McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Chapter 14 Network Security: Firewalls and VPNs

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 List and distinguish between the four conditions of security. Understand how privacy can be achieved through encryption/ decryption. Understand the digital signature concept and how it can be used to provide authentication, integrity, and nonrepudiation. Understanding firewalls and their use in isolating an organization from intruders. After reading this chapter, the reader should be able to: O BJECTIVES

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 O BJECTIVES (continued) Understand the different access control methods. Be familiar with VPN technology and how it provides privacy.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 INTRODUCTIONINTRODUCTION 14.1

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-1 Aspects of security

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 PRIVACYPRIVACY 14.2

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-2 Secret-key encryption

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 In secret-key encryption, the same key is used by the sender (for encryption) and the receiver (for decryption). The key is shared. Note:

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Business Focus: DES One common method of secret-key encryption is the data encryption standard (DES). DES was designed by IBM and adopted by the U.S. government as the standard encryption method for nonmilitary and nonclassified use. The algorithm manipulates a 64-bit plaintext with a 56-bit key. The text is put through 19 different and very complex procedures to create a 64- bit ciphertext.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-3 Public-key encryption

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Technical Focus: RSA One popular public-key encryption technique is called RSA. The technique uses number theory and the fact that it is easy to create two large numbers and multiply them, but difficult to find the original numbers when the product is given. The public key is made of two large numbers (n and e). The private key is made of two numbers (n and d). The encryption algorithm is C  P e mod n The receiver uses the same procedure but with the private key numbers as shown: C  P d mod n

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 DIGITALSIGNATUREDIGITALSIGNATURE 14.3

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-4 Signing the whole document

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Digital signature cannot be achieved using secret-key encryption. Note:

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Digital signature does not provide privacy. If there is a need for privacy, another layer of encryption/decryption must be applied. Note:

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-5 Signing the digest

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-6 Sender site

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-7 Receiver site

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 SECURITY IN THE INTERNETSECURITY INTERNET 14.4

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Technical Focus: Pretty Good Privacy (PGP) Pretty Good Privacy (PGP), invented by Phil Zimmermann, is an example of a security scheme designed to provide all four aspects of security (privacy, integrity, authentication, and nonrepudiation) in the sending of . PGP uses digital signature to provide integrity, authentication, and non- repudiation. It uses a combination of secret-key and public- key encryption to provide privacy. Specifically, it uses one hash function, one secret key, and two private-public key pairs.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Technical Focus: AH and ESP IPSec uses two protocols: authentication header (AH) and encapsulating security payload (ESP) to achieve security. The authentication header (AH) protocol is designed to provide integrity. The method involves a digital signature using a hashing function. The message digest created by applying the hashing function is included in a header (AH header), and inserted between the IP header and transport-layer data and header. The AH protocol does not provide privacy, only integrity and message authentication (digital signature). IPSec defines another protocol that provides privacy as well as a combination of integrity and message authentication. This protocol is called encapsulating security payload (ESP).

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 FIREWALLSFIREWALLS 14.5

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-8 Firewall

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 A proxy firewall filters at the application layer. Note:

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 VIRTUALPRIVATENETWORKSVIRTUALPRIVATENETWORKS 14.6

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 14-9 Private network

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Hybrid network

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Virtual private network

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 ACCESSCONTROLACCESSCONTROL 14.4

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Access control methods