Network Security (B.E.

Cryptography & Network Security (M.Tech)

10EC832 (B.E)
12EC023 (M.Tech)

Dr. Sanjay Jain

Unit 1
 Chapter 1
◦ Introduction

 Text Book
◦ Cryptography and Network Security
◦ By William Stallings

 Other Sources
◦ http://www.williamstallings.com
◦ Lecture slides by Dr. Saleem Al_Zoubi
◦ Lecture slides by Lawrie Brown

07:19 AM
Reader’s Guide

The art of war teaches us to rely

not on the likelihood of the enemy's not
coming, but on our own readiness to receive
him;
not on the chance of his not attacking, but
rather on the fact that we have made our
position unassailable.
—The Art of War, Sun Tzu
Introduction
 Information Security requirements have
changed significantly from the past
 Traditionally provided by physical and
administrative mechanisms
◦ E.g. rugged filing cabinets, personnel screening
 Note both similarities and differences with traditional paper

documents, which for example:

 have signatures & dates;
 need protection from disclosure, tampering, or destruction;
 may be notarized or witnessed;
 may be recorded or licensed

4
Introduction
 With advent of computers, and shared systems,
 the need for automated tools developed
 to protect files and other stored information

 Introduction of distributed systems and use of

networks and communication facilities for
exchanging data, data protection was required
during transmission over the network
 Internet security consists of measures to detect,
prevent, and correct security violations that
involve the transmission of information

07:19 AM
Definitions
 Computer Security - generic name for the
collection of tools designed to protect data
and to thwart hackers
 Network Security - measures to protect data

during their transmission

 Internet Security - measures to protect data

during their transmission over a collection of

interconnected networks

6
Standards Organizations
 National Institute of Standards & Technology
(NIST)
 Internet Society (ISOC)
◦ IETF (Internet Engineering Task Force)
◦ IAB (Internet Architecture Board)
 International Telecommunication Union
Telecommunication Standardization Sector (ITU-
T)
 International Organization for Standardization
(ISO)
 RSA Labs (de facto)
Computer Security
 the protection afforded to an automated
information system in order to attain the
applicable objectives of
preserving the integrity, availability and
confidentiality
of information system resources (includes
hardware, software, firmware,
information/data, and telecommunications)
Key Security Concepts
Examples of Security Requirements
 confidentiality
– student grades
 integrity
– patient information
 availability
– authentication service
 authenticity
– admission ticket
 non-repudiation
– stock sell order
Levels of Impact
 can define 3 levels of impact from a security breach
 Low
The loss could be expected to have a limited adverse effect
on organizational operations, organizational assets, or
individuals.
 Moderate
The loss could be expected to have a serious adverse effect
on organizational operations, organizational assets, or
individuals.
 High
The loss could be expected to have a severe or catastrophic
adverse effect on organizational operations, organizational
assets, or individuals.
Computer Security Challenges
1. not simple – easy to get it wrong
2. must consider potential attacks
3. procedures used counter-intuitive
4. involve algorithms and secret info
5. must decide where to deploy mechanisms
6. battle of wits between attacker / admin
7. not perceived on benefit until fails
8. requires regular monitoring a process, not
an event
9. too often an after-thought
10. regarded as impediment to using system
“Unusable security is not secure”
Microsoft Office
Word Document
The OSI Security Architecture
 ITU-T Recommendation X.800, Security Architecture
for OSI,
defines a systematic approach of defining
requirements for security and
characterizing the approaches to satisfying the
requirements
 For us it provides a useful, if abstract, overview of
concepts we will study
 Computer and communication vendors have
developed security features for their products and
services that relate to this structured definition of
services and mechanisms

07:19 AM
Aspects of Security
 consider 3 aspects of information security:
◦ security attack
◦ security mechanism (control)
◦ security service
 note terms
◦ Threat, Vulnerability, Attack
◦ threat – a potential for violation of security
◦ vulnerability – a way by which loss can happen
◦ attack – an assault on system security, a deliberate
attempt to evade security services
Introduction
 Security attack:
Any action that compromises the security of
information owned by an organization

 Security attacks
◦ Are classified as either passive attacks which include
 unauthorized reading of a message or file
 traffic analysis
◦ And active attacks such as
 modification of messages or files and
 denial of service

