1502543 - Network Security
and Cryptography
Dr. Ala Altaweel
University of Sharjah
1
Course Description
• This course covers theory and practice of
cryptographic techniques used in computer security.
Topics include Encryption (secret-key and public-key)
and privacy, Secure authentication, Network and
Internet Security, Key management, Cryptographic
hashing and data integrity (Digital signatures),
Wireless network security.
• Through study of theory and exploration and more practical
application of technologies and techniques
2
Basic Course Information and Students’ Assessment:
• Instructor:
• Dr. Ala Altaweel
• Office Hours: TBA @ M5 222
• Email: aaltaweel@sharjah.ac.ae
• Make an appointment if necessary
• Textbook:
-
William Stallings, “Cryptography and Network Security: Principles and Practices”, Prentice-Hall, 2017.
-
Security in Computing 5th Edition, by Charles P. Pfleeger, Shari Lawrence Pfleeger, Jonathan Margulies
2015.
Assessment Tool(s)**
Class participation
Assignments
Mid semester evaluation
Final project presentation (group)
Written final evaluation
Total
Date
Through the term
Through the term
Week8
Week 15
Week16
Weight (%)
5
10
25
20
40
100
3
Networking Review: roadmap
Lecture goal:
• Get “feel,” “big picture,”
“Refresh”
• more depth, already
covered during computer
network course!
Overview/roadmap:
• What is the Internet? What is a
protocol?
• Network edge: hosts, access network,
physical media
• Network core: packet/circuit switching,
internet structure
• Protocol layers, service models
4
The Internet: a “nuts and bolts” view
Billions of connected
computing devices:
mobile network
national or global ISP
 hosts = end systems
 running network apps at
Internet’s “edge”
Packet switches: forward
packets (chunks of data)
 routers, switches
Communication links
local or
regional
ISP
Internet
home network
 fiber, copper, radio, satellite
 transmission rate: bandwidth
Networks
 collection of devices, routers, links:
managed by an organization
content
provider
network
datacenter
network
enterprise
network
5
“Fun” Internet-connected devices
Tweet-a-watt:
monitor energy use
bikes
Pacemaker & Monitor
Amazon Echo
IP picture frame
Web-enabled toaster +
weather forecaster
Internet
refrigerator
Security Camera
cars
Slingbox: remote
control cable TV
AR devices
sensorized,
bed
mattress
Internet phones
Gaming devices
scooters
Others?
Fitbit
6
The Internet: a “nuts and bolts” view
mobile network
Internet: “network of networks”
•
4G
national or global ISP
• Interconnected ISPs

protocols are everywhere
control sending, receiving of
messages
• e.g., HTTP (Web), streaming video,
Skype, TCP, IP, WiFi, 4G, Ethernet
•

Internet standards
• RFC: Request for Comments
• IETF: Internet Engineering Task
Force
Streaming
video
IP
Skype
local or
regional
ISP
home network
content
provider
network
HTTP
datacenter
network
Ethernet
TCP
enterprise
network
WiFi
7
The Internet: a “services” view
•
Infrastructure that provides
services to applications:
• Web, streaming video, multimedia
teleconferencing, email, games, ecommerce, social media, interconnected appliances, …

provides programming interface
to distributed applications:
• “hooks” allowing
sending/receiving apps to
“connect” to, use Internet
transport service
• provides service options,
analogous to postal service
mobile network
national or global ISP
Streaming
video
Skype
local or
regional
ISP
home network
HTTP
content
provider
network
datacenter
network
enterprise
network
8
What’s a protocol?
Human protocols:
Network protocols:

“what’s the time?”

