Unit 7 : Network Security

Unit 7 : Network Security
Chandan Gupta Bhagat
https://chandanbhagat.com.np/me

Network Security
 A Model for Network Security
 Principles of cryptography: Symmetric Key and Public Key
 Public Key Algorithm - RSA
 Digital Signature Algorithm
 Communication Security: IPSec, VPN, Firewalls, Wireless Security

A Model for Network Security
 A security-related transformation on the information to be sent. Examples include the encryption of the
message, which scrambles the message so that it is unreadable by the opponent, and the addition of a code
based on the contents of the message, which can be used to verify the identity of the sender.
Model For Network Security

 Some secret information shared by the two principals and, it is hoped, unknown to the opponent. An example
is an encryption key used in conjunction with the transformation to scramble the message before
transmission and unscramble it on reception.
 A trusted third party may be needed to achieve secure transmission. For example, a third party may be
responsible for distributing the secret information to the two principals while keeping it from any opponent.
Or a third party may be needed to arbitrate disputes between the two principals concerning the authenticity
of a message transmission.

 A general model shows that there are four basic tasks in designing a particular security service:
 Design an algorithm for performing the security-related transformation. The algorithm should be such that an
opponent cannot defeat its purpose.
 Generate the secret information to be used with the algorithm.
 Develop methods for the distribution and sharing of the secret information.
 Specify a protocol to be used by the two principals that makes use of the security algorithm and the secret information
to achieve a particular security service.

 A general model of these other situations which reflects a concern for protecting an information system from
unwanted access.
 Most readers are familiar with the concerns caused by the existence of hackers, who attempt to penetrate
systems that can be accessed over a network.
 The hacker can be someone who, with no malign intent, simply gets satisfaction from breaking and entering a
computer system.
 The intruder can be a disgruntled employee who wishes to do damage or a criminal who seeks to exploit
computer assets for financial gain (e.g., obtaining credit card numbers or performing illegal money transfers).

 Programs can present two kinds of threats:-
 Information access threats: Intercept or modify data on behalf of users who should not have access to that data.
 Service threats: Exploit service flaws in computers to inhibit use by legitimate users.
 The security mechanisms needed to cope with unwanted access fall into two broad categories.
 The first category might be termed a gatekeeper function. It includes password-based login procedures that
are designed to deny access to all but authorized users and screening logic that is designed to detect and
reject worms, viruses, and other similar attacks.
 Once either an unwanted user or unwanted software gains access, the second line of defense consists of a
variety of internal controls that monitor activity and analyze stored information in an attempt to detect the
presence of unwanted intruders.

Symmetrical Encryption
 This is the simplest kind of encryption that involves only one secret key to cipher and decipher information.
 Symmetrical encryption is an old and best-known technique.
 It uses a secret key that can either be a number, a word or a string of random letters.
 It is a blended with the plain text of a message to change the content in a particular way.
 The sender and the recipient should know the secret key that is used to encrypt and decrypt all the messages.
AES, DES, RC5, and RC6 are examples of symmetric encryption.
 The most widely used symmetric algorithm is AES-128, AES-192, and AES-256.
 The main disadvantage of the symmetric key encryption is that all parties involved have to exchange
the key used to encrypt the data before they can decrypt it.

Asymmetrical Encryption
 Asymmetrical encryption is also known as public key cryptography, which is a relatively new method, compared to symmetric encryption.
 Asymmetric encryption uses two keys to encrypt a plain text.
 Secret keys are exchanged over the Internet or a large network.
 It ensures that malicious persons do not misuse the keys.
 It is important to note that anyone with a secret key can decrypt the message and this is why asymmetrical encryption uses two related keys
to boosting security.
 A public key is made freely available to anyone who might want to send you a message. The second private key is kept a secret so that you
can only know.
 A message that is encrypted using a public key can only be decrypted using a private key, while also, a message encrypted using a private
key can be decrypted using a public key.
 Security of the public key is not required because it is publicly available and can be passed over the internet. Asymmetric key has a far better
power in ensuring the security of information transmitted during communication.
 Asymmetric encryption is mostly used in day-to-day communication channels, especially over the Internet.
 Popular asymmetric key encryption algorithm includes RSA, DSA etc

