1 / 149

CIS/TCOM 551 Computer and Network Security Slide Set 6

CIS/TCOM 551 Computer and Network Security Slide Set 6. Carl A. Gunter Spring 2004. Public Key Infrastructure. Mutual authentication of participants in a transaction requires a system of identities. Principals are identified by public keys.

nenet
Download Presentation

CIS/TCOM 551 Computer and Network Security Slide Set 6

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CIS/TCOM 551Computer and Network SecuritySlide Set 6 Carl A. Gunter Spring 2004

  2. Public Key Infrastructure • Mutual authentication of participants in a transaction requires a system of identities. • Principals are identified by public keys. • These keys can be used for authentication, but only if “spoofing” is prevented. • A PKI provides a basis for establishing trust.

  3. PKI Systems • ITU X.509 (viz. IETF PKIX). • PGP “web of trust”. • DNS sec.

  4. X.509 • Part of the X.500 series of standards: the ISO/ITU Directory. • Originally intended to support access control for the directory as part of the Directory Access Protocol (DAP). • Dominant candidate now for PKI to support electronic commerce, although adoption has been slow.

  5. Subject Name Subject Public Key CA Name CA Signature X.509 Certificates X.509 certificates bind a subject to a public key. This binding is signed by a Certificate Authority (CA). Subject Name Subject Public Key CA Name CA Signature

  6. Joe Smith Subject Joe’s Key Subject’s Key Philly CA Issuer Philly CA Philly CA Key Pennsylvania CA Pennsylvania CA Pennsylvania CA Key USA CA Chaining

  7. Certificate Distribution • Certificate accompanying signature. • Directory service. • DAP. • LDAP. • DNS SEC. • Email (S/MIME and MOSS). • Primary technique: cut and paste from web pages!

  8. X.509 Certificate Format (v3) • Required fields. • Optional fields.

  9. Required Fields • Version of format (1,2, or 3 currently). • Serial number. • Signature algorithm identifier. Examples: • DSS with SHA hash. • RSA with MD5 hash. • Issuer (CA) X.500 name. • Validity period (start and expiry times).

  10. Required Fields, Continued • Subject X.500 name. • Subject public key information. • Algorithm identifier. • Public key value. • Issuer signature.

  11. Optional Fields • Issuer unique identifier. • Subject unique identifier. • Extensions. • Extension type. • Critical/Non-critical. • Extension field value.

  12. Certificate Revocation Lists • Sometimes it is necessary to terminate certificates before their expiration time. • How does the relying party know that the certificate has been revoked? • Mitre report for NIST suggests certificate revocation will be the largest maintenance cost for PKI’s. • Many distribution strategies proposed.

  13. Semantics of CRL’s • Three certificates. • Q says P is the public key of Alice. • R says P is the public key of Alice. • Q says R is the public key of Bob. • Three kinds of revocation. • P is not the public key of Alice. (3 not 2.) • Q no longer vouches for whether P is the public key of Alice. (2 and 3.) • The key of Q has been compromised. (2 not 3.) Revoke 1998 Fox and LaMacchia

  14. Problems Revocation User ability to deal with keys Registration (challenge for all authentication techniques) Weak business model Areas of Progress SSL Authenticode SSH Smart cards for government employees Web services Adoption of PKI

  15. Overview of Network Security • Challenges: • Sharing • Complexity • Scale • Unknown perimeter • Many points of attack • Anonymity • Unknown paths

  16. Physical Link Network Transport Application Security in Layers

  17. Physical Spread spectrum Tempest Link WEP GSM Network Firewalls IPSec Transport SSL and TLS Application S/MIME XMLDSIG and WS security Access control systems for web pages, databases, and file systems Examples

  18. Network Layer Security HTTP FTP SMTP TCP IP/IPSec

  19. Transport Layer Security HTTP FTP SMTP SSL or TLS TCP IP

  20. Application Layer Security PGP SET S/MIME Kerberos SMTP HTTP TCP UDP IP

  21. Division of Labor in the Internet Hosts Routers Networks

  22. TCP/IP Protocol Stack Host Router Router Host Application Application Transport Transport Network Network Network Network Link Link Link Link Physical Physical Physical Physical

  23. Communication Processing Flow App1 App2 App1 App2 Transport Transport Network Network Network Network Link Link Link Link Link Link Physical Phys Phys Phys Phys Physical

