created the SSL protocol, but now it is implemented in World Wide Web browsers and now it is implemented in World Wide Web browsers and servers from many vendors. SSL provides the followingservers from many vendors. SSL provides the following- Confidentiality through an encrypted connection based on Confidentiality through an encrypted connection based on
symmetric keyssymmetric keys- Authentication using public key identification and verification Authentication using public key identification and verification - Connection reliability through integrity checkingConnection reliability through integrity checking
• There are two parts to SSL standard, as follows:There are two parts to SSL standard, as follows: The SSL Handshake is a protocol for initial authentication and The SSL Handshake is a protocol for initial authentication and
transfer of encryption keys. transfer of encryption keys. The SSL Record protocol is a protocol for transferring encrypted The SSL Record protocol is a protocol for transferring encrypted
datadata
04/12/2304/12/23 ms ms2525
Secure Socket Layer Cont..Secure Socket Layer Cont.. The client sends a "hello" message to the Web server, and the The client sends a "hello" message to the Web server, and the
server responds with a copy of its digital certificate. server responds with a copy of its digital certificate. The client decrypts the server's public key using the well-The client decrypts the server's public key using the well-
known public key of the Certificate Authority such as VeriSign. known public key of the Certificate Authority such as VeriSign. The client generates two random numbers that will be used for The client generates two random numbers that will be used for
symmetric key encryption, one number for the receiving symmetric key encryption, one number for the receiving channel and one for the sending channel. These keys are channel and one for the sending channel. These keys are encrypted using the server's public key and then transmitted encrypted using the server's public key and then transmitted to the server. to the server.
The client issues a challenge (some text encrypted with the The client issues a challenge (some text encrypted with the send key) to the server using the send symmetric key and send key) to the server using the send symmetric key and waits for a response from the server that is using the receive waits for a response from the server that is using the receive symmetric key.symmetric key.
Optional, server authenticates client Optional, server authenticates client Data is exchanged across the secure channel. Data is exchanged across the secure channel.
04/12/2304/12/23 ms ms2626
Cryptographic TechniquesCryptographic Techniques
• Secret Key AlgorithmSecret Key Algorithm
• Public Key AlgorithmPublic Key Algorithm
• Secure Hash FunctionSecure Hash Function
• Digital SignatureDigital Signature
• Certificate AuthorityCertificate Authority
04/12/2304/12/23 ms ms2727
Secret Key AlgorithmSecret Key Algorithm
Encryption
Secret Key
DecryptionClear TextC ipher TextC lear Text
Secret Key
Bob Alice
04/12/2304/12/23 ms ms2828
Public Key AlgorithmPublic Key Algorithm
Clear Text
Alice's PublicKey
Bob Alice
Encryption
Alice'sPrivate Key
DecryptionClear TextCipher Text
04/12/2304/12/23 ms ms2929
Secure Hash FunctionSecure Hash Function
ClearText
Key
Bob Alice
OriginalClearText
OriginalClearText
HashFunction
MessagDigest
HashFunction
ComputedMessagDigestKey
OriginalMessage
Digest
OriginalMessage
DigestCompare
?
Non-Secure
Netw ork
04/12/2304/12/23 ms ms3030
Digital SignatureDigital Signature
Clear Text
Alice'sPrivate Key
Alice Bob
Encryption
Alice'sPublic Key
Decryption &Authentication
Clear TextCipher Text
04/12/2304/12/23 ms ms3131
Certificate AuthorityCertificate Authority
Alice Bob
CertificateAuthority Publish Public
Key
Request Bob'sPublic Key
Bob's PublicKey
Cipher Text
04/12/2304/12/23 ms ms3232
X.509 CertificateX.509 Certificate
• Is a Is a ITU-T RecommendationITU-T Recommendation..• Specifies the authentication service for X.500 Specifies the authentication service for X.500
directoriesdirectories • X.500 specifies the directory services.X.500 specifies the directory services.• Version 1 was published in 1988.Version 1 was published in 1988.• Version 2 was published in 1993.Version 2 was published in 1993.• Version 3 was proposed in 1994 and approved Version 3 was proposed in 1994 and approved
in 1997.in 1997. • Binds the subject (user's) name and the user's Binds the subject (user's) name and the user's
public key. public key.