Symmetric Vs Asymmetric Encryption
Characteristics Symmertic Asymmetric
Key Same Key
Different keys are used for
Encryption and Decryption
Speed Very Fast Slower
Size Same or less than original text More than original text
Known Keys Both parties should know the keys
Either one of the keys is known by
2 parties
Usage Confidentiality Confidentiality, Digital Signatures

RSA
 RSA algorithm is a public key encryption technique and is considered as the most secure way of encryption. It was
invented by Rivest, Shamir and Adleman in year 1978 and hence name RSA algorithm. Algorithm
 The RSA algorithm holds the following features −
 RSA algorithm is a popular exponentiation in a finite field over integers including prime numbers.
 The integers used by this method are sufficiently large making it difficult to solve.
 There are two sets of keys in this algorithm: private key and public key.
 You will have to go through the following steps to work on RSA algorithm
 Generate the RSA Modulus
 Derived Number (e)
 Public Key
 Private Key

RSA
• The initial procedure begins with selection of two prime numbers namely p and q, and then
calculating their product N, as shown:
• N=p*q
• Here, let N be the specified large number.
Step 1: Generate the RSA modulus
• Consider number e as a derived number which should be greater than 1 and less than (p-1)
and (q-1).
• The primary condition will be that there should be no common factor of (p-1) and (q-1)
except 1
Step 2: Derived Number (e)

RSA
• The specified pair of numbers n and e forms the RSA public key and it is made
public.
Step 3: Public key
• Private Key d is calculated from the numbers p, q and e. The mathematical
relationship between the numbers is as follows −
• ed = 1 mod (p-1) (q-1)
• The above formula is the basic formula for Extended Euclidean Algorithm,
which takes p and q as the input parameters.
Step 4: Private Key

RSA
Encryption Formula
Consider a sender who sends the plain
text message to someone whose public
key is (n,e). To encrypt the plain text
message in the given scenario, use the
following syntax:
C = Pe mod n
Decryption Formula
The decryption process is very
straightforward and includes analytics for
calculation in a systematic approach.
Considering receiver C has the private key
d, the result modulus will be calculated as:
Plaintext = Cd mod n

RSA : Example
 Generating Public Key
 Select 2 prime numbers (p=53 and Q=59)
 First part of public key n=p*q=3127
 We need a small exponent e
 Integer
 Not a factor of n
 1<e<φ(n)
 Let us consider it to be 3
 Generating Private key
 We need to calculate φ(n)
 Φ(n)=(p-1)(q-1) = 3016
 Private key d =
𝑘×φ 𝑛 +1
𝑒
for some integer k
 For k=2 d=2011
We have
Public key n=3127 and e=3
Private key d=2011

RSA
 Lets Encrypt “HI”
 Convert the letters to numbers H=>8 and I=>9
 Encrypted Data c=89e mod n
 Encrypted Data comes to be 1394
 Lets Decrypt 1394
 Decrypted Data = cd mod n
 Decrypted data comes out to be 89
 8=>H and 9=>I = “HI”
Public key n=3127 and e=3
Private key d=2011

Digital Signature Algorithm
 Digital signatures are the public-key primitives of message authentication. In the physical world, it is common
to use handwritten signatures on handwritten or typed messages. They are used to bind signatory to the
message.
 Similarly, a digital signature is a technique that binds a person/entity to the digital data. This binding can be
independently verified by receiver as well as any third party.
 Digital signature is a cryptographic value that is calculated from the data and a secret key known only by the
signer.

