The new Internet Protocol securityipsec testing with TTCN-3
|
|
|
- Hilda Goodwin
- 10 years ago
- Views:
Transcription
1 The new Internet Protocol security testing with TTCN-3 Ariel Sabiguero 1,2 María Eugenia Corti 1 César Viho 2 1 Instituto de Computación, Facultad de Ingeniería, Universidad de la República J. Herrera y Reissig 565, Montevideo, Uruguay {asabigue,mcorti}@fing.edu.uy 2 IRISA / Dionysos Campus Universitaire de Beaulieu Rennes CEDEX, France {asabigue,viho}@irisa.fr 30/05/2007 The new Internet Protocol security testing with TTCN-3
2 Overview of relevant concepts General test description Selected test case description IRISA T3DevKit GNU crypto library Implementation alternatives CoDec based development CoDec+ExtFunctions development Code engineering Test Specification Size Performance The new Internet Protocol security testing with TTCN-3
3 Suite of security protocols Overview of relevant concepts General test description Selected test case description Connectionless Integrity Authentication Header (AH) Encapsulating Security Payload (ESP) The new Internet Protocol security testing with TTCN-3
4 Suite of security protocols Overview of relevant concepts General test description Selected test case description Connectionless Integrity Data Origin Authentication Authentication Header (AH) Encapsulating Security Payload (ESP) The new Internet Protocol security testing with TTCN-3
5 Suite of security protocols Overview of relevant concepts General test description Selected test case description Connectionless Integrity Data Origin Authentication Access Control Authentication Header (AH) Encapsulating Security Payload (ESP) The new Internet Protocol security testing with TTCN-3
6 Suite of security protocols Overview of relevant concepts General test description Selected test case description Authentication Header (AH) Connectionless Integrity Data Origin Authentication Access Control Confidentiality Encapsulating Security Payload (ESP) The new Internet Protocol security testing with TTCN-3
7 Overview of relevant concepts General test description Selected test case description Set of cryptographic algorithms Encryption algorithm 3DES-CBC Authentication algorithm The new Internet Protocol security testing with TTCN-3
8 Overview of relevant concepts General test description Selected test case description Set of cryptographic algorithms Encryption algorithm 3DES-CBC NULL Authentication algorithm The new Internet Protocol security testing with TTCN-3
9 Overview of relevant concepts General test description Selected test case description Set of cryptographic algorithms Encryption algorithm 3DES-CBC NULL AES-CBC Authentication algorithm The new Internet Protocol security testing with TTCN-3
10 Overview of relevant concepts General test description Selected test case description Set of cryptographic algorithms Encryption algorithm 3DES-CBC NULL AES-CBC AES-CTR Authentication algorithm The new Internet Protocol security testing with TTCN-3
11 Overview of relevant concepts General test description Selected test case description Set of cryptographic algorithms Encryption algorithm 3DES-CBC NULL AES-CBC AES-CTR Authentication algorithm HMAC-SHA1-96 The new Internet Protocol security testing with TTCN-3
12 Overview of relevant concepts General test description Selected test case description Set of cryptographic algorithms Encryption algorithm 3DES-CBC NULL AES-CBC AES-CTR Authentication algorithm HMAC-SHA1-96 NULL The new Internet Protocol security testing with TTCN-3
13 Overview of relevant concepts General test description Selected test case description Set of cryptographic algorithms Encryption algorithm 3DES-CBC NULL AES-CBC AES-CTR Authentication algorithm HMAC-SHA1-96 NULL AES-XCBX-MAC-96 The new Internet Protocol security testing with TTCN-3
14 modes Outline Overview of relevant concepts General test description Selected test case description Network Network Client A Transport mode Client B Client A Tunnel mode Client B The new Internet Protocol security testing with TTCN-3
15 Overview of relevant concepts General test description Selected test case description SPD and SA Security Policy Database control traffic The new Internet Protocol security testing with TTCN-3
16 Overview of relevant concepts General test description Selected test case description SPD and SA Security Policy Database control traffic consulted for incoming and outgoing traffic The new Internet Protocol security testing with TTCN-3
17 Overview of relevant concepts General test description Selected test case description SPD and SA Security Policy Database control traffic consulted for incoming and outgoing traffic Security Association The new Internet Protocol security testing with TTCN-3
18 Overview of relevant concepts General test description Selected test case description SPD and SA Security Policy Database control traffic consulted for incoming and outgoing traffic Security Association simplex connection that affords security services to the traffic carried by it. The new Internet Protocol security testing with TTCN-3
19 Overview of relevant concepts General test description Selected test case description SPD and SA Security Policy Database control traffic consulted for incoming and outgoing traffic Security Association simplex connection that affords security services to the traffic carried by it. each SA an entry in the SA Database (SAD) The new Internet Protocol security testing with TTCN-3