computers (devices) rather than humans

“I have a question”


introductions
all communication activity in Internet
governed by protocols
Rules for:
… specific messages sent
… specific actions taken
when message received,
or other events
Protocols define the format, order of
messages sent and received
among network entities, and
actions taken on message
transmission, receipt
9
What’s a protocol?
A human protocol and a computer network protocol:
Hi
TCP connection
request
Hi
TCP connection
response
Got the
time?
GET http://sharjah.ac.ae/en/Pages/default.aspx
2:00
<file>
time
Q: other human protocols?
10
Networking Review: roadmap
• What is the Internet?
• What is a protocol?
• Network edge: hosts, access
network, physical media
• Network core: packet/circuit
switching, internet structure
11
A closer look at Internet structure
mobile network
Network edge:
national or global ISP
• hosts: clients and servers
• servers often in data centers
local or
regional
ISP
home network
content
provider
network
datacenter
network
enterprise
network
12
A closer look at Internet structure
mobile network
Network edge:
national or global ISP
• hosts: clients and servers
• servers often in data centers
Access networks, physical
media:
local or
regional
ISP
home network
• wired, wireless communication
links
content
provider
network
datacenter
network
enterprise
network
13
A closer look at Internet structure
mobile network
Network edge:
national or global ISP
• hosts: clients and servers
• servers often in data centers
local or
regional
ISP
Access networks, physical media:
• wired, wireless communication links
home network
Network core:
 interconnected routers
 network of networks
content
provider
network
datacenter
network
enterprise
network
14
Access networks and physical media
Q: How to connect end systems to
edge router?
•
•
•
mobile network
national or global ISP
residential access nets
institutional access networks (school,
company)
mobile access networks (WiFi, 4G/5G)
local or
regional
ISP
home network
content
provider
network
datacenter
network
enterprise
network
15
Access networks: home networks
Wireless and wired
devices
to/from headend or
central office
often combined
in single box
cable or DSL modem
WiFi wireless access
point (54, 450
Mbps)
router, firewall, NAT
wired Ethernet (1 Gbps)
16
Access networks: enterprise networks
Enterprise link to
ISP (Internet)
institutional router
Ethernet
switch
institutional mail,
web servers
 companies, universities, etc.
 mix of wired, wireless link technologies, connecting a mix of switches
and routers
 Ethernet: wired access at 100Mbps, 1Gbps, 10Gbps
 WiFi: wireless access points at 11, 54, 450 Mbps
17
Access networks: data center networks
 high-bandwidth links (10s to 100s
Gbps) connect hundreds to thousands
of servers together, and to Internet
mobile network
national or global ISP
local or
regional
ISP
home network
Courtesy: Massachusetts Green High Performance Computing
Center (mghpcc.org)
content
provider
network
datacenter
network
enterprise
network
18
Host: sends packets of data
host sending function:
 takes application message
 breaks into smaller chunks,
known as packets, of length L bits
 transmits packet into access
network at transmission rate R
• link transmission rate, aka link
capacity, aka link bandwidth
packet
transmission
delay
=
time needed to
transmit L-bit
packet into link
two packets,
L bits each
2 1
host
R: link transmission rate
L (bits)
=
R (bits/sec)
19
Links: physical media
 bit: propagates between
transmitter/receiver pairs
 physical link: what lies
between transmitter &
receiver
 guided media:
• signals propagate in solid
media: copper, fiber, coax
 unguided media:
• signals propagate freely,
e.g., radio
Twisted pair (TP)
 two insulated copper wires
• Category 5: 100 Mbps, 1 Gbps Ethernet
• Category 6: 10Gbps Ethernet
20
Links: physical media
Coaxial cable:
Fiber optic cable:
 two concentric copper conductors
 glass fiber carrying light pulses, each
pulse a bit
 high-speed operation:
• high-speed point-to-point
transmission (10’s-100’s Gbps)
 low error rate:
• repeaters spaced far apart
• immune to electromagnetic noise
 bidirectional
 broadband:
• multiple frequency channels on cable
• 100’s Mbps per channel
21
Networking Review: roadmap
• What is the Internet?
• What is a protocol?
• Network edge: hosts, access
network, physical media
• Network core: packet/circuit
switching, internet structure
• Protocol layers, service models
22
The network core
• mesh of interconnected routers
• packet-switching: hosts break
application-layer messages into