Digital Signature Model
Signer Verifier
Data
Hashing
Function
Hash
Signature
Algortihm
Data
Signature
Signer’s
Private
Key
Hashing
Function
Verification
Algorithm
Signer’s
Public
Key
Equal
Hash

Importance of Digital Signature
 Message authentication : When the verifier validates the digital signature using public key of a sender, he is
assured that signature has been created only by sender who possess the corresponding secret private key
and no one else.
 Data Integrity : In case an attacker has access to the data and modifies it, the digital signature verification at
receiver end fails. The hash of modified data and the output provided by the verification algorithm will not
match. Hence, receiver can safely deny the message assuming that data integrity has been breached.
 Non-repudiation : Since it is assumed that only the signer has the knowledge of the signature key, he can
only create unique signature on a given data. Thus, the receiver can present data and the digital signature to
a third party as evidence if any dispute arises in the future.
By adding public-key encryption to digital signature scheme, we can create a cryptosystem that can
provide the four essential elements of security namely − Privacy, Authentication, Integrity, and Non-
repudiation.

Encryption with Digital Signature
 There are two possibilities
 sign-then-encrypt
 encrypt-then-sign
 However, the crypto system based on sign-then-encrypt can
be exploited by receiver to spoof identity of sender and sent
that data to third party. Hence, this method is not preferred.
The process of encrypt-then-sign is more reliable and widely
adopted. This is depicted in the following illustration The
receiver after receiving the encrypted data and signature on
it, first verifies the signature using sender’s public key. After
ensuring the validity of the signature, he then retrieves the
data through decryption using his private key.
Sender’s Side
Encryption using
Receiver’s Public Key
Hashing
Function
Digital Signature
with Sender’s
Public Key
Hash
Data
Encrypted Data
+
Digital Signature

Advantages of Digital Signature
 Along with having strong strength levels, the length of the signature is smaller as compared to other digital
signature standards.
 The signature computation speed is less.
 DSA requires less storage to work as compared to other digital standards.
 DSA is patent free so it can be used free of cost. Disadvantages of Digital Signature Algorithm
 It requires a lot of time to authenticate as the verification process includes complicated remainder operators. It
requires a lot of time for computation.
 Data in DSA is not encrypted. We can only authenticate data in this.
 The digital signature algorithm firstly computes with SHA1 hash and signs it. Any drawbacks in cryptographic
security of SHA1 are reflected in DSA because implicitly of DSA is dependent on it.
 With applications in both secret and non-secret communications, DSA is of the US National Standard.

IP Security (IPSec)
 Internet protocol security (IPsec) is a set of protocols that provides security for Internet Protocol. It can use
cryptography to provide security. IPsec can be used for the setting up of virtual private networks (VPNs) in a secure
manner.Also known as IP Security.
 IPsec involves two security services:
 Authentication Header (AH): This authenticates the sender and it discovers any changes in data during transmission.
 Encapsulating Security Payload (ESP): This not only performs authentication for the sender but also encrypts the data being
sent.
 There are two modes of IPsec:
 Tunnel Mode: This will take the whole IP packet to form secure communication between two places, or gateways.
 Transport Mode: This only encapsulates the IP payload (not the entire IP packet as in tunnel mode) to ensure a secure channel
of communication.

IP Security (IPSec)
 The IP security (IPSec) is an Internet Engineering Task Force (IETF) standard suite of protocols between 2
communication points across the IP network that provide data authentication, integrity, and confidentiality. It
also defines the encrypted, decrypted and authenticated packets. The protocols needed for secure key
exchange and key management are defined in it.
Uses of IP Security
 IPsec can be used to do the following things:
 To encrypt application layer data.
 To provide security for routers sending routing data across the public internet.
 To provide authentication without encryption, like to authenticate that the data originates from a known sender.
 To protect network data by setting up circuits using IPsec tunneling in which all data is being sent between the two
endpoints is encrypted, as with a Virtual Private Network(VPN) connection.

IP Security (IPSec)
Components of IP Security
 Encapsulating Security Payload (ESP) : It provides data integrity, encryption, authentication and anti replay.
It also provides authentication for payload.
 Authentication Header (AH) : It also provides data integrity, authentication and anti replay and it does not
provide encryption. The anti replay protection, protects against unauthorized transmission of packets. It does
not protect data’s confidentiality.
IP HDR AH TCP Data

IPSec : Internet Key Exchange (IKE)
 It is a network security protocol designed to dynamically exchange encryption keys and find a way over Security
Association (SA) between 2 devices.
 The Security Association (SA) establishes shared security attributes between 2 network entities to support secure
communication.
 The Key Management Protocol (ISAKMP) and Internet Security Association which provides a framework for
authentication and key exchange.
 ISAKMP tells how the set up of the Security Associations (SAs) and how direct connections between two hosts that
are using IPsec.
 Internet Key Exchange (IKE) provides message content protection and also an open frame for implementing
standard algorithms such as SHA and MD5.
 The algorithm’s IP sec users produces a unique identifier for each packet. This identifier then allows a device to
determine whether a packet has been correct or not.
 Packets which are not authorized are discarded and not given to receiver.

