Security Aspects in Communication Systems

1. Security Aspects in Communication Systems Networks, MM3 By Jesper Grønbæk (ljg@es.aau.dk) PhD Student NetSec 9. November 2007

2. MM3 contents Main aim: Give a general introduction to security aspects in communication systems • Requirements and solutions • Confidentiality, Integrity, Authentication, and more… • Security Framework: IPsec • Threats to the security solution • Security in large open communication networks • Discussion

3. Problem Domains • Where are security considerations common? Open IP-based networks • Open interfaces, large user community, flexibility and off-the-shelf components High safety systems • Systems conveying highly critical communication. E.g. air traffic control information. Wireless networks, case SAFEDMI

4. Problem Domains Access Point Malicious Attacker WLAN Train Antenna Maintanence Center • A case from the industry Wireless networks, case SAFEDMI • The industry acknowledges cost saving by introducing wireless communication • A MAJOR concern is security for safety and confidentiality reasons • SAFEDMI: Upload software. Request and download diagnostics data • Medium is easily accessible (from a remote location) and thereby vulnerable • Requirements for: confidentiality, integrity, authentication and availability

5. Confidentiality • Basics and background of popular methods • Definitions: Clear text messages M, Key K, Cipher-texts C • Requirement: The transmitted information can only be available to the sender and receiver. • Threat: Eavesdropping • Method • Symmetric solution: encryption{M x K C, c=E(m, k)} decryption{m=D(c, k)} • M must be difficult to derive when only knowing C. • DES: Invented by IBM, approved federal standard 1976 • Small key size (56 bits)  Brute force attacks available • Crypto analysis attacks available • Designed for efficient hardware implementation • Triple DES, Improvement of DES by IBM in 1979 • Improved DES by 3xDES. I.e. key size 168 bits (or 112 bits). Example: c=DES(k3,DES(k2,DES(k1, m))) • Attacks known but typically considered unfeasible • AES, Candidate found in competition issued by NIST (1997-2000) • Winner: Rijndael, Othercandidates: Serpent, Twofish, RC6, … • Also efficient for hardware implementation (Smartcards. Req: < 256 bytes of RAM, < 2000 bytes of ROM) • Rijndael key sizes: 128-256 bits (32 bits steps). • NSA, National policy: 128,192, 256 bits  SECRET, 192, 256 required for TOP SECRET

6. Confidentiality • DES encryption example • Block cipher: fixed size of m, same size of c, DES block size is 64 bits • Uses Feistel function ’f’ • Confusion: high complexity wrt. key  cipher-text • Diffusion: Redundancy in plaintext is not visible in cipher-text DES Feistel function ’f’

7. Confidentiality C1 C0 C2 Cn P1 P0 P2 Pn K K K K IV Enc Enc Enc Enc Dec Dec Dec Dec K K K K … … IV Ref:Frederic Schutz 2000-11-15 No CBC With CBC P1 P0 P2 Pn C1 C0 C2 Cn • CBC encryption mode for block-chiffres • Encryption modes enable block ciphers to be used on a clear text of arbitrary lengths • CBC simply Cipher-Block-Chaining • Other encryption modes • ECB, CFB, OFB, Block Replay,…

8. Integrity • Basics and background of popular methods • Definitions: Hash value h • Requirement: Provide assurance that the message M has not been changed on its way from the sender to the receiver • Threats: Re-sequence,insertion, deletion, corruption, masquerade or change of data. E.g. change of message destination address. • Method • Cryptographic HASH functions: h=H(m) • H must be efficiently computable • H-1 must NOT be efficiently computable • Collisions should be rare: if h=H(m1), it should be difficult to have H(m2)=H(m1) • Examples: MD5, WHIRLPOOL and SHA-(1/2) • Symmetric keyed HASH function: h=H(m, K) • Avoid man-in-the-middle attacks • Necessary to guarantee that only the intended recipient can calculate the correct HASH and verify authenticity of message M. • HMAC: keyed-Hash Message Authentication Code • Based on an arbitrary HASH function

9. Integrity • HMAC example • Requires: A cryptographic HASH (e.g. SHA-2) + shared secret key K Ref: www.vckbase.com

10. Authentication • Basics and background of popular methods • Requirement: Provide assurance that the communication partner is indeed the one being claimed • Threats: Un-trusted (malicious) party claims to be a trusted party • Method • Symmetric method: shared secret, e.g. key K. • Challenge-response (simplified): • Initiator requests challenge by transmitting a random value X and calculates XMAC • Responder calculates MAC based on X, K and a PRF, e.g. HMAC • Responder generates a new random value Y, calculates XRES, and transmits Y back to initiator with the calculated MAC. • The initiator checks: if XMAC = MAC the responder is trusted. The initiator calculates RES from Y and the PRF and sends it to the responder. • The responder checks if XRES = RES. If this is the case the two parties have successfully authenticated each other. • Asymmetric method: Public key encryption with key pair: Kid(kpriv,kpub) • A message encrypted with kpubcan only be decrypted with kprivand vice versa. • The Initiator can make sure that only the desired responder will receive a given message. The responder can make sure that only the trusted initiator can read the response. • Similarly to the symmetric method PRFs and random values are used in the challenge response.