20 Overview of relevant concepts General test description Selected test case description SPD and SA Security Policy Database control traffic consulted for incoming and outgoing traffic Security Association simplex connection that affords security services to the traffic carried by it. each SA an entry in the SA Database (SAD) one SA for each traffic direction The new Internet Protocol security testing with TTCN-3
21 v6rl test suite coverage Overview of relevant concepts General test description Selected test case description Tunnel and Transport mode The new Internet Protocol security testing with TTCN-3
22 Overview of relevant concepts General test description Selected test case description v6rl test suite coverage Tunnel and Transport mode A combination of authentication and encryption algorithms The new Internet Protocol security testing with TTCN-3
23 Overview of relevant concepts General test description Selected test case description v6rl test suite coverage Tunnel and Transport mode A combination of authentication and encryption algorithms Only ESP The new Internet Protocol security testing with TTCN-3
24 Overview of relevant concepts General test description Selected test case description v6rl test suite coverage Tunnel and Transport mode A combination of authentication and encryption algorithms Only ESP Manual key configuration The new Internet Protocol security testing with TTCN-3
25 Overview of relevant concepts General test description Selected test case description v6rl test suite coverage Tunnel and Transport mode A combination of authentication and encryption algorithms Only ESP Manual key configuration ICMPv6 messages exchange The new Internet Protocol security testing with TTCN-3
26 Overview of relevant concepts General test description Selected test case description Test case NUT Transport mode tested 3DES-CBC encryption algorithm NULL authentication algorithm NUT_Link0=PF0::some_address ROUTER1_Link0=PF0::f ROUTER1 ROUTER1_Link1=PF1::f HOST1_Link1=PF1::1 HOST1 The new Internet Protocol security testing with TTCN-3
27 Overview of relevant concepts General test description Selected test case description Test case NUT Transport mode tested 3DES-CBC encryption algorithm NULL authentication algorithm NUT_Link0=PF0::some_address ROUTER1_Link0=PF0::f ROUTER1 ROUTER1_Link1=PF1::f HOST1_Link1=PF1::1 HOST1 The new Internet Protocol security testing with TTCN-3
28 Overview of relevant concepts General test description Selected test case description Test case NUT Transport mode tested 3DES-CBC encryption algorithm NULL authentication algorithm NUT_Link0=PF0::some_address ROUTER1_Link0=PF0::f ROUTER1 ROUTER1_Link1=PF1::f HOST1_Link1=PF1::1 HOST1 The new Internet Protocol security testing with TTCN-3
29 T3DevKit & IPv6 ATS IRISA T3DevKit GNU crypto library Why? Helper tool for implementing TA-PA, TRI-SA and TCI-CD The new Internet Protocol security testing with TTCN-3
30 IRISA T3DevKit GNU crypto library T3DevKit & IPv6 ATS Why? Helper tool for implementing TA-PA, TRI-SA and TCI-CD Works in C++ environment, adequate for testing The new Internet Protocol security testing with TTCN-3
31 IRISA T3DevKit GNU crypto library T3DevKit & IPv6 ATS Why? Helper tool for implementing TA-PA, TRI-SA and TCI-CD Works in C++ environment, adequate for testing Existing IPv6 ATS enables code reuse (IPv6, ICMPv6, etc.) The new Internet Protocol security testing with TTCN-3
32 IRISA T3DevKit GNU crypto library T3DevKit & IPv6 ATS Why? Helper tool for implementing TA-PA, TRI-SA and TCI-CD Works in C++ environment, adequate for testing Existing IPv6 ATS enables code reuse (IPv6, ICMPv6, etc.) Freely available under CeCILL-C license The new Internet Protocol security testing with TTCN-3
33 GNU crypto library Outline IRISA T3DevKit GNU crypto library General purpose cryptographic library The new Internet Protocol security testing with TTCN-3
34 IRISA T3DevKit GNU crypto library GNU crypto library General purpose cryptographic library Several cryptographic algorithms provided The new Internet Protocol security testing with TTCN-3
35 IRISA T3DevKit GNU crypto library GNU crypto library General purpose cryptographic library Several cryptographic algorithms provided All cryptographic functions implemented The new Internet Protocol security testing with TTCN-3
36 IRISA T3DevKit GNU crypto library GNU crypto library General purpose cryptographic library Several cryptographic algorithms provided All cryptographic functions implemented Broad user base and examples on-line The new Internet Protocol security testing with TTCN-3
37 IRISA T3DevKit GNU crypto library GNU crypto library General purpose cryptographic library Several cryptographic algorithms provided All cryptographic functions implemented Broad user base and examples on-line Freely available under LGPL license The new Internet Protocol security testing with TTCN-3
38 Implementation alternatives CoDec based development CoDec+ExtFunctions development Test case engineering Just an ICMPv6 Echo Request and Echo Reply exchanged Simple message sequence Messages use 3DES-CBC encryption with PSK Complex assembly and disassembly Where to perform cryptographic operations? The new Internet Protocol security testing with TTCN-3