packets
• network forwards packets from one
router to the next, across links on
path from source to destination
mobile network
national or global ISP
local or
regional
ISP
home network
content
provider
network
datacenter
network
enterprise
network
23
Two key network-core functions
Routing:
routing algorithm
Forwarding:
 global action:
determine sourcedestination paths
taken by packets
 routing algorithms
local forwarding table
• aka “switching”
• local action: move
arriving packets
from router’s
input link to
appropriate router
output link
header value
0100
0101
0111
1001
output link
3
2
2
1
1
3 2
destination address in arriving
packet’s header
24
routing
25
forwarding
forwarding
26
Packet-switching: store-and-forward
L bits
per packet
source
3 2 1
R bps
R bps
destination
• packet transmission delay: takes L/R seconds to
transmit (push out) L-bit packet into link at R bps
• store and forward: entire packet must arrive at
router before it can be transmitted on next link
27
Packet-switching: queueing
R = 100 Mb/s
A
B
C
R = 1.5 Mb/s
D
E
queue of packets
waiting for transmission
over output link
Queueing occurs when work arrives faster than it can be serviced:
Packet loss?!
28
Alternative to packet switching: circuit switching
end-end resources allocated to,
reserved for “call” between source
and destination
• in diagram, each link has four circuits.
• call gets 2nd circuit in top link and 1st
circuit in right link.
• dedicated resources: no sharing
• circuit-like (guaranteed) performance
• circuit segment idle if not used by call (no
sharing)
 commonly used in traditional telephone networks
29
Networking Review: roadmap
• What is the Internet?
• What is a protocol?
• Network edge: hosts, access
network, physical media
• Network core: packet/circuit
switching, internet structure
• Protocol layers, service models
30
Protocol “layers” and reference models
Networks are complex,
with many “pieces”:
 hosts
 routers
 links of various media
 applications
 protocols
 hardware, software
Question: is there any
hope of organizing
structure of network?
and/or our discussion
of networks?
31
Example: organization of air travel
end-to-end transfer of person plus baggage
ticket (purchase)
ticket (complain)
baggage (check)
baggage (claim)
gates (load)
gates (unload)
runway takeoff
runway landing
airplane routing
airplane routing
airplane routing
How would you define/discuss the system of airline travel?
 a series of steps, involving many services
32
Example: organization of air travel
ticket (purchase)
ticketing service
ticket (complain)
baggage (check)
baggage service
baggage (claim)
gate service
gates (unload)
runway takeoff
runway service
runway landing
airplane routing
routing service
airplane
routing
airplane routing
gates (load)
layers: each layer implements a service
 via its own internal-layer actions
 relying on services provided by layer below
33
Why layering?
Approach to designing/discussing complex systems:
 explicit structure allows identification,
relationship of system’s pieces
• layered reference model for discussion
 modularization eases maintenance,
updating of system
• change in layer's service implementation:
transparent to rest of system
• e.g., change in gate procedure doesn’t
affect rest of system
34
Layered Internet protocol stack
 application: supporting network applications
• HTTP, IMAP, SMTP, DNS
 transport: process-process data transfer
• TCP, UDP
 network: routing of datagrams from source to
destination
• IP, routing protocols
 link: data transfer between neighboring
network elements (i.e., 1-hop)
• Ethernet, 802.11 (WiFi), PPP
application
application
transport
transport
network
link
physical
 physical: bits “on the wire”
35
Services, Layering and Encapsulation
application
transport
network
link
physical
source
M
Application exchanges messages to
implement some application service
Ht of
M transport layer
using services
Transport-layer protocol transfers M
(e.g., reliably) from one process to
another, using services of network layer
 transport-layer protocol encapsulates
application-layer message, M, with
transport layer-layer header Ht to
create a transport-layer segment
• Ht used by transport layer protocol
to implement its service
application
transport
network
link
physical
destination
36
Services, Layering and Encapsulation
M
application
transport
network
link
physical
source
Ht
M
Transport-layer protocol transfers M
(e.g., reliably) from one process to
M
n Ht
another, using Hservices
of network layer
Network-layer protocol transfers
transport-layer segment [Ht | M] from
