Data Communication and Network

Unit-IV
 Message Authentication
 The threat that exist for data is the lack of message authentication. In this threat, the user
is not sure about the originator of the message. Message authentication can be provided
using the cryptographic techniques that use secret keys as done in case of encryption.
 Message Authentication Code (MAC)
 MAC algorithm is a symmetric key cryptographic technique to provide message
authentication. For establishing MAC process, the sender and receiver share a symmetric
key K.
 Essentially, a MAC is an encrypted checksum generated on the underlying message that is
sent along with a message to ensure message authentication.
 The process of using MAC for authentication is depicted in the following illustration −
 Message Authentication
 Let us now try to understand the entire process in detail −
 The sender uses some publicly known MAC algorithm, inputs the message and the secret key
K and produces a MAC value.
 Similar to hash, MAC function also compresses an arbitrary long input into a fixed length
output. The major difference between hash and MAC is that MAC uses secret key during the
compression.
 The sender forwards the message along with the MAC. Here, we assume that the message is
sent in the clear, as we are concerned of providing message origin authentication, not
confidentiality. If confidentiality is required then the message needs encryption.
 On receipt of the message and the MAC, the receiver feeds the received message and the
shared secret key K into the MAC algorithm and re-computes the MAC value.
 The receiver now checks equality of freshly computed MAC with the MAC received from the
sender. If they match, then the receiver accepts the message and assures himself that the
message has been sent by the intended sender.
 If the computed MAC does not match the MAC sent by the sender, the receiver cannot
determine whether it is the message that has been altered or it is the origin that has been
 Message Authentication
 Limitations of MAC
 There are two major limitations of MAC, both due to its symmetric nature of operation −
 Establishment of Shared Secret.
 It can provide message authentication among pre-decided legitimate users who have shared key.
 This requires establishment of shared secret prior to use of MAC.
 Inability to Provide Non-Repudiation
 Non-repudiation is the assurance that a message originator cannot deny any previously sent
messages and commitments or actions.
 MAC technique does not provide a non-repudiation service. If the sender and receiver get
involved in a dispute over message origination, MACs cannot provide a proof that a message
was indeed sent by the sender.
 Though no third party can compute the MAC, still sender could deny having sent the message
and claim that the receiver forged it, as it is impossible to determine which of the two parties
computed the MAC.
 Both these limitations can be overcome by using the public key based digital signatures.
 Hash Function
 Hash functions are extremely useful and appear in almost all information security applications.
 A hash function is a mathematical function that converts a numerical input value into another
compressed numerical value. The input to the hash function is of arbitrary length but output is always of
fixed length.
 Values returned by a hash function are called message digest or simply hash values. The following
picture illustrated hash function −
 Features of Hash Functions
 The typical features of hash functions are −
 Fixed Length Output (Hash Value)
 Hash function coverts data of arbitrary length to a fixed length. This process is often referred to as hashing the
data.
 In general, the hash is much smaller than the input data, hence hash functions are sometimes called compression
functions.
 Since a hash is a smaller representation of a larger data, it is also referred to as a digest.
 Hash function with n bit output is referred to as an n-bit hash function. Popular hash functions generate values
between 160 and 512 bits.
 Efficiency of Operation
 Generally for any hash function h with input x, computation of h(x) is a fast operation.
 Hash Function
 Properties of Hash Functions
 In order to be an effective cryptographic tool, the hash function is desired to possess following properties −
 Pre-Image Resistance
 This property means that it should be computationally hard to reverse a hash function.
 In other words, if a hash function h produced a hash value z, then it should be a difficult process to find any input value x that
hashes to z.
 This property protects against an attacker who only has a hash value and is trying to find the input.
 Second Pre-Image Resistance
 This property means given an input and its hash, it should be hard to find a different input with the same hash.
 In other words, if a hash function h for an input x produces hash value h(x), then it should be difficult to find any other input
value y such that h(y) = h(x).
 This property of hash function protects against an attacker who has an input value and its hash, and wants to substitute
different value as legitimate value in place of original input value.
 Collision Resistance
 This property means it should be hard to find two different inputs of any length that result in the same hash. This property is
also referred to as collision free hash function.
 In other words, for a hash function h, it is hard to find any two different inputs x and y such that h(x) = h(y).
