Business data communications 5e by stallings chapter 18

Chapter 18: Network Security Business Data Communications, 5e Types of Security • Information Security • Computer Security • Network Security Business Data Commun ications, 5e Security Requirements • • • • Confidentiality Integrity Availability Authenticity Business Data Commun ications, 5e Security Threats • Passive attacks – – – – Release of message contents Traffic analysis Difficult to detect because there is no data alteration Emphasis on prevention through encryption • Active attacks – – – – Masquerae Replay Modification of messages Denial of Service Business Data Commun ications, 5e Symmetric Encryption • The only form of encryption prior to late 1970s • Five components to the algorithm – – – – – – Plaintext The original message or data Encryption algorithm Secret key Ciphertext Decryption algorithm • Two requirements – Strong encryption algorithm – Secure exchange of keys Business Data Commun ications, 5e Conventional Encryption Operation Business Data Commun ications, 5e Symmetric Encryption Attacks • Cryptanalysis – Exploits the algorithm to attempt to deduce a specific plaintext or key being used – If successful, future and past messages encrypted with that key are compromised • Brute Force – Try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained – On average, half of all possible keys must be tried to achieve success Business Data Commun ications, 5e Data Encryption Standard (DES) • Dominant encryption algorithm after release in 1977 • 56-bit key made it too easy to crack by 1998 • Life of DES extended by use of triple DES (3DES – Repeats basic DES algorithm three times, using either two or three unique keys – Key size of 112 or 168 bits – Drawbacks: Algorithm is sluggish in software, 64-bit block size is inefficient Business Data Commun ications, 5e Advanced Encryption Standard Business Data Commun ications, 5e Location of Encryption Devices • Link encryption – Each vulnerable communications link is equipped on both ends with an encryption device – All traffic over all communications links is secured – Vulnerable at each switch • End-to-end encryption – Encryption process carried out at two end systems – Encrypted data transmitted unaltered across network; destination shares key with source to decrypt data – Packet headers cannot be secured Business Data Commun ications, 5e 10 Steps in Public Key Encryption • Each user generates a pair of keys to be used for the encryption and decryption of messages • Each user places one of the two keys in a public register or other accessible file This is the public key The companion key is kept private • If Bob wishes to send a private message to Alice, Bob encrypts the message using Alice's public key • When Alice receives the message, she decrypts it using her private key No other recipient can decrypt the message because only Alice knows Alice's private key Business Data Commun ications, 5e 22 Digital Signature Process Business Data Commun ications, 5e 23 RSA Encryption Algorithm • Developed in 1977, first published in 1978 • Widely accepted and implemented approach to public-key encryption • For plaintext block M and ciphertext block C – C = Me mod n – M = Cd mod n = (Me)d mod n = Med mod n • Both sender and receiver must know values of n and e; only receiver knows value of d • Public key of KU = {e, n} • Private key of KR = {d, n} Business Data Commun ications, 5e 24 RSA Requirements • It is possible to find values of e, d, n such that Med = M mod n for all M < n • It is relatively easy to calculate Me and Cd for all values of M < n • It is infeasible to determine d given e and n – This requirement can be met with large values of e and n Business Data Commun ications, 5e 25 Approaches to Defeating RSA • Brute force approach: try all possible private keys – The larger the number of bits in e and d, the more secure the algorithm – However, the larger the size of the key, the slower the system will run • Cryptanalysis: factoring n into its two prime factors – A hard problem, but not as hard as it used to be – Currently, a 1024-bit key size is considered strong enough for virtually all applications Business Data Commun ications, 5e 26 Key Management • Symmetric encryption requires both parties to share a secret key • Secure distribution of keys is the most difficult problem for symmetric encryption • Public key encryption solves this problem, but adds the issue of authenticity • Public key certiciates address this issue Business Data Commun ications, 5e 27 Public Key Certificates Business Data Commun ications, 5e 28 Public Key Certificate Process A public key is generated by the user and submitted to Agency X for certification X determines by some procedure, such as a faceto-face meeting, that this is authentically the user’s public key X appends a timestamp to the public key, generates the hash code of the result, and encrypts that result with X’s private key forming the signature The signature is attached to the public key Business Data Commun ications, 5e 29 Virtual Private Networks (VPNs) • Internet connectivity provides easier access for telecommuters and off-site employees • Use of a public network exposes corporate traffic to eavesdropping and provides an entry point for unauthorized users • A variety of encryption and authentication packages and products are available to secure and authenticate remote access • Need for a standard that allows a variety of platforms to interconnect securely Business Data Commun ications, 5e 30 Applications of IPSec • Secures communications across a LAN, WANs, and/or the Internet • Can encrypt and/or authenticate all traffic at the IP level • Examples of use: – Secure branch office connectivity over the Internet – Secure remote access over the Internet – Establishing extranet and intranet connectivity with partners – Enhancing electronic commerce security Business Data Commun ications, 5e 31 Benefits of IPSec • When implemented in a firewall or router, provides strong security for all traffic crossing the perimeter • IPSec in a firewall is resistant to bypass • Runs below the transport layer (TCP, UDP) and so is transparent to applications • Can be transparent to end users • Can provide security for individual users if needed Business Data Commun ications, 5e 32 IPSec Functions • IPSec provides three main facilities – authentication-only function referred to as Authentication Header (AH) – combined authentication/encryption function called Encapsulating Security Payload (ESP) – a key exchange function • For VPNs, both authentication and encryption are generally desired Business Data Commun ications, 5e 33 ESP Transport and Tunneling • Transport Mode • Tunnel Mode – provides protection primarily for upper-layer protocols – Typically used for end-toend communication between two hosts – encrypts and optionally authenticates the IP payload but not the IP header – useful for relatively small networks; for a full-blown VPN, tunnel mode is far more efficient – Provides protection to the entire packet – Original packet is encapsulated in ESP fields, protecting contents from examination – Used when one or both ends is a security gateway – Multiple hosts on networks behind firewalls may engage in secure communications without implementing IPSec Business Data Commun ications, 5e 34 IPSec Key Management • Manual – System administrator manually configures each system with its own keys and with the keys of other communicating systems – Practical for small, relatively static environments • Automated – Enables the on-demand creation of keys for SAs and facilitates the use of keys in a large distributed system – Most flexible but requires more effort to configure and requires more software Business Data Commun ications, 5e 35 IPSec and VPNs • Organizations need to isolate their networks and at the same time send and receive traffic over the Internet • Authentication and privacy mechanisms of secure IP allow for security strategy • IPSec can be implemented in routers or firewalls owned and operated by the organization, allowing the network manager complete control over security aspects of the VPN Business Data Commun ications, 5e 36 ... Business Data Commun ications, 5e 18 Public-Key Encryption Operation Business Data Commun ications, 5e 19 Public-Key Signature Operation Business Data Commun ications, 5e 20 Characteristics of Public-Key... is inefficient Business Data Commun ications, 5e Advanced Encryption Standard Business Data Commun ications, 5e Location of Encryption Devices • Link encryption – Each vulnerable communications. .. address this issue Business Data Commun ications, 5e 27 Public Key Certificates Business Data Commun ications, 5e 28 Public Key Certificate Process A public key is generated by the user and submitted