39 Implementation alternatives CoDec based development CoDec+ExtFunctions development Test case engineering Just an ICMPv6 Echo Request and Echo Reply exchanged Simple message sequence Messages use 3DES-CBC encryption with PSK Complex assembly and disassembly Where to perform cryptographic operations? The new Internet Protocol security testing with TTCN-3
40 Implementation alternatives CoDec based development CoDec+ExtFunctions development Test case engineering Just an ICMPv6 Echo Request and Echo Reply exchanged Simple message sequence Messages use 3DES-CBC encryption with PSK Complex assembly and disassembly Where to perform cryptographic operations? The new Internet Protocol security testing with TTCN-3
41 Test case engineering Outline Implementation alternatives CoDec based development CoDec+ExtFunctions development Just an ICMPv6 Echo Request and Echo Reply exchanged Simple message sequence Messages use 3DES-CBC encryption with PSK Complex assembly and disassembly Where to perform cryptographic operations? CoDec External Functions The new Internet Protocol security testing with TTCN-3
42 Implementation alternatives CoDec based development CoDec+ExtFunctions development CoDec only Transmission ESP message modeled in TTCN-3 Checksum and padding fields calculated in the CoDec Payload encrypted in the CoDec Link1.send(ICMPv6WithESP_EchoRequest_AuthNULL(SPI_SA1, O)); The new Internet Protocol security testing with TTCN-3
43 Implementation alternatives CoDec based development CoDec+ExtFunctions development CoDec only Transmission ESP message modeled in TTCN-3 Checksum and padding fields calculated in the CoDec Payload encrypted in the CoDec Link1.send(ICMPv6WithESP_EchoRequest_AuthNULL(SPI_SA1, O)); The new Internet Protocol security testing with TTCN-3
44 Implementation alternatives CoDec based development CoDec+ExtFunctions development CoDec only Transmission ESP message modeled in TTCN-3 Checksum and padding fields calculated in the CoDec Payload encrypted in the CoDec Link1.send(ICMPv6WithESP_EchoRequest_AuthNULL(SPI_SA1, O)); The new Internet Protocol security testing with TTCN-3
45 CoDec only Reception Implementation alternatives CoDec based development CoDec+ExtFunctions development alt //Receive the correct answer [] Link1.receive(ICMPv6WithESP_EchoReply_AuthNULL (SPI_SA2, O)) { setverdict(pass); replytimer.stop; } //Receive incorrect answer [] Link1.receive { setverdict(fail); replytimer.stop; } //Receive no answer [] replytimer.timeout { setverdict(fail); } The new Internet Protocol security testing with TTCN-3
46 CoDec only Reception Implementation alternatives CoDec based development CoDec+ExtFunctions development alt //Receive the correct answer [] Link1.receive(ICMPv6WithESP_EchoReply_AuthNULL (SPI_SA2, O)) { setverdict(pass); replytimer.stop; } //Receive incorrect answer [] Link1.receive { setverdict(fail); replytimer.stop; } //Receive no answer [] replytimer.timeout { setverdict(fail); } The new Internet Protocol security testing with TTCN-3
47 CoDec only Reception Implementation alternatives CoDec based development CoDec+ExtFunctions development alt //Receive the correct answer [] Link1.receive(ICMPv6WithESP_EchoReply_AuthNULL (SPI_SA2, O)) { setverdict(pass); replytimer.stop; } //Receive incorrect answer [] Link1.receive { setverdict(fail); replytimer.stop; } //Receive no answer [] replytimer.timeout { setverdict(fail); } The new Internet Protocol security testing with TTCN-3
48 CoDec+Ext Transmission Implementation alternatives CoDec based development CoDec+ExtFunctions development template ESPMessage ICMPv6ESPMessage (IPv6AddressType src, IPv6AddressType dst, octetstring m_spi, octetstring m_data, UInt16 checksum) := { } SPI:= m_spi, SeqNum := 1, Payload := EncryptPayload(src, dst, EchoRequestType, m_data, checksum), ICV :=omit The new Internet Protocol security testing with TTCN-3
49 CoDec+Ext Reception Implementation alternatives CoDec based development CoDec+ExtFunctions development alt{ } //Receive correct answer, unverified encrypted payload [] Link1.receive(ICMPv6ESPMessage_Answer_AuthNULL (PF0_1, PF1_1, SPI_SA2, DATA, checksum)) -> value Myvar { var bitstring encpayload := Myvar.Payload; var UInt8 payloadlength := lengthof(encpayload)/8; var EncPayload payload := DecriptPayload(encpayload, payloadlength); if (match(payload, ICMPv6EncPayload_Answer(PF0_1, PF1_1, DATA))) { setverdict(pass); } else { setverdict(fail); } replytimer.stop; } //Receive incorrect answer [] Link1.receive { setverdict(fail); replytimer.stop; } //Receive no answer [] replytimer.timeout { setverdict(fail); } The new Internet Protocol security testing with TTCN-3
50 CoDec+Ext Reception Implementation alternatives CoDec based development CoDec+ExtFunctions development alt{ } //Receive correct answer, unverified encrypted payload [] Link1.receive(ICMPv6ESPMessage_Answer_AuthNULL (PF0_1, PF1_1, SPI_SA2, DATA, checksum)) -> value Myvar { var bitstring encpayload := Myvar.Payload; var UInt8 payloadlength := lengthof(encpayload)/8; var EncPayload payload := DecriptPayload(encpayload, payloadlength); if (match(payload, ICMPv6EncPayload_Answer(PF0_1, PF1_1, DATA))) { setverdict(pass); } else { setverdict(fail); } replytimer.stop; } //Receive incorrect answer [] Link1.receive { setverdict(fail); replytimer.stop; } //Receive no answer [] replytimer.timeout { setverdict(fail); } The new Internet Protocol security testing with TTCN-3
