Security on the Internet Jan Damsgaard Dept. of Informatics Copenhagen Business School

EBUSSJan Damsgaard, Introduction u Communications over Internet by default open and uncontrolled u Data can be seen and changed on the way u No means to know who is exactly doing what (service knows only IP address), anonymity and masquerade u No means to ensure that both parties know that a transaction has been completed and if not what is its state

EBUSSJan Damsgaard, Concerns u Primary concerns for E-business –Confidentiality: who gets to read data and conceal it –Integrity: data is changed in a specified manner and not deleted or altered during transfer –Availability: ensure continued access to information and resources –Non-repudiation: capability to identify legal persons and transactions in a trustful way –Legitimate use: data is not used for other or exterior purposes –Ease of use: User should not be controlled or use should not be too difficult

EBUSSJan Damsgaard, What we are looking for u Confidentiality t an envelope to prevent snooping u Integrity t a seal to ensure the message hasn’t been changed u Non-repudiation and authentication t the signature of the sender u Authentication of the recipient t no one else can open it but the intended recipient

EBUSSJan Damsgaard, Private Key Encryption or Symmetric Key Encryption u Both Sender and Receiver know the same key –Lock box to which people share keys u Challenge –How to secretly share the key?

EBUSSJan Damsgaard, Public Key Encryption u Two mathematically related keys –publication of one key provides no information about the other t one is kept secret t one is widely publicized –anything encrypted using the secret key can only be decrypted by using the public one, and vice versa

EBUSSJan Damsgaard, RSA (RivestShamirAdleman) u Authentication –encrypted with the secret key –decrypted with the public key, anyone can verify u Integrity: Virtual sealed envelope –encrypted with the public key and widely broadcast –unreadable to all but holder(s) of the secret key

Clear text message from Professor requesting a conference with Penelope. Because the professor encrypted the message with her private key, Penelope can be assured that the message really is from that professor by decrypting it with the professor’s public key. Professor’s Private Key Professor’s Public Key Sender - ProfessorReceiver - Penelope Encoded Message Transmitted Message decrypt encrypt Clear text message from Professor requesting a conference with Penelope.

Message from Professor requesting a conference with Penelope and disclosing her grade. By encrypting the message with the professor’s private key and Penelope’s publicly available key, Penelope can be assured that the message really is from that professor and that no one else can read the message containing her grade. Sender - ProfessorReceiver - Penelope Professor’s Private Key Professor’s Public Key Penelope’s Public Key Penelope’s Private Key encrypt Double encoded message Transmitted Message decrypt Message from Professor requesting a conference with Penelope and disclosing her grade. encrypt

EBUSSJan Damsgaard, Encryption Strengths u Weak –Password protected text documents. Can be broken with simple tools. u Robust –Using symmetric encryption technologies one can create robust encryption, but the weakness lies in the transmission of the key u Strong –Using public key infrastructure you can transmit the key over networks u Unbreakable –One-time pads. This systems uses a key that is as long as the message itself and and only be decrypted with the pad it has been encrypted on

EBUSSJan Damsgaard, Good Encryption Characteristics u 128 bit key length u Key management policies –Minimal Transmission Time –Compression Then Encryption –Trade-Off More Compression equals More Processing Time versus Less Data equals Faster Encryption

EBUSSJan Damsgaard, Digital Signatures u Digital Signatures - the private key of the sender is used to compute a message digest, similar to a hash code u Certification Authority - a trusted entity that issues and revokes public key certificates and certificate revocation lists

EBUSSJan Damsgaard, Public Certification Authority Individual Generate own key pair Keep private key Public CA Verify Individual Issue Certificate Maintain public key & certificate Provide key generating software Proof of identification Certificate

Certificate Authority Internet Merchant bearing a certificate Customer Visits merchant’s storefront & decides to make a purchase 1 Contacts certificate authority to verify the legitimacy of the storefront 2 Provides information for purchase 3 Contacts certificate authority to verify the legitimacy of the customer 4

EBUSSJan Damsgaard, Use of SSL (https) u Secure Socket Layer (SSL) was developed to provide security through encryption. Using SSL allows businesses to safely conduct e-Commerce, u The price for security is reduced server performance and increased infrastructure demands. u Common SSL sessions: –Shopping cart check out (B2C, B2B, C2C) –Intranet (Internal Corporate Network) –Extranet (Corporate partners)

Network Usage with SSL increase in network usage with SSL Each transaction requires more processing power increase in network usage with SSL Each transaction requires more processing power Client Server Request Data Transfer Standard Transaction: Request Server Public Key Client Server Session Key Encrypted Data Transfer Encryption Decryption Secure Transaction:

ConcernTechnological Solution Confidentiality Cryptography Strong authentication Integrity Cryptography Strong authentication Firewalls Availability Firewalls Trusted operating systems Non-repudiation Digital Signatures Trusted third party verification Smart cards Event logs, time stamping Legitimate use Authorization system Authentication Ease of use System configuration Means to log and maintain passwords Integrated solutions (smartcards, telephones) Biometric techniques

EBUSSJan Damsgaard, Conclusions u All major concerns can be addressed with technologies: the issue is balancing cost, and the business impact with the required level of concern u Conflicting and multiple goals, goals of different stakeholders u Problems how to integrate the solutions and manage them across diverse platforms u Obtain knowledge, skills and resources to do it u How to make management aware: ignorance vs. overkill