Chapter 4.  Chapter 3 introduces cryptographic elements that may be needed in a dialogue  Chapter 4 focuses on important cryptographic system standards,

Slides:



Advertisements
Similar presentations
Spring 2012: CS419 Computer Security Vinod Ganapathy SSL, etc.
Advertisements

Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York.
Attack and Defense in Wireless Networks Presented by Aleksandr Doronin.
Chapter 13 IPsec. IPsec (IP Security)  A collection of protocols used to create VPNs  A network layer security protocol providing cryptographic security.
Security in IEEE wireless networks Piotr Polak University Politehnica of Bucharest, December 2008.
16-1 Last time Internet Application Security and Privacy Authentication Security controls using cryptography Link-layer security: WEP.
WiFi Security. What is WiFi ? Originally, Wi-Fi was a marketing term. The Wi-Fi certified logo means that the product has passed interoperability tests.
1 Enhancing Wireless Security with WPA CS-265 Project Section: 2 (11:30 – 12:20) Shefali Jariwala Student ID
K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.
Wired Equivalent Privacy (WEP)
Wireless Encryption By: Kara Dolansky Network Management Spring 2009.
1 Pertemuan 11 IPSec dan SSL Matakuliah: H0242 / Keamanan Jaringan Tahun: 2006 Versi: 1.
WIRELESS NETWORK SECURITY. Hackers Ad-hoc networks War Driving Man-in-the-Middle Caffe Latte attack.
Chapter 6 IP Security. Outline Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security Architecture Authentication Header.
Internet Protocol Security (IPSec)
Marwan Al-Namari Week 10. RTS: Ready-to-Send. CTS: Clear-to- Send. ACK: Acknowledgment.NAV: network allocation vector (channel access, expected time to.
Chapter 4 Copyright Pearson Prentice Hall  Describe the goals of creating secure networks.  Explain how denial-of-service attacks work.  Explain.
Securing Insecure Networks SSL/TLS & IPSec. 4-1: Cryptographic System Copyright Pearson Prentice-Hall
Faten Yahya Ismael.  It is technology creates a network that is physically public, but virtually it’s private.  A virtual private network (VPN) is a.
Access Control and Site Security (Part 2) (January 28, 2015) © Abdou Illia – Spring 2015.
WLAN What is WLAN? Physical vs. Wireless LAN
Copyright © 2015 Pearson Education, Inc. Chapter 3 Chapter 3.
8: Network Security8-1 Security in the layers. 8: Network Security8-2 Secure sockets layer (SSL) r Transport layer security to any TCP- based app using.
SYSTEM ADMINISTRATION Chapter 13 Security Protocols.
Wireless security & privacy Authors: M. Borsc and H. Shinde Source: IEEE International Conference on Personal Wireless Communications 2005 (ICPWC 2005),
32.1 Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction.
Copyright © 2015 Pearson Education, Inc. Chapter 4 Chapter 4.
Chapter Network Security Architecture Security Basics Legacy security Robust Security Segmentation Infrastructure Security VPN.
1 Chapter 8 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Cryptographic Systems: SSL/TLS, VPNs, and Kerberos.
Chapter 4. Copyright Pearson Prentice-Hall 2010  Chapter 3 introduces cryptographic elements that may be needed in a dialogue  Chapter 4 focuses on.
Wireless Security Beyond WEP. Wireless Security Privacy Authorization (access control) Data Integrity (checksum, anti-tampering)
Lesson 20-Wireless Security. Overview Introduction to wireless networks. Understanding current wireless technology. Understanding wireless security issues.
1 Chapter 8 Copyright 2003 Prentice-Hall Cryptographic Systems: SSL/TLS, VPNs, and Kerberos.
1 Chapter 8 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Cryptographic Systems: SSL/TLS, VPNs, and Kerberos.
1 Figure 2-11: Wireless LAN (WLAN) Security Wireless LAN Family of Standards Basic Operation (Figure 2-12 on next slide)  Main wired network.
Cosc 4765 SSL/TLS and VPN. SSL and TLS We can apply this generally, but also from a prospective of web services. Multi-layered: –S-http (secure http),
Protecting Internet Communications: Encryption  Encryption: Process of transforming plain text or data into cipher text that cannot be read by anyone.
1 C-DAC/Kolkata C-DAC All Rights Reserved Computer Security.
Introduction to Secure Sockets Layer (SSL) Protocol Based on:
Done By : Ahmad Al-Asmar Wireless LAN Security Risks and Solutions.
Chapter 4 Copyright Pearson Prentice Hall  Describe the goals of creating secure networks.  Explain how denial-of-service attacks work.  Explain.
C3 confidentiality classificationIntegrated M2M Terminals Introduction Vodafone MachineLink 3G v1.0 1 Vodafone MachineLink 3G VPN functionality Feature.
CWSP Guide to Wireless Security Chapter 2 Wireless LAN Vulnerabilities.
WEP Protocol Weaknesses and Vulnerabilities
WEP AND WPA by Kunmun Garabadu. Wireless LAN Hot Spot : Hotspot is a readily available wireless connection.  Access Point : It serves as the communication.
Network Security David Lazăr.
IPsec IPsec (IP security) Security for transmission over IP networks –The Internet –Internal corporate IP networks –IP packets sent over public switched.
IP Security.  In CERTs 2001 annual report it listed 52,000 security incidents  the most serious involving:  IP spoofing intruders creating packets.
Cryptography Chapter 3 Copyright Pearson Prentice Hall 2013.
Chapter 4 Copyright Pearson Prentice Hall  Describe the goals of creating secure networks.  Explain how denial-of-service attacks work.  Explain.
.  TJX used WEP security  They lost 45 million customer records  They settled the lawsuits for $40.9 million.
Cryptography Chapter 3 Copyright Pearson Prentice Hall 2013.
Wireless Security Rick Anderson Pat Demko. Wireless Medium Open medium Broadcast in every direction Anyone within range can listen in No Privacy Weak.
Chapter 14 Network Encryption
Cryptography Chapter 3 Copyright Pearson Prentice Hall 2013.
Cryptography Chapter 3 Copyright Pearson Prentice Hall 2013.
Authentication has three means of authentication Verifies user has permission to access network 1.Open authentication : Each WLAN client can be.
Lect 8 Tahani al jehain. Types of attack Remote code execution: occurs when an attacker exploits a software and runs a program that the user does not.
1 © 2004, Cisco Systems, Inc. All rights reserved. Wireless LAN (network) security.
© 2015 Pearson Education Ltd. Chapter 3 Chapter 3.
Securing Access to Data Using IPsec Josh Jones Cosc352.
Cryptography Chapter 3 Copyright Pearson Prentice Hall 2013.
© 2015 Pearson Education Ltd. Chapter 4 Chapter 4.
Tightening Wireless Networks By Andrew Cohen. Question Why more and more businesses aren’t converting their wired networks into wireless networks?
Instructor Materials Chapter 6 Building a Home Network
Wireless LAN Security 4.3 Wireless LAN Security.
Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls
The Secure Sockets Layer (SSL) Protocol
Presentation transcript:

Chapter 4

 Chapter 3 introduces cryptographic elements that may be needed in a dialogue  Chapter 4 focuses on important cryptographic system standards, such as SSL/TLS, IPsec, and wireless security standards  Future chapters will use the cryptographic concepts you are learning in these chapters Copyright Pearson Prentice-Hall

3

4

5

6 StepSenderName of Message Semantics (Meaning) 1ClientClient HelloClient requests secure connection. Client lists cipher suites it supports. 2ServerServer HelloServer indicates willingness to proceed. Selects a cipher suite to use in the session. 3ServerCertificateServer sends its digital certificate containing its public key. (Client should check the certificate’s validity.) 4ServerServerHelloDoneServer indicates that its part in the initial introduction is finished.

Copyright Pearson Prentice-Hall StepSenderName of Message Semantics (Meaning) 5ClientClientKey Exchange Client generates a random symmetric session key. Encrypts it with the server’s public key. It sends this encrypted key to the server. Only the server can decrypt the key, using the server’s own private key. The server decrypts the session key. Both sides now have the session key. 6ClientChangeCipher Spec* Client changes selected cipher suite from pending to active. 7ClientFinishClient indicates that its part in the initial introduction is finished. *Not cipher suite. Key Exchange using public key encryption for confidentiality Key Exchange using public key encryption for confidentiality

Copyright Pearson Prentice-Hall StepSenderName of MessageSemantics (Meaning) 8ServerChangeCipherSpec*Server changes selected cipher suite from pending to active. 9ServerFinishServer indicates that its role in selecting options is finished. 10Ongoing communication stage begins *Not cipher suite.

Copyright Pearson Prentice-Hall

10 SSL/TLSIPsec Cryptographic security standardYes Cryptographic security protectionsGoodGold Standard Supports central managementNoYes Complexity and expenseLowerHigher Layer of operationTransportInternet Transparently protects all higher-layer traffic NoYes Works with IPv4 and IPv6NAYes Modes of operationNATransport, Tunnel

Copyright Pearson Prentice-Hall End-to-End Security (Good) 1. End-to-End Security (Good) 2. Security in Site Network (Good) 2. Security in Site Network (Good) 3. Setup Cost On Each Host (Costly) 3. Setup Cost On Each Host (Costly)

Copyright Pearson Prentice-Hall No Security in Site Network (Bad) 2. No Security in Site Network (Bad) 3. No Setup Cost On Each Host (Good) 3. No Setup Cost On Each Host (Good)

Copyright Pearson Prentice-Hall CharacteristicTransport ModeTunnel Mode Uses an IPsec VPN Gateway? NoYes Cryptographic Protection All the way from the source host to the destination host, including the Internet and the two site networks. Only over the Internet between the IPsec gateways. Not within the two site networks. Setup CostsHigh. Setup requires the creation of a digital certificate for each client and significant configuration work. Low. Only the IPsec gateways must implement IPsec, so only they need digital certificates and need to be configured.