51 CoDec+Ext Reception Implementation alternatives CoDec based development CoDec+ExtFunctions development alt{ } //Receive correct answer, unverified encrypted payload [] Link1.receive(ICMPv6ESPMessage_Answer_AuthNULL (PF0_1, PF1_1, SPI_SA2, DATA, checksum)) -> value Myvar { var bitstring encpayload := Myvar.Payload; var UInt8 payloadlength := lengthof(encpayload)/8; var EncPayload payload := DecriptPayload(encpayload, payloadlength); if (match(payload, ICMPv6EncPayload_Answer(PF0_1, PF1_1, DATA))) { setverdict(pass); } else { setverdict(fail); } replytimer.stop; } //Receive incorrect answer [] Link1.receive { setverdict(fail); replytimer.stop; } //Receive no answer [] replytimer.timeout { setverdict(fail); } The new Internet Protocol security testing with TTCN-3
52 Code engineering Test Specification Size Performance Message transmission & reception CoDec High ATS abstraction (too much?) External Functions The new Internet Protocol security testing with TTCN-3
53 Code engineering Test Specification Size Performance Message transmission & reception CoDec High ATS abstraction (too much?) External Functions More control from ATS The new Internet Protocol security testing with TTCN-3
54 Code engineering Test Specification Size Performance Message transmission & reception CoDec High ATS abstraction (too much?) Increased CoDec complexity External Functions More control from ATS The new Internet Protocol security testing with TTCN-3
55 Code engineering Test Specification Size Performance Message transmission & reception CoDec High ATS abstraction (too much?) Increased CoDec complexity External Functions More control from ATS CoDec just encode and decode The new Internet Protocol security testing with TTCN-3
56 Code engineering Test Specification Size Performance Message transmission & reception CoDec High ATS abstraction (too much?) Increased CoDec complexity Difficult code factorization and reuse External Functions More control from ATS CoDec just encode and decode The new Internet Protocol security testing with TTCN-3
57 Code engineering Test Specification Size Performance Message transmission & reception CoDec High ATS abstraction (too much?) Increased CoDec complexity Difficult code factorization and reuse External Functions More control from ATS CoDec just encode and decode Software engineering techniques applicable The new Internet Protocol security testing with TTCN-3
58 Code engineering Test Specification Size Performance loc based metrics The new Internet Protocol security testing with TTCN-3
59 Performance Outline Code engineering Test Specification Size Performance Every time an external function is invoked, encode and decode operations on the CoDec are invoked The new Internet Protocol security testing with TTCN-3
60 Code engineering Test Specification Size Performance Performance Every time an external function is invoked, encode and decode operations on the CoDec are invoked External functions based approach requires 4 external function invocations. The new Internet Protocol security testing with TTCN-3
61 Code engineering Test Specification Size Performance Performance Every time an external function is invoked, encode and decode operations on the CoDec are invoked External functions based approach requires 4 external function invocations. Not relevant in conformance or interoperability testing, but might be critical for other test paradigms. The new Internet Protocol security testing with TTCN-3
62 Final remarks Ongoing research for more thorough analysis Both methodologies are valid and applicable, with consistent results Excessively complex CoDec development diverges from TTCN-3 philosophy When performance degradation is allowed, external functions provide better code properties and a cleaner solution The new Internet Protocol security testing with TTCN-3
63 Final remarks Ongoing research for more thorough analysis Both methodologies are valid and applicable, with consistent results Excessively complex CoDec development diverges from TTCN-3 philosophy When performance degradation is allowed, external functions provide better code properties and a cleaner solution The new Internet Protocol security testing with TTCN-3
64 Final remarks Ongoing research for more thorough analysis Both methodologies are valid and applicable, with consistent results Excessively complex CoDec development diverges from TTCN-3 philosophy When performance degradation is allowed, external functions provide better code properties and a cleaner solution The new Internet Protocol security testing with TTCN-3
65 Final remarks Ongoing research for more thorough analysis Both methodologies are valid and applicable, with consistent results Excessively complex CoDec development diverges from TTCN-3 philosophy When performance degradation is allowed, external functions provide better code properties and a cleaner solution The new Internet Protocol security testing with TTCN-3
66 Thank you for your time Questions? The new Internet Protocol security testing with TTCN-3
Protocol Security Where?