one host to another, using link layer
services
 network-layer protocol encapsulates
transport-layer segment [Ht | M] with
network layer-layer header Hn to
create a network-layer datagram
• Hn used by network layer protocol to
implement its service
application
transport
network
link
physical
destination
37
Services, Layering and Encapsulation
M
application
transport
network
link
physical
source
application
Ht
M
transport
Hn Ht
M
network
Network-layer protocol transfers
transport-layer
segment [Ht | M] from
Hl Hn Ht M
one host to another, using link layer
Link-layer protocol
transfers datagram
services
[Hn| [Ht |M] from host to neighboring
host, using physical-layer services
 link-layer protocol encapsulates
network datagram [Hn| [Ht |M], with linklayer header Hl to create a link-layer
frame
link
physical
destination
38
Services, Layering and Encapsulation
M
application
message
transport
M
application
Ht
M
transport
Ht
M
Hn Ht
M
Hn Ht
M
network
Hl Hn Ht
M
Hl Hn Ht
M
link
segment
network
datagram
link
frame
physical
source
physical
destination
39
Encapsulation: an
end-end view
source
M
application
Ht
M
datagram Hn Ht
M
Hl Hn Ht
M
transport
network
link
physical
message
segment
frame
link
physical
switch
destination
M
application
Ht
M
Hn Ht
M
Hl Hn Ht
M
transport
network
link
physical
Hn Ht
M
Hl Hn Ht
M
network
link
physical
Hn Ht
M
router
40
Chapter 1
Overview
42
Security: overview
Lecture goals:
 understand principles of network security:
• cryptography and its many uses beyond “confidentiality”
• authentication
• message integrity
 security in practice:
• firewalls and intrusion detection systems
• security in application, transport, network, link layers
43
Computer Security
• The NIST* Computer Security Handbook defines the
term computer security as:
“the protection afforded to an automated
information system in order to attain the
applicable objectives of preserving the
integrity, availability and confidentiality of
information system resources” (includes
hardware, software, firmware, information/
data, and telecommunications)
* National Institute of Standards and Technology, USA
44
What is network security?
confidentiality: only sender, intended receiver should “understand”
message contents
• sender encrypts message
• receiver decrypts message
authentication: sender, receiver want to confirm identity of each
other
message integrity: sender, receiver want to ensure message not
altered (in transit, or afterwards) without detection
access and availability: services must be accessible and available to
users
46
Friends and enemies: Alice, Bob, Trudy
 well-known in network security world
 Bob, Alice (friends!) want to communicate “securely”
 Trudy (intruder) may intercept, delete, add messages
channel data, control
Alice
data
Bob
messages
secure
sender
secure
receiver
data
Trudy
47
Friends and enemies: Alice, Bob, Trudy
Who might Bob and Alice be?
 … well, real-life Bobs and Alices!
 Web browser/server for electronic transactions (e.g., on-line purchases)
 on-line banking client/server
 DNS servers
 BGP routers exchanging routing table updates
 other examples?
48
There are bad guys (and girls) out there!
Q: What can a “bad guy” do?
A: A lot!
• eavesdrop: intercept messages
• actively insert messages into connection
• impersonation: can fake (spoof) source address in packet (or any
field in packet)
• hijacking: “take over” ongoing connection by removing sender or
receiver, inserting himself in place
• denial of service: prevent service from being used by others (e.g.,
by overloading resources)
49
most of the protocols are mixed of first two, asymmetric used to share the keys, then symmetric
Cryptographic algorithms and protocols can be
grouped into four main areas:
Symmetric encryption
The key is the same for both
• Used to conceal the contents of blocks or streams of data of any size,
including messages, files, encryption keys, and passwords
Asymmetric encryption
The key is not the same
It is time costly
• Used to conceal small blocks of data, such as encryption keys and hash
function values, which are used in digital signatures
Data integrity algorithms
• Used to protect blocks of data, such as messages, from alteration
Authentication protocols
• Schemes based on the use of cryptographic algorithms designed to
authenticate the identity of entities
50
Authentication
Impersonate
Do the same action again & authentication
Confidentiality and
Integrity
Availability
One way authentication or (data origin): like home wifi that require a password
Peer: like two factor authentication
: mutual authentication
Secret key