سعي

Securityأمن الشبكات

الشريحة 1 من 17

مقدمة الفصل

ماذا ستتعلم في هذا الفصل

  1. What network security is: confidentiality, authentication, message integrity, access and availability; what a "bad guy" can do.
  2. The language of cryptography: plaintext, ciphertext, encryption and decryption keys.
  3. Securing TCP connections with SSL: its goals, its place above TCP, the handshake and the record protocol.
  4. Network-layer confidentiality with IPsec: services, transport and tunnel modes, AH and ESP.
  5. Operational security: firewalls (stateless packet filters, application gateways) and their limitations; intrusion detection systems.

أقسام الفصل

  1. 1What is network security?ما أمن الشبكات؟
  2. 2The language of cryptographyلغة التشفير
  3. 3SSL: Secure Sockets LayerSSL: طبقة المقابس الآمنة
  4. 4Network-layer confidentiality and IPsecالسرية في طبقة الشبكة وIPsec
  5. 5Firewalls and stateless packet filteringالجدران النارية وترشيح الحزم عديم الحالة
  6. 6Application gateways and limitations of firewallsبوابات التطبيقات وحدود الجدران النارية
  7. 7Intrusion detection systemsأنظمة كشف التسلل

تلميح: استخدم أسهم لوحة المفاتيح للتنقل بين الشرائح.

تفاصيل المصدرالفصل 8 · الشريحة ⁦2⁩
المصدر
الفصل 8 · الشريحة ⁦2⁩
ملاحظات حول المصدر (1)
  • تذكر الشريحة 23 مرشحات الحزم ذات الحالة دون شرح، وتحيل الشريحة 5 إلى القسم 1.6 غير الموجود في الملف.

What is network security?ما أمن الشبكات؟

Confidentialityالسرية
Only sender, intended receiver should "understand" message contents: sender encrypts message, receiver decrypts message.
Authenticationالتحقق من الهوية
Sender, receiver want to confirm identity of each other.
Message integrityسلامة الرسالة
Sender, receiver want to ensure message not altered (in transit, or afterwards) without detection.
Access and availabilityالوصول والإتاحة
Services must be accessible and available to users.

A bank wants to be sure that a transfer order was not changed on its way from the customer, and that any change would be noticed. Which security property is this?

تفاصيل المصدرالفصل 8 · الشريحة ⁦2⁩
المصدر
الفصل 8 · الشريحة ⁦2⁩

Alice, Bob, Trudy — and what a bad guy can doأليس وبوب وترودي

What is network security?

  • Bob, Alice want to communicate "securely"; Trudy (intruder) may intercept, delete, add messages.
  • Real-life Bobs and Alices: Web browser/server for electronic transactions (e.g., on-line purchases); on-line banking client/server; DNS servers; routers exchanging routing table updates.

ما الذي يستطيع المهاجم فعله؟ تذكّر قبل الكشف.

  1. Eavesdropالتنصت
  2. Insert messagesإدخال رسائل
  3. Impersonationالانتحال
  4. Hijackingالاختطاف
  5. Denial of serviceحجب الخدمة

During an ongoing session, an attacker removes the receiver and puts himself in the receiver's place. Which attack is this?

تفاصيل المصدرالفصل 8 · الشرائح ⁦3–5⁩
المصدر
الفصل 8 · الشرائح ⁦3–5⁩

The language of cryptographyلغة التشفير

  1. m

    Plaintext message.

  2. K_A

    Alice's encryption key + encryption algorithm → ciphertext K_A(m).

  3. K_B

    Bob's decryption key + decryption algorithm → plaintext again: m = K_B(K_A(m)).