 Since, hash function is compressing function with fixed hash length, it is impossible for a hash function not to have collisions.
This property of collision free only confirms that these collisions should be hard to find.
 This property makes it very difficult for an attacker to find two input values with the same hash.
 Also, if a hash function is collision-resistant then it is second pre-image resistant.
 Hash Function
 Design of Hashing Algorithms
 At the heart of a hashing is a mathematical function that operates on two fixed-size blocks
of data to create a hash code. This hash function forms the part of the hashing algorithm.
 The size of each data block varies depending on the algorithm. Typically the block sizes
are from 128 bits to 512 bits. The following illustration demonstrates hash function-
 Hashing algorithm involves rounds of above hash function like a block cipher. Each round
takes an input of a fixed size, typically a combination of the most recent message block
and the output of the last round.
 This process is repeated for as many rounds as are required to hash the entire message.
Schematic of hashing algorithm is depicted in the following illustration
 Hash Function
 Design of Hashing Algorithms
 Since, the hash value of first message block becomes an input to the second hash
operation, output of which alters the result of the third operation, and so on. This effect,
known as an avalanche effect of hashing.
 Avalanche effect results in substantially different hash values for two messages that differ
by even a single bit of data.
 Understand the difference between hash function and algorithm correctly. The hash
function generates a hash code by operating on two blocks of fixed-length binary data.
 Hashing algorithm is a process for using the hash function, specifying how the message
will be broken up and how the results from previous message blocks are chained together.
 Hash Function
 Popular Hash Functions
 Let us briefly see some popular hash functions −
 Message Digest (MD)
 MD5 was most popular and widely used hash function for quite some years.
 The MD family comprises of hash functions MD2, MD4, MD5 and MD6. It was adopted
as Internet Standard RFC 1321. It is a 128-bit hash function.
 MD5 digests have been widely used in the software world to provide assurance about
integrity of transferred file. For example, file servers often provide a pre-computed MD5
checksum for the files, so that a user can compare the checksum of the downloaded file to
it.
 In 2004, collisions were found in MD5. An analytical attack was reported to be successful
only in an hour by using computer cluster. This collision attack resulted in compromised
MD5 and hence it is no longer recommended for use.
 Hash Function
 Popular Hash Functions
 Secure Hash Function (SHA)
 Family of SHA comprise of four SHA algorithms; SHA-0, SHA-1, SHA-2, and SHA-3. Though
from same family, there are structurally different.
 The original version is SHA-0, a 160-bit hash function, was published by the National Institute of
Standards and Technology (NIST) in 1993. It had few weaknesses and did not become very
popular. Later in 1995, SHA-1 was designed to correct alleged weaknesses of SHA-0.
 SHA-1 is the most widely used of the existing SHA hash functions. It is employed in several
widely used applications and protocols including Secure Socket Layer (SSL) security.
 In 2005, a method was found for uncovering collisions for SHA-1 within practical time frame
making long-term employability of SHA-1 doubtful.
 SHA-2 family has four further SHA variants, SHA-224, SHA-256, SHA-384, and SHA-512
depending up on number of bits in their hash value. No successful attacks have yet been reported
on SHA-2 hash function.
 Though SHA-2 is a strong hash function. Though significantly different, its basic design is still
follows design of SHA-1. Hence, NIST called for new competitive hash function designs.
 In October 2012, the NIST chose the Keccak algorithm as the new SHA-3 standard. Keccak offers
many benefits, such as efficient performance and good resistance for attacks.
 Cyclic Redundancy Check (CRC)
 Cyclic Redundancy Check (CRC) is a block code invented by W. Wesley Peterson in 1961. It is
commonly used to detect accidental changes to data transmitted via telecommunications networks and
storage devices.
 CRC involves binary division of the data bits being sent by a predetermined divisor agreed upon by the
communicating system. The divisor is generated using polynomials. So, CRC is also called polynomial
code checksum.
 The process is illustrated as follows −
 Encoding using CRC
 The communicating parties agrees upon the size of message block and the CRC divisor. For example, the
block chosen may be CRC (7, 4), where 7 is the total length of the block and 4 is the number of bits in
the data segment. The divisor chosen may be 1011.
 The sender performs binary division of the data segment by the divisor.
