This document provides an overview of network security concepts including cryptography, digital signatures, security at various layers, and firewalls. It discusses cryptography principles like plaintext, ciphertext, and keys. Symmetric and asymmetric key cryptography algorithms are explained along with digital signatures and hashing. Network layer security standards like IPsec and its authentication header and encapsulating security payload are described. Transport layer security including TLS handshake, alert, and cipher protocols is also summarized. The roles and types of firewalls in providing access control between networks are defined.

1. NETWORK SECURITY
name- anoop negi
roll no- 27
Date: 4-04-2016

2. CONTENTS
 understand principles of network security:
 cryptography
 Digital Signatures
 Security at Various Layers
 Firewalls

3. INTRODUCTION
Cryptography is the study of creating and using encryption and decryption techniques.
Plaintext is the the data that before any encryption has been performed.
Ciphertext is the data after encryption has been performed.
The key is the unique piece of information that is used to create ciphertext and decrypt the ciphertext back into
plaintext.

4. KEY TERMS
 Confidentiality: only sender, intended receiver should “ understand” message
contents
 sender encrypts message
 receiver decrypts message
 Authentication: sender, receiver want to confirm identity of each other
 Message Integrity: sender, receiver want to ensure message not altered (in
transit, or afterwards) .
 Access and Availability: services must be accessible and available to users

5. CONTINUE………..
❍ eavesdrop: intercept messages
❍ impersonation: can fake (spoof) source address in packet (or any field in
packet)
❍ hijacking: “take over” ongoing connection by removing sender or receiver,
inserting himself in place

6. SYMMETRIC KEY
CRYPTOGRAPHY
 The same key is used by the sender (for encryption) and the receiver (for decryption).
 The key is shared.
 Encryption and Decryption Algorithms are public.

7. Continue……….
 substitution cipher: substituting one thing for another.
 monoalphabetic cipher: substitute one letter for another .
plaintext: abcdefghijklmnopqrstuvwxyz
ciphertext: mnbvcxzasdfghjklpoiuytrewq
Plaintext: bob. i love you. alice
ciphertext: nkn. s gktc wky. mgsbc

8. Data Encryption Standard
 Created in 1977 and in operation into the 1990s, the data encryption standard took a 64-
bit block of data and subjected it to 16 levels of encryption.
 The choice of encryption performed at each of the 16 levels depends on the 56-bit key
applied.
 Even though 56 bits provides over 72 quadrillion combinations, a system using this
standard has been cracked (in 1998 by Electronic Frontier Foundation in 3 days).

9. Continue……….

10. Public Key Cryptography
 Very powerful encryption technique in which two keys are used: the first key (the
public key) encrypts the message while the second key (the private key) decrypts the
message.
 Not possible to deduce one key from the other.
 Not possible to break the code given the public key.
 If you want someone to send you secure data, give them your public key, you keep the
private key.
 Secure sockets layer on the Internet is a common example of public key cryptography.

11. RSA
 The most common public key algorithm .
 Private key is a pair of numbers (n,d).
 Public key is a pair of numbers (n,e).
 The sender uses the following algorithm to encrypt the message:
 C=p*pow(e) mod n
 P=plaintext ,C=cyphertext and e,n are components of public key.
 Receiver : p=C*pow(d) mod n

12. RSA

13. Digital Signature
Digital signature can provide:
Authentication
Integrity
Nonrepudiation
The sender uses her private key to encrypt(sign) the message .
The receiver on the other hand uses the public key of sender to decrypt the msg.
No need to sign the entire document(digest).
Digital signature does not provide privacy.

14. Message Digests
 Computationally expensive to public-key-encrypt long messages.
 Goal: fixed-length, easy to-compute digital “fingerprint”.
 apply hash function H to m, get fixed size message digest, H(m).
 Hash function properties:
 Hashing is one way: digest can only be created from the msg , not vice versa.
 Hashing is one to one function: there is little probability that two msg produce same digest.

