Lecture III :
Communication Security, Services & Mechanisms
Internet Security: Principles & Practices
John K. Zao, PhD SMIEEE
National Chiao-Tung University
Fall 2005
Internet Security - ComSec Services & Mechanisms
2
Fall 2005
What is Communication Security?
To provide safe communication over unsafe medium
Alice
Bob
Eve
 Safe Communication
 Alice can send a message to Bob that only Bob can understand
 Confidentiality
 Nobody can tamper with message content during communication
 Integrity
 Bob can know for sure it was Alice who sent the message
 Authentication
 Unsafe Medium
 Medium over which passive and active attacks are possible
Internet Security - ComSec Services & Mechanisms
3
Outline
 What types of services do we need to protect
communication?
 What kinds of mechanisms do we use to protect
communication?
Fall 2005
4
Internet Security - ComSec Services & Mechanisms
Fall 2005
ISO 7498-2 : Security Framework Architecture
 Security Services
 Service Types
 Service Layer Mapping
 Security Mechanisms
 Mechanism Definition
 Service - Mechanism Mapping
Internet Security - ComSec Services & Mechanisms
5
Communication Security Services
 Confidentiality
 Data Confidentiality
 Traffic Confidentiality
 Data Integrity
Primary Services
 Authentication
 Data Origin Authentication
 Peer Authentication
 Access Control
 Non-Repudiation
 Non-Repudiation of Origin
 Non-Repudiation of Reception
 Audit
 Availability – an after-thought but increasingly important
Note: all services are defined here in context of Communication Security
Fall 2005
6
Internet Security - ComSec Services & Mechanisms
Fall 2005
Confidentiality
Protection of information from disclosure to unauthorized entities
(organizations, people, machines, processes).
Information includes data contents, size, existence, communication
characteristics, etc.
Service Types
 Data Confidentiality / Disclosure
Protection
 Connection Oriented
 Connectionless
 Selective Field
 Traffic Flow Confidentiality
 Origin Destination Association
 Message Size
 Transmission Patterns
 Accompanied with Data Integrity
Protection Mechanisms
 Data Encryption
 Symmetric (Secret-Key)
 Asymmetric (Public-Key)
7
Internet Security - ComSec Services & Mechanisms
Fall 2005
Integrity
Protection of data against creation, alteration, deletion, duplication, reordering by unauthorized entities (organizations, people, machines,
processes).
Integrity violation is always caused by active attacks.
Service Types
 Message Integrity
 Associated with
connectionless communication
 Message Stream Integrity
 Associated with
connection oriented communication
Protection Mechanisms
 Message Digests (Hashing)
 Sequence Numbers
 Nonce ID (Random Number)
 Time Stamps
8
Internet Security - ComSec Services & Mechanisms
Fall 2005
Authentication
Communicating entities are provided with assurance & information of
relevant identities of communicating partners (people, machines,
processes).
Personnel Authentication requires special attention.
Service Types
 Data Origin Authentication
 Associated with
Connectionless Communication
 Peer Entity Authentication
 Associated with
Connection Oriented Communication
 Fundamental for access control
hence, confidentiality & integrity
Protection Mechanisms
 Password
 Manual
 One-Time Password
 Key Sharing
 Manual
 Symmetric Key (Tickets)
 Asymmetric Key (Certificates)
 Challenge – Response
 Nonce Based
 Zero Knowledge Proof
Internet Security - ComSec Services & Mechanisms
9
Fall 2005
Access Control
Protection of information resources or services from access or use by
unauthorized entities (organizations, people, machines, processes).






Privileges – rights to access or use resources or services
Principles – entities own access control privileges
Subjects – entities exercise access control privileges
Objects / Targets – resources or services accessed/used by subjects
Delegation – transfer of access control privileges among principals
Authorization – transfer of access control privileges from principals to subjects
Service Types
 Subject Based Typing
 Identity Based
 Role Based
 Enforcement Based Typing
 Mandatory Access Control
― Management Directed
 Discretionary Access Control ―
Resource Owner Directed
Protection Mechanisms
 Access Control Lists (ACLs)
 Object Based Specification
Ex.: UNIX File System
 Capabilities
 Subject Based Specification
 Issue Tickets/Certificates
10
Internet Security - ComSec Services & Mechanisms
Fall 2005
Non-Repudiation
Protection against denial of participation by communicating entities in
all or part of a communication.
Service Types
 Non-Repudiation of Origin
 Non-Repudiation of Reception
Protection Mechanisms
 Notarization
 Time Stamp
 Digital Signature
Internet Security - ComSec Services & Mechanisms
11
Fall 2005
Audit
Recording & analyses of participation, roles and actions in information
communication by relevant entities.
Service Types
 Off-line Analysis
(Computer Forensic)
 On-line Analysis
(Real-time Intrusion Detection)
Protection Mechanisms
 “Syslog”
 Intrusion Monitors / Sensors
 Common Intrusion Detection
Framework (CIDF)
 Common Information Model
(CIM)
Internet Security - ComSec Services & Mechanisms
12
Fall 2005
Layers of Protocol Protection
APPLICATION
MSP, PEM
KEY MGMT
PRESENTATION
SESSION
TRANSPORT
NETWORK
TLSP
NLSP, IPSP
DATA LINK
SILS
PHYSICAL
Secure Signaling
Security Protection is provided in
multiple protocol layers.
