Top Banner
Network Layer Security Network Systems Security Mort Anvari
24

Network Layer Security Network Systems Security Mort Anvari.

Jan 20, 2018

Download

Documents

Gerard Sims

9/30/20043 IPSec Two protocols Authentication Header (AH) Encasulating Security Payload (ESP) Provide general security services for IP Authentication Confidentiality Anti-replay Key management Applicable to use over LANs, across public and private WANs, and for the Internet
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Network Layer Security Network Systems Security Mort Anvari.

Network Layer Security Network Systems Security

Mort Anvari

Page 2: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 2

Security in Network Layer Implementing security in application layer

provides flexibility in security policy and key management

Problem is need to implement security mechanism in every application individually

To reduce the overhead, implement security in network layer to provide security for all applications between selected pair of computers

Page 3: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 3

IPSec Two protocols

Authentication Header (AH) Encasulating Security Payload (ESP)

Provide general security services for IP Authentication Confidentiality Anti-replay Key management

Applicable to use over LANs, across public and private WANs, and for the Internet

Page 4: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 4

Scenario of IPSec Uses

Page 5: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 5

Benefits of IPSec Provide strong security to all traffic

crossing the perimeter if installed in a firewall/router

Resistant to bypass IPSec is below transport layer, hence

transparent to applications Can be transparent to end users Can provide security for individual users if

desired

Page 6: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 6

IP Security Architecture Specification is quite complex Defined in numerous RFC’s

RFC 2401/2402/2406/2408 many others, grouped by category

Mandatory in IPv6, optional in IPv4

Page 7: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 7

Security Association (SA) A unidirectional relationship between

sender and receiver that affords security for traffic flow

Each IPSec computer maintains a database of SA’s

Defined by 3 parameters Security Parameters Index (SPI) IP Destination Address Security Protocol Identifier

Page 8: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 8

SA Parameters Sequence Number Counter Sequence Number Overflow Anti-Replay Window AH and ESP information Lifetime IPSec Protocol Mode Path MTU

Page 9: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 9

Authentication Header (AH) Provide support for data integrity and

authentication of IP packets end system/router can authenticate

user/app prevent address spoofing attacks by

tracking sequence numbers Based on use of a MAC

HMAC-MD5-96 or HMAC-SHA-1-96 Parties must share a secret key

Page 10: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 10

Authentication Header

Page 11: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 11

End-to-End vs End-to-Intermediate Authentication

Page 12: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 12

Scope of AH Authentication

Page 13: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 13

Encapsulating Security Payload (ESP) Provide message content confidentiality

and limited traffic flow confidentiality Can optionally provide the same

authentication services as AH Support range of ciphers, modes,

padding DES, Triple-DES, RC5, IDEA, CAST etc CBC most common pad to meet blocksize, for traffic flow

Page 14: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 14

Encapsulating Security Payload

Page 15: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 15

Transport vs Tunnel Mode ESP Transport mode is used to encrypt and

optionally authenticate IP data data protected but header left in clear can do traffic analysis but is efficient good for ESP host to host traffic

Tunnel mode encrypts entire IP packet add new header for next hop good for VPNs, gateway to gateway security

Page 16: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 16

Scope of ESP Encryption and Authentication

Page 17: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 17

Combining Security Associations SAs can implement either AH or

ESP, but each SA can implement only one

To implement both, need to combine SAs form a security bundle

Have 4 cases

Page 18: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 18

Combining Security Associations

Page 19: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 19

Key Management Handle key generation and distribution Typically need 2 pairs of keys

2 per direction for AH & ESP Manual key management

sysadmin manually configures every system Automated key management

automated system for on demand creation of keys for SA’s in large systems

Oakley and ISAKMP

Page 20: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 20

OAKLEY A key exchange protocol Based on Diffie-Hellman key exchange Add features to address weaknesses of

Diffie-Hellman cookies to counter clogging attacks nonces to counter replay attacks key exchange authentication to counter

man-in-the-middle attacks Can use arithmetic in prime fields or

elliptic curve fields

Page 21: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 21

Usage of Cookies Three basic requirements

Must depend on specific parties Impossible for anyone other than issuing entity

to generate cookies that will be accepted by issuing party

Cookie generation and verification must be fast To create a cookie, perform a fast hash

over src and dst IP addresses, src and dst ports, and a locally generated secret value

Page 22: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 22

ISAKMP Internet Security Association and Key

Management Protocol Provide framework for key management Define procedures and packet formats to

establish, negotiate, modify, and delete SAs

Independent of key exchange protocol, encryption algorithm, and authentication method

Page 23: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 23

ISAKMP

Page 24: Network Layer Security Network Systems Security Mort Anvari.

9/30/2004 24

Next Class Denial-of-Service (DoS) attack Hop Integrity