Cryptography and Network Security

1. Cryptography and Network Security Eyad Alshareef

2. Introduction • The most critical phase of e-transactions is ensuring the security of e-payments and the privacy of the information • Transaction contents can be read, modified, or made up by anyone. Eyad Alshareef

3. Introduction • Internet security is not about protecting hardware or physical environment • It is about protecting information • Electronic security • Focuses on designing measures that can enforce security policies • When a malicious attack occurs Eyad Alshareef

4. Background • Information Security requirements have changed in recent times • traditionally provided by physical and administrative mechanisms • computer use requires automated tools to protect files and other stored information • use of networks and communications links requires measures to protect data during transmission Eyad Alshareef

5. Definitions • Computer Security - generic name for the collection of tools designed to protect data and to thwart hackers (in your computer) • Network Security - measures to protect data during their transmission • Internet Security - measures to protect data during their transmission over a collection of interconnected networks Eyad Alshareef

6. The Internet Is An Insecure Place • Many protocols do not provide any security. • Viruses, worms, Trojan horses etc. • Client/server applications often require transmission of user identity/passwords. • “Hackers” may sniff passwords and other sensitive information of the network. • Need to restrict control access privileges • No system is totally immune to security problems. Eyad Alshareef

7. Solution? • There is nothing more secure then a computer which is not connected to the network – and powered off! • But… • These restrictions are simply unrealistic and unacceptable. Eyad Alshareef

8. What we want from Security • Some characteristics we might like: • messages should be transmitted to destination • only the recipient should see it • only the recipient should get it • proof of the sender’s identity • message shouldn’t be corrupted in transit • message should be sent/received once only Eyad Alshareef

9. Services, Mechanisms, Attacks • consider three aspects of information security: • security attack • security mechanism • security service • consider in reverse order Eyad Alshareef

10. Security Service • is something that enhances the security of the data processing systems and the information transfers of an organization • intended to counter security attacks • make use of one or more security mechanisms to provide the service • replicate functions normally associated with physical documents • eg have signatures, dates; need protection from disclosure, tampering, or destruction; be notarized or witnessed; be recorded or licensed Eyad Alshareef

11. Security Mechanism • a mechanism that is designed to detect, prevent, or recover from a security attack • no single mechanism that will support all functions required • however one particular element underlies many of the security mechanisms in use: cryptographic techniques • hence our focus on this area Eyad Alshareef

12. Security Attack • any action that compromises the security of information owned by an organization • information security is about how to prevent attacks, or failing that, to detect attacks on information-based systems • have a wide range of attacks • can focus of generic types of attacks • note: often threat & attack mean same Eyad Alshareef

13. Attacks, Services and Mechanisms • Security Attack:Any action that compromises the security of information. • Security Mechanism:A mechanism that is designed to detect, prevent, or recover from a security attack. • Security Service:A service that enhances the security of data processing systems and information transfers. A security service makes use of one or more security mechanisms. Eyad Alshareef

14. What Functionality Is Needed? • Authentication -- who user is • Authorization -- who is allowed to do what • Enforcement -- make sure people do what they are supposed to do Eyad Alshareef

15. Methods • Cryptography • Converting messages to unreadable forms... and then converting it back to the readable form • Steganography • Hiding the existence of a message Eyad Alshareef

16. Steganography Eyad Alshareef

17. Steganography • Used for concealing information inside other information • Some techniques: • Character marking: selected letter of printed or typewritten text are overwritten in pencil • Invisible ink • Pin punctures: small pin punctures are only shown if paper is hold against a light source • Typewriter correction ribbon: used between lines of normal black ribbon. Only visible under strong light. Eyad Alshareef

18. Null Cipher Fishing freshwater bends and saltwater coasts rewards anyone feeling stressed. Resourceful anglers usually find masterful leapers fun and admit swordfish rank overwhelming anyday. Send lawyers, guns, and money. Eyad Alshareef

19. Invisible Ink • Write with lemon juice and a toothpick/ cotton swab. Let the paper dry. • Heat the paper with an iron to reveal the hidden message. Eyad Alshareef

20. Introduction to Security • Businesses are increasingly dependent on information and communication technology • security is becoming a primary concern with public access systems • there are different types of attack: • viruses • unauthorised access • hacking Eyad Alshareef

21. What Can Go Wrong… • …when your computer y receive or is waiting for a message m? ? Internet m x y Eyad Alshareef

22. Message Loss • Adversary A can discard m in its transit A m x y Eyad Alshareef

23. Message Interception • Adversary A can get a copy of m when m passes by m A m m x y Eyad Alshareef

24. Message Modification • Adversary A can arbitrarily modify the content of m to become m’ A m m’ x y Eyad Alshareef

25. Message Insertion • Adversary A can arbitrarily fabricate a message m, pretending that m was sent by x src: x dst: y A m x y Eyad Alshareef

