Computer Networks
Summary
Common Secure Protocols
Secure Shell (SSH)
A protocol to allow secure login to a
remote machine
Provides the following guarantees…
Privacy (via encryption)
SSH (Cont…)
SSH is a suite of protocols
SSH-TRANS (transport protocol)
SSH-AUTH (authentication protocol) SSH-CONN (connection protocol)
SSH-TRANS & SSH-AUTH
Use TCP to create a connection to the host and
authenticate (the host) using RSA.
How do you authenticate the servers public key?
A symmetric session key is then established
and used.
The user then needs to authenticate their id
with the remote host.
SSH-CONN
Extends SSH to support applications
other than a remote shell.
X Windows
IMAP mail clients Etc…
How?
Port Forwarding
Uses SSH to form a secure tunnel between
hosts.
When data arrives at host B, SSH will forward
the incoming data to the appropriate port.
Application
client Applicationserver
SSH Forwarded connection SSH Direct connection
HTTPS
HTTPS = HTTP running on Secure Channel
Originally the secure channel was SSL
Developed by Netscape
The new standard is TLS
Developed by IETF
Transport Layer Security (TLS)
Allows for a variety of different security
algorithms to be used.
Both sides agree to a set of algorithms
Application (e.g., HTTP) Secure transport layer
TCP IP
IPSec
A framework for providing security
services to the network layer
Optional in IPv4 but mandatory in IPv6
Idea: if you provide security in a lower
IPSec (Cont…)
2 Types
Authentication Header
• Authentication only
Encapsulating Security Payload
• Authentication plus confidentiality
ESP encrypts the entire IP payload. Why
is this a problem?
Summary
Common Secure Protocols
WPA2
WiFi Protected Access 2
Can be broken into two logical units…
• Authentication
• Encryption
Why not talk about other protocols?
WEP (virtually useless)
WPA2 Authentication
Supports 2 Authentication Mechanisms
Pre-shared Key (PSK)
Extensible Authentication Protocol (EAP)
PSK
common in homes and home offices.
requires that both the host and access point share a
common key
EAP
Usually implemented in enterprises using a RADIUS
WPA2 Encryption
After authenticating the wireless device then
establishes a “session key” with the access point.
The “session key” is really a collection of keys
that is used by the Temporal Key Integrity Protocol (TKIP)
Each frame transmitted encrypts the data using
TKIP
Ensures that each packet is sent with its
own unique encryption key
If an attacker knows the initial set of keys
then they can decrypt the traffic
It is computationally infeasible to
Summary
Common Secure Protocols
Firewall
A system which is a sole point of
connectivity between a network and all
other external networks and protects that
network from the external networks
Firewall Services
The key service is access control
decides which message flow into and out of the
network
• Example: disallow any outgoing messages from a specific IP
Allows admins to create zones of trust
The three common zones are…
• Internal Network
• Demilitarized Zone (DMZ)
Zones of Trust
You can define an arbitrary number of zones
Each subsequent zone must be less restrictive than
the previous
Common Setup
Internal Network -- trust everything in this zone
DMZ -- allow external network access but the internal
network hosts see this host as outside the firewall
External Network -- donʼt trust anyone out here
If you donʼt trust someone you can still
Access Control
Filter based on IP, TCP, UDP, and other
headers.
Uses the data provided and a set of rules to
determine whether or not to forward the traffic
Rules are configured in the firewall
There can be a lot of rules to manage
If a rule is missing or malformed it can create an
Stateful Firewalls
Many programs dynamically assign clients port
numbers. Consider the following scenario…
Internal host initiates connection to external host
using a dynamic port
External host responds to the client What will the firewall do?
Stateless firewall -- discard the data
Stateful firewall -- allow the data through
Keeps track of the state of all connections to allow
Summary
Common Secure Protocols
Discussion Questions
Benefits of a firewall?
Problems with firewalls?