تفاصيل المصدرالفصل 8 · الشريحة ⁦6⁩
المصدر
الفصل 8 · الشريحة ⁦6⁩

SSL: Secure Sockets LayerSSL

  • Widely deployed security protocol: supported by almost all browsers, web servers; https; billions $/year over SSL.
  • Mechanisms: [Woo 1994]; implementation: Netscape. Variation — TLS: transport layer security, RFC 2246.
  • Provides confidentiality, integrity, authentication.
  • Original goals: Web e-commerce transactions; encryption (especially credit-card numbers); Web-server authentication; optional client authentication; minimum hassle in doing business with new merchant.
  • Available to all TCP applications: secure socket interface.
SSL and TCP/IP (slide 8)

Normal application

  • Application
  • TCP
  • IP

Application with SSL

  • Application
  • SSL
  • TCP
  • IP
  • SSL provides application programming interface (API) to applications.
  • C and Java SSL libraries/classes readily available.

An application that uses SSL has which protocol stack, from top to bottom?

تفاصيل المصدرالفصل 8 · الشرائح ⁦7–8⁩
المصدر
الفصل 8 · الشرائح ⁦7–8⁩

Real SSL: the handshakeمصافحة SSL

SSL: Secure Sockets Layer

  1. 1Server authentication
  2. 2Negotiation: agree on crypto algorithms
  3. 3Establish keys
  4. 4Client authentication (optional)

Handshake steps (slide 10)

  1. 1

    Client sends list of algorithms it supports, along with client nonce.

  2. 2

    Server chooses algorithms from list; sends back: choice + certificate + server nonce.

  3. 3

    Client verifies certificate, extracts server's public key, generates pre_master_secret, encrypts with server's public key, sends to server.

  4. 4

    Client and server independently compute encryption and MAC keys from pre_master_secret and nonces.

  5. 5

    Client sends a MAC of all the handshake messages.

  6. 6

    Server sends a MAC of all the handshake messages.

In the SSL handshake, how does the pre_master_secret reach the server?

تفاصيل المصدرالفصل 8 · الشرائح ⁦9–10⁩
المصدر
الفصل 8 · الشرائح ⁦9–10⁩

Why the last two MACs, and why two nonces?MAC والرقمان العشوائيان

SSL: Secure Sockets Layer

فكّر في الهجوم قبل أن تكشف الحل.

  1. Tampering with the handshake (slide 11)

    The client offers a range of algorithms, some strong, some weak. A man-in-the-middle deletes the stronger algorithms from the list. What stops this?

  2. Replaying records (slide 12)

    Trudy sniffs all messages between Alice & Bob; next day she opens a TCP connection with Bob and sends the exact same sequence of records. Bob (Amazon) would think Alice made two separate orders for the same thing. What stops this?

Trudy records an entire SSL session in which Alice orders a book from Bob, and replays the same records to Bob on a new connection the next day. Why does the replay fail?

تفاصيل المصدرالفصل 8 · الشرائح ⁦11–12⁩
المصدر
الفصل 8 · الشرائح ⁦11–12⁩

SSL record protocol and record formatسجلات SSL

SSL: Secure Sockets Layer

  • Data is split into fragments; each fragment gets a MAC; data and MAC are encrypted; a record header is added.
  • Record header: content type; version; length.
  • MAC: includes sequence number, MAC key M_x.
  • Fragment: each SSL fragment 2^14 bytes (~16 Kbytes).
SSL record format (slide 14)
FieldSize
content type1 byte
SSL version2 bytes
length3 bytes
data
MAC
  • Data and MAC encrypted (symmetric algorithm).
  • Real SSL connection (slide 15): after the handshake, everything henceforth is encrypted; TCP FIN follows.

In an SSL record, which parts are encrypted?

تفاصيل المصدرالفصل 8 · الشرائح ⁦13–15⁩
المصدر
الفصل 8 · الشرائح ⁦13–15⁩

Network-layer confidentiality and IPsec servicesIPsec وخدماته

Network-layer confidentiality
Between two network entities, the sending entity encrypts the datagram payload — TCP or UDP segment, ICMP message, OSPF message …. All data sent from one entity to the other would be hidden (web pages, e-mail, P2P file transfers, TCP SYN packets …): "blanket coverage".