IPsec: AH and ESP 1 Protocol Security Where? Application layer: (+) easy access to user credentials, extend without waiting for OS vendor, understand data; (-) design again and again; e.g., PGP, ssh, Kerberos
Securing IP Networks with Implementation of IPv6
Securing IP Networks with Implementation of IPv6 R.M.Agarwal DDG(SA), TEC Security Threats in IP Networks Packet sniffing IP Spoofing Connection Hijacking Denial of Service (DoS) Attacks Man in the Middle
CSCI 454/554 Computer and Network Security. Topic 8.1 IPsec
CSCI 454/554 Computer and Network Security Topic 8.1 IPsec Outline IPsec Objectives IPsec architecture & concepts IPsec authentication header IPsec encapsulating security payload 2 IPsec Objectives Why
Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity
Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration
21.4 Network Address Translation (NAT) 21.4.1 NAT concept
21.4 Network Address Translation (NAT) This section explains Network Address Translation (NAT). NAT is also known as IP masquerading. It provides a mapping between internal IP addresses and officially
Network Security. Lecture 3
Network Security Lecture 3 Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Security protocols application transport network datalink physical Contents IPSec overview
Network Security Part II: Standards
Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 [email protected] These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview
CS 4803 Computer and Network Security
Network layers CS 4803 Computer and Network Security Application Transport Network Lower level Alexandra (Sasha) Boldyreva IPsec 1 2 Roughly Application layer: the communicating processes themselves and
Chapter 32 Internet Security
Chapter 32 Internet Security Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. Chapter 32: Outline 32.1 NETWORK-LAYER SECURITY 32.2 TRANSPORT-LAYER SECURITY 32.3
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance Johnnie Chen Project Manager of Network Security Group Network Benchmarking Lab Network Benchmarking Laboratory
APNIC elearning: IPSec Basics. Contact: [email protected]. esec03_v1.0
APNIC elearning: IPSec Basics Contact: [email protected] esec03_v1.0 Overview Virtual Private Networks What is IPsec? Benefits of IPsec Tunnel and Transport Mode IPsec Architecture Security Associations
IPsec Details 1 / 43. IPsec Details
Header (AH) AH Layout Other AH Fields Mutable Parts of the IP Header What is an SPI? What s an SA? Encapsulating Security Payload (ESP) ESP Layout Padding Using ESP IPsec and Firewalls IPsec and the DNS
Security Engineering Part III Network Security. Security Protocols (II): IPsec
Security Engineering Part III Network Security Security Protocols (II): IPsec Juan E. Tapiador [email protected] Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,
IP Security. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ [email protected] +46 470 70 86 49
IP Security Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ [email protected] +46 470 70 86 49 1 Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security
IP SECURITY (IPSEC) PROTOCOLS
29 IP SECURITY (IPSEC) PROTOCOLS One of the weaknesses of the original Internet Protocol (IP) is that it lacks any sort of general-purpose mechanism for ensuring the authenticity and privacy of data as
Building scalable IPSec infrastructure with MikroTik. IPSec, L2TP/IPSec, OSPF
Building scalable IPSec infrastructure with MikroTik IPSec, L2TP/IPSec, OSPF Presenter information Tomas Kirnak Network design Security, wireless Servers Virtualization MikroTik Certified Trainer Atris,
Lecture 17 - Network Security
Lecture 17 - Network Security CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Idea Why donʼt we just integrate some of these neat
Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku
Univerzita Komenského v Bratislave Fakulta matematiky, fyziky a informatiky Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku ITMS: 26140230008 dopytovo orientovaný projekt Moderné
Computer and Network Security Exercise no. 4
University of Haifa Winter Semester 11/1/12 Computer and Network Security Exercise no. 4 Submit in Pairs/Single to mailbox 19 by 25/1/12, 2:00 p.m. 1. Following the sensitivity of the information in its
Chapter 4 Virtual Private Networking
Chapter 4 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FVL328 Firewall. VPN tunnels provide secure, encrypted communications between
INF3510 Information Security University of Oslo Spring 2011. Lecture 9 Communication Security. Audun Jøsang
INF3510 Information Security University of Oslo Spring 2011 Lecture 9 Communication Security Audun Jøsang Outline Network security concepts Communication security Perimeter security Protocol architecture
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
Outline. INF3510 Information Security. Lecture 10: Communications Security. Communication Security Analogy. Network Security Concepts
Outline INF3510 Information Security Lecture 10: Communications Security Network security concepts Communication security Perimeter security Protocol architecture and security services Example security
Lecture 10: Communications Security
INF3510 Information Security Lecture 10: Communications Security Audun Jøsang University of Oslo Spring 2015 Outline Network security concepts Communication security Perimeter security Protocol architecture
Chapter 5: Network Layer Security
Managing and Securing Computer Networks Guy Leduc Mainly based on Network Security - PRIVATE Communication in a PUBLIC World C. Kaufman, R. Pearlman, M. Speciner Pearson Education, 2002. (chapters 17 and
Internet Security. Internet Security Voice over IP. Introduction. ETSF10 Internet Protocols 2011-11-22. ETSF10 Internet Protocols 2011
Internet Security Voice over IP ETSF10 Internet Protocols 2011 Kaan Bür & Jens Andersson Department of Electrical and Information Technology Internet Security IPSec 32.1 SSL/TLS 32.2 Firewalls 32.4 + Voice
Using IPSec in Windows 2000 and XP, Part 2
Page 1 of 8 Using IPSec in Windows 2000 and XP, Part 2 Chris Weber 2001-12-20 This is the second part of a three-part series devoted to discussing the technical details of using Internet Protocol Security
Introduction to Computer Security
Introduction to Computer Security Network Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Circuit switching vs. packet switching OSI and TCP/IP layered models TCP/IP encapsulation
INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002
INTERNET SECURITY: FIREWALLS AND BEYOND Mehernosh H. Amroli 4-25-2002 Preview History of Internet Firewall Technology Internet Layer Security Transport Layer Security Application Layer Security Before
Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1
Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 roadmap 1 What is network security? 2 Principles of cryptography 3 Message integrity, authentication
CCNA Security 1.1 Instructional Resource
CCNA Security 1.1 Instructional Resource Chapter 8 Implementing Virtual Private Networks 2012 Cisco and/or its affiliates. All rights reserved. 1 Describe the purpose and types of VPNs and define where
Internet Protocol: IP packet headers. vendredi 18 octobre 13
Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)
Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress
Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress Alan Davy and Lei Shi Telecommunication Software&Systems Group, Waterford Institute of Technology, Ireland adavy,[email protected]
13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) 13.2 Layer 2/3/4 VPNs 13.3 Multi-Protocol Label Switching 13.4 IPsec Transport Mode
13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) PPP-based remote access using dial-in PPP encryption control protocol (ECP) PPP extensible authentication protocol (EAP) 13.2 Layer 2/3/4
Security Architecture for IP (IPsec)
Security Architecture for IP (IPsec) Security Association (SA), AH-Protocol, ESP-Protocol Operation-Modes, Internet Key Exchange Protocol (IKE) Agenda Overview AH Protocol ESP Protocol Security Association
The application of TTCN-3 in M2M Testing
The application of TTCN-3 in M2M Testing Xiaohong Huang, Ruiping Zhu, Weihai Li, Yan Ma TTCN-3 User Conference 2010 June 8-10 2009, Beijing, CHINA Outlines Introduction M2M Network Architecture TTCN-3
CS 356 Lecture 27 Internet Security Protocols. Spring 2013
CS 356 Lecture 27 Internet Security Protocols Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Chapter 9. IP Secure
Chapter 9 IP Secure 1 Network architecture is usually explained as a stack of different layers. Figure 1 explains the OSI (Open System Interconnect) model stack and IP (Internet Protocol) model stack.