04/12/2304/12/23 ms ms3333
X.509 Certificate (cont..)X.509 Certificate (cont..)• X09 certificate consists of the following fields:X09 certificate consists of the following fields:
– VersionVersion
– Serial NumberSerial Number
– Algorithm IdentifierAlgorithm Identifier
– Issuer nameIssuer name
– Validity periodValidity period
– Subject nameSubject name
– Subject public key informationSubject public key information
– Issuer unique identifier (Version 2 & 3 only)Issuer unique identifier (Version 2 & 3 only)
– Subject unique identifier (Version 2 & 3 only)Subject unique identifier (Version 2 & 3 only)
– Extensions (Version 3 only)Extensions (Version 3 only)
– SignatureSignature
04/12/2304/12/23 ms ms3434
X.509 Certificate (Cont..)X.509 Certificate (Cont..)
• Version 1Version 1– BasicBasic
• Version 2 Version 2 – Adds unique identifier to prevent reuse of X.500Adds unique identifier to prevent reuse of X.500
• Version 3 Version 3 – Adds extension to carry additional information and Adds extension to carry additional information and
some of them aresome of them are• Distinguish different certificatesDistinguish different certificates• Alternative to X.500 nameAlternative to X.500 name• Limit on further certification by subjectLimit on further certification by subject• Policy and UsagePolicy and Usage
04/12/2304/12/23 ms ms3535
X.509 Certificate Revocation List (CRL)X.509 Certificate Revocation List (CRL)
• Is to prevent fraud and misuse.Is to prevent fraud and misuse.• A certificate may be revoked for one the A certificate may be revoked for one the
following reason:following reason:– The user’s private is compromisedThe user’s private is compromised– The user is no longer certified by this CAThe user is no longer certified by this CA– The CA’s private key a compromisedThe CA’s private key a compromised
• Version 1 was published in 1988.Version 1 was published in 1988.• Version 2 was published in 1997.Version 2 was published in 1997.
04/12/2304/12/23 ms ms3636
X.509 CRL (cont..)X.509 CRL (cont..)
• X09 CRL consists of the following fields:X09 CRL consists of the following fields:– VersionVersion
– Serial NumberSerial Number
– Revocation DateRevocation Date
– Algorithm IdentifierAlgorithm Identifier
– Issuer nameIssuer name
– Last updateLast update
– Next updateNext update
– Extensions (Version 2 only)Extensions (Version 2 only)
– SignatureSignature
04/12/2304/12/23 ms ms3737
Internet FirewallInternet Firewall
• A firewall is to control traffic flow between A firewall is to control traffic flow between networks.networks.
• Firewall uses the following techniques:Firewall uses the following techniques:– Packet FiltersPacket Filters– Application Proxy Application Proxy – Socks serversSocks servers– Secure TunnelSecure Tunnel– Screened Subnet ArchitectureScreened Subnet Architecture
04/12/2304/12/23 ms ms3838
Packet FilteringPacket Filtering
• Most commonly used firewall techniqueMost commonly used firewall technique• Operates at IP levelOperates at IP level• Checks each IP packet against the filter rules Checks each IP packet against the filter rules
before passing (or not passing) it on to its before passing (or not passing) it on to its destination. destination.
• Very fast than other firewall techniquesVery fast than other firewall techniques• Hard to configureHard to configure
04/12/2304/12/23 ms ms3939
Packet Filter Cont..Packet Filter Cont..
PacketFilteringServer
Non-SecureNetw ork
SecureNetw ork
04/12/2304/12/23 ms ms4040
Application ProxyApplication Proxy
• Application Level GatewayApplication Level Gateway• The communication steps are as followsThe communication steps are as follows
– User connects to proxy server User connects to proxy server – From proxy server, user connects to destination From proxy server, user connects to destination
serverserver
• Proxy server can provideProxy server can provide– Content ScreeningContent Screening– LoggingLogging– AuthenticationAuthentication
04/12/2304/12/23 ms ms4141
Application (telnet) Proxy Cont..Application (telnet) Proxy Cont..
