Cryptography and Network SecurityChapter 16.ppt

Cryptography and Network SecurityChapter 16 Fourth Edition by William Stallings Chapter 16 – IP Security If a secret piece of news is divulged by a spy before the time is ripe, he must be put to death, together with the man to whom the secret was told. —The Art of War, Sun Tzu IP Security have a range of application specific security mechanisms eg. S/MIME, PGP, Kerberos, SSL/HTTPS however there are security concerns that cut across protocol layers would like security implemented by the network for all applications IPSec general IP Security mechanisms provides authentication confidentiality key management applicable to use over LANs, across public private WANs, for the Internet IPSec Uses Benefits of IPSec in a firewall/router provides strong security to all traffic crossing the perimeter in a firewall/router is resistant to bypass is below transport layer, hence transparent to applications can be transparent to end users can provide security for individual users secures routing architecture IP Security Architecture specification is quite complex defined in numerous RFC’s incl. RFC 2401/2402/2406/2408 many others, grouped by category mandatory in IPv6, optional in IPv4 have two security header extensions: Authentication Header (AH) Encapsulating Security Payload (ESP) IPSec Services Access control Connectionless integrity Data origin authentication Rejection of replayed packets a form of partial sequence integrity Confidentiality (encryption) Limited traffic flow confidentiality Security Associations a one-way relationship between sender receiver that affords security for traffic flow defined by 3 parameters: Security Parameters Index (SPI) IP Destination Address Security Protocol Identifier has a number of other parameters seq no, AH EH info, lifetime etc have a database of Security Associations Authentication Header (AH) provides support for data integrity authentication of IP packets end system/router can authenticate user/app prevents address spoofing