  24. Typical Patchwork App1 App2 App1 App2 Transport Transport Network Network Network Network Link Link Link Link Link Link Physical Phys Phys Phys Phys Physical

  25. Physical Layer Protection Issues • Hide signal • Spread spectrum • Emission security • Radio emissions (Tempest) • Power emissions

  26. Encapsulation Link Layer Frame IP TCP Application Link Link Network Layer Header Transport Layer Header Application Layer Payload

  27. One Hop Link Layer Encryption Host Router Router Host Application Application Transport Transport Network Network Network Network Link Link Link Link Link Link

  28. Link Layer Encryption Encrypted IP TCP Application Link Link

  29. End-to-End Network Security Host Router Router Host Application Application Transport Transport Network Network Network Network Link Link Link Link

  30. Network Layer Transport Mode IP TCP Application Link Link Encrypted IP Hdr TCP Application Tlr Link Link Link

  31. VPN Gateway Host Router Router Host Application Application Transport Transport Network Network Network Network Link Link Link Link

  32. Network Layer Tunnel Mode IP TCP Application Link Link Encrypted New IP Hdr IP TCP Application Tlr Link Link

  33. Layer 3 Implementation Options • Location • Host • Network • Style • Integrated • Modular (for tunnel mode)

  34. Modular Implementation:Bump In The Stack (BITS) App1 App2 App1 App2 Transport Network Transport Security Network Net + Sec Network Link Link Link Link

  35. Modular Implementation:Bump In The Wire (BITW) App1 App2 App1 App2 Transport Security Security Transport Network Network Network Network Link Link Link Link

  36. Implementation Options:Integrated on Host App1 App2 App1 App2 Transport Transport Net + Sec Network Network Net + Sec Link Link Link Link

  37. Implementation Options:Integrated on Router App1 App2 App1 App2 Transport Transport Network Net + Sec Net + Sec Network Link Link Link Link

  38. Network Security Location Options Application Application End-to-End Transport Transport Transport Network Network Network Network Link Link Link Link Application Application Transport Transport Voluntary Tunnel Network Network Network Network Link Link Link Link Application Application Transport Transport Involuntary Tunnel Network Network Network Network Link Link Link Link

  39. Transport Layer Security Host Router Router Host Application Application Transport Transport Network Network Network Network Link Link Link Link

  40. Transport Layer Encryption IP TCP Application Link Link Encrypted IP TCP RH Application Link Link IP TCP App Link Link

  41. Message Processing Sequence App1 App2 App1 App2 App2 Sec App2 Sec Transport Transport Network Network Network Network Link Link Link Link

  42. IP TCP Application Link Link Application Layer Security Encrypted IP Key ID TCP Application Link Link

  43. Link Layer Security • Advantages: • Transparent to applications. • Hardware solution possible. • Can address especially vulnerable links (viz. wireless). • Disadvantages: • Hop-by-hop protection causes multiple applications of crypto operations.

  44. Network Layer Security • Advantages • Transparent to applications. • Amenable to hardware. • Flexible. • Disadvantages • Makes routing more complex. • Flexibility introduces policy management and compatibility challenges.

  45. Transport Layer Security • Advantages • Transparent to applications. • Exposing TCP enables compression, QoS. • Disadvantages • Probably implemented in software. • Exposing TCP risks DoS

  46. Application Layer Security • Advantages: • customize to application • no special protocol stack required: transparent to networking • Disadvantages: • hard to share between applications

  47. Firewalls Filter Filter Gateway Inside Outside Filters protect against “bad” packets. A gateway machine restores needed services. Protect services offered internally from outside access. Provide outside services to hosts located inside.

  48. Possible Firewall Architecture Gateway Hosts Routers Networks DMZ “Demilitarized Zone” Filtering Routers Internal Network External Network

  49. Benefits of Firewalls • Increased security for internal hosts. • Reduced amount of effort required to counter break ins. • Possible added convenience of operation within firewall (with some risk). • Reduced legal and other costs associated with sponsoring hacker activities.

  50. Costs of Firewalls • Hardware purchase and maintenance • Software development or purchase, and update costs • Administrative setup and training, and ongoing administrative costs and trouble-shooting • Lost business or inconvenience from broken gateway • Loss of some services that an open connection would supply.

More Related