IPSec Access control Connectionless integrity

Slides:

Advertisements

Similar presentations

IP Security have considered some application specific security mechanisms –eg. S/MIME, PGP, Kerberos, SSL/HTTPS however there are security concerns that.

Advertisements

CS470, A.SelcukIPsec – AH & ESP1 CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk.

Internet Security CSCE 813 IPsec

Internet Security CS457 Seminar Zhao Cheng. Security attacks interruption, interception, modification, fabrication passive attack, active attack.

IPSec In Depth. Encapsulated Security Payload (ESP) Must encrypt and/or authenticate in each packet Encryption occurs before authentication Authentication.

IPSec: Authentication Header, Encapsulating Security Payload Protocols CSCI 5931 Web Security Edward Murphy.

Security at the Network Layer: IPSec

Henric Johnson1 Chapter 6 IP Security Henric Johnson Blekinge Institute of Technology, Sweden

NAT TRAVERSAL FOR IPSEC Research Seminar on Datacommunications Software HIIT

Chapter 13 IPsec. IPsec (IP Security)  A collection of protocols used to create VPNs  A network layer security protocol providing cryptographic security.

ECE 454/CS 594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall.

1 Lecture 15: IPsec AH and ESP IPsec introduction: uses and modes IPsec concepts –security association –security policy database IPsec headers –authentication.

Henric Johnson1 Ola Flygt Växjö University, Sweden IP Security.

Henric Johnson1 Chapter 6 IP Security. Henric Johnson2 Outline Internetworking and Internet Protocols IP Security Overview IP Security Architecture Authentication.

IP Security IPSec 2 * Essential Network Security Book Slides. IT352 | Network Security |Najwa AlGhamdi 1.

IP Security. Overview In 1994, Internet Architecture Board (IAB) issued a report titled “Security in the Internet Architecture”. This report identified.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

1 IP Security Outline of the session –IP Security Overview –IP Security Architecture –Key Management Based on slides by Dr. Lawrie Brown of the Australian.

Configuration of a Site-to-Site IPsec Virtual Private Network Anuradha Kallury CS 580 Special Project August 23, 2005.

Encapsulation Security Payload Protocol Lan Vu. OUTLINE 1.Introduction and terms 2.ESP Overview 3.ESP Packet Format 4.ESP Fields 5.ESP Modes 6.ESP packet.

1 IPsec Youngjip Kim Objective Providing interoperable, high quality, cryptographically-based security for IPv4 and IPv6 Services  Access.

Chapter 6 IP Security. Outline Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security Architecture Authentication Header.

CMSC 414 Computer and Network Security Lecture 22 Jonathan Katz.

CMSC 414 Computer (and Network) Security Lecture 25 Jonathan Katz.

Protocol Basics. IPSec Provides two modes of protection –Tunnel Mode –Transport Mode Authentication and Integrity Confidentiality Replay Protection.

1 Chapter 8 Copyright 2003 Prentice-Hall Cryptographic Systems: SSL/TLS, VPNs, and Kerberos.

An Introduction to Encrypting Messages on the Internet Mike Kaderly INFS 750 Summer 2010.

Cosc 4765 SSL/TLS and VPN. SSL and TLS We can apply this generally, but also from a prospective of web services. Multi-layered: –S-http (secure http),

IP Security Lawrence Taub IPSEC IP security — security built into the IP layer Provides host-to-host (or router-to-router) encryption and.

CSCE 715: Network Systems Security

Information management 1 Groep T Leuven – Information department 1/26 IPSec IP Security (IPSec)

/IPsecurity.ppt 1 - Chapter 6 of William Stallings. Network Security Essentials (2nd edition). Prentice Hall.

IT:Network:Apps.  RRAS does nice job of routing ◦ NAT is nice ◦ BASIC firewall ok but somewhat weak  Communication on network (WS to SRV) is in clear.

IPSec IPSec provides the capability to secure communications across a LAN, across private and public wide area networks (WANs) and across the Internet.

Security at different layers

8-1 Chapter 8 Security Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 part 4: Securing IP.

Karlstad University IP security Ge Zhang

IPsec Introduction 18.2 Security associations 18.3 Internet Security Association and Key Management Protocol (ISAKMP) 18.4 Internet Key Exchange.

IP Security.  In CERTs 2001 annual report it listed 52,000 security incidents  the most serious involving:  IP spoofing intruders creating packets.

IPSec ● IP Security ● Layer 3 security architecture ● Enables VPN ● Delivers authentication, integrity and secrecy ● Implemented in Linux, Cisco, Windows.

IP Security: Security Across the Protocol Stack. IP Security There are some application specific security mechanisms –eg. S/MIME, PGP, Kerberos, SSL/HTTPS.

1 Chapter 6 IP Security. 2 Outline Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security Architecture Authentication Header.

1 CMPT 471 Networking II Authentication and Encryption © Janice Regan,

IP security Ge Zhang Packet-switched network is not Secure! The protocols were designed in the late 70s to early 80s –Very small network.

IPSec and TLS Lesson Introduction ●IPSec and the Internet key exchange protocol ●Transport layer security protocol.

Encapsulated Security Payload Header ● RFC 2406 ● Services – Confidentiality ● Plus – Connectionless integrity – Data origin authentication – Replay protection.

1 Lecture 13 IPsec Internet Protocol Security CIS CIS 5357 Network Security.

Internet Security CSCE 813 IPsec. CSCE813 - Farkas2 TCP/IP Protocol Stack Application Layer Transport Layer Network Layer Data Link Layer.