IP Security (IPSec)
 IPsec provides the following security services for traffic at the IP layer:
 Data origin authentication : identifying who sent the data.
 Confidentiality (encryption) : ensuring that the data has not been read en route.
 Connectionless integrity : ensuring the data has not been changed en route.
 Replay protection : detecting packets received more than once to help protect against denial of service attacks.
IP HDR TCP Data Original Packet
ESP HDR Data
ESP
Trailer
IP HDR TCP
ESP
Authentic
ation
Encryption
Authentication

IP Security (IPSec)
Applications of IPSec
 As we all know to help in the security of a network the Internet community has done lot of work and developed
application-specific security mechanisms in numerous application areas, including electronic mail (Privacy Enhanced
Mail, Pretty Good Privacy [PGP]), network management (Simple Network Management Protocol Version
3[SNMPv3]), Web access (Secure HTTP, Secure Sockets Layer [SSL]), and others.
Benefits of IPSec
 When IPSec is implemented in a firewall or router, it provides strong security whose application is to all traffic
crossing this perimeter. Traffic within a company or workgroup does not incur the overhead of securityrelated
processing.
 IPSec is below the transport layer (TCP, UDP), and is thus transparent to applications. There is no need to change
software on a user or server system when IPSec is implemented in the firewall or router.
 Even if IPSec is implemented in end systems, upper layer software, including applications is not affected. IPSec can
be transparent to end users.

VPN
 VPN stands for Virtual Private Network (VPN) that allows a user to connect to a private network over the Internet securely and privately.
 VPN creates an encrypted connection that is called VPN tunnel and all Internet traffic and communication is passed through this secure tunnel.
Types
 Remote Access VPN: Remote Access VPN permits a user to connect to a private network and access all its services and resources remotely.
The connection between the user and the private network occurs through the Internet and the connection is secure and private. Remote
Access VPN is useful for home users and business users both.
 Site to Site VPN: A Site-to-Site VPN is also called as Router-to-Router VPN and is commonly used in the large companies. Companies or
organizations, with branch offices in different locations, use Site-to-site VPN to connect the network of one office location to the network at
another office location.
 Intranet based VPN: When several offices of the same company are connected using Site-to-Site VPN type, it is called as Intranet based
VPN.
 Extranet based VPN: When companies use Site-to-site VPN type to connect to the office of another company, it is called as Extranet
based VPN.

Types of VPN Protocols
 Internet Protocol Security (IPSec): Internet Protocol Security, known as IPSec, is used to secure Internet communication across an IP network.
IPSec secures Internet Protocol communication by verifying the session and encrypts each data packet during the connection. IPSec runs in 2
modes:
 Transport mode
 Tunneling mode
The work of transport mode is to encrypt the message in the data packet and the tunneling mode encrypts the whole data
packet. IPSec can also be used with other security protocols to improve the security system.
 Layer 2 Tunneling Protocol (L2TP): L2TP or Layer 2 Tunneling Protocol is a tunneling protocol that is often combined with another VPN security
protocol like IPSec to establish a highly secure VPN connection. L2TP generates a tunnel between two L2TP connection points and IPSec
protocol encrypts the data and maintains secure communication between the tunnel.
 Point–to–Point Tunneling Protocol (PPTP): PPTP or Point-to-Point Tunneling Protocol generates a tunnel and confines the data packet. Point-
toPoint Protocol (PPP) is used to encrypt the data between the connection. PPTP is one of the most widely used VPN protocol and has been in
use since the early release of Windows. PPTP is also used on Mac and Linux apart from Windows.