IPsec services (slide 17)

  • data integrity
  • origin authentication
  • replay attack prevention
  • confidentiality
  • Two protocols providing different service models: AH and ESP.
تفاصيل المصدرالفصل 8 · الشرائح ⁦16–17⁩
المصدر
الفصل 8 · الشرائح ⁦16–17⁩

IPsec modes and protocolsأوضاع IPsec وبروتوكولاه

Network-layer confidentiality and IPsec

IPsec modes (slides 18–19)

Transport modeوضع النقل

  • IPsec datagram emitted and received by end-system
  • Protects upper level protocols

Tunneling modeوضع النفق

  • Edge routers IPsec-aware
  • or hosts IPsec-aware
Two IPsec protocols (slide 20)
ProtocolSource authenticationData integrityConfidentiality
AH (Authentication Header)YesYesNo
ESP (Encapsulation Security Protocol)YesYesYes
  • ESP is more widely used than AH.
  • Four combinations are possible: host mode with AH, host mode with ESP, tunnel mode with AH, tunnel mode with ESP — tunnel mode with ESP: most common and most important (slide 21).

A network needs IPsec packets that are authenticated and integrity-protected AND hidden from eavesdroppers. Which protocol must it use?

تفاصيل المصدرالفصل 8 · الشرائح ⁦18–21⁩
المصدر
الفصل 8 · الشرائح ⁦18–21⁩

Firewalls: what and whyالجدار الناري ولماذا

Firewalls and stateless packet filtering

Firewall
Isolates organization's internal net from larger Internet, allowing some packets to pass, blocking others. Administered network: trusted "good guys"; public Internet: untrusted "bad guys".

Firewalls: why (slide 23)

  • Prevent denial of service attacks
    • SYN flooding: attacker establishes many bogus TCP connections, no resources left for "real" connections
  • Prevent illegal modification/access of internal data
    • e.g., attacker replaces CIA's homepage with something else
  • Allow only authorized access to inside network
    • set of authenticated users/hosts

Three types of firewalls

  • stateless packet filters
  • stateful packet filters
  • application gateways
تفاصيل المصدرالفصل 8 · الشرائح ⁦22–23⁩
المصدر
الفصل 8 · الشرائح ⁦22–23⁩

Stateless packet filteringالمرشح عديم الحالة

  • Internal network connected to Internet via router firewall.
  • Router filters packet-by-packet; decision to forward/drop packet based on:
  • source IP address
  • destination IP address
  • TCP/UDP source and destination port numbers
  • ICMP message type
  • TCP SYN and ACK bits

ما نتيجة كل قاعدة؟

  1. Example 1

    Block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23.

  2. Example 2

    Block inbound TCP segments with ACK=0.

A router firewall blocks every inbound TCP segment with ACK = 0. What is the effect?

تفاصيل المصدرالفصل 8 · الشرائح ⁦24–25⁩
المصدر
الفصل 8 · الشرائح ⁦24–25⁩

Policies and firewall settingsسياسات وإعدادات

Firewalls and stateless packet filtering

Stateless packet filtering: more examples (slide 26)
PolicyFirewall setting (slide 26)
No outside Web access.Drop all outgoing packets to any IP address, port 80
No incoming TCP connections, except those for institution's public Web server only.Drop all incoming TCP SYN packets to any IP except 130.207.244.203, port 80
Prevent Web-radios from eating up the available bandwidth.Drop all incoming UDP packets - except DNS and router broadcasts.
Prevent your network from being used for a smurf DoS attack.Drop all ICMP packets going to a "broadcast" address (e.g. 130.207.255.255).
Prevent your network from being traceroutedDrop all outgoing ICMP TTL expired traffic

Which firewall setting implements the policy "No outside Web access"?

تفاصيل المصدرالفصل 8 · الشريحة ⁦26⁩
المصدر
الفصل 8 · الشريحة ⁦26⁩

Application gatewaysبوابات التطبيقات

Application gateway
Filters packets on application data as well as on IP/TCP/UDP fields.