Introduction to Computer Security
Introduction to Computer Security Network Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Circuit switching vs. packet switching OSI and TCP/IP layered models TCP/IP encapsulation
The GO4IT IPv6 Test Tool and Associated services. Alain Vouffo FOKUS (Fraunhofer Institute for Open Communication Systems) [email protected].
The GO4IT IPv6 Test Tool and Associated services Alain Vouffo FOKUS (Fraunhofer Institute for Open Communication Systems) [email protected] Roadmap Motivations Introduction The GO4IT IPv6 Test
How To Establish IPSec VPN connection between Cyberoam and Mikrotik router
How To Establish IPSec VPN connection between Cyberoam and Mikrotik router Applicable Version: 10.00 onwards Scenario Establish IPSec VPN connection between Cyberoam and Mikrotik router using Preshared
Internet Protocol Security IPSec
Internet Protocol Security IPSec Summer Semester 2011 Integrated Communication Systems Group Ilmenau University of Technology Outline Introduction Authentication Header (AH) Encapsulating Security Payload
Lecture 5.1: IPsec Basics
Lecture 5.1: sec Basics Recommended reading: Stallings, Chapter 16 (RFCs are perhaps a bit too complex and extensive for our class use as extra reading material) A parenthesis VPNs: what they are Perhaps
Introduction to Security and PIX Firewall
Introduction to Security and PIX Firewall Agenda Dag 28 Föreläsning LAB PIX Firewall VPN A Virtual Private Network (VPN) is a service offering secure, reliable connectivity over a shared, public network
z/os Firewall Technology Overview
z/os Firewall Technology Overview Mary Sweat E - Mail: [email protected] Washington System Center OS/390 Firewall/VPN 1 Firewall Technologies Tools Included with the OS/390 Security Server Configuration
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
This is a guide on how to create an IPsec VPN tunnel from a local client running Shrew Soft VPN Client to an Opengear device.
IPsec VPN Guide Opengear to Shrew Soft VPN Client This is a guide on how to create an IPsec VPN tunnel from a local client running Shrew Soft VPN Client to an Opengear device. In this document: 1. Network
Quality of Service Analysis of site to site for IPSec VPNs for realtime multimedia traffic.
Quality of Service Analysis of site to site for IPSec VPNs for realtime multimedia traffic. A Network and Data Link Layer infrastructure Design to Improve QoS in Voice and video Traffic Jesús Arturo Pérez,
IP Security. IPSec, PPTP, OpenVPN. Pawel Cieplinski, AkademiaWIFI.pl. MUM Wroclaw
IP Security IPSec, PPTP, OpenVPN Pawel Cieplinski, AkademiaWIFI.pl MUM Wroclaw Introduction www.akademiawifi.pl WCNG - Wireless Network Consulting Group We are group of experienced professionals. Our company
Chapter 8 Virtual Private Networking
Chapter 8 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FWG114P v2 Wireless Firewall/Print Server. VPN tunnels provide secure, encrypted
[SMO-SFO-ICO-PE-046-GU-
Presentation This module contains all the SSL definitions. See also the SSL Security Guidance Introduction The package SSL is a static library which implements an API to use the dynamic SSL library. It
IPsec VPN Application Guide REV: 1.0.0 1910010876
IPsec VPN Application Guide REV: 1.0.0 1910010876 CONTENTS Chapter 1. Overview... 1 Chapter 2. Before Configuration... 2 Chapter 3. Configuration... 5 3.1 Configure IPsec VPN on TL-WR842ND (Router A)...
