CNS - Module-4-Network Security Notes
CNS - Module-4-Network Security Notes
Figure 10.1. (a) Message content and sender identity falsified by intruder; (b) a method of applied security
AUTHENTICATION TECHNIQUES
• Encryption methods offer the assurance of message confidentiality.
• A networking-system must be able to verify the authenticity of the message and the sender of the message.
These forms of security techniques are known as authentication techniques.
• Authentication techniques are categorized as i) authentication with message digest and
ii) authentication with digital signature.
SECRET KEY ENCRYPTION PROTOCOLS
• This is also called as symmetric encryption or single-key encryption.
• Sender and receiver conventionally use the same key for an encryption process.
• This consist of
→ an encryption-algorithm
→ a key and
→ a decryption-algorithm
• The encrypted-message is called ciphertext.
• Two popular protocols are: 1) DES (Data Encryption Standard)
2) AES (Advanced Encryption Standard)
• A shared secret-key between a transmitter and a receiver is assigned at the transmitter and receiver points.
• At the receiving end, the encrypted information can be transformed back to the original data by using
→ decryption algorithm and
→ secret key
DES
• Plaintext messages are converted into 64-bit blocks & each block is encrypted using a key.
• The key length is 56 bits.
• This consists of 16 identical rounds of an operation (Figure 10.3).
Begin DES Algorithm
1) Initialize. Before round 1 begins, all 64 bits of the message and all 56 bits of the secret key
` are separately permuted( shuffled).
2) Each incoming 64-bit message is broken into two 32-bit halves denoted by L i and Ri
respectively.
3) The 56 bits of the key are also broken into two 28-halves, and each half is rotated one or two
bit positions, depending on the round.
4) All 56 bits of the key are permuted, producing version k i of the key on round i.
5) Li and Ri are determined by
Li = Ri-1
and
Ri = Li-1 F(Ri-1,ki)
6) All 64 bits of a message are permuted.
Operation of function F()
• Out of 56 bits of ki, function F( ) chooses 48 bits.
• The 32-bit Ri-1 is expanded from 32 bits to 48 bits so that it can be combined with 48 bit ki.
• F( ) also partitions the 48 bits of ki into eight 6-bit chunks.
• The corresponding eight chunks of Ri-1 and eight chunks of ki are combined as follows
Ri=1 = Ri-1 ki
Figure 10.5. Message authentication: (a) combined with encryption; (b) use of the hash function
SECURITY OF IEEE
802.11i
• This standard specifies an authentication-server for the base-station communication.
• The separation of the authentication-server from the base-station means that the authentication-server can
serve many base stations.
• Extensible Authentication Protocol(EAP) specifies the interaction between a user and an authentication
server(IEEE802.11i)
To summarize the IEEE802.11i security mechanism:
• A base-station first announces its presence and types of security services it can provide to
wireless users.
• EAP frames are encapsulated and sent over the wireless link.
• After decapsulation at the base station, the frames are encapsulated again, this time using a protocol
called RADIUS for transmission over UDP to the authentication-server.
• With EAP, public-key encryption is used.
FIREWALLS
• This is placed between hosts of a certain network and the outside world (Figure 10.8).
• This is used to protect the network from unwanted web sites and potential hackers.
• The main objective is to monitor and filter packets coming from unknown sources.
• This can also be used to control data traffic.
• This can be a software program or a hardware device.
1) Software firewalls can be installed in home computers by using an Internet connection with
gateways.
2) Hardware firewalls
→ are more secure than software firewalls
→ are not expensive.
• A firewall controls the flow of traffic by one of the following three methods:
1) Packet filtering: A firewall filters those packets that pass through.
If packets can get through the filter, they reach their destinations: otherwise, they are discarded
2) A firewall filters packets based on the source IP address. This filtering is helpful when a host
has to be protected from any unwanted external packets.
3) Denial of Service(DOS). This method controls the number of packets entering a network.