Authentication Header ● RFC 2402 ● Services – Connectionless integrity – Data origin authentication – Replay protection – As much header authentication.

Security IPsec 1 * Essential Network Security Book Slides. IT352 | Network Security |Najwa AlGhamdi 1.

Cryptography and Network Security (CS435) Part Thirteen (IP Security)

IPSec  general IP Security mechanisms  provides  authentication  confidentiality  key management  Applications include Secure connectivity over.

IPSec – IP Security Protocol By Archis Raje. What is IPSec IP Security – set of extensions developed by IETF to provide privacy and authentication to.

IPSec is a suite of protocols defined by the Internet Engineering Task Force (IETF) to provide security services at the network layer. standard protocol.

1 IPSec: An Overview Dr. Rocky K. C. Chang 4 February, 2002.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Network Layer Security Network Systems Security Mort Anvari.

8-1Network Security Virtual Private Networks (VPNs) motivation:  institutions often want private networks for security.  costly: separate routers, links,

@Yuan Xue CS 285 Network Security IP Security Yuan Xue Fall 2013.

UNIT 7- IP Security 1.IP SEC 2.IP Security Architecture

Chapter 18 IP Security  IP Security (IPSec)

Internet and Intranet Fundamentals

IT443 – Network Security Administration Instructor: Bo Sheng

IPSec IPSec is communication security provided at the network layer.

IP Security - Chapter 6 of William Stallings. Network Security Essentials (2nd edition). Prentice Hall Slides by Henric Johnson Blekinge Institute.

Virtual Private Networks (VPNs)

Chapter 6 IP Security.

Presentation transcript:

Sheng-Liang Song ssl@cisco.com IPSec Access control Connectionless integrity Data origin authentication Rejection of replayed packets Confidentiality Sheng-Liang Song ssl@cisco.com

Sheng-Liang Song ssl@cisco.com IPSec Complexity Security worst “enemy” “best practice” Sheng-Liang Song ssl@cisco.com

Agenda IPSec Overview IPSec Discussion Q&A IPSec (Network Layer) Modes (Tunnel/Transport) Protocols (ESP/AH) IKE (Internet Key Exchange) IPSec Cases IPSec Discussion Q&A

Key Words ISAKMP (Internet Security Association and Key Management Protocol) SA (Security Associations) SPD (Security Policy Database) IKE (Internet Key Exchange) AH (Authentication Header) ESP (Encapsulating Security Payload) HMAC (Keyed-Hashing for Message Authentication) H(K XOR opad_5C, H(K XOR ipad_36, text))

IPSec (Network Layer) lives at the network layer transparent to applications application transport network link physical User SSL OS IPSec NIC

IPv4 Header Format Mutable, predictable, Immutable

IPv6 Header Format

IPSec Modes (Tunnel and Transport) Transport Mode Tunnel Mode Transport Mode IP header data IP header ESP/AH data Tunnel Mode IP header data new IP hdr ESP/AH IP header data

IPSec Protocols (ESP and AH) ESP (Encapsulating Security Payload) Integrity and confidentiality (HMAC/DES-CBC) Integrity only by using NULL encryption AH (Authentication Header) Integrity only IP HDR Data IPSec Tunnel Original IP Layer encrypted IPSec Encrypted session IPSec Authenticated session AH HDR ESP HDR New IP HDR

AH Format The sender's counter is initialized to 0 when an SA is established.

AH/Transport

AH/Transport

ESP Format The sender's counter is initialized to 0 when an SA is established.

ESP/Transport

ESP/Tunnel

IPSec Tunnels Original IP Packet Classified IP packet IPSec packet IP header TOS IP Payload IP header IP Payload Classified IP packet Set TOS TOS Original IP Packet TOS copy TOS IP new hdr New IP header built by tunnel entry point TOS byte is copied IP new hdr ESP header IPSec packet IP IP Payload TOS

Anti-Replay in IPSec Both ESP and AH have an anti-reply mechanism based on sequence numbers sender increment the sequence number after each transmission receiver optionally checks the sequence number and rejects if it is out of window

How IPSec uses IKE

IPSec and IKE in Practice Sets up a keying channel Sets up data channels Internal Network Certificate Authority Digital Certificate ISAKMP Session Digital Certificate SA Authenticated Encrypted Tunnel ISAKMP (Internet Security Association and Key Management Protocol) SA (Security Associations) SPD (Security Policy Database) Discard,bypass IPsec, apply IPSec (Overhead) Clear Text Internal Network Encrypted

IPSec (IKE1 Phase1) Authenticated with Signatures Authenticated with Shared key Authenticated with Public Key Encryption Authenticated with Public Key Encryption (Revised)

IPSec (Cases)

IPSec Case1

IPSec Case2

IPSec Case3

IPSec Case4

Q & A IPSec Discussion IPSec authenticates machines, not users Does not stop denial of service attacks Easier to do DoS Order of operations: Encryption/Authentication Q & A L2,L3,L4 Parsing Header(IP,TCP,UDP) checking Packet action classifying Probabilistic content matching

Reference Information Security: Principles and Practice, Mark Stamp, Jan 29,2005 http://www.ietf.org/ Cisco IOS IPsec www.cisco.com/go/ipsec/ Cisco White Paper, IPsec, http://www.cisco.com/warp/public/cc/so/neso/sqso/eqso/ipsec_wp.htm N. Ferguson and B. Schneier, A Cryptographic Evaluation of IPsec, http://www.schneier.com/paper-ipsec.html IPsec, Security for the Internet Protocol, http://www.freeswan.org/freeswan_trees/freeswan-2.06/doc/intro.html