Module 4

Security in Networks
 SECURITY GOALS

Confidentiality
Confidentiality is probably the most common aspect of information security. We need to protect our confidential
information. An organization needs to guard against those malicious actions that endanger the confidentiality of its
information.
Confidentiality not only applies to the storage of the information, it also applies to the transmission of information.
When we send a piece of information to be stored in a remote computer or when we retrieve a piece of information
from a remote computer, we need to conceal it during transmission.
Integrity
 Information needs to be changed constantly.
 In a bank, when a customer deposits or withdraws money, the balance of her account needs to be changed.
 Integrity means that changes need to be done only by authorized entities and through authorized mechanisms.
 Integrity violation is not necessarily the result of a malicious act; an interruption in the system, such as a power surge,
may also create unwanted changes in some information.

Availability
 The third component of information security is availability.
 The information created and stored by an organization needs to be available to authorized entities.
 Information is useless if it is not available. Information needs to be constantly changed, which means it must be
accessible to authorized entities.
 The unavailability of information is just as harmful for an organization as the lack of confidentiality or integrity.
 Imagine what would happen to a bank if the customers could not access their accounts for transactions.
ATTACKS

Attacks Threatening Confidentiality

Snooping
 Snooping refers to unauthorized access to or interception of data.
 For example, a file transferred through the Internet may contain confidential information.
 An unauthorized entity may intercept the transmission and use the contents for her own benefit.
 To prevent snooping, the data can be made nonintelligible to the intercepter by using encipherment
techniques.
Traffic Analysis
 Although encipherment of data may make it nonintelligible for the intercepter, she can obtain some other type
information by monitoring online traffic.
 For example, she can find the electronic address (such as the e-mail address) of the sender or the receiver.
 She can collect pairs of requests and responses to help her guess the nature of transaction.

Attacks Threatening Integrity

The integrity of data can be threatened by several kinds of attacks: modification, masquerading, replaying, and repudiation.
Modification
 After intercepting or accessing information, the attacker modifies the information to make it beneficial to herself.
 For example, a customer sends a message to a bank to do some transaction.
 The attacker intercepts the message and changes the type of transaction to benefit herself.
 Note that sometimes the attacker simply deletes or delays the message to harm the system or to benefit from it.
Masquerading
 Masquerading, or spoofing, happens when the attacker impersonates somebody else.
 For example, an attacker might steal the bank card and PIN of a bank customer and pretend that she is that customer.
Sometimes the attacker pretends instead to be the receiver entity.
 For example, a user tries to contact a bank, but another site pretends that it is the bank and obtains some information
from the user.
Replaying
Replaying is another attack.
The attacker obtains a copy of a message sent by a user and later tries to replay it.
For example, a person sends a request to her bank to ask for payment to the attacker, who has done a job for her. The
attacker intercepts the message and sends it again to receive another payment from the bank.

Repudiation
 This type of attack is different from others because it is performed by one of the two parties in the communication: the
sender or the receiver.
 The sender of the message might later deny that she has sent the message; the receiver of the message might later deny
that he has received the message.
 An example of denial by the sender would be a bank customer asking her bank to send some money to a third party but
later denying that she has made such a request.
 An example of denial by the receiver could occur when a person buys a product from a manufacturer and pays for it
electronically, but the manufacturer later denies having received the payment and asks to be paid
Attacks Threatening Availability
 We mention only one attack threatening availability: denial of service. Denial of Service Denial of service (DoS) is a very
common attack.
 It may slow down or totally interrupt the service of a system.
 The attacker can use several strategies to achieve this. She might send so many bogus requests to a server that the
server crashes because of the heavy load.
 The attacker might intercept and delete a server’s response to a client, making the client to believe that the server is not
responding.
 The attacker may also intercept requests from the clients, causing the clients to send requests many times and overload
the system
Passive Attacks
 In a passive attack, the attacker’s goal is just to obtain information.
 This means that the attack does not modify data or harm the system. The system continues with its normal
operation.
 However, the attack may harm the sender or the receiver of the message.
 Attacks that threaten confidentiality , snooping and traffic analysis are passive attacks.
 The revealing of the information may harm the sender or receiver of the message, but the system is not
affected. For this reason, it is difficult to detect this type of attack until the sender or receiver finds out about
the leaking of confidential information.
 Passive attacks, however, can be prevented by encipherment of the data.

