通信网络技术课件：Chapter 8 Security

1、Chapter 8Upon completion you will be able to:Security Differentiate between two categories of cryptography schemes Understand four aspects of security Understand the concept of digital signature Understand the role of key management in entity authentication Know how and where IPSec, TLS, and PPG pro

2、vide securityObjectives 1TCP/IP Protocol Suite8.1 CRYPTOGRAPHYThe word cryptography in Greek means “secret writing.” The term today refers to the science and art of transforming messages to make them secure and immune to attacks.The topics discussed in this section include:Symmetric-Key Cryptography

3、 Asymmetric-Key Cryptography Comparison 2TCP/IP Protocol SuiteFigure 8.1 Cryptography components3TCP/IP Protocol SuiteIn cryptography, the encryption/decryption algorithms are public; the keys are secret.Note:4TCP/IP Protocol SuiteIn symmetric-key cryptography, the same key is used by the sender (fo

4、r encryption) and the receiver (for decryption). The key is shared.Note:5TCP/IP Protocol SuiteFigure 8.2 Symmetric-key cryptography6TCP/IP Protocol SuiteIn symmetric-key cryptography, the same key is used in both directions.Note:7TCP/IP Protocol SuiteFigure 8.3 Caesar cipher8TCP/IP Protocol SuiteFig

5、ure 8.4 Transpositional cipher9TCP/IP Protocol SuiteFigure 8.5 DES10TCP/IP Protocol SuiteFigure 8.6 Iteration block11TCP/IP Protocol SuiteFigure 8.7 Triple DES12TCP/IP Protocol SuiteThe DES cipher uses the same concept as the Caesar cipher, but the encryption/ decryption algorithm is much more compl

6、ex.Note:13TCP/IP Protocol SuiteFigure 8.8 Public-key cryptography14TCP/IP Protocol SuiteFigure 8.9 RSA15TCP/IP Protocol SuiteSymmetric-key cryptography is often used for long messages.Note:16TCP/IP Protocol SuiteAsymmetric-key algorithms are more efficient for short messages.Note:17TCP/IP Protocol S

7、uite8.2 PRIVACYPrivacy means that the sender and the receiver expect confidentiality. The transmitted message must make sense to only the intended receiver. To all others, the message must be unintelligible.The topics discussed in this section include:Privacy with Symmetric-Key Cryptography Privacy

8、with Asymmetric-Key Cryptography 18TCP/IP Protocol SuiteFigure 8.10 Privacy using symmetric-key encryption19TCP/IP Protocol SuiteFigure 8.11 Privacy using asymmetric-key encryption20TCP/IP Protocol SuiteDigital signature can provide authentication, integrity, and nonrepudiation for a message.Note:21

9、TCP/IP Protocol Suite8.3 DIGITAL SIGNATUREDigital signature can provide authentication, integrity, and nonrepudiation for a message. The topics discussed in this section include:Signing the Whole Document Signing the Digest 22TCP/IP Protocol SuiteFigure 8.12 Signing the whole document23TCP/IP Protoc

10、ol SuiteDigital signature does not provide privacy. If there is a need for privacy, another layer of encryption/decryption must be applied.Note:24TCP/IP Protocol SuiteFigure 8.13 Hash function25TCP/IP Protocol SuiteFigure 8.14 Sender site26TCP/IP Protocol SuiteFigure 8.15 Receiver site27TCP/IP Proto

11、col Suite8.4 ENTITY AUTHENTICATIONEntity authentication is a procedure that verifies the identity of one entity for another. An entity can be a person, a process, a client, or a server. In entity authentication, the identity is verified once for the entire duration of system access.The topics discus

12、sed in this section include:Entity Authentication with Symmetric-Key Cryptography Entity Authentication with Asymmetric-Key Cryptography 28TCP/IP Protocol SuiteFigure 8.16 Using a symmetric key only29TCP/IP Protocol SuiteFigure 8.17 Using a nonce30TCP/IP Protocol SuiteFigure 8.18 Bidirectional authe

13、ntication31TCP/IP Protocol Suite8.5 KEY MANAGEMENTIn this section we explain how symmetric keys are distributed and how public keys are certified. The topics discussed in this section include:Symmetric-Key Distribution Public-Key Certification Kerberos 32TCP/IP Protocol SuiteA symmetric key between

14、two parties is useful if it is used only once; it must be created for one session and destroyed when the session is over.Note:33TCP/IP Protocol SuiteFigure 8.19 Diffie-Hellman method34TCP/IP Protocol SuiteThe symmetric (shared) key in the Diffie-Hellman protocol is K = G xy mod N.Note:35TCP/IP Proto

15、col SuiteLet us give an example to make the procedure clear. Our example uses small numbers, but note that in a real situation, the numbers are very large. Assume G = 7 and N = 23. The steps are as follows:1. Alice chooses x = 3 and calculates R1 = 73 mod 23 = 21.2. Alice sends the number 21 to Bob.

16、3. Bob chooses y = 6 and calculates R2 = 76 mod 23 = 4.4. Bob sends the number 4 to Alice.5. Alice calculates the symmetric key K = 43 mod 23 = 18.6. Bob calculates the symmetric key K = 216 mod 23 = 18.The value of K is the same for both Alice and Bob; G xy mod N = 718 mod 23 = 18.Example 136TCP/IP

17、 Protocol SuiteFigure 8.20 Man-in-the-middle attack37TCP/IP Protocol SuiteFigure 8.21 First approach using KDC38TCP/IP Protocol SuiteFigure 8.22 Needham-Schroeder protocol39TCP/IP Protocol SuiteFigure 8.23 Otway-Rees protocol40TCP/IP Protocol SuiteIn public-key cryptography, everyone has access to e

18、veryones public key.Note:41TCP/IP Protocol SuiteTable 8.1 X.509 fields42TCP/IP Protocol SuiteFigure 8.24 PKI hierarchy43TCP/IP Protocol SuiteFigure 8.25 Kerberos servers44TCP/IP Protocol SuiteFigure 8.26 Kerberos example45TCP/IP Protocol Suite8.6 SECURITY IN THE INTERNETIn this section we discuss a

19、security method for each of the top 3 layers of the Internet model. At the IP level we discuss a protocol called IPSec; at the transport layer we discuss a protocol that “glues” a new layer to the transport layer; at the application layer we discuss a security method called PGP.The topics discussed

20、in this section include:IP Level Security: IPSec Transport Layer Security Application Layer Security: PGP 46TCP/IP Protocol SuiteFigure 8.27 Transport mode47TCP/IP Protocol SuiteFigure 8.28 Tunnel mode48TCP/IP Protocol SuiteFigure 8.29 AH49TCP/IP Protocol SuiteThe AH protocol provides message authen

21、tication and integrity, but not privacy.Note:50TCP/IP Protocol SuiteFigure 8.30 ESP51TCP/IP Protocol SuiteESP provides message authentication, integrity, and privacy.Note:52TCP/IP Protocol SuiteFigure 8.31 Position of TLS53TCP/IP Protocol SuiteFigure 8.32 TLS layers54TCP/IP Protocol SuiteFigure 8.33 Handshake protocol55TCP/IP Protocol SuiteFigure 8.34 Record Protocol56TCP/IP Protocol SuiteFigure 8.35 PGP at the sender site57TCP/IP Protocol SuiteF