11. Asymmetric Encryption • Basics of RSA • Principle: difficulty of determining prime facors of large numbers • Secret primes p, q (>100 decimal digits) • Communicate n=p·q • Choose encryption key Ke, where Keand (p-1)(q-1) are without common factors • Decryption key: Kd = Ke-1mod (p-1)(q-1) • Usage: • Encryption: c = m mod n  Public key: (n, Ke) • Decryption: m = c mod n  Private key: (n, Kd) • Asymmetric encryption could also be used to solve confidentiality and integrity requirements. • Slow compared to symmetric methods. Great impact on communication performance • Good for authentication where large key sizes (1024 bits) can be used with little impact on performance Ke Kd

12. Additional Requirements • Basics • Availability • Threat:DoS attacks try to make service unavailable e.g. by requesting it excessively • Method: Design system to spend minimal resources to deny malicious requests • Repetition • Threat: An attacker replays a recorded series of messages. E.g. to repeat transaction (money withdrawal). • Method: Sequence numbers • Privacy • Threat: The identity of, and potentially private information of users is revealed. • Method: Encryption and a design that protects identity information • Non-repudiation • Threat: A user can deny having used a certain service without the possibility for the service provider to prove the claim wrong. • Method: Introduce mechanisms of authentication. However, research topic.

13. Additional Requirements • Keying material • In a full blown cryptographic communication solution different key types exist • Long Term-keys • Rarely changed • Should be used ”as little as possible”, e.g. only for first time authentication • Maybe stored in tamper-proof hardware: • Short Term-keys (session keys) • Newly generated for each session • Updated regularly based on time and/or data amount constraints • Different keys for: encryption, integrity/authentication and input for new keying material  Symmetric keys need to be established on two communicating parties separated by an un-trusted link  How may keys be generated? Trusted Platform Module SIM card Hardware Security Module

14. Additional Requirements Prime: p Prime: p Base int: g (<(p-1)) Base int: g (<(p-1)) Secret rand. no.: XA Secret rand. no.: XB XA YA =g mod p XB YB =g mod p YA YB XB XA Xa XB Session key: K [g mod p] mod p [g mod p] mod p • Diffie-Hellman key agreement Peer ’A’ Peer ’B’ • Basic Principle • K is difficult to find even when knowing YA and YB given XA and XB are unknown Open wireless link

15. Additional Requirements Application Access Point Transport A security framework for IP stacks Train Antenna WLAN IP IPsec Link Maintanence Center 802.11 • Performance requirements • Designing a secure communication system • Risk Assessment • Which attacks may occur? • How frequent may attacks be? • What are the potential impacts of certain attacks? (safety risks?) • Solutions • Design architecture • Methodologies used to attain security (we have considered basic cryptographic) • Cost of introducing security (performance/components/administration) • Limitations to the system • Impossible to provide ”full security” and prevent attacks.  More on this later

16. Security Framework: IPsec • Background • Application Layer security solutions • SSL, SSH, TLS, … • Useful for end-to-end security solutions • (May be) Application specific • IPsec – an Internet layer solution • Independent of applications • General framework • Provides negotiation of security methods to be used • Applies security methods to IP packets depending on configuration • Does NOT specify specific cryptographic algorithms • Does NOT specify session-key establishment methods • Typically used for VPNs (AAU wireless) and Internet links between coorporate networks • Pro: May be implemented seamlessly to protect links in open networks • Con: May be complex to administer and configure • A collection of numerous RFCs (e.g. RFC 1828, RFC 2104, RFC 1829, …)

17. Security Framework: IPsec • Configuration: modes of operation Tunnel mode: • Only payload is encrypted. • IP header remains unchanged – (e.g. not protected when using ESP, but it is with AH.) Transport mode (end-to-end oriented): • The original packet is fully encrypted (ESP). • Original packets are encapsulated in a new IP-header

18. Security Framework: IPsec • Configuration: ESP • Encapsulating Security Payload (ESP) • Tunnel mode: • Outer IP-header not protected (not a problem in tunnel mode…) • Supports confidentiality • Supports origin authentication • Supports Data integrity • CBC-mode of algorithms typically used.

