Lecture II : Communication Security Services

(1)

Lecture II :

Communication Security Services

Internet Security: Principles & Practices

John K. Zao, PhD (Harvard) SMIEEE Computer Science Department, National Chiao Tung University Spring 2012

(2)

Spring 2012

Internet Security - X.800 Security Services

2

What is Communication Security?

To provide safe communication over unsafe media

Alice

Bob

Eve



Safe Communication



Alice can send a message to Bob that only Bob can understand

 Confidentiality



Nobody can tamper with message content during communication

 Integrity



Bob can know for sure it was Alice who sent the message

 Authentication



Unsafe Media

(3)

(4)

(5)

(6)

Spring 2012

6

X.800 : Security Architecture



Security Services



Different kinds of security protection



Service Types



Service Layer Mapping



Security Mechanisms



Different ways to implement security protection



Mechanism Definition

(7)

Spring 2012

7

Communication Security Services



Confidentiality

 Data Confidentiality  Traffic Confidentiality



Data Integrity



Authentication

 Data Origin Authentication  Peer Authentication 

Access Control



Non-Repudiation

 Non-Repudiation of Origin  Non-Repudiation of Reception 

Audit



Availability

– an after-thought but increasingly important

Note: all services are defined here in context of Communication Security

(8)

Spring 2012

8

Confidentiality

Service Types

 Data Confidentiality / Disclosure

Protection

 Connection Oriented

 Connectionless  Selective Field

 Traffic Flow Confidentiality

 Origin Destination Association  Message Size

 Transmission Patterns

 Accompanied with Data Integrity

Protection Mechanisms

 Data Encryption

Symmetric (Secret-Key) Asymmetric (Public-Key)

Protection of

information

from

disclosure

to unauthorized entities

(organizations, people, machines, processes).

Information includes

data contents

,

size

,

existence

,

communication

characteristics, etc.

(9)

Spring 2012

9

Integrity

Service Types

Message Integrity  Associated with connectionless communication

Message Stream Integrity

 Associated with

connection oriented communication

Protection Mechanisms

 Message Digests (Hashing)  Sequence Numbers

 Nonce ID (Random Number)  Time Stamps

Protection of

data

against

creation

,

alteration, deletion, duplication,

re-ordering

by unauthorized entities (organizations, people, machines,

processes).

(10)

Spring 2012

10

Authentication

Service Types

Data Origin Authentication

Associated with

Connectionless Communication

Peer Entity Authentication

Associated with

Connection Oriented Communication

Fundamental for access control

hence, confidentiality & integrity

Protection Mechanisms

 Password  Manual  One-Time Password  Key Sharing  Manual

 Symmetric Key (Tickets)

 Asymmetric Key (Certificates)

 Challenge – Response

 Nonce Based

 Zero Knowledge Proof

Communicating entities are provided with

assurance

& information of

relevant identities

of communicating partners (people, machines,

processes).

(11)

Spring 2011

Internet Security - ComSec Services & Mechanisms

11

Access Control

Service Types

 Subject Based Typing

 Identity Based

 Role Based

 Enforcement Based Typing

 Mandatory Access Control ― Management Directed

 Discretionary Access Control ― Resource Owner Directed

Protection Mechanisms

 Access Control Lists (ACLs)

 Object Based Specification Ex.: UNIX File System

 Capabilities

 Subject Based Specification

 Issue Tickets/Certificates

Protection of

information resources

or

services

against unauthorized

access

or

use

by entities (organizations, people, machines, processes).

 Policies – Subject-Action-Target rules prescribing access restrictions  Principles – entities own access control privileges

 Subjects – entities exercise access control privileges  Privileges – rights to access or use resources or services

 Objects / Targets – resources or services accessed/used by subjects  Authorization – Assertion of access control privileges

(12)

Spring 2012

12

Non-Repudiation

Service Types

 Non-Repudiation of Origin  Non-Repudiation of Reception

Protection Mechanisms

 Notarization  Time Stamp  Digital Signature

Protection against

denial of participation

by communicating entities in

all or part of a communication.

(13)

Spring 2012

13

Audit

Service Types

 Off-line Analysis (Computer Forensic)  On-line Analysis

(Real-time Intrusion Detection)

Protection Mechanisms

 “Syslog”

 Intrusion Monitors / Sensors Common Intrusion Detection

Framework (CIDF)

Common Information Model

(CIM)

Recording & analyses of

participation

,

roles

and

actions

in information

communication by relevant entities.

(14)

Service vs. Layer Mapping

Relationship between Security Services and Protocol Layers

Service Layer

1 2 3 4 5 6 7* Peer Entity Authentication · · Y Y · · Y

Data Origin Authentication · · Y Y · · Y

Access Control · · Y Y · · Y

Connection Confidentiality Y Y Y Y · Y Y

Connectionless Confidentiality · Y Y Y · Y Y

Selective Field Confidentiality · · · Y Y

Traffic Flow Confidentiality Y · Y · · · Y

Connection Integrity with Recovery · · · Y · · Y

Connection integrity without Recovery · · Y Y · · Y

Selective Field Connection Integrity · · · Y

Connectionless Integrity · · Y Y · · Y

Selective Field Connectionless Integrity · · · Y

Non-repudiation, Origin · · · Y

Non-repudiation, Delivery · · · Y

Spring 2012

14 APPLICATION PRESENTATION SESSION TRANSPORT NETWORK DATA LINK

PHYSICAL Secure Signaling MSP, PEM KEY MGMT

TLSP NLSP, IPSP

(15)