SSL Firewalls

Transcription

1 & & ( ) SSL Firewalls :. :.. byte 0x01 : 1,. 1

2 , :,, : ( ) ). : : (Confidentiality) (Integrity) (Availability) :.,,. :. :...,,. :,,. 2

3 (Identification) (Authentication).,,, )... (Authorization) (Accountability) (Non-repudiation)..... ;. Hackers- :. ( ) ; ; :. : (, ).. :.. 3

4 (Vulnerability),,,. (Threat). : : :. :,. :. (risk). (attack). (Countermeasures). :. :. :. :,. :. :.. :. :. :. 4

5 (, ): ( ). : (, ). :.. ) 5

6 . : : (,, ), ). : ( ). : (MAC):. (unilateral authentication):. (mutual authentication):. Password ( ) PIN (challenge-response). Security token (password generator) Smart card, magnetic stripe card - Passwords string x. passwords:.. dictionary attacks. ( ) password checkers password.. Passwords password: dictionary attacks. passwords,,. passwords. default passwords. 6

7 .. : ( ). :. Crossover Error Rate:.. ( ) : :. :.,,. :. :. :.. :.. :. 7

8 : (MAC):.,.,,. ( ). (one-way hash function). ( ) (hash value) (message digest). : m, f(m). f(m), m. m m f(m) = f(m )..,.. 8

9 . (, ). : (access). (subject),,. (object).,,,,. :. : : (observe): (alter):. :. : : :,. (execute): (delete - windows): (change ownership - windows): ( ) :. : (discretionaryaccess control DAC): ( ),. ( manager ).. DAC ACLs (Access Control Lists ). 9

10 ( ) (mandatoryaccess control MAC):.... (security clearance) secret, top secret, confidential, (classified) secret, top secret, confidential.. security clearance.. ( ) (role based access control RBAC) (Nondiscretionary access control):.. :,. RBAC.. ( ) : ( ) (access control matrix):. (DAC).. : ( capabilities) ( access control lists) ( ) (capabilities):,... : alpha.exe: execute; beta.com: execute, read : delta.doc: read, write; alpha.exe: execute; beta.com: execute DAC.. : ( administrator)

11 ( ) (Access control list ACL):. ACL.. ACL alpha.exe: A: execute, : execute. (groups). ACLs.... (Bell-LaPadula), (Biba, Clark-Wilson). :.. :. :.. (Bell-LaPadula).,. Bell-LaPadula.. (subject s security clearance) (data classification):. 11

12 (Bell-LaPadula) Bell- LaPadula: (Simple security rule):. (no read up). *- (*-property rule): (no write down). :.,... (Biba) Bell-LaPadula.. : (no write up):. (no read down). (Clark-Wilson).. (separation of duties):.. 12

13 ,,. :, : : :. :. :. :. :. Plaintext:. Ciphertext:. 1/3 - ( -GSM) (cryptophones) ( ) ( ) 2/3 (, ) 13

14 3/3 (VPN) Word Wide Web ( ) (Hipperlan, bluetooth, x) (VOIP) ( ) , ( ) Caesar cipher. ( ), ( ) Enigma.,

15 ( ) ClaudeShannon 1949, (Communication Theory of Secrecy Systems) DES (Data Encryption Standard) DES AES 2001 NIST FIPS 197. This is plaintext ) - &cw*4l %$?e} ) - This is plaintext ) : k k,., k = k.. 15

16 :... This is plaintext k - &cw*4l %$?e} k - This is plaintext X = k ) Y X = k (Y) X.. m...,,.. : 16

17 ,,.. : : ).. : ). :.,. :. Block ciphers (blocks) t blocks. Stream ciphers block ciphers block 1 bit. bits. 17

18 Stream ciphers stream cipher bit byte bit byte. stream ciphers. Stream ciphers stream cipher : bit,. Stream ciphers Vernam : t m 1 m 2 m t k 1 k 2 k t c 1 c 2 c t : c i = m i k i, 1 i t. : : : Stream ciphers Vernam cipher onetime-pad. O one-time-pad... 18

19 Symmetric-key block ciphers block cipher n-bit n-bit. k-bit. : C = E K (P) : P = D K (C) : ECB, CBC, CFB, OFB. (Electronic CodeBook Mode; ECB mode) : : k-bit K; n-bit x 1,x 2,,x t. : c 1,c 2,,c t : 1 j t, c j E K ( x j ). : 1 j t, x j D K ( c j ). k x j x j / n / n E D k / n / n c j c j x jxj (Electronic CodeBook Mode; ECB). ECB: ).. : bits. :. (Cipher Block Chaining mode; CBC) : : k-bit K; n-bit IV; n-bit x 1,x 2,,x t. : c 1,c 2,,c t : 1 j t, c j E K (c j-1 x j ). : 1 j t, x j c j-1 D K ( c j ). 19

20 (Cipher Block Chaining mode; CBC) CBC:., IV,. c j x j.. (Cipher Block Chaining mode; CBC) CBC: : bit c j c j c j+1 x j c j c j-1 ) : CBC selfsynchronizing c j c j+1, c j+2 x j+2. IV,. E(x) = E K2 (E K1 (x)) K1 2 E(x) = Y K3 (Y K2 (Y K1 (x))). Y. E(x) = K3 (D K2 (E K1 (x))). K1= 3. K1= 2= 3; Symmetric-key Block Ciphers : (substitution) ( ) ( ). Caesar cipher 3 : plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: defghijklmnopqrstuvwxyzabc Caesar cipher k. k. 20

