ETSF10 Part 3 Lect 2



Similar documents
Internet Security. Internet Security Voice over IP. Introduction. ETSF10 Internet Protocols ETSF10 Internet Protocols 2011

Chapter 32 Internet Security

Chapter 25 Domain Name System Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

Network Security Part II: Standards

INF3510 Information Security University of Oslo Spring Lecture 9 Communication Security. Audun Jøsang

Chapter 10. Network Security

3.2: Transport Layer: SSL/TLS Secure Socket Layer (SSL) Transport Layer Security (TLS) Protocol

Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide

Cape Girardeau Career Center CISCO Networking Academy Bill Link, Instructor. 2.,,,, and are key services that ISPs can provide to all customers.

Application Layer -1- Network Tools

Computer Networks. Secure Systems

Protocol Security Where?

Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)

Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer

I. What is VPN? II. Types of VPN connection. There are two types of VPN connection:

Web Security Considerations

Communication Security for Applications

Outline. INF3510 Information Security. Lecture 10: Communications Security. Communication Security Analogy. Network Security Concepts

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli

21.4 Network Address Translation (NAT) NAT concept

Forouzan: Chapter 17. Domain Name System (DNS)

Lecture 10: Communications Security

TLS and SRTP for Skype Connect. Technical Datasheet

APNIC elearning: IPSec Basics. Contact: esec03_v1.0

CS 356 Lecture 27 Internet Security Protocols. Spring 2013

Virtual Private Networks

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP

Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1

Introduction to Security and PIX Firewall

Chapter 17. Transport-Level Security

The Secure Sockets Layer (SSL)

Security. Contents. S Wireless Personal, Local, Metropolitan, and Wide Area Networks 1

Overview. SSL Cryptography Overview CHAPTER 1

Chapter 7 Transport-Level Security

z/os Firewall Technology Overview

Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku

WEB Security & SET. Outline. Web Security Considerations. Web Security Considerations. Secure Socket Layer (SSL) and Transport Layer Security (TLS)

Today s Topics SSL/TLS. Certification Authorities VPN. Server Certificates Client Certificates. Trust Registration Authorities

Network Configuration Settings

Network Security Fundamentals

Cornerstones of Security

Laboratory Exercises V: IP Security Protocol (IPSec)

Electronic Service Agent TM. Network and Transmission Security And Information Privacy

APNIC elearning: Network Security Fundamentals. 20 March :30 pm Brisbane Time (GMT+10)

Communication Systems 16 th lecture. Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009

TLS/SSL in distributed systems. Eugen Babinciuc

BorderWare Firewall Server 7.1. Release Notes

Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.

T Cryptography and Data Security

Lecture 17 - Network Security

Secure Sockets Layer

Network Security. Lecture 3

Fireware How To VPN. Introduction. Is there anything I need to know before I start? Configuring a BOVPN Gateway

Introduction to Network Operating Systems

ReadyNAS Remote White Paper. NETGEAR May 2010

Overview SSL/TLS HTTPS SSH. TLS Protocol Architecture TLS Handshake Protocol TLS Record Protocol. SSH Protocol Architecture SSH Transport Protocol

Insecure network services

How To Understand And Understand The Ssl Protocol ( And Its Security Features (Protocol)

Lab Exercise SSL/TLS. Objective. Step 1: Open a Trace. Step 2: Inspect the Trace

IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers

This section provides a summary of using network location profiles to identify network connection types. Details include:

Communication Systems SSL

Authentication applications Kerberos X.509 Authentication services E mail security IP security Web security

Network Security Protocols

Lecture 9 - Network Security TDTS (ht1)

VPN. Date: 4/15/2004 By: Heena Patel

Part III-b. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai Siemens AG 2001, ICN M NT

Securing an IP SAN. Application Brief

CSCI 454/554 Computer and Network Security. Topic 8.1 IPsec

Domain Name System (DNS)

Computer and Network Security Exercise no. 4

How To Understand And Understand The Security Of A Key Infrastructure

Spirent Abacus. SIP over TLS Test 编 号 版 本 修 改 时 间 说 明

CS 4803 Computer and Network Security

19 Domain Name System (DNS)

Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300

Report to WIPO SCIT Plenary Trilateral Secure Virtual Private Network Primer. February 3, 1999

Configuration Guide. How to establish IPsec VPN Tunnel between D-Link DSR Router and iphone ios. Overview

Firewalls, Tunnels, and Network Intrusion Detection. Firewalls

7.1. Remote Access Connection

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?

Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance

OS/390 Firewall Technology Overview

Firewalls, Tunnels, and Network Intrusion Detection

Bridgit Conferencing Software: Security, Firewalls, Bandwidth and Scalability

Chapter 4 Virtual Private Networking

Chapter 6 CDMA/802.11i

Network Security. by David G. Messerschmitt. Secure and Insecure Authentication. Security Flaws in Public Servers. Firewalls and Packet Filtering

How to configure VPN function on TP-LINK Routers

Netzwerksicherheit: Anwendungen

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding

- Introduction to Firewalls -

NETWORK SECURITY (W/LAB) Course Syllabus

Chapter 9. IP Secure

VPNs. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright Palo Alto Networks

High Performance VPN Solutions Over Satellite Networks

IPsec Details 1 / 43. IPsec Details

Network Security Essentials Chapter 5

Transcription:

ETSF10 Part 3 Lect 2 DHCP, DNS, Security Jens A Andersson Electrical and Information Technology

DHCP Dynamic Host Configuration Protocol bootp is predecessor Alternative: manual configuration IP address Net mask Df Default gateway DNS server(s)

Figure 21.7 BOOTP client and server on the same and different networks Relay agent often here 21.3

Figure 18.3 Use of UDP ports TCP/IP Protocol Suite 4

Figure 18.9 Exchanging messages TCP/IP Protocol Suite 5

DHCP address allocation Static Static mapping MAC IP address Client always get the same IP address Used in clients home network Dynamic Client gets IP address from pool Used in open networks

DNS Domain Name System/Service Internets telephone book? Name to Number Number to Name Mail to which server Who s responsible More

Figure 25.1 Example of using the DNS service 25.8

Figure 25.2 2 Domain name space 25.9

Figure 25.8 DNS IN THE INTERNET 25.10

Figure 25.9 Generic domains 25.11

25.12 Table 25.1 Generic domain labels

Figure 25.10 Country domains 25.13

Country domain Root level ae fr se zw lth eit any any.eit.lth.se

Figure 25.11 Inverse domain 25.15

Figure 25.3 Domain names and labels 25.16

Figure 25.4 FQDN and PQDN Note the dot FQDN = Fully Qualified Domain Name PQDN = Partially yqualified Domain Name 25.17

Figure 25.5 5 Domains 25.18

Figure 25.7 Zones and ddomains 25.19

Figure 25.6 Hierarchy of name servers 25.20

Figure 25.12 Recursive resolution 25.21

Figure 25.13 Iterative ti resolution 25.22

Caching Boost efficieny Remember what you ve learned Local host / client DNS serversers (Zone transfer) Request data of a zone From primary to secondary DNS server

Figure 25.14 Query and response messages 25.24

Figure 25.15 Header format 25.25

Adding new domains Apply / Register by Regstrar Registrar: Commercial entity (many) Accredited by ICANN

DDNS Host may change IP address DHCP updates primary name server with new binding (IP address Name) Authentication to update

Encapsulation UDP Message less than 512 bytes TCP Message more than 512 bytes Example: Zone transfer

IP Sec IP Security Collection of protocols Security for packets on network layer Alternative: ti Securityat t application layer transport layer

Figure 32.1 Common structure t of three security protocols Normally two keys Payload MAC MAC = Message Authentication Code 32.30

Figure 32.2 2 TCP/IP protocol suite and IPSec 32.31

Figure 32.3 3 Transport mode and tunnel modes of fipsec protocol 32.32

Figure 32.4 Transport mode in action 32.33 Host Aand host B addresses fully visable

Figure 32.5 Tunnel mode in action 32.34 IP headers here are for the tunnel s end-points only

Two Protocols Authentication Header (AH) Provides source authentication and data integrity No privacy Encapsulating Security Payload (ESP) Provides source authentication and data integrity Privacy

Figure 32.6 Authentication ti ti Header (AH) Protocol lin transport tmode 32.36

Figure 32.7 Encapsulating Security Payload d(esp) Protocol lin transport tmode 32.37

Table 32.1 IPSec services 32.38

Exchange secrets Bob and Alice must exchange secrets For that they need a secured channel For the secured channel they nedd to exchange secrets For that they need a secured channel

Asymetric encryption Pair of keys Public, known by all Private, secure, kept by owner Encrypt messages with receivers public key Can only be decrypted with private key Sign/Authenticate ti t messages with private key Test with sender s public key

IPSec Security Associations Logical secured channel between two parties Internet Key Exchange (IKE) Creates SAs (inbound and outbound) in a database

Figure 32.8 Simple inbound and outbound security associations 32.42

Figure 32.9 IKE components 32.43

(Virtual) Private Network VPN Overlay network Alternative to a really private network

32.45 Table 32.2 Addresses for private networks

Figure 32.10 Pi Private network 32.46

Figure 32.11 Hbid Hybrid network 32.47

Figure 32.13 A VPN 32.48

SSL/TLS Secure Sockets Layer Protocol Transport Layer Security TLS is IETF version of SSL

Figure 32.14 Location of SSL and TLS in the Internet t model 32.50

Table 32.3 SSL cipher suite list 32.51

Table 32.3 3 SSL cipher suite list (continued) 32.52

SSL Created by Netscape Authentictation Message integrity Confidentiallity i

SSL Services Fragmentation Create blocks of 2 14 bytes or less Compression Message Integrity Confidentiality Framing

Figure 32.18 Processing done by the Record dprotocol 32.55

Figure 32.15 Creation of cryptographic secrets in SSL 32.56

Figure 32.16 Four SSL protocols 32.57

Four protocols Record Protocol The carrier Handshake Protocol Authentication Establishe cipher sets Provides keys and security parameters ChangeCipherSPec Protocol Crypotgraphic Secrets ready Alert Protocol Signaling of abnormalities

Figure 32.17 Handshake Protocol 32.59

Firewalls Control system access Check/Drop packets Network layer, Transport layer Application layer

Figure 32.22 22 Firewall 32.61

Figure 32.23 23 Packet-filter firewall 32.62

Application Gateway Firewall on Application Layer Acts as server against client client against requested service Checks if user s request is legitimate i application data integrity

Figure 32.24 24 Example of proxy firewall llfor http 32.64 Also called application gateway