Active Attacks
 An active attack may change the data or harm the system.
 Attacks that threaten the integrity and availability are active attacks.
 Active attacks are normally easier to detect than to prevent, because an attacker can launch them in a variety
of ways.
SERVICES AND MECHANISMS
 The International Telecommunication Union-Telecommunication Standardization Sector (ITU-T) provides
some security services and some mechanisms to implement those services.
 Security services and mechanisms are closely related because a mechanism or combination of mechanisms
are used to provide a service.
 Also, a mechanism can be used in one or more services.

It is easy to relate one or more of these services to one or more of the security goals.
Data Confidentiality
 Data confidentiality is designed to protect data from disclosure attack.

 The service as defined by X.800 is very broad and encompasses confidentiality of the whole message or part of a
message and also protection against traffic analysis.

 That is, it is designed to prevent snooping and traffic analysis attack.

Data Integrity
Data integrity is designed to protect data from modification, insertion, deletion, and replaying by an adversary.
It may protect the whole message or part of the message.

Authentication
 This service provides the authentication of the party at the other end of the line.
 In connection-oriented communication, it provides authentication of the sender or receiver during the connection
establishment (peer entity authentication). In connectionless communication, it authenticates the source of the data
(data origin authentication).
Nonrepudiation
 Nonrepudiation service protects against repudiation by either the sender or the receiver of the data.
 In nonrepudiation with proof of the origin, the receiver of the data can later prove the identity of the sender if
denied.
 In nonrepudiation with proof of delivery, the sender of data can later prove that data were delivered to the
intended recipient.

Access Control
 Access control provides protection against unauthorized access to data.
 The term access in this definition is very broad and can involve reading, writing, modifying, executing programs, and
so on.
Security Mechanisms
ITU-T (X.800) also recommends some security mechanisms to provide the security services defined in the
previous section.
Encipherment -hiding or covering data, can provide confidentiality. It can also be used to complement other mechanisms
to provide other services. Today two techniques cryptography and steganographyare used for enciphering.

Data Integrity
The data integrity mechanism appends to the data a short checkvalue that has been created by a specific process from
the data itself. The receiver receives the data and the checkvalue. He creates a new checkvalue from the received data
and compares the newly created checkvalue with the one received. If the two checkvalues are the same, the integrity of
data has been preserved.

Digital Signature A digital signature is a means by which the sender can electronically sign the data and the receiver can
electronically verify the signature. The sender uses a process that involves showing that she owns a private key related to
the public key that she has announced publicly. The receiver uses the sender’s public key to prove that the message is
indeed signed by the sender who claims to have sent the message.

Authentication Exchange In authentication exchange, two entities exchange some messages to prove their identity to
each other. For example, one entity can prove that she knows a secret that only she is supposed to know.

Traffic Padding Traffic padding means inserting some bogus data into the data traffic to thwart the adversary’s attempt
to use the traffic analysis.
IP Security (IPSec)
A collection of protocols designed by the Internet Engineering Task Force (IETF) to provide security for a packet at the
network level.

The network layer in the Internet is often referred to as the Internet Protocol or IP layer.

IPSec helps to create authenticated and confidential packets for the IP layer
TWO MODES
IPSec operates in one of two different modes: transport mode or tunnel mode.