07:19 AM
Introduction
 Security mechanism:
A process (or a device incorporating such a
process) that is designed to detect, prevent,
or recover from a security attack
 Examples of mechanism are
 encryption algorithms,
 digital signatures and
 authentication protocols

07:19 AM
Introduction
 Security service:
A processing or communication service
that enhances the security
of the data processing systems and the information
transfers of an organization.
The services are intended to counter security attacks,
and
they make use of one or more security mechanisms to
provide the service
 Security services
◦ includes authentication, access control, data confidentiality,
data integrity, nonrepudiation, and availability

07:19 AM
Types of Security Threats and Attacks
Eavesdropping - Message Interception (Attack on Confidentiality)

 Unauthorized access to information

 Packet sniffers and wiretappers
 Illicit copying of files and programs

S R

Eavesdropper
18
Passive Attack - Interception
Passive Attack: Traffic Analysis
monitor traffic flow to
determine location and
identity of communicating
hosts and could observe the
frequency and length of
messages being exchanged

Observe traffic pattern

Types of Security Threats and Attacks
Modification
Integrity Attack - Tampering With Messages
 Stop the flow of the message
 Delay and optionally modify the message
 Release the message again

S R

Perpetrator
21
Active Attack: Modification

Modify message
Active Attack: Replay
Types of Security Threats and Attacks
Interruption - Attack on Availability
 Destroy hardware (cutting fiber) or software
 Modify software in a subtle way (alias commands)
 Corrupt packets in transit

S R

 Blatant denial of service (DoS):

◦ Crashing the server
◦ Overwhelm the server (use up its resource)
24
Active Attack: Interruption

Block delivery of message

Types of Security Threats and Attacks
Authenticity Attack - Fabrication

 Unauthorized assumption of other’s identity

 Generate and distribute objects under this identity

S R

Masquerader: from S
26
Active Attack: Fabrication

Fabricate message
Passive Attacks
 Passive attacks are in the nature of eavesdropping
on, or monitoring of, transmissions
 Two types of passive attacks
◦ Release of message contents
 Opponent learning the contents of transmission such as e-
mail or a transferred file
◦ Traffic analysis
 Opponent can
 Guess the nature of communication that is taking place even
though he may not be able unmask the contents
 Determine the location and identity of communicating hosts
 Could observe the frequency and length of messages being
exchanged

07:19 AM
Active Attacks
 Active attacks involve some modification of
the data stream or the creation of a false
stream
 Can be divided into four categories:
 Masquerade

◦ A masquerade takes place when one entity pretends

to be a different entity (impersonating an entity)
 Replay
◦ Capture of data unit and its subsequent
retransmission to produce an unauthorized effect

07:19 AM
Active Attacks
 Modification of messages
◦ Some portion of a legitimate message is altered, or
delayed, or reordered, to produce an unauthorized
effect.
 Denial of service
◦ Prevents or inhibits the normal use or management
of communications facilities
◦ Disruption of an entire network, either by disabling
the network or by overloading it with messages so
as to degrade performance

07:19 AM
Handling Attacks
 Which is difficult to detect?
 Which is difficult to prevent?

 Passive attacks are difficult to detect

 We can only prevent the success of such attacks,
usually by means of encryption

 Active attacks are difficult to prevent

 We should detect active attacks and try to recover
from any disruption or delays caused by them
 If the detection has a deterrent effect, it may also
contribute to prevention
Handling Attacks
 Passive attacks – focus on Prevention
◦ Easy to stop
◦ Hard to detect

 Active attacks – focus on Detection and

Recovery
◦ Hard to stop
◦ Easy to detect
Security Mechanism
 a.k.a. control
 feature designed to detect, prevent, or
recover from a security attack
 no single mechanism that will support all
services required
 however one particular element underlies
many of the security mechanisms in use:
◦ cryptographic techniques
 hence our focus on this topic
Security Mechanisms (X.800)
 Specific security mechanisms
◦ May be incorporated into the appropriate
protocol layer in order to provide some of the OSI
security services

 pervasive security mechanisms

◦ Not specific to any particular OSI security layer
Security Mechanisms
 Specific security mechanisms

