What is Network Security & Cryptography Jntuh notes NSC

Network Security & Cryptography

What is Network Security & Cryptography

Network Security & Cryptography is a concept to protect data transmission across the network. A network security system typically relies on layers of protection and consists of multiple components including networking monitoring and security software in addition to hardware components. All these components work together to increase the overall security of the computer network.

What is Network security

Network security  consists of the provisions and policies adopted by a network administrator to prevent and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources.

What is Cryptography

Cryptography is the science of converting plain text into secret code. It construct and analyze different protocols  in information security such as data confidentiality, data integrity, authentication, and non-repudiation.

Security services

It is a service that is provided by a protocol layer of communicating open systems and that ensures adequate security of the systems or of data transfers. It enhances the security of data processing and transferring.

1. Message confidentiality (Data Confidentiality )

Message or Data Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. A loss of confidentiality is the unauthorized disclosure of information.

• It means that the content of a message when transmitted across a network must remain confidential, i.e. only the intended receiver and no one else should be able to read the message.

• The users; therefore, want to encrypt the message they send so that an eavesdropper on the network will not be able to read the contents of the message.

2. Message Integrity (Data Integrity)

Message or Data Integrity It can apply to a stream of messages, a single message, or selected fields within a message. A loss of integrity is the unauthorized modification or destruction of information.

• It means the data must reach the destination without any adulteration i.e. exactly as it was sent.

• There must be no changes during transmission, neither accidentally nor maliciously.

• Integrity of a message is ensured by attaching a checksum to the message.

• The algorithm for generating the checksum ensures that an intruder cannot alter the checksum or the message.

3. Message Authentication (Data Authentication)

Authenticity Provide authentication to all the node and base station for utilizing the available limited resources. It also ensures that only the authorized node can participant for the communication.

• In message authentication the receiver needs to be .sure of the sender's identity i.e. the receiver has to make sure that the actual sender is the same as claimed to be.

• There are different methods to check the genuineness of the sender :

1. The two parties share a common secret code word. A party is required to show the secret code word to the other for authentication.

2. Authentication can be done by sending digital signature.

3. A trusted third party verifies the authenticity. One such way is to use digital certificates issued by a recognized certification authority.

4. Message non-reproduction

Non-repudiation prevents either sender or receiver from denying a transmitted message. Thus, when a message is sent, the receiver can prove that the alleged sender in fact sent the message. Similarly, when a message is received, the sender can prove that the alleged receiver in fact received the message.

• Non-repudiation means that a sender must not be able to deny sending a message that it actually sent.

• The burden of proof falls on the receiver.

• Non-reproduction is not only in respect of the ownership of the message; the receiver must prove that the contents of the message are also the same as the sender sent.

• Non-repudiation is achieved by authentication and integrity mechanisms.

5. Entity Authentication (Access control)

Access control is the ability to limit and control the access to host systems and applications via communications links. To achieve this, each entity trying to gain access must first be identified, or authenticated, so that access rights can be tailored to the individual.

• In entity authentication (or user identification) the entity or user is verified prior to access to the system resources .

Types of Security Attacks

 Network security attacks can be classified into two types :

1.Passive Attacks

 A passive attack attempts to learn or make use of information from the system but does not affect system resources. The goal of the opponent is to obtain information that is being transmitted.

Types of passive attacks:

a) Traffic Analysis: The message traffic is sent and received in an apparently normal fashion and neither the sender nor receiver is aware that a third party has read the messages or observed the traffic pattern.

b) Release of Message Contents: Read contents of message from sender to receiver.

2. Active Attacks

 An active attack attempts to alter system resources or affect their operation. It involves some modification of the data stream or the creation of a false stream.

Types of active attacks:

a) Modification of Messages: some portion of a legitimate message is altered, or that messages are delayed or reordered.

b) Denial of Service: An entity may suppress all messages directed to a particular destination.

Cryptography Mechanism

Cryptography is a method of storing and transmitting data in a particular form so that it can be read and process it.

The term is most often associated with scrambling plaintext message (ordinary text, sometimes referred to as plaintext) into ciphertext (a process called encryption), then back again (known as decryption).

There are, in general, three types of cryptographic schemes typically used to accomplish these goals: secret key (or symmetric) cryptography, public-key (or asymmetric) cryptography, and hash functions, each of which is described below.

scrambling plaintext message

ciphertext (encryption)

ciphertext (decryption)

scrambling plaintext message

Symmetric cryptosystems

In symmetric cryptosystems (also called conventional, secret-key or one-key cryptosystems), the enciphering and deciphering keys are either identical or simply related.

Both keys must be kept secret, and if either is compromised further secure communication is impossible.

Keys need to be exchanged between users, often over a slow secure channel, for example a private courier, and the number of keys can be very large.

Asymmetric cryptosystems

Asymmetric cryptosystems uses two keys, one key used for enciphering can be made public, while the other, used for deciphering, is kept secret. The two keys are generated such that it is computationally infeasible to find the secret key from the public key.

If user A wants to communicate with user B, A can use B's public key (from a public directory) to encipher the data. Only B can decipher the ciphertext since he alone possesses the secret deciphering key. The scheme described above is called a public-key cryptosystem or an asymmetric cryptosystem.

Hash functions

Hash functions, also called message digests and one-way encryption, are algorithms that, in some sense, use no key. A hash function H accepts a variable-length block of data M as input and produces a fixed-size hash value h = H(M).

The hash algorithm involves repeated use of a compression function, f, that takes two inputs (an -bit input from the previous step, called the chaining variable, and a -bit block) and produces an -bit output. At the start of hashing, the chaining variable has an initial value that is specified as part of the algorithm. The final value of the chaining variable is the hash value. It is seen that b > n.