Triple DES Encryption for IPSec
Triple DES Encryption for IPSec Feature Summary Platforms Prerequisites IPSec supports the Triple DES encryption algorithm (168-bit) in addition to 56-bit encryption. Triple DES (3DES) is a strong form
Network Working Group Request for Comments: 4301. Category: Standards Track December 2005. Security Architecture for the Internet Protocol
Network Working Group S. Kent Request for Comments: 4301 K. Seo Obsoletes: 2401 BBN Technologies Category: Standards Track December 2005 Status of This Memo Security Architecture for the Internet Protocol
MPLS VPN in Cellular Mobile IPv6 Architectures(04##017)
MPLS VPN in Cellular Mobile IPv6 Architectures(04##017) Yao-Chung Chang, Han-Chieh Chao, K.M. Liu and T. G. Tsuei* Department of Electrical Engineering, National Dong Hwa University Hualien, Taiwan, Republic
MINI-FAQ: OpenBSD 2.4 IPSEC VPN Configuration
MINI-FAQ: OpenBSD 2.4 IPSEC VPN Configuration Maintainer: Steve McQuade v1.07 - March 2, 1999 After trying to configure an OpenBSD 2.4 IPSEC based VPN based on the samples and
Network Security. Marcus Bendtsen Institutionen för Datavetenskap (IDA) Avdelningen för Databas- och Informationsteknik (ADIT)
Network Security Securing communications (SSL/TLS and IPSec) Marcus Bendtsen Institutionen för Datavetenskap (IDA) Avdelningen för Databas- och Informationsteknik (ADIT) Network communication Who are you
VPN Modules for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers
Q&A VPN Modules for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers OVERVIEW Q. What is a VPN? A. A VPN, or virtual private network, delivers the benefits of private network security,
Cryptography and Network Security IPSEC
Cryptography and Network Security IPSEC Security architecture and protocol stack Applicaz. (SHTTP) SSL/TLS TCP IPSEC IP Secure applications: PGP, SHTTP, SFTP, or Security down in the protocol stack -SSL
IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers
IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers Application Note Revision 1.0 10 February 2011 Copyright 2011. Aruba Networks, Inc. All rights reserved. IPsec VPN Security
Network virtualization
Martin Černý, Jan Fürman ([email protected], [email protected]) Department of Computer Systems Faculty of Information Technologies Czech technical university in Prague Martin Černý, Jan Fürman,
IPv6 Fundamentals: A Straightforward Approach
IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6 Rick Graziani Cisco Press 800 East 96th Street Indianapolis, IN 46240 IPv6 Fundamentals Contents Introduction xvi Part I: Background
Dr. Arjan Durresi. Baton Rouge, LA 70810 [email protected] These slides are available at: http://www.csc.lsu.edu/~durresi/csc4601_07/
Set of Problems 2 Dr. Arjan Durresi Louisiana State University Baton Rouge, LA 70810 [email protected] These slides are available at: http://www.csc.lsu.edu/~durresi/csc4601_07/ Louisiana State University
Security issues with Mobile IP
Technical report, IDE1107, February 2011 Security issues with Mobile IP Master s Thesis in Computer Network Engineering Abdel Rahman Alkhawaja & Hatem Sheibani School of Information Science, Computer and
UVOIP: CROSS-LAYER OPTIMIZATION OF BUFFER OPERATIONS FOR PROVIDING SECURE VOIP SERVICES ON CONSTRAINED EMBEDDED DEVICES
UVOIP: CROSS-LAYER OPTIMIZATION OF BUFFER OPERATIONS FOR PROVIDING SECURE VOIP SERVICES ON CONSTRAINED EMBEDDED DEVICES Dinil.D 1, Aravind.P.A 1, Thothadri Rajesh 1, Aravind.P 1, Anand.R 1, Jayaraj Poroor
Computer Networks. Secure Systems
Computer Networks Secure Systems Summary Common Secure Protocols SSH HTTPS (SSL/TSL) IPSec Wireless Security WPA2 PSK vs EAP Firewalls Discussion Secure Shell (SSH) A protocol to allow secure login to
ICSA Labs Network Protection Devices Test Specification Version 1.3
Network Protection Devices Test Specification Version 1.3 August 19, 2011 www.icsalabs.com Change Log Version 1.3 August 19, 2011 added general configuration note to default configuration in Firewall section
Computer and Network Security
Computer and Network Security c Copyright 2000 R E Newman Computer & Information Sciences & Engineering University Of Florida Gainesville, Florida 32611-6120 nemo@ciseufledu Network Security Protocols
This section provides a summary of using network location profiles to identify network connection types. Details include:
Module 7 Network Access and Security In Module 7 students will learn several strategies for controlling network access and enhancing network security. These will include: controlling network location profiles,
Virtual Private Networks: IPSec vs. SSL
Virtual Private Networks: IPSec vs. SSL IPSec SSL Michael Daye Jr. Instructor: Dr. Lunsford ICTN 4040-001 April 16 th 2007 Virtual Private Networks: IPSec vs. SSL In today s society organizations and companies
IPSec Network Security Commands
IPSec Network Security Commands This chapter describes the function and displays the syntax for IPSec network security commands. For more information about defaults and usage guidelines, see the corresponding
Configuring a Lan-to-Lan VPN with Overlapping Subnets with Juniper NetScreen/ISG/SSG Products
Application Note Configuring a Lan-to-Lan VPN with Overlapping Subnets with Juniper NetScreen/ISG/SSG Products Version 1.0 January 2008 Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089
EITF25 Internet Techniques and Applications L5: Wide Area Networks (WAN) Stefan Höst
EITF25 Internet Techniques and Applications L5: Wide Area Networks (WAN) Stefan Höst Data communication in reality In reality, the source and destination hosts are very seldom on the same network, for