19. Security Framework: IPsec • Configuration: AH • Authentication Header (AH) • Tunnel mode: • Entire header is protected except few fields like TOS, Fragment Offset… I.e. fields that may be changed in transit. • Supports Data integrity • Supports origin authentication • No confidentiality

20. Security Framework: IPsec • Extended example: • Peer agreement of Security Associations • Security Association (SA) • Defines cryptographic algorithms and configuration (ESP, AH, tunnel…) • Corresponds to IP-add, IP-classes and ports • A SA is uni-directional. Two are needed for secure bi-directional communication • Application Layer control • Security Association Database • Security Policy Database • Simple example: Peer ’B’ Peer ’A’ Outbound – SA1 ESP-AES ESP-SHA-2 Dest. IP Inbound – SA2ESP-3DES ESP-MD5 Dest. IP Inbound – SA1 ESP-AES ESP-SHA-2 Dest. IP Outbound – SA2ESP-3DES ESP-MD5 Dest. IP SA1 SA2

21. Security Framework: IPsec • Key agreement and SA setup procedure • Internet Key Exchange version 2 (IKEv2) • RFC 2409 typically deployed in IPsec solutions (Not defined by IPsec) • Two phase solution for negotiation of IPsec SAs • Phase 1: Establishment of temporary SAs (IKE SAs) for key negotiation • Authentication performed using asymmetric keys or pre-shared symmetric keys • Different modes (Main, Aggressive, Quick)  Different amount of exchanges required and levels of protection (E.g. in main mode peer IDs are only sent in an encrypted context) • DH key exchange to setup keys: • From main key ‘SKEYSEED’ three keys have been derived and used: • SKEY_A: Key used for authentication and integrity protection. • SKEY_E: Key used for encryption. • SKEY_D: Key used in later key generation processes to ensure different message exchanges to be associated even when changing keys. • Output: A secure and authenticated channel safe to use for setting up SAs • Phase 2: Negotiation and establishment of SAs used for actual data • New DH key negotiation is performed • Perfect Forward Secrecy (PFS): New keying data is used in the generation process. Decouples new session keys from LT-keys used for authentication • Session keys: time in use proportional to overall security of communication system • Keys are renegotiated as needed (time/data) [Tiller J.S.]

22. Security Framework: IPsec • SAFEDMI deployment example • Bridge Device handles the lower layer security solution • Preshared keys • Remote authentication • IKEv2: Starting point in aggresive mode

23. Security Framework: IPsec • SAFEDMI: Performance examples, communication • Configuration • IPv4, ESP (with confidentiality), Transport mode • Integrity/authentication: SHA-2 and HMAC (Keyed HASH) • Encryption: AES/(Rijndael) (NIST) IPsec performance: BD-DC uses IPsec. SHA256, Varying key length for AES. BD Utilization: 100% 128 bit – Mean goodput (FTP): 2.6 MiB/s (2 = 0.00027) 256 bit – Mean goodput (FTP): 2.4 MiB/s (2 = 0.00035) Baseline performance: IPsec disabled. BD Utilization: 75% Mean goodput (FTP): 11.1 MiB/s (2 = 0.0041)

24. Security Framework: IPsec • SAFEDMI: Performance examples, IKEv2 • Example: PSK • Authentication handled by DMI • Total delay, Phase I and II, DH groups (main mode, AES256, SHA256) • 1024 bits, 3 seconds • 1536 bits, 4 seconds • 6144 bits, 47 seconds

25. Threats To the Security Solution • What are the biggest challenges in providing a secure solution? • Brute force attack • Cryptographic Analysis to breach algorithms • Statistical • Mathematical • Often the ”tedious” approach • Lots of continuous research is done on finding weaknesses of e.g. AES. • Much simpler attacks may be possible • Examples of (more) Security threats • Bad passwords (who am I to judge) • Incomplete design • Complex design • Is IPsec an ideal security framework? – Experts say yes! experts say no! [The Hybrid Report] Opponents: “Complexity is the biggest enemy of security.” “Our biggest criticism is that IPsec is too complex. There are too many options that achieve the same or similar properties” Proponents: ”… if they (options) were completely equivalent this would be a good basis for simplifying IPsec. However there are subtle differences that have resulted in the proliferation of (different) options…” • Incomplete/wrong implementation:  Attack scenarios have been demonstrated for Linux native IPsec implementation (2002) Cause: A mandatory post-processing check defined in the RFCs was not implemented. • Bad configuration: Encryption without strong integrity checks is possible in ESP but makes no sense from a security perspective  Attacks based on destination address rewriting. See example in [Paterson, K.G.]