13
Internet Security - ComSec Services & Mechanisms
Fall 2005
Service vs. Layer Mapping
Service / Layer
1
Confidentiality, Connectionless
Confidentiality, Connection
Y
2
3
4
Y
Y
Y
Y
Y
Y
Y
Y
Confidentiality, Selected Field
Confidentiality, Traffic Flow
6
Y
Y
Authentication, Data Origin
7
Y
Y
?
Authentication, Peer Entity
Y
Y
Y
Y
Y
Y
Integrity, Message
Y
Y
Y
Y
Integrity, Message Stream
?
Y
Y
Y
Access Control
?
Y
Y
Y
Non-Repudiation, Origin
Y
Non-Repudiation, Receipt
Y
? = difference between IEEE802 and ISO
14
Internet Security - ComSec Services & Mechanisms
ISO 7498-2 : Security Architecture
 Security Services
 Service Types
 Service Layer Mapping
 Security Mechanisms
 Mechanism Definition
 Service - Mechanism Mapping
Fall 2005
15
Internet Security - ComSec Services & Mechanisms
Security Mechanisms
 Encipherment – with Secret / Public Key Cryptography
 Data Integrity – with One-Way Hash Function
 Authentication – with Public-Key Challenge/Response
 Access Control
 Digital Signature – with Public-Key Cryptography
 Traffic Padding
 Notarization
Fall 2005
Internet Security - ComSec Services & Mechanisms
16
Fall 2005
Symmetric / Secret Key Encipherment
Algorithms use same keys for encryption & decryption :
 Symmetric / Secret Key must be dispatched in secret
 Used for bulk encryption / decryption
Also used in following security services :
 Authentication
Random
Number
Generator
Clear
Text
Symmetric
Key
Encryption
Engine
Cipher
Text
Symmetric
Key
Clear
Decryption Text
Engine
Internet Security - ComSec Services & Mechanisms
17
Fall 2005
Asymmetric / Public Key Encipherment
Algorithms use different keys for encryption & decryption
 Public Key is disclosed but Private Key is kept secret
 Computationally intensive - based on large prime numbers
Also used in following security services :
 Digital Signatures
 Authentication
 Key Exchange
Public Key
Clear
Text
Encryption
Engine
Cipher
Text
Private Key
Decryption
Engine
Clear
Text
Internet Security - ComSec Services & Mechanisms
18
Fall 2005
Data Encryption & Key Distribution
Public
Key
Private
Key
Encryption
Engine
{
Symmetric
Key
Random
Number
Generator
Clear
Text
Symmetric
Key
Encryption
Engine
Cipher
Text
Decryption
Engine
Symmetric
Key
Decryption
Engine
Clear
Text
Internet Security - ComSec Services & Mechanisms
19
Fall 2005
Message Digest or Hash
Message Originator
Message
Computes a fixed-length message digest from the
message using a one-way hash transformation
Message Recipient
MD5
Digest
Validate message integrity by computing the
message hash and comparing with the message
digest
Internet Security - ComSec Services & Mechanisms
20
Fall 2005
Challenge-Response Authentication
 Challenger sends a challenge of random number to Responder
 Responder creates a response by digitally signing the challenge with its
private key and returns the response to the Challenger
 Challenger processes the response with public key of legitimate Responder
and compare it with original challenge
Random
Number
Generator
Decryption
Engine
Challenge
Private
Key
Response
Same?
=
Challenge (Recovered)
Encryption
Engine
Public
Key
Internet Security - ComSec Services & Mechanisms
21
Fall 2005
Digital Signature
Message
Signature is public-key encrypted hash of a
document and its relevant parameters
MD5
Message
Signed
Document
Private
Key
Hash
Decryption
Engine
Digital
Signature
Internet Security - ComSec Services & Mechanisms
22
Fall 2005
Digital Signature Validation
Message recipients can validate the signature by “encrypting it”
with the public key and comparing with document’s hash value
Signed
Document
MD5
Message
Public
Key
Digital
Signature
Encryption
Engine
Hash
=
Hash
Valid?
23
Internet Security - ComSec Services & Mechanisms
Fall 2005
Service - Mechanism Mapping
Single security services may need to be implemented by multiple and
different security mechanisms.
Service: Data Confidentiality
 Mechanism [1]: Encipherment
Service: Peer Authentication
 Mechanism [1]: Challenge+Response
 Symmetric (Secret-Key) Cipher
 Nonce (Random Number) Based
 Asymmetric (Public-Key) Cipher
 Zero-Knowledge Proof
 Mechanism [2]: Integrity
 Message Digest / Digital Hash
 Mechanism [3]: Key Management
 Key Distribution Centers
(Secret-Key)
 Public Key Infrastructure
(Public-Key)
 Manual Keying
 Mechanism [2] Integrity
 Message Digest / Digital Hash