Copyright Pearson Prentice-Hall CharacteristicTransport ModeTunnel Mode Firewall FriendlinessBad. A firewall at the border to a site cannot filter packets because the content is encrypted. Good. Each packet is decrypted by the IPsec gateway. A border firewall after the IPsec gateway can filter the decrypted packet. The “Bottom Line”End-to-end security at high cost. Low cost and protects the packet over the most dangerous part of its journey.

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall Router does not need to make a complex decision for each packet

Copyright Pearson Prentice-Hall Cryptographic VPNsRouted VPNs ExamplesSSL/TLS IPsec Carrier PSDNs Carrier TCP/IP MPLS VPNs Cryptographic protections Confidentiality, integrity, authentication, etc. None Other protectionsLimiting customer access Limiting access to routing supervisory protocols Customer actions to improve protection Create a cryptographic VPN to run over carrier services

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall RADIUS Functionality AuthenticationAuthorizationsAuditing Uses EAPUses RADIUS authorization functionality Uses RADIUS auditing functionality

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall Cryptographic Characteristic WEPWPA802.11i (WPA2) Cipher for Confidentiality RC4 with a flawed implementation RC4 with 48-bit initialization vector (IV) AES with 128- bit keys Automatic Rekeying NoneTemporal Key Integrity Protocol (TKIP), which has been partially cracked AES-CCMP Mode Overall Cryptographic Strength NegligibleWeaker but no complete crack to date Extremely strong

Copyright Pearson Prentice-Hall Cryptographic Characteristic WEPWPA802.11i (WPA2) Operates in 802.1X (Enterprise) Mode? NoYes Operates in Pre- Shared Key (Personal) Mode? NoYes

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall

 Origin of WEP ◦ Original core security standard in , created in 1997  Uses a Shared Key ◦ Each station using the access point uses the same (shared) key ◦ The key is supposed to be secret, so knowing it “authenticates” the user ◦ All encryption uses this key Copyright Pearson Prentice-Hall

 Problem with Shared Keys ◦ If the shared key is learned, an attacker near an access point can read all traffic ◦ Shared keys should at least be changed frequently  But WEP had no way to do automatic rekeying  Manual rekeying is expensive if there are many users  Manual rekeying is operationally next to impossible if many or all stations use the same shared key because of the work involved in rekeying many or all corporate clients Copyright Pearson Prentice-Hall

 Problem with Shared Keys ◦ Because “everybody knows” the key, employees often give it out to strangers ◦ If a dangerous employee is fired, the necessary rekeying may be impossible or close to it Copyright Pearson Prentice-Hall

 RC4 Initialization Vectors (IV) ◦ WEP uses RC4 for fast and therefore cheap encryption ◦ But if two frames are encrypted with the same RC4 key are compared, the attacker can learn the key ◦ To solve this, WEP encrypts with a per-frame key that is the shared WEP key plus an initialization vector (IV) ◦ However, many frames “leak” a few bits of the key ◦ With high traffic, an attacker using readily available software can crack a shared key in two or three minutes ◦ (WPA uses RC4 but with a 48-bit IV that makes key bit leakage negligible) Copyright Pearson Prentice-Hall

 Conclusion ◦ Corporations should never use WEP for security Copyright Pearson Prentice-Hall

 Spread Spectrum Operation and Security ◦ Signal is spread over a wide range of frequencies ◦ NOT done for security, as in military spread spectrum transmission. Copyright Pearson Prentice-Hall

 Turning Off SSID Broadcasting ◦ Service set identifier (SSID) is an identifier for an access point ◦ Users must know the SSID to use the access point ◦ Drive-by hacker needs to know the SSID to break in ◦ Access points frequently broadcast their SSIDs Copyright Pearson Prentice-Hall

 Turning off SSID Broadcasting ◦ Some writers favor turning off of this broadcasting ◦ But turning off SSID broadcasting can make access more difficult for ordinary users ◦ Will not deter the attacker because he or she can read the SSID,  which is transmitted in the clear in each transmitted frame Copyright Pearson Prentice-Hall

 MAC Access Control Lists ◦ Access points can be configured with MAC access control lists ◦ Only permit access by stations with NICs having MAC addresses on the list ◦ But MAC addresses are sent in the clear in frames, so attackers can learn them ◦ Attacker can then spoof one of these addresses Copyright Pearson Prentice-Hall

 Perspective ◦ These “false” methods, however, may be sufficient to keep out nosy neighbors ◦ But drive-by hackers hit even residential users ◦ Simply applying WPA or i provides much stronger security and is easier to do Copyright Pearson Prentice-Hall

Copyright Pearson Prentice-Hall