26. Security in Large Open Comm. Networks • Current and future challenges in the Internet [Cantrell A.] • “Cybercrime is an ever increasing threat” • Attacks – conducted by organized criminals • Characteristics • Silent (not observable by computer/network owners) • Hard to detect (Increasingly complex and organized) • Highly targeted (Specific objectives defined for attacks) • 70 percent of weaknesses are related to Web technologies • Aims • Steal confidential information (credit card, passwords, coorporate information) • Collect e-mail addresses and personal information for targeted spamming • Perform DoS attacks to paralyze parts of the network (security companies) • … • Methods • Bot nets • Worms • Malicious homepages • … • Interested parties • Private and corporate users • Network providers/Service providers • Security companies • Research

27. Security in Large Open Comm. Networks Ref: [Verissimo P.] • Research in security [Verissimo P.] • Huge research area, background in fault tolerant systems • How to make a system secure? • Traditional approach: Primarily fault avoidance  Attack prevention, vulnerability removal • New approaches: More fault tolerance  Intrusion detection, recovery, masking. • Intrusion tolerance • Assumption of vulnerable systems • Assumption of successful attacks • Tolerance: Ensure that the system remains secure and operational • Prevent faults from propagating:

28. Security in Large Open Comm. Networks • Current and future challenges in the Internet • Need methods to provide useful intrusion (IDS) • An IDS may be deployed in a networking system to detect intrusions • Provide detection to enable prevention and recovery • Close external/internal ports • Disable network connections • Kill malicious clients • … • Collects monitoring information • Amount of port scans from external network • Amount of port scans from internal network • Increase in activity from external network • … • To provide useful detection mechanisms much work is done in analyzing ongoing attacks to create models

29. Security in Large Open Comm. Networks • Honeypot projects • Use of Honeypots to attract attackers • A computer system with known and unknown vulnerabilities exposed to the open communication network. • Running in a virtual environment where observations about the attack can be collected • An attacker is unaware of trap • Typically organized in data collection networks to provide a full picture of attack types, targets and origins • CAIDA, Internet Motion Sensor, Team Cymru Darknet, … • Example honeypotleurre.com [Kaâniche M.] • 80 honeypots • 30 countries • 5 continents • Possible to join…

30. Security in Large Open Comm. Networks • Some results (leurre.com) [Kaâniche M.] • Statistical models • Needed to develop predictive models for detection • HMM, Bayesian Networks, Heuristic diagnostic mechanisms, … • Example • An attack is associated to attacker IP address • Time between attacks given first packet from attacker IP address • http://www.laas.fr/~kaaniche/Slides/Slides-WEEDS-DSN06.pdf

31. Final Discussion Access Point WLAN Train Antenna Maintanence Center • DES encryption example • ”Security aspects” is typically the first bullet in our delimitation, but… • … security aspects may have a huge impact if a technology can move to market or not! • RFIDs for object identification • Air traffic control systems • … • Your project (of course)… • SAFEDMI • Now hiring!

32. References [Tiller J.S.]: A Technical Guide to IPsec Virtual Private Networks. CRC Press (2001) [Verissimo P.]: Design for resilient systems – Architectural, paradigmatic and algorithmic issues. Presentation, ReSIST summer school (2007) [Kaâniche M.]: Resilience evaluation with regard to accidental and malicious threats. Presentation, ReSIST summer school (2007) [Schwefel H.P.]:. Introduction to security aspects. Presentation, Algorithms and Architectures III AAU (2005) [Cantrell A.] Cybercrime on the rise, survey finds, CNNMoney.com (March 7, 2006) [Paterson, K.G.] Cryptography in Theory and Practice: The Case of Encryption in IPsec, In Journal Advances in Cryptology: EUROCRYPT (2006)

33. References • Exercises Address: 181 Attacker node • Attacker wants to read parts of the communication between the source and destination node.Find the flipped bit sequence in C2Use the attack instructions in section 3 (3.1) and figure 3 of:http://www.ay2.org/downloads/ipsec-full.pdf 2) Tanenbaum (4th ed.): 11, 20, 25, 31 3) Make a risk assessment of your own project - Which requirements exist for security? - What are impacts of possible attacks? - What can be done to deliver the required security? Dest. node Security Gateway 1 Security Gateway 2 Open network Address: 107 IPsec tunnel mode, ESP, No integrity checks Source node