 It then appends the remainder called CRC bits to the end of data segment. This makes the resulting data
unit exactly divisible by the divisor.
 Decoding
 The receiver divides the incoming data unit by the divisor.
 If there is no remainder, the data unit is assumed to be correct and is accepted.
 Otherwise, it is understood that the data is corrupted and is therefore rejected. The receiver may then
 RSA Cryptosystem
 This cryptosystem is one the initial system. It remains most employed cryptosystem even
today. The system was invented by three scholars Ron Rivest, Adi Shamir, and Len
Adleman and hence, it is termed as RSA cryptosystem.
 We will see two aspects of the RSA cryptosystem, firstly generation of key pair and
secondly encryption-decryption algorithms.
 Generation of RSA Key Pair
 Each person or a party who desires to participate in communication using encryption needs
to generate a pair of keys, namely public key and private key. The process followed in the
generation of keys is described below
 Generate the RSA modulus (n)
 Select two large primes, p and q.
 Calculate n=p*q. For strong unbreakable encryption, let n be a large number, typically a
minimum of 512 bits.
 RSA Cryptosystem
 Find Derived Number (e)
 Number e must be greater than 1 and less than (p − 1)(q − 1).
 There must be no common factor for e and (p − 1)(q − 1) except for 1. In other words two
numbers e and (p – 1)(q – 1) are coprime.
 Form the public key
 The pair of numbers (n, e) form the RSA public key and is made public.
 Interestingly, though n is part of the public key, difficulty in factorizing a large prime number
ensures that attacker cannot find in finite time the two primes (p & q) used to obtain n. This is
strength of RSA.
 Generate the private key
 Private Key d is calculated from p, q, and e. For given n and e, there is unique number d.
 Number d is the inverse of e modulo (p - 1)(q – 1). This means that d is the number less than (p -
1)(q - 1) such that when multiplied by e, it is equal to 1 modulo (p - 1)(q - 1).
 This relationship is written mathematically as follows −
 ed = 1 mod (p − 1)(q − 1)
 RSA Cryptosystem
 Example
 An example of generating RSA Key pair is given below. (For ease of understanding, the
primes p & q taken here are small values. Practically, these values are very high).
 Let two primes be p = 7 and q = 13. Thus, modulus n = pq = 7 x 13 = 91.
 Select e = 5, which is a valid choice since there is no number that is common factor of 5
and (p − 1)(q − 1) = 6 × 12 = 72, except for 1.
 The pair of numbers (n, e) = (91, 5) forms the public key and can be made available to
anyone whom we wish to be able to send us encrypted messages.
 Input p = 7, q = 13, and e = 5 to the Extended Euclidean Algorithm. The output will be d =
29.
 Check that the d calculated is correct by computing −
de = 29 × 5 = 145 = 1 mod 72
 Hence, public key is (91, 5) and private keys is (91, 29).
 RSA Cryptosystem
 RSA Encryption
 Suppose the sender wish to send some text message to someone whose public key is (n, e).
 The sender then represents the plaintext as a series of numbers less than n.
 To encrypt the first plaintext P, which is a number modulo n. The encryption process is
simple mathematical step as −
 C = Pe mod n
 In other words, the ciphertext C is equal to the plaintext P multiplied by itself e times and
then reduced modulo n. This means that C is also a number less than n.
 Returning to our Key Generation example with plaintext P = 10, we get ciphertext C −
 C = 105 mod 91
 RSA Cryptosystem
 RSA Decryption
 The decryption process for RSA is also very straightforward. Suppose that the receiver of
public-key pair (n, e) has received a ciphertext C.
 Receiver raises C to the power of his private key d. The result modulo n will be the
plaintext P.
 Plaintext = Cd mod n
 Returning again to our numerical example, the ciphertext C = 82 would get decrypted to
number 10 using private key 29 −
 Plaintext = 8229 mod 91 = 10
 RSA Cryptosystem
 RSA Analysis
 The security of RSA depends on the strengths of two separate functions. The RSA
cryptosystem is most popular public-key cryptosystem strength of which is based on the
practical difficulty of factoring the very large numbers.
 Encryption Function − It is considered as a one-way function of converting plaintext into
ciphertext and it can be reversed only with the knowledge of private key d.