15. SECURITY AT IP LEVEL
 IP Security (ipsec) is a collection of protocols to provide security for a packet at the IP level.
 Ipsec requires a logical connection between two hosts using a signalling protocol called Security
Association.
 An SA connection can be simplex or duplex.
 SA is uniquely defined by three elements:
 A 32 bit security parameter index (spi),which acts as virtual circuit identifier in connection
oriented protocols.
 The source ip address.
 The type of protocol used- AH,ESP.

16. AUTHENTICATION HEADER (AH)
 AH provides authentication , integrity and anti-replay for the entire
packet(ip header & data payload).
 It does not provide confidentiality , which means it does not encrypt the
data.
 The data is readable but protected from modification.
 Integrity and authentication are provided by placement of AH header
between the Ip header and transport layer protocol .
 AH uses an ip protocol id of 51 to identify itself in the IP header.

17. AH FIELDS
 Next Header: Identifies the next header that uses IP protocol id,
ex- value might be 6 to indicate tcp.
 Length: indicate length of AH header.
 SPI: used in combination with the destination address and security protocol(AH OR ESP) to
identify correct security association for the communication.
 Sequence no. : provides anti-relay protection. It is a 32 bit number that is never allowed to
cycle . The receiver checks this field to verify that a packet with this number has not been
received yet. If one is received ,the packet is rejected.
 Authentication data: contains integrity check value to verify the integrity of the msg.

18. ENCAPSULATING SECURITY PAYLOAD
Provides confidentiality in addition to authentication , integrity and anti-replay.
ESP indicates itself in the IP header using IP protocol id of 50.
Ex- alice on computer A sends data to bob on computer B.
The data payload is encrypted and signed for integrity. Upon receipt the data
payload packet is decrypted . Bob can be certain it was really alice who send the
data. Also the data is unmodified and no other was able to read it.

19. ESP HEADER AND TRAILER FIELD
 SECURITY PARAMETER INDEX (SPI): same as in AH.
 Sequence no : same as in AH.
 Padding : the variable length field of 0’s serves as padding.
 Padding length: indicates the length of the padding field in bytes.
 This field is used by the receiver to discard the padding field.
 Next header: identifies the type of payload tcp or udp.
 Authentication data: contains the integrity check value(icv) and a msg
authentication code that is used to verify the sender’s identity and msg
integrity.

20. Continue….

21. Transport layer security
 TLS was designed to provide security at transport layer.
 TLS allows two parties to exchange messages in a secure environment. To accomplish this TLS
require that
 Two parties must agree on 3 protocols : an entity authentication protocol, a message
authentication protocol and encrypt/decrypt protocol.
 TLS has two layers.
 The top layer includes three protocols ,one for session setup(handshaking),one for alerting the
other party of unusual situation, and one informing the establishment of security parameters.
 The lower layer ,the record protocol ,is used to encapsulate msg from the upper layer.

22. Handshake protocol

23. Alert protocol
 The alert protocol is used to signal an error or a potential error to other party.
 The packet exchanged defines the severity level of the condition.

24. Change cipher spee protocol
 This protocol is designed to activate the security services (message
authentication and encryption/decryption) after all the agreements are
confirmed in the handshake protocol.
 After exchanging the one message defined in this protocol ,the two parties
can use the services.

25. FIREWALLS
 A system or combination of systems that supports an access control policy between two networks.
 A firewall can limit the types of transactions that enter a system, as well as the types of transactions that
leave a system.
 Firewalls can be programmed to stop certain types or ranges of IP addresses, as well as certain types of TCP
port numbers (applications).
 A packet filter firewall is essentially a router that has been programmed to filter out or allow to pass certain
IP addresses or TCP port numbers.
 A proxy server is a more advanced firewall that acts as a doorman into a corporate network. Any external
transaction that request something from the corporate network must enter through the proxy server.
 Proxy servers are more advanced but make external accesses slower.

26. THANK YOU