Non-SecureNetw ork
SecureNetw ork
TelnetTelnetTelnetd
Porxy Server
Telnetd
04/12/2304/12/23 ms ms4242
SOCKS ServerSOCKS Server
• Circuit-level gatewaysCircuit-level gateways • Generally for Generally for outboundoutbound TCP traffic from TCP traffic from
secure networksecure network • Client code must be installed on the user’s Client code must be installed on the user’s
machine.machine.• The communication steps are as follows: The communication steps are as follows:
– User starts application using destination server IP address User starts application using destination server IP address – SOCKS server intercepts and authenticates the IP address SOCKS server intercepts and authenticates the IP address
and the userID and the userID – SOCKS creates a second session to non-secure systemSOCKS creates a second session to non-secure system
04/12/2304/12/23 ms ms4343
Socks Servers Cont..Socks Servers Cont..
Non-Secure
Netw ork
SecureNetw ork
SockSifiedClient
StandardServer
Socksserver
04/12/2304/12/23 ms ms4444
Secure Tunnel Cont..Secure Tunnel Cont..
W orkstation
Laptop
server
Router
Internet
W orkstation
Laptop
server
Router
W orkstation
Laptop
server
Router
VPN
Coporate IntranetBusiness Partner
Branch Office
Remote Access
04/12/2304/12/23 ms ms4545
Secure IP TunnelSecure IP Tunnel
• A secure channel between the secure network A secure channel between the secure network and an external trusted server through a non-and an external trusted server through a non-secure network (e.g., Internet)secure network (e.g., Internet)
• Encrypts the data between the Firewall and the Encrypts the data between the Firewall and the external trusted hostexternal trusted host
• Also identifies of the session partners and the Also identifies of the session partners and the messagesmessages authenticity authenticity
04/12/2304/12/23 ms ms4646
VPN SolutionsVPN Solutions
• IP Security (IPSec)IP Security (IPSec)
• Layer 2 Tunnel Protocol (L2TP)Layer 2 Tunnel Protocol (L2TP)
• Virtual CircuitsVirtual Circuits
• Multi Protocol Label Switching (MPLS)Multi Protocol Label Switching (MPLS)
04/12/2304/12/23 ms ms4747
IPSec SolutionIPSec Solution
• IPSec is an Internet standard for IPSec is an Internet standard for ensuring secure private communication ensuring secure private communication over IP networks, and it was developed over IP networks, and it was developed by IPSec working group of IETFby IPSec working group of IETF
• IPSec implements network layer IPSec implements network layer security security
04/12/2304/12/23 ms ms4848
Principle of IPSec protocolsPrinciple of IPSec protocols• Authentication Header (AH)Authentication Header (AH)
– Provides data origin authentication, data integrity and replay Provides data origin authentication, data integrity and replay protectionprotection
• Encapsulating Security Payload (ESP)Encapsulating Security Payload (ESP)– Provides data confidentiality, data origin authentication, data Provides data confidentiality, data origin authentication, data
integrity and replay protectionintegrity and replay protection
• Internet Security Association and Key Management Internet Security Association and Key Management Protocol (ISAKMP) or Internet Key Exchange (IKE)Protocol (ISAKMP) or Internet Key Exchange (IKE)– Provides a method for automatically setting up security association Provides a method for automatically setting up security association
and managing their cryptographic key. and managing their cryptographic key.
• Security Association (SA)Security Association (SA)– Provides all the relevant information that communicating systems Provides all the relevant information that communicating systems
need to execute the IPSec protocols.need to execute the IPSec protocols.
