Topic 8: Secure communication
in mobile devices
Choice of secure communication protocols, leveraging SSL for
remote authentication and using HTTPS for web traffic
• The rapid growth of the mobile devices as both individual and
business communication devices has created a growing demand for
security and privacy in this electronic communication channel.
• Both security and privacy are essential in mobile communication.
• The desire for security and privacy has led to several
communication security protocols and standards.
• Among these are:
–
–
–
–
–
–
Secure Socket Layer (SSL)
Transport Layer Security (TLS)
secure IP (IPSec);
Secure HTTP (S-HTTP),
secure E-mail ( PGP and S/MIME), DNDSEC, SSH,
others.
• We focus on three communication layers:
– Application Layer:
•
•
•
•
•
•
PGP
S/MIME
S-HTTP
HTTPS
SET
KERBEROS
– Transport Layer:
• SSL
• TLS
– Network Layer:
• IPSec
• VPN
• Secure Socket Layer (SSL)
– SSL is a widely used general purpose
cryptographic system used in Internet browsers
and mobile communication.
– It provides an encrypted end-to-end data path
between a client and a server regardless of
platform or OS.
– Secure and authenticated services are provided
through data encryption, server authentication,
message integrity, and client authentication for a
TCP connection through HTTP, LDAP or POP3
application layers.
– It rivals S-HTTP
• The SSL Handshake
– Before any TCP connection between a client and a serve, both
running under SSL, is established, there must be almost a
process similar to a three-way handshake. This get-to-know-you
process, is similarly called the SSL handshake. During the
handshake, the client and server perform the following tasks:
• Establish a cipher suite to use between them.
• Provide mandatory server authentication through the server sending
its certificate to the client to verify that the server's certificate was
signed by a trusted CA.
• Provide optional client authentication, if required, through the client
sending its own certificate to the server to verify that the client's
certificate was signed by a trusted CA.
• Exchange key information using public key cryptography, after mutual
authentication, that leads to the client generating a session key
(usually a random number) which, with the negotiated cipher, is used
in all subsequent encryption or decryption. The customer encrypts
the session key using the public key of the merchant server (from the
merchant’s certificate). The server recovers the session key by
decrypting it using the its private key. This symmetric key which now
both parties have is used in all subsequent communication.
• Secure-HTTP (S-HTTP)
– Secure HTTP (S-HTTP) extends the Hypertext
Transfer Protocol (HTTP).
– When HTTP was developed, it was developed for a
Web that was simple, that did not have dynamic
graphics, that did not require, at that time, hard
encryption for end-to-end transactions that have
since developed.
– As the Web became popular for businesses users
realized that current HTTP protocols needed more
cryptographic and graphic improvements if it were
to remain the e-commerce backbone it had
become.
Validation of server privilege boundary
in networked applications
•
Server side validation offers more security over data than client side validation.
– Client side validation can easily be tempered with.
– Server side validation eliminates this security breach
•
Without strong and effective validation leaveweb application vulnerable to:
– cross-site scripting attacks,
– SQL injection attacks,
– buffer overflows,
– other types of input attack.
•
Consider the following guidelines when designing a validation strategy:
–
–
–
–
–
–
Identify trust boundaries within Web application layers, and validate all data crossing these
boundaries.
Assume that all client-controlled data is malicious and needs to be validated.
Design validation strategy to constrain, reject, and sanitize malicious input.
Design to validate input for length, range, format, and type.
Use client-side validation for user experience, and server-side validation for security.
Use certificates and avoiding man-in-the-middle
• Cryptography guarantees basic security services authorization,
authentication, integrity, confidentiality, and non-repudiation in all
communications and data exchanges in the new information
society. These guarantees are achieved as follows:
– Confidentiality - through encryption
– Authentication - through digital signatures and digital certificates
– Integrity - through generating a digital signature with a public key
and obtain the message digest. Then hashing the message to obtain a
second digest. If the digests are identical, the message is authentic
and the signer’s identity is proven.
– Non-repudiation - through digital signatures of a hashed message
then encrypting the result with the private key of the sender, thus
binding the digital signature to the message being sent
– Non-replay – through encryption, hashing, and digital signature
• The Key Exchange Problem in communication
– Although symmetric encryption is commonly used in
communication due to its historical position in the
cryptography and its speed, it suffers from a serious
problem of how to safely and secretly deliver a secret
key from the sender to the recipient.
– This problem forms the basis for the key exchange
problem. The key exchange problem involves:
• ensuring that keys are exchanged so that the sender and
receiver can perform encryption and decryption,
• ensuring that an eavesdropper or outside party (man-in-the
middle) cannot break the code,
• ensuring the receiver that a message was encrypted by the
sender.
• For the distribution of public keys, there were
several solutions including:
– Public announcements where any user can broadcast
their public keys or send them to selected individuals
– Public directory which is maintained by a trusted
authority. The directory is usually dynamic to
accommodate additions and deletions
– Certificate Authority (CA) to distribute certificates to
each communicating element. Each communicating
element in a network or system communicates
securely with the CA to register its public key with
the CA. Since public keys are already in public arena,
the registration may be done using a variety of
techniques including the postal service.