network layer security network systems security mort anvari
DESCRIPTION
9/30/20043 IPSec Two protocols Authentication Header (AH) Encasulating Security Payload (ESP) Provide general security services for IP Authentication Confidentiality Anti-replay Key management Applicable to use over LANs, across public and private WANs, and for the InternetTRANSCRIPT
![Page 1: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/1.jpg)
Network Layer Security Network Systems Security
Mort Anvari
![Page 2: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/2.jpg)
9/30/2004 2
Security in Network Layer Implementing security in application layer
provides flexibility in security policy and key management
Problem is need to implement security mechanism in every application individually
To reduce the overhead, implement security in network layer to provide security for all applications between selected pair of computers
![Page 3: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/3.jpg)
9/30/2004 3
IPSec Two protocols
Authentication Header (AH) Encasulating Security Payload (ESP)
Provide general security services for IP Authentication Confidentiality Anti-replay Key management
Applicable to use over LANs, across public and private WANs, and for the Internet
![Page 4: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/4.jpg)
9/30/2004 4
Scenario of IPSec Uses
![Page 5: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/5.jpg)
9/30/2004 5
Benefits of IPSec Provide strong security to all traffic
crossing the perimeter if installed in a firewall/router
Resistant to bypass IPSec is below transport layer, hence
transparent to applications Can be transparent to end users Can provide security for individual users if
desired
![Page 6: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/6.jpg)
9/30/2004 6
IP Security Architecture Specification is quite complex Defined in numerous RFC’s
RFC 2401/2402/2406/2408 many others, grouped by category
Mandatory in IPv6, optional in IPv4
![Page 7: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/7.jpg)
9/30/2004 7
Security Association (SA) A unidirectional relationship between
sender and receiver that affords security for traffic flow
Each IPSec computer maintains a database of SA’s
Defined by 3 parameters Security Parameters Index (SPI) IP Destination Address Security Protocol Identifier
![Page 8: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/8.jpg)
9/30/2004 8
SA Parameters Sequence Number Counter Sequence Number Overflow Anti-Replay Window AH and ESP information Lifetime IPSec Protocol Mode Path MTU
![Page 9: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/9.jpg)
9/30/2004 9
Authentication Header (AH) Provide support for data integrity and
authentication of IP packets end system/router can authenticate
user/app prevent address spoofing attacks by
tracking sequence numbers Based on use of a MAC
HMAC-MD5-96 or HMAC-SHA-1-96 Parties must share a secret key
![Page 10: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/10.jpg)
9/30/2004 10
Authentication Header
![Page 11: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/11.jpg)
9/30/2004 11
End-to-End vs End-to-Intermediate Authentication
![Page 12: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/12.jpg)
9/30/2004 12
Scope of AH Authentication
![Page 13: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/13.jpg)
9/30/2004 13
Encapsulating Security Payload (ESP) Provide message content confidentiality
and limited traffic flow confidentiality Can optionally provide the same
authentication services as AH Support range of ciphers, modes,
padding DES, Triple-DES, RC5, IDEA, CAST etc CBC most common pad to meet blocksize, for traffic flow
![Page 14: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/14.jpg)
9/30/2004 14
Encapsulating Security Payload
![Page 15: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/15.jpg)
9/30/2004 15
Transport vs Tunnel Mode ESP Transport mode is used to encrypt and
optionally authenticate IP data data protected but header left in clear can do traffic analysis but is efficient good for ESP host to host traffic
Tunnel mode encrypts entire IP packet add new header for next hop good for VPNs, gateway to gateway security
![Page 16: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/16.jpg)
9/30/2004 16
Scope of ESP Encryption and Authentication
![Page 17: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/17.jpg)
9/30/2004 17
Combining Security Associations SAs can implement either AH or
ESP, but each SA can implement only one
To implement both, need to combine SAs form a security bundle
Have 4 cases
![Page 18: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/18.jpg)
9/30/2004 18
Combining Security Associations
![Page 19: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/19.jpg)
9/30/2004 19
Key Management Handle key generation and distribution Typically need 2 pairs of keys
2 per direction for AH & ESP Manual key management
sysadmin manually configures every system Automated key management
automated system for on demand creation of keys for SA’s in large systems
Oakley and ISAKMP
![Page 20: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/20.jpg)
9/30/2004 20
OAKLEY A key exchange protocol Based on Diffie-Hellman key exchange Add features to address weaknesses of
Diffie-Hellman cookies to counter clogging attacks nonces to counter replay attacks key exchange authentication to counter
man-in-the-middle attacks Can use arithmetic in prime fields or
elliptic curve fields
![Page 21: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/21.jpg)
9/30/2004 21
Usage of Cookies Three basic requirements
Must depend on specific parties Impossible for anyone other than issuing entity
to generate cookies that will be accepted by issuing party
Cookie generation and verification must be fast To create a cookie, perform a fast hash
over src and dst IP addresses, src and dst ports, and a locally generated secret value
![Page 22: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/22.jpg)
9/30/2004 22
ISAKMP Internet Security Association and Key
Management Protocol Provide framework for key management Define procedures and packet formats to
establish, negotiate, modify, and delete SAs
Independent of key exchange protocol, encryption algorithm, and authentication method
![Page 23: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/23.jpg)
9/30/2004 23
ISAKMP
![Page 24: Network Layer Security Network Systems Security Mort Anvari](https://reader036.vdocuments.us/reader036/viewer/2022062402/5a4d1be17f8b9ab0599dfb9f/html5/thumbnails/24.jpg)
9/30/2004 24
Next Class Denial-of-Service (DoS) attack Hop Integrity