1. Encipherment
2. Digital Signature
3. Access Control
4. Data Integrity
5. Authentication Exchange
6. Traffic Padding
7. Routing Control
8. Notarization

07:19 AM
Security Mechanisms
 Encipherment
◦ The use of mathematical algorithms to transform data
into a form that is not readily intelligible. The
transformation and subsequent recovery of the data
depend on an algorithm, and zero or more encryption
keys
◦ A reversible encipherment mechanism is simply an
encryption algorithm that allows data to be encrypted
and subsequently decrypted
◦ Irreversible encipherment mechanisms include hash
algorithms and message authentication codes, which
are used in digital signature and message
authentication applications

07:19 AM
Security Mechanisms
 Digital Signature
◦ Data appended to, or a cryptographic transformation of, a data
unit that allows a recipient of the data unit to prove the source
and integrity of the data unit and protect against forgery (e.g.
by the recipient)
 Access Control
◦ A variety of mechanisms that enforce access rights to resources
 Data Integrity
◦ A variety of mechanism used to assure the integrity of a data
unit or streams of data units
 Authentication Exchange
◦ A mechanism intended to ensure the identity of an entity by
means of information exchange

07:19 AM
Security Mechanisms
 Traffic Padding
◦ The insertion of bits into gaps in a data stream to
frustrate traffic analysis attempts
 Routing Control
◦ Enables selection of particular physically secure
routes for certain data and allows routing changes,
especially when a breach of security is suspected
 Notarization
◦ The use of a trusted third party to assure certain
properties of a data exchange

07:19 AM
Security Mechanisms
 Pervasive security mechanisms
Mechanisms that are not specific to any particular OSI
security layer
1. Trusted Functionality
2. Security Label
3. Event Detection
4. Security Audit Trail
5. Security Recovery

07:19 AM
Security Mechanisms
 Trusted Functionality
◦ That which is perceived to be correct with respect
to some criteria (e.g. as established by a security
policy)
 Security Label
◦ The marking bound to a resource (which may be a
data unit) that names or designates the security
attributes of that resource
 Event Detection
◦ Detection of security-relevant events

07:19 AM
Security Mechanisms
 Security Audit Trail
◦ Data collected and potentially used to facilitate a
security audit, which is an independent review and
examination of system records and activities
 Security Recovery
◦ Deals with requests from mechanism, such as event
handling and management functions, and takes
recovery actions

07:19 AM
Security Service
◦ Enhances security of data processing systems and
information transfers of an organization
◦ Intended to counter security attacks
◦ Using one or more security mechanisms
◦ Often replicates functions normally associated with
physical documents
 which, for example, have signatures, dates; need
protection from disclosure, tampering, or destruction;
be notarized or witnessed; be recorded or licensed
Security Services
 X.800 defines a security service
as a service provided by a protocol layer of
communicating open systems,
which ensures adequate security of the systems or
of data transfers

 RFC 2828 provides clearer definition as:

A processing or communication service that is
provided by a system to give a specific kind of
protection to system resources;
security services implement security policies and
are implemented by security mechanisms
Security Services
 X.800 divides these services into 5 categories
and 14 specific services
 Categories

◦ Authentication
◦ Access control
◦ Data confidentiality
◦ Data integrity
◦ Non-repudiation

07:19 AM
Security Services (X.800)
 Authentication - assurance that
communicating entity is the one claimed
◦ have both peer-entity & data origin authentication
 Access Control - prevention of the
unauthorized use of a resource
 Data Confidentiality –protection of data from
unauthorized disclosure
 Data Integrity - assurance that data received
is as sent by an authorized entity
 Non-Repudiation - protection against denial
by one of the parties in a communication
 Availability – resource accessible/usable
Authentication
 The authentication service is concerned with assuring that
a communication is authentic
 The function is to assure the recipient that the message is
from the source that it claims to be from
 Two specific authentication services:
◦ Peer entity authentication
 Provides for the corroboration of the identity of a peer entity in an
association
 It attempts to provide confidence that an entity is not performing either
a masquerade or an unauthorized replay of a previous connection
◦ Data origin authentication
 Provides for the corroboration of the source of a data unit
 Supports application like e-mail where there are no prior interactions
between the communication entities