 Key Generation − The difficulty of determining a private key from an RSA public key is
equivalent to factoring the modulus n. An attacker thus cannot use knowledge of an RSA
public key to determine an RSA private key unless he can factor n. It is also a one way
function, going from p & q values to modulus n is easy but reverse is not possible.
 If either of these two functions are proved non one-way, then RSA will be broken. In fact,
if a technique for factoring efficiently is developed then RSA will no longer be safe.
 The strength of RSA encryption drastically goes down against attacks if the number p and
q are not large primes and/ or chosen public key e is a small number.
 Diffie-Hellman Key Exchange
 The question of key exchange was one of the first problems addressed by
a cryptographic protocol.
 This was prior to the invention of public key cryptography.
 The Diffie-Hellman key agreement protocol (1976) was the first practical
method for establishing a shared secret over an un secured
communication channel.
 The point is to agree on a key that two parties can use for asymmetric
encryption, in such a way that an eavesdropper (Hacker) can not obtain the
key.
 Diffie-Hellman Key Exchange

 Steps in the algorithm:

 1 Alice and Bob agree on a prime number p and a base g.
 2 Alice chooses a secret number a, and sends Bob (g a mod p).
 3 Bob chooses a secret number b, and sends Alice (gb mod p).
 4 Alice computes ((gb mod p)a mod p).
 5 Bob computes ((ga mod p)b mod p).
 Both Alice and Bob can use this number as their key. Notice that p and g need
not be protected.
 Diffie-Hellman Key Exchange
 1 Alice and Bob agree on p= 23 and g= 5.
 2 Alice chooses a= 6 and sends 56 mod 23 = 8.
 3 Bob chooses b= 15 and sends 515 mod 23 = 19.
 4 Alice computes 196 mod 23 = 2.
 5 Bob computes 815 mod 23 = 2.
 Then 2 is the shared secret.
 Clearly, much larger values of a, b, and p are required. An eavesdropper
cannot discover this value even if she knows p and g and can obtain each
of the messages.
 Diffie-Hellman Key Exchange
 Suppose p is a prime of around 300 digits, and a and b at least100 digits
each.
 Discovering the shared secret given g, p, ga mod p and gb mod p would
take longer than the lifetime of the universe, using the best known
algorithm. This is called the discrete logarithm problem.
 The Diffie-Hellman algorithm accomplishes this, and is still widely used.
 With sufficiently large inputs, Diffie-Hellman is very secure.
 Key Management
 It goes without saying that the security of any cryptosystem depends upon how securely its keys
are managed. Without secure procedures for the handling of cryptographic keys, the benefits of
the use of strong cryptographic schemes are potentially lost.
 It is observed that cryptographic schemes are rarely compromised through weaknesses in their
design. However, they are often compromised through poor key management.
 There are some important aspects of key management which are as follows −
 Cryptographic keys are nothing but special pieces of data. Key management refers to the secure
administration of cryptographic keys.
 Key management deals with entire key lifecycle as depicted in the following illustration −
 There are two specific requirements of key management for public key cryptography.
 Secrecy of private keys. Throughout the key lifecycle, secret keys must remain secret from all parties
except those who are owner and are authorized to use them.
 Assurance of public keys. In public key cryptography, the public keys are in open domain and seen
as public pieces of data. By default there are no assurances of whether a public key is correct, with
whom it can be associated, or what it can be used for. Thus key management of public keys needs to
focus much more explicitly on assurance of purpose of public keys.
 The most crucial requirement of ‘assurance of public key’ can be achieved through the public-
key infrastructure (PKI), a key management systems for supporting public-key cryptography.
 Digital Signature Standard (DSS)
 The Digital Signature Standard (DSS) is a suite of algorithms that the US federal
government has approved for generating and verifying a digital signature. It sets minimum
standards for a digital signature, and those implementing a Digital Signature Algorithm
(DSA) are required to do so in compliance with the benchmarks set forth by DSS.
 DSS is a Federal Information Processing Standard (FIPS) established and announced in
1994 and revised most recently in July 2013 in FIPS PUB 186-4. Alongside an approved
hash function specified in the guidance, the guidance identifies DSA, RSA, and ECDSA as
approved symmetric algorithms for digital signature generation and verification.