Transport Mode
In transport mode, IPSec protects what is delivered from the transport layer to the network layer. In other words, transport
mode protects the network layer payload, the payload to be encapsulated in the network layer, as shown in Figure 18.2.
 Note that transport mode does not protect the IP header.
 In other words, transport mode does not protect the whole IP packet; it protects only the packet from the transport
layer (the IP layer payload).
 In this mode, the IPSec header (and trailer) are added to the information coming from the transport layer.
 The IP header is added later.
 Transport mode is normally used when we need host-to-host (end-to-end) protection of data.
 The sending host uses IPSec to authenticate and/or encrypt the payload delivered from the transport layer.
 The receiving host uses IPSec to check the authentication and/or decrypt the IP packet and deliver it to the transport
layer.
 IPSec in transport mode does not protect the IP header; it only protects the information coming from the transport
layer
Tunnel Mode
 In tunnel mode, IPSec protects the entire IP packet.
 It takes an IP packet, including the header, applies IPSec security methods to the entire packet, and then adds a new IP
header

 The new IP header, as we will see shortly, has different information than the original IP header.
 Tunnel mode is normally used between two routers, between a host and a router, or between a router and a host,
as shown in Figure 18.5.
 In other words, tunnel mode is used when either the sender or the receiver is not a host.
 The entire original packet is protected from intrusion between the sender and the receiver, as if the whole packet
goes through an imaginary tunnel.
IPSec in tunnel mode protects the original IP header
Comparison
In transport mode, the IPSec layer comes between the transport layer and the network layer.
In tunnel mode, the flow is from the network layer to the IPSec layer and then back to the network layer again
TWO SECURITY PROTOCOLS
IPSec defines two protocols the Authentication Header (AH) Protocol and the Encapsulating Security Payload (ESP)
Protocol to provide authentication and/or encryption for packets at the IP level.

Authentication Header (AH)

The Authentication Header (AH) Protocol is designed to authenticate the source host and to ensure the integrity of the
payload carried in the IP packet.

The protocol uses a hash function and a symmetric key to create a message digest; the digest is inserted in the
authentication header. The AH is then placed in the appropriate location, based on the mode (transport or tunnel).

Figure 18.7 shows the fields and the position of the authentication header in transport mode.
The AH protocol provides source authentication and data integrity, but not privacy.
 When an IP datagram carries an authentication header, the original value in the protocol field of the IP header is
replaced by the value 51.

 A field inside the authentication header (the next header field) holds the original value of the protocol field (the
type of payload being carried by the IP datagram).

 The addition of an authentication header follows these steps

1. An authentication header is added to the payload with the authentication data field set to 0.
2. Padding may be added to make the total length even for a particular hashing algorithm.
3. Hashing is based on the total packet. However, only those fields of the IP header that do not change during
transmission are included in the calculation of the message digest (authentication data).
4. The authentication data are inserted in the authentication header.
5. The IP header is added after changing the value of the protocol field to 51.
A brief description of each field follows:

❏ Next header. The 8-bit next header field defines the type of payload carried by the IP datagram (such as TCP, UDP,
ICMP, or OSPF). It has the same function as the protocol field in the IP header before encapsulation. In other words, the
process copies the value of the protocol field in the IP datagram to this field. The value of the protocol field in the new
IP datagram is now set to 51 to show that the packet carries an authentication header.

 Payload length. The name of this 8-bit field is misleading. It does not define the length of the payload; it defines the
length of the authentication header in 4-byte multiples, but it does not include the first 8 bytes.

❏ Security parameter index. The 32-bit security parameter index (SPI) field plays the role of a virtual circuit identifier
and is the same for all packets sent during a connection called a Security Association (discussed later).

❏ Sequence number. A 32-bit sequence number provides ordering information for a sequence of datagrams. The
sequence numbers prevent a playback. Note that the sequence number is not repeated even if a packet is
retransmitted. A sequence number does not wrap around after it reaches 232; a new connection must be established.

❏ Authentication data. Finally, the authentication data field is the result of applying a hash function to the entire IP
datagram except for the fields that are changed during transit (e.g., time-to-live).
Encapsulating Security Payload (ESP)

 IPSec later defined an alternative protocol, Encapsulating Security Payload (ESP), that provides source authentication,
integrity, and privacy.
 ESP adds a header and trailer.
 Note that ESP’s authentication data are added at the end of the packet, which makes its calculation easier.
 Figure 18.8 shows the location of the ESP header and trailer.
When an IP datagram carries an ESP header and trailer, the value of the protocol field in the IP header is 50.
A field inside the ESP trailer (the next-header field) holds the original value of the protocol field (the type of payload
being carried by the IP datagram, such as TCP or UDP).
The ESP procedure follows these steps:
1. An ESP trailer is added to the payload.
2. The payload and the trailer are encrypted.
3. The ESP header is added.
4. The ESP header, payload, and ESP trailer are used to create the authentication data
5. The authentication data are added to the end of the ESP trailer. 6. The IP header is added after changing the
protocol value to 50.

