SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Network Layer Security Network Systems Security

rtracy avatar
rtracy
24 diapositives · 743 Views · Jan 03, 2020

IPSec offers a robust framework for securing data transmitted over networks by functioning at the network layer. This approach eliminates the need to implement security features within each application, significantly reducing overhead. It employs two key protocols: Authentication Header (AH) for data integrity and authentication, and Encapsulating Security Payload (ESP) for confidentiality. IPSec’s versatility makes it applicable across various network environments, including LANs and the Internet, enhancing security transparently for users and applications alike.

Network Layer Security Network Systems Security - slide 1
01 / 24Network Layer Security Network Systems Security
1 / 17

Télécharger la présentation

Network Layer Security Network Systems Security
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Network Layer Security Network Systems Security Mort Anvari

  2. Security in Network Layer • Implementing security in application layer provides flexibility in security policy and key management • Problem is need to implement security mechanism in every application individually • To reduce the overhead, implement security in network layer to provide security for all applications between selected pair of computers

  3. IPSec • Two protocols • Authentication Header (AH) • Encasulating Security Payload (ESP) • Provide general security services for IP • Authentication • Confidentiality • Anti-replay • Key management • Applicable to use over LANs, across public and private WANs, and for the Internet

  4. Scenario of IPSec Uses

  5. Benefits of IPSec • Provide strong security to all traffic crossing the perimeter if installed in a firewall/router • Resistant to bypass • IPSec is below transport layer, hence transparent to applications • Can be transparent to end users • Can provide security for individual users if desired

  6. IP Security Architecture • Specification is quite complex • Defined in numerous RFC’s • RFC 2401/2402/2406/2408 • many others, grouped by category • Mandatory in IPv6, optional in IPv4

  7. Security Association (SA) • A unidirectional relationship between sender and receiver that affords security for traffic flow • Each IPSec computer maintains a database of SA’s • Defined by 3 parameters • Security Parameters Index (SPI) • IP Destination Address • Security Protocol Identifier

  8. SA Parameters • Sequence Number Counter • Sequence Number Overflow • Anti-Replay Window • AH and ESP information • Lifetime • IPSec Protocol Mode • Path MTU

  9. Authentication Header (AH) • Provide support for data integrity and authentication of IP packets • end system/router can authenticate user/app • prevent address spoofing attacks by tracking sequence numbers • Based on use of a MAC • HMAC-MD5-96 or HMAC-SHA-1-96 • Parties must share a secret key

  10. Authentication Header

  11. End-to-End vs End-to-Intermediate Authentication

  12. Scope of AH Authentication

  13. Encapsulating Security Payload (ESP) • Provide message content confidentiality and limited traffic flow confidentiality • Can optionally provide the same authentication services as AH • Support range of ciphers, modes, padding • DES, Triple-DES, RC5, IDEA, CAST etc • CBC most common • pad to meet blocksize, for traffic flow

  14. Encapsulating Security Payload

  15. Transport vs Tunnel Mode ESP • Transport mode is used to encrypt and optionally authenticate IP data • data protected but header left in clear • can do traffic analysis but is efficient • good for ESP host to host traffic • Tunnel mode encrypts entire IP packet • add new header for next hop • good for VPNs, gateway to gateway security

  16. Scope of ESP Encryption and Authentication

  17. Combining Security Associations • SAs can implement either AH or ESP, but each SA can implement only one • To implement both, need to combine SAs • form a security bundle • Have 4 cases

  18. Combining Security Associations

  19. Key Management • Handle key generation and distribution • Typically need 2 pairs of keys • 2 per direction for AH & ESP • Manual key management • sysadmin manually configures every system • Automated key management • automated system for on demand creation of keys for SA’s in large systems • Oakley and ISAKMP

  20. OAKLEY • A key exchange protocol • Based on Diffie-Hellman key exchange • Add features to address weaknesses of Diffie-Hellman • cookies to counter clogging attacks • nonces to counter replay attacks • key exchange authentication to counter man-in-the-middle attacks • Can use arithmetic in prime fields or elliptic curve fields

  21. Usage of Cookies • Three basic requirements • Must depend on specific parties • Impossible for anyone other than issuing entity to generate cookies that will be accepted by issuing party • Cookie generation and verification must be fast • To create a cookie, perform a fast hash over src and dst IP addresses, src and dst ports, and a locally generated secret value

  22. ISAKMP • Internet Security Association and Key Management Protocol • Provide framework for key management • Define procedures and packet formats to establish, negotiate, modify, and delete SAs • Independent of key exchange protocol, encryption algorithm, and authentication method

  23. ISAKMP

  24. Next Class • Denial-of-Service (DoS) attack • Hop Integrity