 Digital signatures are used to authenticate message recipients and to detect whether
information that has been exchanged has been altered. Going further, the recipient of
digitally signed data can present signed information to a third party as evidence that it has
not been modified, known as non-repudiation since such a claim is unassailable. Digital
signatures are commonplace in financial transactions, delivery of proprietary software, and
contracts.
 Intrusion Techniques
 The objective of the intruder is to gain access to a system or to increase the range of
privileges accessible on a system.
 Most initial attacks use system or software vulnerabilities that allow a user to execute code
that opens a back door into the system.
 Alternatively, the intruder attempts to acquire information that should have been protected.
 In some cases, this information is in the form of a user password. With knowledge of some
other user’s password, an intruder can log in to a system and exercise all the privileges
accorded to the legitimate user.
 Typically, a system must maintain a file that associates a password with each authorized
user. If such a file is stored with no protection, then it is an easy matter to gain access to it
and learn passwords. The password file can be protected in one of two ways:
 • One-way function: The system stores only the value of a function based on the user’s
password. When the user presents a password, the system transforms that password and
compares it with the stored value. In practice, the system usually performs a one-way
transformation (not reversible) in which the password is used to generate a key for the one-
way function and in which a fixed-length output is produced.
 • Access control: Access to the password file is limited to one or a very few accounts.
 Intrusion Techniques
 If one or both of these counter measures are in place, some effort is needed for a potential intruder to
learn passwords. On the basis of a survey of the literature and interviews with a number of password
crackers, reports the following techniques for learning passwords:
 1. Try default passwords used with standard accounts that are shipped with the system. Many
administrators do not bother to change these defaults.
 2. Exhaustively try all short passwords (those of one to three characters).
 3. Try words in the system’s online dictionary or a list of likely passwords. Examples of the latter are
readily available on hacker bulletin boards.
 4. Collect information about users, such as their full names, the names of their spouse and children,
pictures in their office, and books in their office that are related to hobbies.
 5. Try users’ phone numbers, Social Security numbers, and room numbers.
 6. Try all legitimate license plate numbers for this state.
 7. Use a Trojan horse (described in Chapter 10) to bypass restrictions on access.
 8. Tap the line between a remote user and the host system.
 The first six methods are various ways of guessing a password.
 The seventh method of attack listed earlier, the Trojan horse, can be particularly difficult to counter.
 The eighth attack listed, line tapping, is a matter of physical security.
 Intrusion Detection
 An Intrusion Detection System (IDS) is a system that monitors network traffic for
suspicious activity and issues alerts when such activity is discovered.
 It is a software application that scans a network or a system for harmful activity or policy
breaching.
 Any malicious venture or violation is normally reported either to an administrator or
collected centrally using a security information and event management (SIEM) system.
 A SIEM system integrates outputs from multiple sources and uses alarm filtering
techniques to differentiate malicious activity from false alarms.
 Although intrusion detection systems monitor networks for potentially malicious activity,
they are also disposed to false alarms. Hence, organizations need to fine-tune their IDS
products when they first install them.
 It means properly setting up the intrusion detection systems to recognize what normal
traffic on the network looks like as compared to malicious activity.
 Intrusion prevention systems also monitor network packets inbound the system to check
the malicious activities involved in it and at once sends the warning notifications.
 Intrusion Detection
 Classification of Intrusion Detection System:
IDS are classified into 5 types:
 Network Intrusion Detection System (NIDS): Network intrusion detection systems
(NIDS) are set up at a planned point within the network to examine traffic from all devices
on the network. It performs an observation of passing traffic on the entire subnet and
matches the traffic that is passed on the subnets to the collection of known attacks. Once an
attack is identified or abnormal behavior is observed, the alert can be sent to the
administrator. An example of an NIDS is installing it on the subnet where firewalls are
located in order to see if someone is trying crack the firewall.
 Host Intrusion Detection System (HIDS): Host intrusion detection systems (HIDS) run
on independent hosts or devices on the network. A HIDS monitors the incoming and
outgoing packets from the device only and will alert the administrator if suspicious or
malicious activity is detected. It takes a snapshot of existing system files and compares it
with the previous snapshot. If the analytical system files were edited or deleted, an alert is
sent to the administrator to investigate. An example of HIDS usage can be seen on mission
critical machines, which are not expected to change their layout.