A cryptographic hash function can be used to construct a pseudorandom function (PRF) or a pseudorandom number generator (PRNG). Secure Hash Algorithm (SHA) is a family of cryptographic hash functions.

Types of Network Security:

Wireless security is the prevention of unauthorized access or damage to computers using wireless networks. The most common types of wireless security are Wired Equivalent Privacy (WEP) and WiFi Protected Access (WPA).

WEP is a notoriously weak security standard. The password it uses can often be cracked in a few minutes with a basic laptop computer and widely available software tools.

WAP security is primarily provided by the Wireless Transport Layer Security (WTLS), which provides security services between the mobile device (client) and the WAP gateway to the Internet. There are several approaches to WAP end-to-end security and WTLS concepts are the secure session and the secure connection, which are defined in the specification as:

Secure connection:

A connection is a transport (in the OSI layering model definition) that provides a suitable type of service. The connections are transient. Every connection is associated with one session. Between any pair of parties (applications such as HTTP on client and server), there may be multiple secure connections. In theory, there may also be multiple simultaneous sessions between parties, but this feature is not used in practice.

Secure session:

An SSL session is an association between a client and a server. Sessions are created by the Handshake Protocol. Sessions define a set of cryptographic security parameters, which can be shared among multiple connections. Sessions are used to avoid the expensive negotiation of new security parameters for each connection.

There are a number of states associated with each session. Once a session is established, there is a current operating state for both read and write (i.e., receive and send). In addition, during the Handshake Protocol, pending read and write states are created. Upon successful conclusion of the Handshake Protocol, the pending states become the current states.

Internet Protocol Security (IPsec)

Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session.

IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.

IPsec can be used in protecting data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host).

IPsec is said to be especially useful for implementing virtual private networks and for remote user access through dial-up connection to private networks.

A big advantage of IPsec is that security arrangements can be handled without requiring changes to individual user computers.

IPsec provides two choices of security service:

Authentication Header (AH), which essentially allows authentication of the sender of data.

 Encapsulating Security Payload (ESP), which supports both authentication of the sender and encryption of data as well.

IPsec uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. IPsec protects any application traffic over an IP network. Applications can be automatically secured by IPsec at the IP layer.

Transport-Level Security (TLS)

Transport-Level Security (TLS) is an IETF standardization initiative whose goal is to produce an Internet standard version of SSL. Secure Socket Layer (SSL) provides security services between TCP and applications that use TCP.

The Internet standard version is called Transport Layer Service (TLS). The TLS Record Format is the same as that of the SSL Record Format. SSL/TLS provides confidentiality using symmetric encryption and message integrity using a message authentication code.

SSL/TLS includes protocol mechanisms to enable two TCP users to determine the security mechanisms and services they will use. HTTPS (HTTP over SSL) refers to the combination of HTTP and SSL to implement secure communication between a Web browser and a Web server.

Firewall

A firewall is a network security system that monitors and controls the incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted, secure internal network and another outside network, such as the Internet, that is assumed not to be secure or trusted.

Firewalls impose restrictions on incoming and outgoing Network packets to and from private networks. Network firewalls filter traffic between two or more networks; they are either software appliances running on general purpose hardware, or hardwarebased appliances.

They can also serve as the platform for IPsec. Using tunnel mode capability, firewall can be used to implement VPNs. Firewalls can also limit network exposure by hiding the internal network system and information from the public Internet.

A firewall may be designed to operate as a filter at the level of IP packets, or may operate at a higher protocol layer. Firewalls can be categorized into following types:

· Packet-filtering firewalls or Network layer ( Layer 3) firewalls make decisions based on the source and destination addresses and ports in IP packets. This basic form of firewall protection is really no more than a simple sorting algorithm. Generally they enable you to have some control through the use of access lists.

· Circuit-level gateways monitor the TCP handshaking going on between the local and remote hosts to determine whether the session being initiated is legitimate -- whether the remote system is considered "trusted."

· Stateful inspection firewalls on the other hand, these firewalls not only examine each packet, but also keep track of whether or not that packet is part of an established TCP session. This offers more security than either packet filtering or circuit monitoring alone, but exacts a greater toll on network performance.

· Application-level gateways (proxies) combine some of the attributes of packet-filtering firewalls with those of circuit-level gateways. They filter packets not only according to the service for which they are intended (as specified by the destination port), but also by certain other characteristics such as HTTP request string. A system establishes a connection to the proxy, which serves as an intermediary, and initiates a new network connection on behalf of the request. This prevents direct connections between systems on either side of the firewall and makes it harder for an attacker to discover where the network is, because they don't receive packets created directly by their target system. While application-level gateways provide considerable data security, they can dramatically impact network performance.

·Multilayer inspection firewalls combine packet filtering with circuit monitoring, while still enabling direct connections between the local and remote hosts, which are transparent to the network. They accomplish this by relying on algorithms to recognize which service is being requested, rather than by simply providing a proxy for each protected service. Multilayer firewalls work by retaining the status (state) assigned to a packet by each firewall component through which it passes on the way up the protocol stack.

Conclusion

With the rapid growth in the Internet, network data security has become an inexorable concern for any individual or organization whose internal private network is connected to the Internet. The security for the data has become highly important and the user’s data privacy across the network is a central question. Use of cryptographic techniques to secure data across networks is gaining more importance and with more mathematical tools, cryptographic schemes are getting more versatile and often involve multiple keys for a single application. Cryptography, along with suitable communication protocols, can provide a high degree of protection in digital communications against intruder attacks as far as the communication between two different computers is concerned.