21 Caesar Chipher : : : : C = (M + 3) mod 24 ( ) : M = (C 3) mod 24 (C 3), 24,., mod 24, mod 26. Symmetric-key Block Ciphers : (substitution),,,.. plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: rivnsojltzkgaqsmwvbyex (26!=4x10 26 )... Symmetric-key Block Ciphers : (substitution) Vigenere) tk 1 k 2 k t. m=m 1 m 2 m 3 c=c 1 c 2 c 3 c 1 = m 1 + k t mod s s. t. : : : :, 6,, 3,, 9, (6 + 3) mod 24 = 9., 17,, 5,, (17 + 5) mod 24 = 22.,. 21

22 Vigenere Vigenere, «cryptography». : C R Y P T O G R AP H Y C R Y P T O G R A P H Y C R Y : N E W D I R E C T I O N S I N C R Y P T O G R A P H Y : : «P» «V». Symmetric-key Block Ciphers : (transposition). t, t, e 1 t... t = 6 e = (641352).. d = (364251). 22

23 : 3 ( ) : : : Symmetric-key Block Ciphers (Product cipher):... block cipher (iterated block cipher): block cipher (round function). Symmetric-key Block Ciphers Feistel: 2t-bit (L 0, R 0 ), t-bit L 0 R 0, (R r, L r ) r r 1. 1 i r L i = R i-1, R i = L i-1 f(r i-1, K i ) K i f. r 3. DES O Data Encryption Standard (DES) block cipher. FIPS n = 64bits 64bits. 64bits 8 (8,16,...,64) bits (parity)., Feistel. 23

24 DES : 16. K bit,,. 64-bit bit L 0 R bit L i-1 R i-1 32-bit L i R i : L i = R i-1 ; R i = L i-1 f(r i-1, K i ) f ( S-boxes). 8 S-boxes DES.. DES 16 ( 16 1 ). DES DES: x ( (x))=x DES: 1, 2, 1 ( 2 (x))=x. DES DES (E-D-E). AES DES. Rijndael. NIST (National Institute of Standards and Technology). 128bits 128, 192, 256 bits. DES. : DES ~10 12 keys / sec DES. ES ~10 16 keys / sec ES ~150,000,000,000.. DES.. 24

25 AES bytes ( States) 4x4, (10 AES-128, 12 AES-192, 14 AES-256).. : bytes S-box XOR. e d., d e. e e, D d. m e e c = e (m). d D d m = D d (c). 2, 2 m

26 .. ( )... RSA ( n n). A (n, e), n modulus e, d. :. m ( [0, n-1]) c = m e mod n. c. RSA modulusn. 512, 768, 1024, 2048, RSA p q n= pq. : p q,. n = pq = (p -1)(q -1). e, 1<e<, gcd(e, ) = 1. d (1< d ed = 1 (mod ). (n, e d. e e=3 e= , (session keys). ( ). 26

27 ., K,, E (K),, D (E (K)) = K..,,.. m S : s = S (m). (m, s). s m. s m, : V A. u = V A (m, s)., u = true u = false. K., L. :,, m s V A (m, s) = true. :,. :. 27

28 .... : TTP.. (one-way hash function) MD5 hash, H(M),, M,, h. h = H(M), h m : M, h. M,, M, H(M) = H(M ). h, M, h = H(M)., (collision resistance)., M M, H(M) = H(M ).. (key distribution centers) (key translation centers) :.. :. TTP n. TTP. TTP. :,. TTP. TTP: TTP. TTP. : TTP. 28

29 Trusted Third Parties (TTPs). TTP. : In-line:. On-line: ( ).. Off-line:. TTPs :. Registration Authority ( ):. Key Generator ( ):,. Certificate Directory ( ):. Key server ( ):.. Timestamp Agent:. Notary Agent:. Key Escrow Agent:...,,.. ( ) ): TTP.. 29

30 (public-key certificates):,,. (identity certificates):. (attribute certificates): (, ).. : ( ). (. ) (. ), ),,,.,,,,,.,,,,.. : (repository) 30

31 ... :.,,,,,... :. () ( ). (certificate revocation list). CRL.. (Registration Authority):,,... :. (certificate directory):. (, ).. ( ),. 31

32 :.. ( ).. ( ).. ( )... ( )...,. :,.. 32

33 ,, : : (selfreplicating)..,. (Trojan Horses):.... (Transient virus):. (Resident Virus):. (Terminate-stayresident). (logic bomb): (. ). (Worm):. , TCP/IP.... ( ) : :. IBM : ROM. ROM (master boot sector) ( ). (sector) 0, (track) 1, (side) 0. (partition table) ( bootable).. DOS (DOS boot sector). 33

34 ( ) DOS (DOS boot sector): (file allocation table FAT). O FAT. (linked list) (clusters). : IO.SYS, BIOS SYSINIT. To SYSINIT MSDOS.SYS. DOS (COMMAND.COM) AUTOEXEC.BAT. COMMAND.COM. ( ). DOS, BIOS.. : New Zealand : DOS. IO.SYS COMMAND.COM. ( ). (parasitic virus),.com.exe,.,..,,..,. ( ) (companion virus).. DOS, DOS.COM.EXE,.BAT..EXE,.COM ( ).COM. 34

35 (Macro ) macros Word Basic, Visual Basic, VBScript Microsoft Office. macro.. macro Microsoft Office. ) (stealth virus):., antivirus.. antivirus. ( ), ) antivirus )... : :. :. :.. : (scanners): ( ).,. (cryptographic checksum):.,. 35