Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 86 views

    CH 32

    Uploaded by

    Veeraj Thakur

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd

    CH 32

    Uploaded by

    Veeraj Thakur
    86 views44 pages

    Original Title

    ch32.ppt

    Copyright

    © © All Rights Reserved

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    86 views44 pages

    CH 32

    Uploaded by

    Veeraj Thakur

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 44

    Chapter 32

    Security in the Internet:


    IPSec, SSL/TLS, PGP,
    VPN, and Firewalls
    32.1

    Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

    Figure 32.1 Common structure of three security protocols

    32.2

    321IPSecurity(IPSec)
    IPSecurity (IPSec) is a collection of protocols designed
    by the Internet Engineering Task Force (IETF) to
    provide security for a packet at the network level.

    Topics discussed in this section:


    Two Modes
    Two Security Protocols
    Security Association
    Internet Key Exchange (IKE)
    Virtual Private Network
    32.3

    Figure 32.2 TCP/IP protocol suite and IPSec

    32.4

    Figure 32.3 Transport mode and tunnel modes of IPSec protocol

    32.5

    Note

    IPSec in the transport mode does not


    protect the IP header; it only protects
    the information coming from the
    transport layer.

    32.6

    Figure 32.4 Transport mode in action

    32.7

    Figure 32.5 Tunnel mode in action

    32.8

    Note

    IPSec in tunnel mode protects the


    original IP header.

    32.9

    Figure 32.6 Authentication Header (AH) Protocol in transport mode

    32.10

    Note

    The AH Protocol provides source


    authentication and data integrity,
    but not privacy.

    32.11

    Figure 32.7 Encapsulating Security Payload (ESP) Protocol in transport mode

    32.12

    Note

    ESP provides source authentication,


    data integrity, and privacy.

    32.13

    Table 32.1 IPSec services

    32.14

    Figure 32.8 Simple inbound and outbound security associations

    32.15

    Note

    IKE creates SAs for IPSec.

    32.16

    Figure 32.9 IKE components

    32.17

    Table 32.2 Addresses for private networks

    32.18

    Figure 32.10 Private network

    32.19

    Figure 32.11 Hybrid network

    32.20

    Figure 32.12 Virtual private network

    32.21

    Figure 32.13 Addressing in a VPN

    32.22

    322SSL/TLS
    Two protocols are dominant today for providing
    security at the transport layer: the Secure Sockets
    Layer (SSL) Protocol and the Transport Layer
    Security (TLS) Protocol. The latter is actually an
    IETF version of the former.
    Topics discussed in this section:
    SSL Services
    Security Parameters
    Sessions and Connections
    Four Protocols
    Transport Layer Security
    32.23

    Figure 32.14 Location of SSL and TLS in the Internet model

    32.24

    Table 32.3 SSL cipher suite list

    32.25

    Table 32.3 SSL cipher suite list (continued)

    32.26

    Note

    The client and the server have six


    different cryptography secrets.

    32.27

    Figure 32.15 Creation of cryptographic secrets in SSL

    32.28

    Figure 32.16 Four SSL protocols

    32.29

    Figure 32.17 Handshake Protocol

    32.30

    Figure 32.18 Processing done by the Record Protocol

    32.31

    323PGP
    One of the protocols to provide security at the
    application layer is Pretty Good Privacy (PGP). PGP is
    designed to create authenticated and confidential
    e-mails.
    Topics discussed in this section:
    Security Parameters
    Services
    A Scenario
    PGP Algorithms
    Key Rings
    PGP Certificates
    32.32

    Figure 32.19 Position of PGP in the TCP/IP protocol suite

    32.33

    Note

    In PGP, the sender of the message


    needs to include the identifiers of the
    algorithms used in the message as well
    as the values of the keys.

    32.34

    Figure 32.20 A scenario in which an e-mail message is


    authenticated and encrypted

    32.35

    Table 32.4 PGP Algorithms

    32.36

    Figure 32.21 Rings

    32.37

    Note

    In PGP, there can be multiple paths from


    fully or partially trusted authorities to
    any subject.

    32.38

    324FIREWALLS
    All previous security measures cannot prevent Eve
    from sending a harmful message to a system. To
    control access to a system, we need firewalls. A firewall
    is a device installed between the internal network of an
    organization and the rest of the Internet. It is designed
    to forward some packets and filter (not forward)
    others.
    Topics discussed in this section:
    Packet-Filter Firewall
    Proxy Firewall
    32.39

    Figure 32.22 Firewall

    32.40

    Figure 32.23 Packet-filter firewall

    32.41

    Note

    A packet-filter firewall filters at the


    network or transport layer.

    32.42

    Figure 32.24 Proxy firewall

    32.43

    Note

    A proxy firewall filters at the


    application layer.

    32.44

    You might also like