 Intrusion Detection
 Protocol-based Intrusion Detection System (PIDS): Protocol-based intrusion detection
system (PIDS) comprises of a system or agent that would consistently resides at the front
end of a server, controlling and interpreting the protocol between a user/device and the
server. It is trying to secure the web server by regularly monitoring the HTTPS protocol
stream and accept the related HTTP protocol. As HTTPS is un-encrypted and before
instantly entering its web presentation layer then this system would need to reside in this
interface, between to use the HTTPS.
 Application Protocol-based Intrusion Detection System (APIDS): Application
Protocol-based Intrusion Detection System (APIDS) is a system or agent that generally
resides within a group of servers. It identifies the intrusions by monitoring and interpreting
the communication on application specific protocols. For example, this would monitor the
SQL protocol explicit to the middleware as it transacts with the database in the web server.
 Hybrid Intrusion Detection System :Hybrid intrusion detection system is made by the
combination of two or more approaches of the intrusion detection system. In the hybrid
intrusion detection system, host agent or system data is combined with network
information to develop a complete view of the network system. Hybrid intrusion detection
system is more effective in comparison to the other intrusion detection system. Prelude is
an example of Hybrid IDS.
 Intrusion Detection
 Detection Method of IDS:
 Signature-based Method: Signature-based IDS detects the attacks on the basis of the
specific patterns such as number of bytes or number of 1’s or number of 0’s in the network
traffic. It also detects on the basis of the already known malicious instruction sequence that
is used by the malware. The detected patterns in the IDS are known as signatures.
Signature-based IDS can easily detect the attacks whose pattern (signature) already exists
in system but it is quite difficult to detect the new malware attacks as their pattern
(signature) is not known.
 Anomaly-based Method: Anomaly-based IDS was introduced to detect the unknown
malware attacks as new malware are developed rapidly. In anomaly-based IDS there is use
of machine learning to create a trustful activity model and anything coming is compared
with that model and it is declared suspicious if it is not found in model. Machine learning
based method has a better generalized property in comparison to signature-based IDS as
these models can be trained according to the applications and hardware configurations.
 Password-based Authentication
 Simple: people log into a computer by typing a user nameand a password Problems with
using passwords for authentication:
 The user himself/herself
 Eavesdroppers might see the password when careless users log in.
 The password might be easy to guess (on-line attack) because users choose passwords they
can remember easily.
 Attempts to force users to choose unguessable passwords might render the system so
inconvenient that users write down passwords
 Password management
 For login, the system has to “know” the valid passwords – they are stored in an own file.
An attacker might read the system file with the password information.
 Thus: encrypt stored password information
 Store hashes of passwords.
 Encrypt the stored passwords.
 Combination: Encrypt a database of hashed passwords
 Address-based Authentication
 Computers are identified by hierarchical IP addresses:
 Network………………..Subnet………………Computer
 Possible forms of authentication:
 Maintain list of network addresses of “equivalent” machines, i.e., give users who have
access to machine X the same access rights for machine Y
 Problem: user must have identical account names on all systems
 Extension: store entry: 〈remote address, remote account name, local account name 〉
 Implementation e.g. in UNIX:
 /etc/hosts.equiv file contains list of computers that have identical user account assignments
 .rhosts file in a user’s home directory contains a list of tuples 〈computer, account 〉that are
granted access to this user’s account
 But: if someone gains privileged access to a node, he can access all users’ resources on this
node. He can also get access to other machines accessable by users of the current node.
 Authentication services
 The authentication service is concerned with assuring that a communication is authentic. In
the case of a single message, such as a warning or alarm signal, the function of the
authentication service is to assure the recipient that the message is from the source that it
claims to be from. In the case of an ongoing interaction, such as the connection of a terminal to
a host, two aspects are involved. First, at the time of connection initiation, the service assures
that the two entities are authentic (that is, that each is the entity that it claims to be). Second,
the service must assure that the connection is not interfered with in such a way that a third
party can masquerade as one of the two legitimate parties for the purposes of unauthorized
transmission or reception.
