HANNAM UNIVERSITY Http://netwk.hannam.ac.kr 1 Chapter 29 Internet Security.

1HANNAM UNIVERSITYHttp://netwk.hannam.ac.kr

Chapter 29

InternetSecurity


CONTENTSCONTENTS• INTRODUCTION• PRIVACY• DIGITAL SIGNATURE• SECURITY IN THE INTERNET• APPLICATION LAYER SECURITY• TRANSPORT LAYER SECURITY: TLS• SECURITY AT THE IP LAYER: IPSEC• FIREWALLS


INTRODUCTIONINTRODUCTION

29.129.1


29.1 29.1 개요개요

보안에서 필요한 기능


PRIVACYPRIVACY

29.229.2


29.2 29.2 기밀성기밀성

비밀키 암호화


29.2 29.2 기밀성기밀성

In secret-key encryption, In secret-key encryption, the same key is used by the sender the same key is used by the sender

(for encryption)(for encryption) and the receiver and the receiver (for decryption).(for decryption). The key is shared.The key is shared.


29.2 29.2 기밀성기밀성

Secret-key encryption is often called Secret-key encryption is often called symmetric encryption because symmetric encryption because

the same key can the same key can be used in both directions.be used in both directions.


29.2 29.2 기밀성기밀성

Secret-key encryption is Secret-key encryption is often used for long messages.often used for long messages.


29.2 29.2 기밀성기밀성

We discuss one secret-key We discuss one secret-key algorithm in Appendix E.algorithm in Appendix E.


29.2 29.2 기밀성기밀성

KDCKDC can solve the problem can solve the problem

of secret-key distribution.of secret-key distribution.


29.2 29.2 기밀성기밀성

공개키 암호화


29.2 29.2 기밀성기밀성

Public-key algorithms are more Public-key algorithms are more efficient for short messages.efficient for short messages.


29.2 29.2 기밀성기밀성

A A CACA

can certify the binding between can certify the binding between a public key and the owner.a public key and the owner.


29.2 29.2 기밀성기밀성

비밀키와 공개키의 결합


29.2 29.2 기밀성기밀성

To have the advantages of both To have the advantages of both secret-key and public-key secret-key and public-key

encryption, we can encrypt the secret key encryption, we can encrypt the secret key using the public key and encrypt using the public key and encrypt the message using the secret key.the message using the secret key.


DIGITAL SIGNATUREDIGITAL SIGNATURE

29.329.3


29.3 29.3 디지털 서명디지털 서명

전체 문서에 서명



Digital signature cannot be Digital signature cannot be achieved using only secret keys. achieved using only secret keys.



Digital signature does not Digital signature does not provide privacy. provide privacy.

If there is a need for privacy, If there is a need for privacy, another layer of another layer of

encryption/decryption encryption/decryption must be applied.must be applied.



다이제스트에 서명



송신자 측



수신자 측


SECURITY IN THESECURITY IN THEINTERNETINTERNET

29.429.4


29.4 29.4 인터넷 보안인터넷 보안

인터넷 보안 기능 제공응용 계층

Client 와 server 고려전송 계층

새로운 계층 추가IP 계층

OSPF, ICMP, IGMP 층과 같은 프로토콜을 위한 서비스


APPLICTION LAYERAPPLICTION LAYERSECURITYSECURITY

29.529.5


29.5 29.5 응용계층 보안응용계층 보안

PGP(Pretty Good Privacy)Phill Zimmermann 에 의해 개발기밀성 , 무결성 , 인증 , 부인방지 서비스 제공무결성 , 인증 , 부인 방지를 위해 디지털 서명 사용기밀성을 위해 비밀키와 공개키 암호화 조합 이용



송신측의 PGP



수신측의 PGP



SSH(Secure Shell)보안을 제공하는 클라이언트 - 서버 프로그램인증 , 권한부여 , 기밀성 , 무결성 , 터널링 기능

제공


TRANSPORT LAYERTRANSPORT LAYERSECURITYSECURITY

(TLS)(TLS)

29.629.6


29.6 29.6 전송계층 보안전송계층 보안

TLS 의 위치



TLS(Transport Layer Security)전송계층 보안 제공넷스케이프사 개발 SSL(Secure Socket Layer)IETF 에 의해 설계된 SSL 의 공개 버전Handshake Protocol : 보안 협상 , 브라우저 / 서버간

인증Data Exchange Protocol : 무결성 , 기밀성 제공



핸드쉐이크 프로토콜


SECURITY AT THESECURITY AT THEIP LAYERIP LAYER

(IPSec)(IPSec)

29.729.7


29.7 IP 29.7 IP 계층 보안 계층 보안 : IPSEC: IPSEC

인증



헤더 형식



ESP



ESP 형식


FIREWALLSFIREWALLS

29.829.8


29.8 29.8 방화벽방화벽


29.8 29.8 방화벽방화벽

패킷 - 필터 방화벽


29.8 29.8 방화벽방화벽

A packet-filter firewall filters A packet-filter firewall filters at the network or transport layer.at the network or transport layer.


29.8 29.8 방화벽방화벽

프록시 방화벽


29.8 29.8 방화벽방화벽

A proxy firewall A proxy firewall filters at the application layer.filters at the application layer.

HANNAM UNIVERSITY Http://netwk.hannam.ac.kr 1 Chapter 29 Internet Security.

Documents

Transcript of HANNAM UNIVERSITY Http://netwk.hannam.ac.kr 1 Chapter 29 Internet Security.