Network/Information Security z“The terms network security and information security refer in a broad sense to confidence that information and services available on a network cannot be accessed by unauthorized users.” (Comer 1995) zNeed to protect yPhysical resources (disks, computers, cables, bridges, routers, etc.) yAbstract resources (information)

Security Requirements zData integrity - protecting information from unauthorized change. zData availability - guaranteeing that outsiders cannot prevent legitimate data access. zConfidentiality/Privacy - preventing unauthorized listening.

Security Requirements (contd..) zAuthentication - ensuring that a message indeed originated from its apparent source. zNon-repudiation - ensuring that a party to a transaction cannot subsequently deny that this transaction took place.

Internet Security Mechanisms zAuthentication Mechanisms: IP source authentication, Public key encryption zPrivacy Mechanism: Encryption zAccess Control Mechanisms: Internet firewall zAuthentication and privacy mechanisms can be added to application programs. Access control requires basic changes to Internet infrastructure.

IP Source Authentication zServer maintains a list of valid IP source addresses. zWeak because it can be broken easily. zAn imposter can gain control of an intermediate router and impersonate an authorized client. zAn imposter can also impersonate a server.

Public Key Encryption System zEach end-entity has a cryptographic key pair ya private key that is kept secret at that end- entity, and ya public key which is distributed. zKeys, which are large integers, are used to encode and decode messages. zA message encoded using one key can be decoded using the other.

Public Key Encryption System (contd.) zMessage encrypted by a public key can only be decrypted by the holder of the corresponding private key. zPrivate key can be used to generate a digital signature and anyone knowing the public key can authenticate it. zGuessing or calculating the secret private key is an extremely difficult task.

Public Key Encryption System (contd.) zPublic key encryption scheme can also handle the problem of privacy. zSender uses the receiver’s public key to encode the message. Receiver uses it’s private key to decode the message. zMessages can be encoded twice to authenticate the sender and to enforce privacy. First with the sender’s private key and then with the receiver’s public key.

Certificates and Certification Authorities zTo ensure authenticity, public keys are generally distributed in the form of certificates. zA certificate contains ya public key value yidentity of the holder of the corresponding private key ydigital signature of the certification authority (CA)

Certificates and Certification Authorities (contd.) zA CA is a trusted party whose public key is known, e.g., VeriSign, Inc. zThe recipient uses the public key of the CA, to decrypt the sender's public key in the certificate. zThe most vulnerable part of this method is the CA’s private key, which is used to digitally sign the certificate.

SSL Handshake z ClientKeyExchange A random challenge, encrypted with the server’s public key Certificate Server sends its certificate ServerHello Server selects a cipher suite, usually RSA ClientHello A list of cipher suites supported CLIENTSERVER HTTP communication begins over the secure channel Messages exchanged in a typical SSL handshake Source: Abbott, S The Debate for Secure E-Commerce. Performance Computing, February 1999, p.p

Secure Sockets Layer (SSL) zThe leading security protocol on the internet. Developed by Netscape. zAt the start of an SSL session, the browser sends its public key to the server. zServer uses the browser’s public key to encrypt a secret key and sends it to the browser. zDuring the session, the server and browser exchange data via secret key encryption.

SSL (contd.) zSSL has merged with other protocols and authentication methods to create a new protocol known as Transport Layer Security (TLS). zTypically only server authentication is done. Authentication of browser’s (user’s) identity requires certificates to be issued to users.

Internet Firewalls zFirewall protects an organization’s internal networks, routers, computers, and data against unauthorized access. zSecurity perimeter involves installing a firewall at each external connection. zFor effective control all firewalls must use exactly the same access restrictions.

Internet Firewall Implementation zA firewall must handle datagrams at the same speed as the connection to the outside world. zTo operate at network speeds, routers include a high-speed filtering mechanism. zFilters form the basic building blocks of a firewall.

Packet Filters zProvides a basic level of network security at the IP level. zFiltering is based on any combination of source IP address, destination IP address, protocol, source protocol port number, and destination protocol port number. zPacket filters do not maintain context or understand the application they are dealing with.

Packet Filters zSpecifying the datagrams that should be filtered is not very effective. zInstead we specify which datagrams to admit. zSecurity concerns yIP spoofing (mimicing IP addresses of trusted machines) yIP tunneling (one datagram is temporarily encapsulated in another)

Packet Filters z“If an organization’s firewall restricts incoming datagrams except for ports that correspond to services the organization makes available externally, an arbitrary application inside the organization cannot become a client of a server outside the organization.” (Comer, 1995)

Proxy Firewalls zMost secure form of firewall zAll incoming traffic is tunneled to the appropriate proxy gateway for mail, HTTP, FTP, etc. zProxies then direct the information to the internal network. zProxies are applications that make decisions based on context, authorization, & authentication rules instead of IP addresses.

Proxy Firewalls (contd.) zProxy firewall operates at the highest level of the protocol stack. zProxies are relays between the Internet and the organization’s private network. zProxy’s firewall address is the only one available to the outside world. zSome firewalls combine router and proxy techniques to provide more security.