Example: allow select internal users to telnet outside

  1. 1

    Require all telnet users to telnet through gateway.

  2. 2

    For authorized users, gateway sets up telnet connection to dest host. Gateway relays data between 2 connections.

  3. 3

    Router filter blocks all telnet connections not originating from gateway.

An organisation lets only selected internal users telnet outside, using an application gateway. Which rule makes sure nobody bypasses the gateway?

تفاصيل المصدرالفصل 8 · الشرائح ⁦27–28⁩
المصدر
الفصل 8 · الشرائح ⁦27–28⁩

Limitations of firewalls, gatewaysحدود الجدران النارية

Application gateways and limitations of firewalls

  1. IP spoofingRouter can't know if data "really" comes from claimed source.
  2. One gateway per applicationIf multiple app's. need special treatment, each has own app. gateway.
  3. Client configurationClient software must know how to contact gateway, e.g., must set IP address of proxy in Web browser.
  4. UDPFilters often use all or nothing policy for UDP.
  5. TradeoffDegree of communication with outside world, level of security.
  6. Still attackedMany highly protected sites still suffer from attacks.
تفاصيل المصدرالفصل 8 · الشريحة ⁦29⁩
المصدر
الفصل 8 · الشريحة ⁦29⁩

Intrusion detection systemsأنظمة كشف التسلل

Packet filtering vs. IDS (slide 30)
Packet filteringIDS
What it looks atTCP/IP headers onlyPacket contents (deep packet inspection), e.g. character strings against a database of known virus, attack strings
Across packets/sessionsNo correlation check among sessionsExamines correlation among multiple packets
  • Multiple IDSs: different types of checking at different locations (slide 31).
  • The figure shows a firewall between the internal network and the Internet, IDS sensors, and a demilitarized zone with the Web server, FTP server and DNS server.

A security team wants to detect a port scan that is spread over many separate packets and sessions. Why is an IDS suited to this but a packet filter is not?

تفاصيل المصدرالفصل 8 · الشرائح ⁦30–31⁩
المصدر
الفصل 8 · الشرائح ⁦30–31⁩

الخلاصة

أنهيت الدرس

الخطوة التالية: ثبّت المعلومات بالبطاقات، ثم اختبر نفسك بالأسئلة.

البطاقاتالتدريب

ما راجعته في هذا الدرس

تفاصيل المصدر
المصدر
الفصل 8

خريطة الفصل

    1. 1مقدمة الفصل

  2. What is network security?ما أمن الشبكات؟

    1. 2What is network security?ما أمن الشبكات؟
    2. 3Alice, Bob, Trudy — and what a bad guy can doأليس وبوب وترودي
    1. 4The language of cryptographyلغة التشفير

  4. SSL: Secure Sockets LayerSSL: طبقة المقابس الآمنة

    1. 5SSL: Secure Sockets LayerSSL
    2. 6Real SSL: the handshakeمصافحة SSL
    3. 7Why the last two MACs, and why two nonces?MAC والرقمان العشوائيان
    4. 8SSL record protocol and record formatسجلات SSL

  5. Network-layer confidentiality and IPsecالسرية في طبقة الشبكة وIPsec

    1. 9Network-layer confidentiality and IPsec servicesIPsec وخدماته
    2. 10IPsec modes and protocolsأوضاع IPsec وبروتوكولاه

  6. Firewalls and stateless packet filteringالجدران النارية وترشيح الحزم عديم الحالة

    1. 11Firewalls: what and whyالجدار الناري ولماذا
    2. 12Stateless packet filteringالمرشح عديم الحالة
    3. 13Policies and firewall settingsسياسات وإعدادات

  7. Application gateways and limitations of firewallsبوابات التطبيقات وحدود الجدران النارية

    1. 14Application gatewaysبوابات التطبيقات
    2. 15Limitations of firewalls, gatewaysحدود الجدران النارية
    1. 16Intrusion detection systemsأنظمة كشف التسلل
    1. 17الخلاصة