©The McGraw-Hill Companies, Inc., 2000© Adapted for use at JMU by Mohamed Aboutabl, 2003Mohamed...
-
Upload
preston-gordon -
Category
Documents
-
view
214 -
download
1
Transcript of ©The McGraw-Hill Companies, Inc., 2000© Adapted for use at JMU by Mohamed Aboutabl, 2003Mohamed...
1©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200311
Chapter 29
InternetSecurity
2©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200322
CONTENTSCONTENTS• INTRODUCTION• PRIVACY• DIGITAL SIGNATURE• SECURITY IN THE INTERNET• APPLICATION LAYER SECURITY• TRANSPORT LAYER SECURITY: TLS• SECURITY AT THE IP LAYER: IPSEC• FIREWALLS
3©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200333
29.1 Aspects of security
Privacy = Confidentiality of the transmitted message (encryption) Authentication = The sender ( not an imposter) sent the message Integrity = Message arrives without corruption Nonrepudiation = Sender cannot deny the message.
4©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200344
29.2 Privacy : Secret-key Encryption
the same key is used by the sender (for encryption) and the receiver (for decryption). The key is shared.
Often called symmetric encryption because the same key can be used in both directions
Efficient algorithms, takes less time to compute. Often used for long messages.
Each pair must have a secret key. N people need ½N(N-1) Difficult to distribute the secret key
KDC can solve the problem of secret-key distribution.
5©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200355
Privacy: Public-key Encryption
Each entity has two distinct keys: Private key and a Public key. Sender uses Receiver’s public key to encrypt the plaintext Receiver uses its own private key to decrypt the ciphertext.
No other private key can decrypt the ciphertext. N people need 2 N keys. Easy key distribution. Requires more time to encrypt/decrypt than the Secret Key method.
• More suitable for short messages How to authenticate the binding between an entity and its public key?
6©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200366
Certification Authorities (CAs)
A trusted agency used to verify that a public key belongs to a specific entity.
Issues a certificate: Public key + entity’s information (e.g. name, router IP) and encrypt it using the CA private key
Each receiver uses the CA’s public key to decrypt the sender’s certificate thus obtains the sender’s public key.
7©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200377
Secret Key + Public Key Combination
8©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200388
29.3 Digital Signature
Encryption achieves privacy only. Digital Signature’s goal is to achieve authentication and
nonrepudiation of sender + integrity of the message. Sender signs the message with a unique signature. Receiver verifies the sender’s signature. Two options:
Signing the whole document Signing a Digest of the document.
9©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 200399
Signing the Whole Document
Sender uses its private key to encrypt (i.e. sign) the messgae Receiver uses the sender’s public key to decrypt (i.e. verify the signature) of
the message.
Integrity: If message is intercepted and/or corrupted, the decrypted message is unreadable.
Authentication: If an imposter sent the message, using the intended sender’s public key to decrypt results in garbage.
Nonrepudiation: If sender denies the message, its private key is used by the authorities to decrypt the ciphertext. If results match, then the messages realy belongs to the sender.
10©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031010
Digital signature does not provide privacy.
If there is a need for privacy, another layer of
encryption/decryption must be applied.
11©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031111
Signing the digest
Two common has functions: MD5 → 120-bit digest SHA-1 → 160-bit digest
Properties of hash function:
1. One-Way: Massage to digest but not vice versa
2. One-to-One: No two distinct messages generate the same digest
12©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031212
Sender site
+
13©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031313
Receiver site
+
Integrity, authenticity and nonrepudiation of Digest guarantees the same for the Message. Why so?
14©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031414
29.4 Security in the Internet
At the Application layer The PGP scheme
At the Transport layer TLS protocol
At the IP layer IPSec
Firewalls
15©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031515
29.5 Application-Layer Security: PGP at the sender site
+ +
16©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031616
PGP at the receiver site
17©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031717
29.6 Transport Layer Security (TLS)
18©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031818
Encrypted by Server’s public key
Encrypted by client’s secret key
Includes Server’s public key
Encrypted by client’s secret key
TLS: 1) The Handshake Protocol
Data transfer is encrypted using the client-generated secret key
19©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20031919
29.7 Security at the IP-Layer: 1) Authentication Header Protocol
20©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20032020
2) Encapsulating Security Payload (ESP)
21©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20032121
Figure 29-16
ESP format
22©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20032222
FIREWALLSFIREWALLS
29.829.8
23©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20032323
Figure 29-17
Firewall
24©The McGraw-Hill Companies, Inc., 2000 © Adapted for use at JMU by Mohamed Aboutabl, 20032424
Packet-filter firewall
A packet-filter firewall filters at the network or transport layer.