1. Computer Science and Engineering Computer System Security CSE 5339/7339 Session 27 November 23, 2004

2. Computer Science and Engineering Contents  Security in Networks (Cont.)  Group Work  Khalid’s presentation  Ben’s presentation

3. Computer Science and Engineering Wired Backbone with Mobile nodes Fixed Communication Network Fixed Host Fixed host Fixed Host Base Station Wired Backbone Mobile Host

4. Computer Science and Engineering Mobile IP (Cont.) Arbitrary Topology of Routers and Links Home Agent Mobile Host at Home Foreign Agent Mobile Host visiting A foreign subnet Home subnet Foreign subnet

5. Computer Science and Engineering Wireless Multi-hop Backbone Mobile Host

6. Computer Science and Engineering Hybrid backbone Fixed Communication Network Fixed Host Fixed host Fixed Host Base Station Wired Backbone Mobile Host Wireless Multi-hop Backbone Mobile Host Hybrid Backbone Mobile Host

7. Computer Science and Engineering Encryption  Link Encryption  End-to-End Encryption BNTSME

8. Computer Science and Engineering Link Encryption Application Presentation Session Transport Network Data Link Physical Application Presentation Session Transport Network Data Link Physical BNTSME

9. Computer Science and Engineering End-to-End Encryption Application Presentation Session Transport Network Data Link Physical Application Presentation Session Transport Network Data Link Physical BNTSME

10. Computer Science and Engineering IP Security Protocol (IPSec)  With IPv6, IETF addresses security requirements  Defines a standard for handling encrypted data  Implemented at the IP layer  Supports authentication and confidentiality  Allows communicating parties to agree on a mutually supported set of protocols  Security Association -- set of parameters for a secured communication channel

11. Computer Science and Engineering Security Association A security association includes:  encryption algorithm and mode – e.g. DES  encryption key  encryption parameters – e.g. initialization vector  authentication protocol and key  lifespan of the association  address of opposite end of association  sensitivity level of protected data – used for classified data

12. Computer Science and Engineering IPSec (cont.)  Security Parameter Index (SPI) – data element, a pointer into a table of security associations  Authentication Header (AH) – immediately follows IP header (authentication for IP traffic)  Encapsulated Security Payload (ESP) – replaces (includes) the conventional TCP header and data portion of packet (encryption for IP data)

13. Computer Science and Engineering TCP/IP Conventional Packets Physical Header IP Header TCP Header Data Physical Trailer

14. Computer Science and Engineering TCP/IP Conventional Packets IP Header AH

15. Computer Science and Engineering Authentication Header Next Header SEQUENCE NUMBER Payload Length Security Parameters Index (SPI) Authentication Data Reserved

16. Computer Science and Engineering IPSec Packets ESP (includes TCP header and Data)

17. Computer Science and Engineering Encapsulated Security Packet Next Header SEQUENCE NUMBER Payload DATA Padding Length Padding Security Parameters Index (SPI) Authentication Data authenticated encrypted

18. Computer Science and Engineering Key Management  Internet Security Association Key management Protocol (ISAKMP) – distinct key be generated for each security association  ISAKMP Key Exchange (IKE)  Setup of secure communication – authentication of peers, exchange of keys, creation of security association

19. Computer Science and Engineering Group Work (firewalls, pages 458-465) 5 groups Read, discuss, and report  G1  packet filtering  G2  stateful inspection  G3  application proxies  G4  guards  G5  personal firewall

20. Computer Science and Engineering Thank you!