07:19 AM
Access Control
 Access control is the ability to limit and
control the access to host systems and
applications via communications links
 Each entity trying to gain access must first be

identified, or authenticated, so that access

rights can be tailored to the individual

07:19 AM
Data Confidentiality
 Confidentiality is the protection of transmitted data from
passive attacks
 Several levels of protection can be identified
 The broadest services protects all user data transmitted
between two users over a period of time e.g. TCP protection
prevents any release of user data over the TCP connection
 Narrower forms of the service can protect a single message
or even specific field
 Other aspects of confidentiality is the protection of traffic
flow from analysis
◦ This requires that an attacker not be able to observe the source and
destination, frequency, length, or other characteristics of the traffic
on a communications facility

07:19 AM
Data Confidentiality
 Services
◦ Connection confidentiality
◦ Connectionless confidentiality
◦ Selective-field confidentiality
◦ Traffic-flow confidentiality

07:19 AM
Data Integrity
 As with confidentiality, integrity can apply to a stream of
messages, a single message, or selected fields within a
message
 The most useful approach is total stream protection
 A connection-oriented integrity service, one that deals with
a stream of messages assures that messages are received
as sent, with no duplication, insertion, modification,
reordering, or replays
 The destruction of data is also covered under this service
 Thus a connection-oriented integrity service addresses
both message stream modification and denial of service
 Connectionless integrity services, one that deals with
individual messages, generally provides protection against
message modification only
07:19 AM
Data Integrity
 The data integrity service can be with or without
recovery
 On detection of violation of integrity, automated
recovery mechanism or human intervention is
required to recover from violation

 Services
◦ Connection integrity with recovery
◦ Connection integrity without recovery
◦ Selective-field connection integrity
◦ Connectionless integrity
◦ Selective-field connectionless integrity

07:19 AM
Nonrepudiation
 It prevents either sender or receiver from
denying a transmitted message
 Receiver can prove that the alleged sender in

fact sent the message

 Sender can prove that the alleged receiver in

fact received the message

 Services

◦ Nonrepudiation, Origin
◦ Nonrepudiation, Destination

07:19 AM
Availability service
 Availability is define as the property of a
system or a system resource been accessible
and usable upon demand by an authorized
system entity, according to performance
specifications for the system
 X.800 treats availability as a property to be

associated with various security services

07:19 AM
Model for Network Security
Model for Network Security
 Two parties (called principals) must cooperate
for the exchange of messages
 A logical information channel is established

by defining a route through the internet from

source to destination and by cooperative use
of communication protocols (e.g. TCP/IP) by
the two principals
 Security aspect come into play to protect the

information transmission from an opponent

07:19 AM
Model for Network Security
 The general model shows that there are four
basic tasks in designing a particular service
◦ Design an algorithm for performing the security-
related transformation. The algorithm should be such
that an opponent cannot defeat its purpose
◦ Generate the secret information to be used with the
algorithm
◦ Develop methods for the distribution and sharing of
the secret information (e.g. through trusted 3rd party)
◦ Specify a protocol to be used by the two principals that
makes use of the security algorithm and the secret
information to achieve a particular security service

07:19 AM
Model for Network Access Security
Model for Network Access Security
 The model reflects a concern for protecting an information
system from unwanted access
 The hacker can be someone who, with no malign intent,
simply gets satisfaction from breaking and entering a
computer system
 Or intruder may wish to damage, or a criminal who seeks to
exploit computer assets for financial gains (e.g. getting
credit card details)
 Programs such as virus and worms can also present two
kinds of threats:
◦ Information access threats intercept or modify data on behalf of
users who should not have access to that data
◦ Service threats exploit service flaws in computers to inhibit use by
legitimate users

07:19 AM
Model for Network Access Security
 The security mechanisms needed to cope with
unwanted access fall into two broad categories:

◦ Gatekeeper function: Includes password based login

procedures that deny access to all but authorized users,
and screening logic that detect and reject worms, viruses
and other similar attacks

◦ Internal Security controls: Consists of a variety of internal

controls that monitor activity and analyze stored
information in an attempt to detect the presence of
unwanted intruders (this works as second line of defence)

07:19 AM
Summary
 standards organizations
 security concepts:

◦ confidentiality, integrity, availability

 X.800 security architecture
 security attacks, services, mechanisms
 models for network (access) security