Cisco QuickVPN Installation Tips for Windows Operating Systems
Article ID: 2922 Cisco QuickVPN Installation Tips for Windows Operating Systems Objective Cisco QuickVPN is a free software designed for remote access to a network. It is easy to install on a PC and simple
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Deploying IPSec VPN in the Enterprise
VPN5 6/9/03 6:14 PM Page 137 Chapter 5 Deploying IPSec VPN in the Enterprise 5.1 Chapter Overview In Chapters 3 and 4, the focus was on implementing a single site-to-site IPSec VPN and the different IKE
Implementing and Managing Security for Network Communications
3 Implementing and Managing Security for Network Communications............................................... Terms you ll need to understand: Internet Protocol Security (IPSec) Authentication Authentication
Configuring SIP Support for SRTP
Configuring SIP Support for SRTP This chapter contains information about the SIP Support for SRTP feature. The Secure Real-Time Transfer protocol (SRTP) is an extension of the Real-Time Protocol (RTP)
VPNs. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks
VPNs Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
802.11 Security (WEP, WPA\WPA2) 19/05/2009. Giulio Rossetti Unipi [email protected]
802.11 Security (WEP, WPA\WPA2) 19/05/2009 Giulio Rossetti Unipi [email protected] 802.11 Security Standard: WEP Wired Equivalent Privacy The packets are encrypted, before sent, with a Secret Key
Insecure network services. Firewalls. Two separable topics. Packet filtering. Example: blocking forgeries. Example: blocking outgoing mail
Insecure network services NFS (port 2049) - Read/write entire FS as any non-root user given a dir. handle - Many OSes make handles easy to guess Portmap (port 111) - Relays RPC requests, making them seem
Virtual Private Networks
Virtual Private Networks ECE 4886 Internetwork Security Dr. Henry Owen Definition Virtual Private Network VPN! Virtual separation in protocol provides a virtual network using no new hardware! Private communication
VOIP-211RS/210RS/220RS/440S. SIP VoIP Router. User s Guide
VOIP-211RS/210RS/220RS/440S SIP VoIP Router User s Guide Trademarks Contents are subject to revise without prior notice. All trademarks belong to their respective owners. FCC Warning This equipment has
The BANDIT Products in Virtual Private Networks
encor! enetworks TM Version A.1, March 2010 2010 Encore Networks, Inc. All rights reserved. The BANDIT Products in Virtual Private Networks One of the principal features of the BANDIT products is their
CSCI 454/554 Computer and Network Security. Final Exam Review
CSCI 454/554 Computer and Network Security Final Exam Review Topics covered by Final Topic before Midterm 20% Topic after Midterm 80% Date: 05/13/2015 9:00am noon Place: the same classroom Open book/notes
Introduction. An Overview of the DX Industrial Router Product Line. IP router and firewall. Integrated WAN, Serial and LAN interfaces
Introduction An Overview of the D Industrial Router Product Line Secure Access with VPN Technology in Industrial Networks Outlining the IPsec and VPN capabilities available in the GarrettCom D series of
Chapter 10. Network Security
Chapter 10 Network Security 10.1. Chapter 10: Outline 10.1 INTRODUCTION 10.2 CONFIDENTIALITY 10.3 OTHER ASPECTS OF SECURITY 10.4 INTERNET SECURITY 10.5 FIREWALLS 10.2 Chapter 10: Objective We introduce
VPN. VPN For BIPAC 741/743GE
VPN For BIPAC 741/743GE August, 2003 1 The router supports VPN to establish secure, end-to-end private network connections over a public networking infrastructure. There are two types of VPN connections,
Laboratory Exercises V: IP Security Protocol (IPSec)
Department of Electronics Faculty of Electrical Engineering, Mechanical Engineering and Naval Architecture (FESB) University of Split, Croatia Laboratory Exercises V: IP Security Protocol (IPSec) Keywords:
Final exam review, Fall 2005 FSU (CIS-5357) Network Security
Final exam review, Fall 2005 FSU (CIS-5357) Network Security Instructor: Breno de Medeiros 1. What is an insertion attack against a NIDS? Answer: An insertion attack against a network intrusion detection
NATIONAL RESEARCH AGENCY CASE STUDY - CCTV NETWORK SERVICES
NATIONAL RESEARCH AGENCY CASE STUDY - CCTV NWORK SERVICES A Major CCTV network and surveilance services provider chose Senetas certified high-speed encryptors to protect European law enforcement CCTV network
Moonv6 Test Suite. IPv6 Firewall Base Functionality Test Suite. Technical Document. Revision 0.11
Moonv6 Test Suite IPv6 Firewall Base Functionality Test Suite Technical Document Revision 0.11 IPv6 Consortium 121 Technology Drive, Suite 2 InterOperability Laboratory Durham, NH 03824-3525 Research Computing
Configuring TheGreenBow VPN Client with a TP-LINK VPN Router
Configuring TheGreenBow VPN Client with a TP-LINK VPN Router This chapter describes how to configure TheGreenBow VPN Client with a TP-LINK router. This chapter includes the following sections: Example
High Performance VPN Solutions Over Satellite Networks
High Performance VPN Solutions Over Satellite Networks Enhanced Packet Handling Both Accelerates And Encrypts High-Delay Satellite Circuits Characteristics of Satellite Networks? Satellite Networks have
Cisco Networks (ONT) 2006 Cisco Systems, Inc. All rights reserved.
Optimizing Converged Cisco Networks (ONT) reserved. Lesson 2.4: Calculating Bandwidth Requirements for VoIP reserved. Objectives Describe factors influencing encapsulation overhead and bandwidth requirements