Network Security
Assigned to:
BHARGAVI H. GOSWAMI
Assistant Professor
Sunshine Group of Institutes
Faculty of MCA
Rajkot
Network Security
Essentials
Applications and Standards
Third Edition
William Stallings
Chapter 1
Introduction
Outline: Topics
1.
2.
3.
4.
5.
6.
7.
Security Trends
The OSI Security Architecture
Security Attacks
Security Services
Security Mechanisms
A Model for Internetwork Security
Internet Standards and the Internet
Society
Introduction:
• This book focuses on internet
security consisting of measures to
deter, prevent, detect & correct
security violations that involve
transmission of information.
Cases where security is
needed:
1. AB, C who is unauthorized monitor & capture
data during transmission.
2. D(Mngr)  E(Comp), F(Intruder)
adds/deletes/alters during transmission.
3. F(Intruder) alter message before reaching
from D to E.
4. Fired employee inserts delay on msgs of mngr
to reach system server to invalidate employee’s
account.
5. Customer sends msg to broker for purchase &
when share value degrades, denies his prior
transactions made with broker.
Internetwork Security is both,
Fascinating &
Complex
Reasons:
• Confidentiality, Authentication, Non-repudiation,
Integrity.
• Develop security mechanism or algo which always
consider potential attacks or security features,
exploiting unexpected weakness in algo.
• Procedures providing particular services are counter
intuitive.
• Imp to decide when & where to use designed algo or
security mechanism. i.e Physical or Logical layer.
• N no. of algo. Use encryption key at creation,
distribution & protection, time limits.
Information Security
• Requirements
– Computer Security (System Security)
– Network Security (Internet Security)
• Security Violations
1. Security Trends
• Internet Architecture Board (IAB)
– Issued report on “Security in the Internet
Architecture” (RFC 1636), in 1994.
– Report Stated: Internet needs more and better security
in areas like:
•
•
•
•
Unauthorized monitoring of n/w infrastructure.
Unauthorized control of n/w traffic over end users.
Authentication Mechanism.
Encryption Mechanism.
• Then Computer Emergency Response Team (CERT)
Coordination Center (CERT/CC) given Trends
Report for 10 years.
– Figure 1.1(a): Vulnerabilities in CERT Statistics
– Figure 1.2(b): Incidents in CERT Statistics
– Figure 1.2: Trends in Attack Sophistication and Intruder
Knowledge.
• Security related incidents reported
include
–
–
–
–
Denial of service attacks.
IP spoofing (IP based security attack)
Eavesdropping
Packet sniffing (read packet info)
• Final analysis say that: Attacks have
grown more sophisticated while skill &
knowledge required to mount an attack
has declined.
• Thus, wide range of technologies and
tools are needed to counter the growing
threat.
High
(Back Orifice)
Low
Conclusion:
• Over time, attacks have grown more
sophisticated while skill and
knowledge required to mount an
attack has declined.
2. The OSI Security
Architecture
• Requirement:
• To access effectively the security needs,
choose & evaluate security products &
Policies, systematic approach is needed.
• Solution? ITU-T2 Recommendation X.800,
Security Architecture for OSI.
• OSI Security Architecture focuses on
– Security Attacks
– Security Mechanisms
– Security Service
• Security Attack: Any action that
compromises the security of information.
• Security Mechanism: A mechanism that is
designed to detect, prevent, or recover
from a security attack.
• Security Service: A service that enhances
the security of data processing systems
and information transfers. A security
service makes use of one or more security
mechanisms.
• RFC.2828: Threats & Attacks ……
3. Security Attacks
• Use both, X.800 & RFC 2828
• Classified as:
– Passive Attacks
– Active Attacks
• 1. Passive Attacks
– Is the nature of eavesdroppers
– Goal: Obtain Information
– Types:
• Release of message contents (Fig 1.3 a)
• Traffic analysis (Fig 1.3 b)
– Solution?
– Mask content using encryption.
– Passive attacks are very difficult to detect
because they do not involve any alteration
of the data.
– How to deal with passive attacks?
– Prevention rather than detection.
• 2. Active Attacks
– Involve some modifications of the data
stream or creation of false stream.
– Categorized into:
•
•
•
•
Masquerade
Replay
Modification of message
Denial of service
Masquerade (1.4 a): One entity pretends to be a different
entity. Obtain extra privileges by impersonating an entity.
Replay (1.4 b): Passive capture of a data unit & its
Subsequent Retransmission.
Modification of Messages (1.4 c): Some portion of message
is altered eg: “Allow John Smith” altered to “Allow Darth”.
Denial of Service (1.4 d): Entity may suppress all messages
directed to particular destination.
• Conclusion:
• Prevention of active attacks is
difficult.
• So, goal should be to deter them & to
recover from any disruption or delays
caused by them.
• Deter needs detection, detection
contribute to prevention indirectly.
Security Goals (CIA)
Confidentiality
（機密性）
Integrity
Availability
（真確性）
（可取用性）
4. Security Services
•
X.800 defines a security service that is provided
by protocol layer of communicating open system.
• Security Service implement security policies and
are implemented by security mechanism.
• X.800 divides services into 5 categories and
fourteen specific services. (Table 1.2)
–
–
–
–
–
–
Data Confidentiality (privacy)
Authentication (who created or sent the data)
Data Integrity (has not been altered)
Non-repudiation (the order is final)
Access Control (prevent misuse of resources)
Availability (permanence, non-erasure)
• Denial of Service Attacks
• Virus that deletes files
Availability Service:
– Both X.800 & RFC2828 defined availability
property of system.
– System is available if it provides services
according to the system design whenever user
request them.
– Attacks results in loss of or reduction in
availability.