26. Message Replay • Adversary A can replay a message m that has been sent earlier by x and received by y m A m x y Eyad Alshareef

27. … … … … … … Denial-of-Service Attack • Adversary A can send huge amount of messages to y to block m from arriving at y A m ????? x y Eyad Alshareef

28. Network Security Is Great… • Protect messages from interception in their transit • Detect and discard messages that are modified, inserted, or replayed • Disallow unauthorized access to local system resource and sensitive data Eyad Alshareef

29. Types of Security Threats • Normal flow • Interruption • Interception • Modification • Fabrication Eyad Alshareef

30. Security Attacks Eyad Alshareef

31. What is network security? Confidentiality: only sender, intended receiver should “understand” message contents • sender encrypts message • receiver decrypts message Authentication: sender, receiver want to confirm identity of each other Message Integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection Access and Availability: services must be accessible and available to users Eyad Alshareef

32. Security Attacks • Interruption: This is an attack on availability • Interception: This is an attack on confidentiality • Modfication: This is an attack on integtrity • Fabrication: This is an attack on authenticity Eyad Alshareef

33. Security Criteria Eyad Alshareef

34. Friends and enemies: Alice, Bob, Trudy • well-known in network security world • Bob, Alice (lovers!) want to communicate “securely” • Trudy (intruder) may intercept, delete, add messages Alice Bob data, control messages channel secure sender secure receiver data data Trudy Eyad Alshareef

35. TTP A P P A Model for Network Security • Security techniques commonly have three components: • security related transformation of message • secret keys shared by the participants • need for third party notary support for some transactions Eyad Alshareef

36. Firewalls • can be an effective means of protecting a system or network from network-based security threats • while providing access to the outside world • positioned between the system(s) and the outside world • all external traffic must pass through it • a single choke point where security measures can be concentrated Eyad Alshareef

37. Types of Firewall • there are hardware and software firewalls • can be implemented on a designated gateway or dedicated machine • there are three types: • packet filtering routers • application-level gateway • circuit-level gateway Eyad Alshareef

38. Packet Filtering Routers • A router that applies a set of rules to incoming and outgoing packets: • based on fields in the IP and transport header • e.g. source, destination IP, port and IP protocol • where no rule exists to discard of forward Eyad Alshareef

39. Application-Level Gateway • An application-level gateway acts as a relay of application-level traffic • also known as a proxy server • users contact the proxy using TCP/IP based applications • the gateway checks and forwards for supported/allowed applications or safe sub-sets/features thereof • these tend to be more secure than packet filters • disadvantage: processing overhead Eyad Alshareef

40. Circuit-level Gateway • Can be stand-alone system or hosted • does not permit end-to-end TCP connection • sets up two TCP connection one on either side • TCP segments are relayed without examining content • based on the principle of allowing connections only to select/trusted hosts • usually used for outgoing connections • can therefore complement application-layer gateways for incoming traffic Eyad Alshareef

41. Security Services (X.800) • Authentication - assurance that the communicating entity is the one claimed • Access Control - prevention of the unauthorized use of a resource • Data Confidentiality –protection of data from unauthorized disclosure • Data Integrity - assurance that data received is as sent by an authorized entity • Non-Repudiation - protection against denial by one of the parties in a communication Eyad Alshareef

42. Classify Security Attacks as • passive attacks - eavesdropping on, or monitoring of, transmissions to: • obtain message contents, or • monitor traffic flows • active attacks – modification of data stream to: • masquerade of one entity as some other • replay previous messages • modify messages in transit • denial of service Eyad Alshareef

43. Eyad Alshareef

44. Model for Network Security Eyad Alshareef

45. Model for Network Security • using this model requires us to: • design a suitable algorithm for the security transformation • generate the secret information (keys) used by the algorithm • develop methods to distribute and share the secret information • specify a protocol enabling the principals to use the transformation and secret information for a security service Eyad Alshareef

46. Model for Network Access Security Eyad Alshareef

47. Model for Network Access Security • using this model requires us to: • select appropriate gatekeeper functions to identify users • implement security controls to ensure only authorised users access designated information or resources • trusted computer systems can be used to implement this model Eyad Alshareef

48. More Information • Spyware • Software the user unknowingly installs through an email attachment or downloading an effected file that could be used for illicit reasons • Usually used to collect information from infected computer Eyad Alshareef

49. More Information • Adware • Software that sneaks into user hard disk • Installed by internet advertising companies tp promote pop-up ads and release information for advertisers on the outside Eyad Alshareef