TCP/IP Protocols Contains Five Layers Top three layers contains many protocols Actual transmission at the physical layer

TCP/IP Layers Application Presentation Session SMTP FTP DNS TELNET Applications SMTP FTP DNS TELNET HTTP Transport TCP UDP Network ICMP ARP RARP Data Link Physical Protocols specific to the underlying physical media used for data communication at the hardware level IP

Message Transfer using TCP/IP Original Message Original Message TCP header IP header Frame header Source Destination

TCP Reliable transport layer communication Establishes a logical connection between the communicating hosts Socket-to-socket communication (Socket = Port + IP address)

TCP Segment Format Source Port number Destination Port number Sequence Number Acknowledgement Number Data 2 bytes 4 bytes 20-to-60 bytes header consisting of the following fields Header Length 4 bits Reserved 6 bits Flag Window size Checksum Urgent pointer Options 0 to 40 bytes

IP Best effort delivery Does not guarantee success Leaves error checking to higher layers (e.g. to TCP)

Destination IP address IP Datagram Format Version HLEN Service Type Total Length (4 bits) (4 bits) (8 bits) (16 bits) Identification Flags Fragmentation Offset (16 bits) (3 bits) (13 bits) Time to live Protocol Header Checksum (8 bits) (8 bits) (16 bits) Source IP address (32 bits) Destination IP address Data Options

Network Aspects Internal network (e.g. LAN) External Network (e.g. Internet) Threats from the External Network to the Internal Network

Network Threats N e t w o r k B a c k b o n e Router To Internet Outside dangers can come in from here Inside information can leak out from here Corporate network

Firewall Special type of router Controls transmission between internal and external networks Decides what to allow/disallow

NAT Implementation Internal network with internal IP addresses  192.168.10.1 192.168.10.3 192.168.10.2 192.168.10.10 Internet 201.26.7.9 Router’s internal IP address Router’s external IP address NAT router

Internal network with internal IP addresses NAT Example Internal network with internal IP addresses 192.168.10.1 192.168.10.10 Internet 201.26.7.9 NAT router Source: 192.168.10.1 Source: 201.26.7.9 Destination: 192.168.10.1 Destination: 201.26.7.9

NAT Translation Table Source: 192.168.10.1 Destination: 210.10.20.20 192.168.10.10 201.26.7.9 192.168.10.1 210.10.20.20 Source: 210.10.20.20 Destination: 192.168.10.1 Destination: 201.26.7.9 Internal … External Translation table

Firewall Concept N e t w o r k B a c k b o n e To Internet Firewall Corporate network Firewall

Firewall Types Firewalls Packet Filters Application Gateways

Internal (Private) Network Packet Filter Internet Internal (Private) Network Packet filter Protected zone

Packet Filter Operation Outgoing packets Incoming packets Receive each packet. Apply rules. If no rules, apply default rules.

Packet Filter Defeating IP Spoofing Attack Incoming packet  178.29.10.89 178.29.10.90 178.29.10.91 Internal network and the IP addresses of the hosts Packet filter Source address: 178.29.10.91 STOP!

Application Gateway Inside connection Outside connection HTTP SMTP FTP TELNET Outside connection Inside connection Application gateway

Circuit Gateway Source address = 178.29.10.90 HTTP SMTP FTP TELNET Application gateway IP address = 178.29.10.90 IP address = 178.29.10.70 Source address = 178.29.10.90 Source address = 178.29.10.70 IP packet Inside host Outside host

Application Gateway - Illusion HTTP SMTP FTP TELNET External host Internal host Application gateway User’s illusion Real connection

Firewall Configurations Screened host firewall, Single-homed bastion Dual-homed bastion Screened subnet firewall

Screened Host Firewall, Single-homed Bastion  Packet filter HTTP SMTP FTP TELNET Internet Application gateway Internal network

Screened Host Firewall, Dual-homed Bastion  Packet filter HTTP SMTP FTP TELNET Internet Application gateway Internal network

Screened Subnet Firewall  Packet filter HTTP SMTP FTP TELNET Internet Application gateway Internal network

Demilitarized Zone (DMZ)  Internet Internal private network Demilitarized Zone (DMZ) Firewall

Security at multiple Layers Application Layer Transport Layer Internet Layer Data Link Layer Physical Layer First level of security Second level of security

IPSec Not concerned with application layer security Applies security at the Internet layer More effective in IPv6

IPSec Processing Result Actual data (Encrypted) Transport header (Encrypted) Internet header (Not encrypted)

IPSec in TCP/IP Sender Receiver Original message Application Transport Transmission medium Application Transport IPSec Internet Data link Sender Receiver

Authentication Header (AH) Encapsulating Security Payload (ESP) IPSec Protocols IPSec Authentication Header (AH) Encapsulating Security Payload (ESP)

AH and ESP Operation Modes AH and ESP modes of operation Tunnel mode Transport mode

Tunnel Mode X  P1 Proxy P2 Y Network 1 Network 2 Tunnel

Tunnel Mode Implementation A <---> B P1 <---> P2 … Internal IP header and data (encrypted) External IP header (not encrypted)

IPSec steps Step 1 Algorithm and Key negotiations using IKE Step 2 Actual AH and ESP operations

Security Parameter Index (SPI) Authentication data (Variable size) AH Format Bit 0 8 16 31 Next header Payload length Reserved Security Parameter Index (SPI) Sequence number Authentication data (Variable size)

Receiver’s Sliding Window Receiver’s sliding window (W = 8) N – W Marked if a valid packet is received Unmarked if a valid packet is not yet received N

AH Transport Mode IP header TCP header Original data (a) Before applying AH (b) After applying AH AH

AH Tunnel Mode IP header TCP header Original data (a) Before applying AH Original IP header (b) After applying AH AH New IP header

ESP Format Bit 0 16 24 31 Security Parameter Index (SPI) Sequence Number Padding (0-255 bytes) Payload data (Variable size) Padding length Next header Authentication data (Variable size)

(a) Before applying ESP ESP Transport Mode IP header TCP header Original data (a) Before applying ESP (b) After applying ESP ESP header Original IP header ESP trailer ESP auth Encrypted Authenticated

(a) Before applying ESP ESP Tunnel Mode IP header TCP header Original data (a) Before applying ESP (b) After applying ESP ESP header Original IP header ESP trailer ESP auth Encrypted Authenticated New IP header

ISAKMP Header Format Bit 0 8 16 24 31 Initiator cookie Responder cookie Next payload Major version Minor version Exchange type Flags Message ID Length

Virtual Private Network (VPN) Uses the Internet as if it is a private network Far less expensive than a leased line Uses IPSec protocol

VPN Between Two Networks X  Network 1 Y Network 2 Firewall 1 Firewall 2 VPN tunnel Internet