Types of VPN Protocols
 SSL and TLS: SSL (Secure Sockets Layer) and TLS (Transport Layer Security) generate a VPN connection where
the web browser acts as the client and user access is prohibited to specific applications instead of entire
network. Online shopping websites commonly uses SSL and TLS protocol. It is easy to switch to SSL by web
browsers and with almost no action required from the user as web browsers come integrated with SSL and TLS.
SSL connections have “https” in the initial of the URL instead of “http”.
 OpenVPN: OpenVPN is an open source VPN that is commonly used for creating Point-to-Point and Site-to-Site
connections. It uses a traditional security protocol based on SSL and TLS protocol.
 Secure Shell (SSH): Secure Shell or SSH generates the VPN tunnel through which the data transfer occurs and
also ensures that the tunnel is encrypted. SSH connections are generated by a SSH client and data is
transferred from a local port on to the remote server through the encrypted tunnel.

Firewall
 A firewall is a network security device, either hardware or software-based, which monitors all incoming and
outgoing traffic and based on a defined set of security rules it accepts, rejects or drops that specific traffic.
 Accept : allow the traffic
 Reject : block the traffic but reply with an “unreachable error”
 Drop : block the traffic with no reply
 A firewall establishes a barrier between secured internal networks and outside untrusted network, such as the
Internet.
 A firewall is a network security device that monitors incoming and outgoing network traffic and permits or
blocks data packets based on a set of security rules. Its purpose is to establish a barrier between your internal
network and incoming traffic from external sources (such as the internet) in order to block malicious traffic like
viruses and hackers.

Firewall
 Before Firewalls, network security was performed by Access Control Lists (ACLs) residing on routers. ACLs are
rules that determine whether network access should be granted or denied to specific IP address.
 But ACLs cannot determine the nature of the packet it is blocking. Also, ACL alone does not have the capacity
to keep threats out of the network. Hence, the Firewall was introduced.
 Connectivity to the Internet is no longer optional for organizations.
 However, accessing the Internet provides benefits to the organization; it also enables the outside world to
interact with the internal network of the organization.
 This creates a threat to the organization. In order to secure the internal network from unauthorized traffic, we
need a Firewall.

How does Firewall Work?
 Firewalls carefully analyze incoming traffic based on pre-established rules and filter traffic coming from
unsecured or suspicious sources to prevent attacks.
 Firewalls guard traffic at a computer’s entry point, called ports, which is where information is exchanged with
external devices. For example, “Source address 172.18.1.1 is allowed to reach destination 172.18.2.1 over port
22."
 Think of IP addresses as houses, and port numbers as rooms within the house. Only trusted people (source
addresses) are allowed to enter the house (destination address) at all—then it’s further filtered so that people
within the house are only allowed to access certain rooms (destination ports), depending on if they're the
owner, a child, or a guest. The owner is allowed to any room (any port), while children and guests are allowed
into a certain set of rooms (specific ports).

Types of Firewall
 Host- based Firewalls : Host-based firewall is installed on each network node which controls each incoming and
outgoing packet. It is a software application or suite of applications, comes as a part of the operating system.
Host-based firewalls are needed because network firewalls cannot provide protection inside a trusted network.
Host firewall protects each host from attacks and unauthorized access.
 Network-based Firewalls : Network firewall function on network level. In other words, these firewalls filter all
incoming and outgoing traffic across the network. It protects the internal network by filtering the traffic using
rules defined on the firewall. A Network firewall might have two or more network interface cards (NICs). A
network-based firewall is usually a dedicated system with proprietary software installed. Generation of Firewall
Firewalls can be categorized based on its generation

