Chapter 37. Secure Networks

Transcription

1 Chapter 37 Network Security (Access Control, Encryption, Firewalls) Secure Networks Secure network is not an absolute term Need to define security policy for organization Network security policy cannot be separated from security policy for attached computers Costs and benefits of security policies must be assessed 2

2 Network Security Policy Devising a network security policy can be complex because a rational policy requires an organization to assess the value of information. The policy must apply to information stored in computers as well as to information traversing a network. 3 Data integrity Aspects of Security Data availability Data confidentiality Privacy 4

3 Responsibility and Control Accountability: how an audit trail is kept Authorization: who is responsible for each item and how is responsibility delegated to others 5 Integrity Mechanisms Techniques to ensure integrity Parity bits Checksums CRCs These cannot guarantee data integrity (e.g., against intentional change Use of message authentication code (MAC) that cannot be broken or forged 6

4 Access Control and Passwords Passwords used to control access Over a network, passwords susceptible to snooping 7 Encryption and Confidentiality To ensure confidentiality of a transmitted message, use encryption Secret key or public key schemes message m encryption decryption message m Secret key S Secret key S 8

5 Public Key Cryptosystem Each processor has private key S and public key P S is kept secret, and cannot be deduced from P P is made available to all processors Encryption and decryption with S and P are inverse functions: P(S(m)) = m and S(P(m)) = m message m encryption decryption message m private key S public key P message m encryption decryption message m public key P private key S 9 Message Digest Digest function maps arbitrary length message m to fixed length digest d(m) One-way function: given d(m), can't find m Collision-free: infeasible to generate m and m' such that d(m) = d(m') message digest 10

6 Digital Signature To sign message m, sender computes digest d(m) Sender computes S(d(m)) and sends along with m Receiver computes P(S(d(m))) = d(m) Receiver computes digest of m and compares with result above; if match, signature is verified 11 Digital Signature Sender: Alice Receiver: Bob compute digest compute signature Alice's Private Key signature compute digest verify signature Alice's Public Key 12

7 Internet Firewall Protect an organization s computers from internet problems (firewall between two structures to prevent spread of fire) 13 Internet Firewall All traffic entering the organization passes through the firewall All traffic leaving the organization passes through the firewall The firewall implements the security policy and rejects any traffic that doesn t adhere The firewall must be immune to security attacks 14

8 Packet Filtering Packet filter is embedded in router Specify which packets can pass through and which should be blocked 15 Using Packet Filters to Create a Firewall Three components in a firewall Packet filter for incoming packets Packet filter for outgoing packets Secure computer system to run application-layer gateways or proxies 16

9 Virtual Private Networks Two approaches to building corporate intranet for an organization with multiple sites: Private network connections (confidential) Public internet connections (low cost) Virtual Private Network Achieve both confidentiality and low cost Implemented in software 17 Virtual Private Network VPN software in router at each site gives appearance of a private network 18

10 Virtual Private Network Obtain internet connection for each site Choose router at each site to run VPN software Configure VPN software in each router to know about the VPN routers at other sites VPN software acts as a packet filter; next hop for outgoing datagram is another VPN router Each outgoing datagram is encrypted 19 Tunneling Desire to encrypt entire datagram so source and destination addresses are not visible on Internet How can internet routers do proper forwarding? Solution: VPN software encrypts entire datagram and places inside another for transmission Called IP-in-IP tunneling (encapsulation) 20

11 Tunneling Datagram from computer x at site 1 to computer y at site 2 Router R 1 on site 1 encrypts, encapsulates in new datagram for transmission to router R 2 on site 2 21 Summary Security is desirable but must be defined by an organization Assess value of information and define a security policy Aspects to consider include privacy and data integrity, availability, and confidentiality 22

12 Summary (continued) Mechanisms to provide aspects of security Encryption: secret and public key cryptosystems Firewalls: packet filtering Virtual private networks Use Internet to transfer data among organization s sites but ensure that data cannot be read by others 23