04/12/2304/12/23 ms ms4949
Operation Modes of IPSecOperation Modes of IPSec
• Transport ModeTransport Mode– The IP payload is encrypted and the IP headers are left The IP payload is encrypted and the IP headers are left
alone alone
IP HeaderIP Header PayloadPayload
The IP datagram is encryptedThe IP datagram is encrypted
04/12/2304/12/23 ms ms5050
Operation Modes of IPSec Conti...Operation Modes of IPSec Conti...
• Tunnel ModeTunnel Mode– The entire original IP datagram is encrypted and it becomes The entire original IP datagram is encrypted and it becomes
the payload in the new IP the payload in the new IP
New IP HeaderNew IP Header IP HeaderIP Header PayloadPayload
The original IP datagram is the encrypted and is The original IP datagram is the encrypted and is payload for the new IP headerpayload for the new IP header
04/12/2304/12/23 ms ms5151
IPSec ExampleIPSec Example• This example combines IPSec protocols and is AH in tunnel mode This example combines IPSec protocols and is AH in tunnel mode
protecting ESP traffic in transport mode. This example assume that protecting ESP traffic in transport mode. This example assume that the SA’s for communicates points have set up. the SA’s for communicates points have set up.
Workstation
Laptop
serverH1
G1
Internet
Coporate Intranet
Workstation
Laptop
serverH2
G2
Branch Office
AH in Tunnel Mode
ESP in Transport Mode
04/12/2304/12/23 ms ms5252
IP HeaderIP HeaderH1 to H2H1 to H2 PayloadPayload
New IP Hdr.New IP Hdr.G1 to G2G1 to G2
IP HeaderIP HeaderH1 to H2H1 to H2 PayloadPayloadESP Hdr.ESP Hdr. ESP Trl.ESP Trl. ESP Auth.ESP Auth.
IP HeaderIP HeaderH1 to H2H1 to H2 PayloadPayloadESP Hdr.ESP Hdr. ESP Trl.ESP Trl. ESP Auth.ESP Auth.AH Hdr.AH Hdr.
EncryptedEncrypted
EncryptedEncrypted
AuthenticatedAuthenticated
04/12/2304/12/23 ms ms5353
New IP Hdr.New IP Hdr.G1 to G2G1 to G2
IP HeaderIP HeaderH1 to H2H1 to H2 PayloadPayloadESP Hdr.ESP Hdr. ESP Trl.ESP Trl. ESP Auth.ESP Auth.AH Hdr.AH Hdr.
EncrypteEncryptedd
AuthenticatedAuthenticated
IP HeaderIP HeaderH1 to H2H1 to H2 PayloadPayloadESP Hdr.ESP Hdr. ESP Trl.ESP Trl. ESP Auth.ESP Auth.
EncrypteEncryptedd
IP HeaderIP HeaderH1 to H2H1 to H2 PayloadPayload
04/12/2304/12/23 ms ms5454
Screened Subnet Architecture Cont..Screened Subnet Architecture Cont..
DNon-
SecureNetw ork
SecureNetw ork
PacketFiltering
PacketFiltering
TelentProxyServer
SocksServer
HTTPProxyServer
FTPProxyServer
ScreenedSubnet
Demilitarized Zone (DMZ)
04/12/2304/12/23 ms ms5555
Screened Subnet ArchitectureScreened Subnet Architecture
• The DMZ (perimeter network) is set up The DMZ (perimeter network) is set up between the secure and non-secure networksbetween the secure and non-secure networks
• It is accessible from both networks and It is accessible from both networks and contains machines that act as gateways for contains machines that act as gateways for specific applicationsspecific applications
04/12/2304/12/23 ms ms5656
Firewall ConclusionFirewall Conclusion• Not the complete answer Not the complete answer
• The fox is inside the henhouseThe fox is inside the henhouse• Host security + User educationHost security + User education
• Cannot control back door traffic Cannot control back door traffic • any dial-in accessany dial-in access• Management problemsManagement problems
• Cannot fully protect against new viruses Cannot fully protect against new viruses • Antivirus on each host MachineAntivirus on each host Machine
• Needs to be correctly configured Needs to be correctly configured • The security policy must be enforcedThe security policy must be enforced
top related