Types of Firewall
 First Generation- Packet Filtering Firewall : Packet filtering firewall is used to control network access by monitoring outgoing and
incoming packet and allowing them to pass or stop based on source and destination IP address, protocols and ports. It analyses
traffic at the transport protocol layer (but mainly uses first 3 layers).
 Incoming packets from network 192.168.21.0 are blocked.
 Incoming packets destined for internal TELNET server (port 23) are blocked.
 Incoming packets destined for host 192.168.21.3 are blocked.
 All well-known services to the network 192.168.21.0 are allowed.
 Second Generation- Stateful Inspection Firewall : Stateful firewalls (performs Stateful Packet Inspection) are able to determine the
connection state of packet, unlike Packet filtering firewall, which makes it more efficient.
 Third Generation- Application Layer Firewall : Application layer firewall can inspect and filter the packets on any OSI layer, up to
the application layer. It has the ability to block specific content, also recognize when certain application and protocols (like HTTP, FTP)
are being misused.
 Next Generation Firewalls (NGFW) : Next Generation Firewalls are being deployed these days to stop modern security breaches
like advance malware attacks and application-layer attacks.

Wireless Security
 Like the system's security and data security, keeping a sound knowledge about different wireless security
measures is also essential to know for security professionals. It is because different wireless security
mechanisms have a different level of strength and capabilities.
 There are automated wireless hacking tools available that have made cybercriminals more powerful. List of
some of these tools are:
 AirCrack.
 AirSnort.
 Cain & Able.
 Wireshark.
 NetStumbler etc.
 Different various techniques of hacking include remote accessing, shoulder surfing, wireless router's dashboard
accessing, and brute-forcing attack that are used to penetrate wireless security.

What is Wireless Security?
 Wireless security revolves around the concept of securing the wireless network from malicious attempts and
unauthorized access.
 The wireless security can be delivered through different ways such as:
 Hardware-based: where routers and switches are fabricated with encryption measures protects all wireless
communication. So, in this case, even if the data gets compromised by the cybercriminal, they will not be able to decrypt
the data or view the traffic's content.
 Wireless setup of IDS and IPS: helps in detecting, alerting, and preventing wireless networks and sends an alarm to the
network administrator in case of any security breach.
 Wireless security algorithms: such as WEP, WPA, WPA2, and WPA3. These are discussed in the subsequent paragraphs.

Wired Equivalent Privacy (WEP)
 Wired Equivalent Privacy (WEP) is the oldest security algorithm of 1999.
 It uses the initialization vector (IV) method. The very first versions of the WEP algorithm were not
predominantly strong enough, even for that time when it got released.
 But the reason for this weak release was because of U.S. limits on the exporting of different cryptographic
technologies, which led the manufacturing companies to restrict their devices to 64-bit encryption only.
 As the limitation was withdrawn, the 128 bit and 256 bit WEP encryption were developed and came into the
wireless security market, though 128 became the standard one.

Wi-Fi Protected Access (WPA)
 Wi-Fi Protected Access (WPA) was the next Wi-Fi Alliance's project that replaced the increasingly noticeable
vulnerabilities of WEP standard.
 WPA was officially adopted in the year 2003, one year before the retirement of WEP.
 WPA's most common configuration is with WPA-PSK, which is abbreviated as Pre-Shared Key.
 WPA uses 256-bit, which was a considerable enhancement above the 64-bit as well as 128-bit keys.

Wi-Fi Protected Access II (WPA2)
 Wi-Fi Protected Access II (WPA2) became official in the year 2006 after WPA got outdated.
 It uses the AES algorithms as a necessary encryption component as well as uses CCMP (Counter Cipher Mode -
Block Chaining Message Authentication Protocol) by replacing TKIP.

Wi-Fi Protected Access 3 (WPA3)
 Wi-Fi Protected Access 3 (WPA3) is the latest, and the third iteration of this family developed under Wi-Fi
Alliance.
 It has personal as well as enterprise security-support feature and uses 384-bit Hashed Message Authentication
Mode, 256-bit Galois / Counter Mode Protocol (GCMP-256), as well as Broadcast/Multicast Integrity Protocol of
256-bit.
 WPA3 also provides perfect forward secrecy mechanism support.

Thank you
https://chandanbhagat.com.np/me

Unit 7 : Network Security

Recommended

More Related Content

What's hot (20)

Similar to Unit 7 : Network Security (20)

More from Chandan Gupta Bhagat (20)

Recently uploaded (20)

Unit 7 : Network Security