 Two specific authentication services are defined:
 • Peer entity authentication: Provides for the corroboration of the identity of a peer entity in
an association. Two entities are considered peers if they implement the same protocol in
different systems (e.g., two TCP modules in two communicating systems). Peer entity
authentication is provided for use at the establishment of or during the data transfer phase of a
connection. It attempts to provide confidence that an entity is not performing either a
masquerade or an unauthorized replay of a previous connection.
 • Data origin authentication: Provides for the corroboration of the source of a data unit. It
does not provide protection against the duplication or modification of data units. This type of
service supports applications like electronic mail, where there are no prior interactions between
 Email Security
 E-mail Hacking
 Email hacking can be done in any of the following ways:
 Spam
 Virus
 Phishing
 Spam
 E-mail spamming is an act of sending Unsolicited Bulk E-mails (UBI) which one has not asked for.
Email spams are the junk mails sent by commercial companies as an advertisement of their products
and services.
 Virus
 Some emails may incorporate with files containing malicious script which when run on your computer
may lead to destroy your important data.
 Phishing
 Email phishing is an activity of sending emails to a user claiming to be a legitimate enterprise. Its
main purpose is to steal sensitive information such as usernames, passwords, and credit card details.
 Such emails contains link to websites that are infected with malware and direct the user to enter details
at a fake website whose look and feels are same to legitimate one.
 Email Security
 E-mail Spamming and Junk Mails
 Email spamming is an act of sending Unsolicited Bulk E-mails (UBI) which one has not asked for.
Email spams are the junk mails sent by commercial companies as an advertisement of their products
and services.
 Spams may cause the following problems:
 1. It floods your e-mail account with unwanted e-mails, which may result in loss of important e-
mails if inbox is full.
 2. Time and energy is wasted in reviewing and deleting junk emails or spams.
 3. It consumes the bandwidth that slows the speed with which mails are delivered.
 4. Some unsolicited email may contain virus that can cause harm to your computer.
 Blocking Spams
 Following ways will help you to reduce spams:
 1. While posting letters to newsgroups or mailing list, use a separate e-mail address than the one you
used for your personal e-mails.
 2. Don’t give your email address on the websites as it can easily be spammed.
 3. Avoid replying to emails which you have received from unknown persons.
 Firewalls
 A firewall can be defined as a special type of network security device or a software
program that monitors and filters incoming and outgoing network traffic based on a
defined set of security rules.
 It acts as a barrier between internal private networks and external sources (such as the
public Internet).
 The primary purpose of a firewall is to allow non-threatening traffic and prevent malicious
or unwanted data traffic for protecting the computer from viruses and attacks.
 A firewall is a cybersecurity tool that filters network traffic and helps users block
malicious software from accessing the Internet in infected computers.
 Packet-filtering
 Packet-filtering firewalls allow or block the packets mostly based on criteria such as
source and/or destination IP addresses, protocol, source and/or destination port numbers,
and various other parameters within the IP header.
 The decision can be based on factors other than IP header fields such as ICMP(Internet
Control Message Protocol) message type, TCP SYN and ACK bits, etc.
 Packet filter rule has two parts −
 Selection criteria − It is a used as a condition and pattern matching for decision making.
 Action field − This part specifies action to be taken if an IP packet meets the selection
criteria. The action could be either block (deny) or permit (allow) the packet across the
firewall.
 Packet filtering is generally accomplished by configuring Access Control Lists (ACL) on
routers or switches. ACL is a table of packet filter rules.
 As traffic enters or exits an interface, firewall applies ACLs from top to bottom to each
incoming packet, finds matching criteria and either permits or denies the individual
packets.
 Packet-filtering
 Stateless firewall is a kind of a rigid tool. It looks at packet and allows it if its meets the
criteria even if it is not part of any established ongoing communication.
 Hence, such firewalls are replaced by stateful firewalls in modern networks. This type of
firewalls offer a more in-depth inspection method over the only ACL based packet
inspection methods of stateless firewalls.
 Stateful firewall monitors the connection setup and teardown process to keep a check on
connections at the TCP/IP level. This allows them to keep track of connections state and
determine which hosts have open, authorized connections at any given point in time.
 They reference the rule base only when a new connection is requested. Packets belonging
to existing connections are compared to the firewall's state table of open connections, and
decision to allow or block is taken. This process saves time and provides added security as
well. No packet is allowed to trespass the firewall unless it belongs to already established
connection. It can timeout inactive connections at firewall after which it no longer admit
packets for that connection.