– Can be associated with services property.
– Address security concerns raised by denial-ofservices attacks.
– Depends upon:
• Management & Control of system resources
• Access control service.
5 Security Mechanisms
• Defined in X.800.
• Classification 1:
• 1. Reversible Encipherment Mechanism:
– Simply encryption algorithm.
– Allows data encryption & subsequent
decryption.
• 2. Irreversible Encipherment Mechanism:
– Include hash algorithms.
– Include message authentication codes.
– Used in digital signature & message
authentication application.
• Classification 2:
• 1. Specific Security Mechanisms
– May be incorporated into the
appropriate protocol layer in order to
provide some of the OSI security
services
• 2. Pervasive Security Mechanisms
– Mechanisms that are not specific to any
particular OSI security service or
protocol layer
X.800 indicates relationship between security services and
security mechanisms given in the following table.
6. A Model for Network
Security:
• The sender and receivers are Principals in
transaction and they should co-operate.
• Logical channel using TCP/IP is developed between
principals and needs security.
• Two components of technique providing security
are:
– Encryption of the message.
– Encryption Key.
• General model shows that there are four basic
tasks in designing a particular security service:
• Which four? Lets see...
• 1. Design an algorithm for performing
the security-related transformation.
The algorithm should be such that an
opponent cannot defeat its purpose.
• 2. Generate the secret information to
be used with the algorithm.
• 3. Develop methods for the distribution
and sharing of the secret information.
• 4. Specify a protocol to be used by the
two principals that makes use of the
security algorithm and the secret
information to achieve a particular
security service.
• Need? Protect information system from
unwanted access like...
• Human Attack:
– Hacker: Someone who with no malign intent,
simply gets satisfaction from breaking and
entering a computer system.
– Intruder: seeks to exploit computer assets for
financial gain.
• Software Attack:
– Virus & Worms: attacks can be introduced into
a system by means of a disk that contains the
unwanted logic concealed in otherwise useful
software.
• Solution? Defensive Methods
Methods of Defense
• Gate-Keeper function: It includes password-based
login procedures that are designed to deny access
to all but authorized users and screening logic
that is designed to detect and reject worms,
viruses, and other similar attacks. See next figure.
• System activity monitoring.
• Encryption
• Software Controls (access limitations in a data
base, in operating system protect each user from
other users)
• Hardware Controls (smartcard)
• Policies (frequent changes of passwords)
• Physical Controls
7. Internet Standards and
the Internet Society
• Protocols included in TCP/IP protocol suite are
standardized.
• Who standardize the developed technology and
publish?
• The Internet society.
• Is composed of
– Internet Architecture Board (IAB): Responsible far
defining the overall architecture of the Internet,
providing guidance and broad direction to the IETF.
– Internet Engineering Task Force (IETF): The protocol
engineering and development arm of the Internet.
– Internet Engineering Steering Group (IESG): Responsible
far technical management of IETF activities and the
Internet standards process
• IETF procedure:
– Working group will make a draft version of the
document available as an Internet Draft, which is
placed in the IETF's "Internet Drafts" online
directory.
– The document may remain as an Internet Draft for
up to six months, and interested parties may review
and comment on the draft.
– The working-group may subsequently publish a
revised version of the draft as RFC (Request for
Comment) which are the working notes of the
Internet research and development community.
– The IETF is responsible for publishing the RFCs,
with approvaI of the IESG.
– Table 1.6 shows the IETF areas and their focus.
The Standardization Process:
•
•
The decision of which RFCs become Internet
standards is made by the IESG, on the
recommendation of the IETF.
To become a standard, a specification must
meet the following criteria:
1. Be stable and well understood
2. Be technically competent
3. Have multiple, independent, and interoperable
implementations with substantial operational
experience.
4. Enjoy significant public support .
5. Be recognizably useful in some or all parts of the
Internet
• The left-hand side of Figure shows the series of
steps, called the standards track, that a specification
goes through to become a standard; this process is
defined in RFC 2026.
• IETF must make a recommendation for advancement
of the protocol, and the IESG must ratify it.
• The white boxes in Figure 1.5 represent temporary
states, used for small duration like 6 months.
• The gray boxes represent long-term states that may
be occupied for years.
• After significant implementation and operational
experience has been obtained,
• a specification may be elevated to Internet Standard.
At this point, the specification is assigned an STD
number as well as an RFC number.
• Finally, when a protocol becomes obsolete, it is
assigned to the Historic state.
Internet Standards Categories
• All Internet standards fall into one of two categories:
1. Technical specification (TS): A TS defines a protocol,
service, procedure, convention, or format. Most Internet
standards are TSs.
2. Applicability statement (AS): An AS specifies how, and
under what circumstances, one or more TSs may be applied
to support a particular Internet capability.
• An AS identifies one or more TSs that are relevant to the
capability, and may specify values or ranges for particular
parameters associated with a TS or functional subsets of a
TS that are relevant for the capability.
Other RFC Types
• There are numerous RFCs that are not destined to
become Internet standards.
• Such RFCs are designated as Best Current Practice
(BCP).
• Approval of BCPs follows essentially the same process
for approval of Proposed Standards.
• A three-stage process for BCPs;
– A BCP goes from Internet draft status to approved BCP
in one step.
– A protocol or other specification that is not considered
ready for standardization may be published as an
Experimental RFC. Specification may be resubmitted.
– When research appears to enjoy enough community
interest to be considered valuable, then the RFC will be
designated a Proposed Standard.
• Finally, an Informational Specification is published for
the general information of the Internet community.
Chapter is over…
• Thank You….
• Be regular otherwise your tension is
obviously going to increase as time
passes….
• Assignment Submission?????