The fields for the header and trailer are as follows:

❏ Security parameter index. The 32-bit security parameter index field is similar to that defined for the AH protocol.

❏ Sequence number. The 32-bit sequence number field is similar to that defined for the AH protocol.

❏ Padding. This variable-length field (0 to 255 bytes) of 0s serves as padding.

❏ Pad length. The 8-bit pad-length field defines the number of padding bytes. The value is between 0 and 255; the
maximum value is rare.

❏ Next header. The 8-bit next-header field is similar to that defined in the AH protocol. It serves the same purpose as
the protocol field in the IP header before encapsulation.

❏ Authentication data. Finally, the authentication data field is the result of applying an authentication scheme to parts
of the datagram. Note the difference between the authentication data in AH and ESP. In AH, part of the IP header is
included in the calculation of the authentication data; in ESP, it is not.

IPv4 and IPv6

IPSec supports both IPv4 and IPv6. In IPv6, however, AH and ESP are part of the extension header.

AH versus ESP
The ESP protocol was designed after the AH protocol was already in use. ESP does whatever AH does with additional
functionality (privacy). The question is, Why do we need AH? The answer is that we don’t. However, the implementation
of AH is already included in some commercial products, which means that AH will remain part of the Internet until these
products are phased out.
Services Provided by IPSec
SECURITY ASSOCIATION
 Security Association is a very important aspect of IPSec.
 IPSec requires a logical relationship, called a Security Association (SA), between two host.

Idea of Security Association

 A Security Association is a contract between two parties; it creates a secure channel between them.
 Let us assume that Alice needs to unidirectionally communicate with Bob.
 If Alice and Bob are interested only in the confidentiality aspect of security, they can get a shared secret key between
themselves.
 We can say that there are two Security Associations (SAs) between Alice and Bob; one outbound SA and one inbound SA.
Each of them stores the value of the key in a variable and the name of the encryption/ decryption algorithm in another.
Alice uses the algorithm and the key to encrypt a message to Bob; Bob uses the algorithm and the key when he needs to
decrypt the message received from Alice.
 Figure 18.10 shows a simple SA.
 The Security Associations can be more involved if the two parties need message integrity and authentication.
 Each association needs other data such as the algorithm for message integrity, the key, and other parameters.
 It can be much more complex if the parties need to use specific algorithms and specific parameters for different
protocols, such as IPSec AH or IPSec ESP.

Security Association Database (SAD)

 A Security Association can be very complex.
 This is particularly true if Alice wants to send messages to many people and Bob needs to receive messages from many
people. In addition, each site needs to have both inbound and outbound SAs to allow bidirectional communication.
 In other words, we need a set of SAs that can be collected into a database.
 This database is called the Security Association Database (SAD).
 The database can be thought of as a two-dimensional table with each row defining a single SA.
 Normally, there are two SADs, one inbound and one outbound.
 Figure 18.11 shows the concept of outbound and inbound SADs for one entity.
 When a host needs to send a packet that must carry an IPSec header, the host needs to find the corresponding entry in
the outbound SAD to find the information for applying security to the packet.

 Similarly, when a host receives a packet that carries an IPSec header, the host needs to find the corresponding entry in the
inbound SAD to find the information for checking the security of the packet.

 This searching must be specific in the sense that the receiving host needs to be sure that correct information is used for
processing the packet. Each entry in an inbound SAD is selected using a triple index: security parameter index, destination
address, and protocol
Refer Chapter 17 and question bank for SSL and TLS

Module 5
Types of firewalls
Refer
Types of Firewall - javatpoint