 Access Control
 Network access control is a method of enhancing the security of a private organizational
network by restricting the availability of network resources to endpoint devices that
comply with the organization’s security policy.
 A typical network access control scheme comprises of two major components such as
Restricted Access and Network Boundary Protection.
 Restricted Access to the network devices is achieved through user authentication and
authorization control which is responsible for identifying and authenticating different users
to the network system. Authorization is the process of granting or denying specific access
permissions to a protected resource.
 Network Boundary Protection controls logical connectivity into and out of networks. For
example, multiple firewalls can be deployed to prevent unauthorized access to the network
systems. Also intrusion detection and prevention technologies can be deployed to defend
against attacks from the Internet.
 Trusted systems
 One way to enhance the ability of a system to defend against intruders and malicious
programs is to implement trusted system technology.
 1. Data access control
 Following successful logon, the user has been granted access to one or set of hosts and
applications. This is generally not sufficient for a system that includes sensitive data in its
database. Through the user access control procedure, a user can be identified to the system.
Associated with each user, there can be a profile that specifies permissible operations and
file accesses. The operating system can then enforce rules based on the user profile. The
database management system, however, must control access to specific records or even
portions of records. The operating system may grant a user permission to access a file or
use an application, following which there are no further security checks, the database
management system must make a decision on each individual access attempt. That
decision will depend not only on the user‟s identity but also on the specific parts of the
data being accessed and even on the information already divulged to the user.
 Trusted systems
 A general model of access control as exercised by an file or database management system
is that of an access matrix. The basic elements of the model are as follows:
 Subject: An entity capable of accessing objects. Generally, the concept of subject equates
with that of process.
 Object: Anything to which access is controlled. Examples include files, portion of files,
programs, and segments of memory.
 Access right: The way in which the object is accessed by a subject. Examples are read,
write and execute.
 Trusted systems
 One axis of the matrix consists of identified subjects that may attempt
data access. Typically, this list will consist of individual users or user
groups. The other axis lists the objects that may be accessed. Objects may
be individual data fields. Each entry in the matrix indicates the access
rights of that subject for that object. The matrix may be decomposed by
columns, yielding access control lists. Thus, for each object, an access
control list lists users and their permitted access rights. The access control
list may contain a default, or public, entry.
 Decomposition by rows yields capability tickets. A capability ticket
specifies authorized objects and operations for a user. Each user has a
number of tickets and may be authorized to loan or give them to others.
Because tickets may be dispersed around the system, they present a
greater security problem than access control lists. In particular, the ticket
must be unforgeable. One way to accomplish this is to have the operating
system hold all tickets on behalf of users. These tickets would have to be
held in a region of memory inaccessible to users.
 Trusted systems
 The concept of Trusted Systems
 When multiple categories or levels of data are defined, the requirement is
referred to as multilevel security. The general statement of the
requirement for multilevel security is that a subject at a high level may not
convey information to a subject at a lower or non comparable level unless
that flow accurately reflects the will of an authorized user. For
implementation purposes, this requirement is in two parts and is simply
stated. A multilevel secure system must enforce:
 No read up: A subject can only read an object of less or equal security
level. This is referred to as simple security property.
 No write down: A subject can only write into an object of greater or
equal security level.
 This is referred to as *-property (star property).
 These two rules, if properly enforced, provide multilevel security.
 Trusted systems
 Reference Monitor concept
 The reference monitor is a controlling element in the hardware and operating
system of a computer that regulates the access of subjects to objects on the basis
of security parameters of the subject and object. The reference monitor has
access to a file, known as the security kernel database that lists the access
privileges (security clearance) of each subject and the protection attributes
(classification level) of each object. The reference monitor enforces the security
rules and has the following properties:
 Complete mediation: The security rules are enforced on every access,
not just, for example, when a file is opened.
 Isolation: The reference monitor and database are protected from
unauthorised modification.
 Verifiability: The reference monitor‟s correctness must be provable. That is, it
must be possible to demonstrate mathematically that the reference monitor
enforces the security rules and provides complete mediation and isolation.
Important security events, such as detected security violations and authorized
changes to the security kernel database, are stored in the audit file