Welcome to the lecture on protocols and services designed to ensure the security of computer systems
the subject is very important because the bulk of protocols still in use today are more than 30 years
old.
These protocols were not designed with security in mind examining individual layers of the OS model.
We have noted that some security measures are present only from the third layer up the first secure
protocol is the IP SEC which is used by the fall with IP version 6 even when there are mechanisms allowing
to improve security of a computer system or a computer network.
They are often used.
There are a number of solutions but the number of those news is smaller still.
What could you do to improve the security of a computer network.
You could ensure the confidentiality and authenticity of the data sent over the network.
You can also make sure that you exchange data with the host you actually intended to or authenticate
the remote computer doing these three things would improve security greatly due to confidentiality and
authenticity and the identity of the remote computer can be insured by implementing the secure Internet
Protocol or IP sec.
Actually this is a whole suite of protocols which will now examine each of them individually
the first and most widely used as the ESPN protocol encapsulating security payload all the protocols
that make up the IP Senge operate at that third layer of the same model.
One of the basic advantages of the ESPN is that the protocol will not effect in any way the functionality
of applications running in a given network the IP set can be enabled from the third layer and not from
the session layer or higher.
We can secure communication between hosts or groups of hosts in a manner not requiring any changes to
the infrastructure and software running on your network.
Yes P is used for encryption and digital signing of the transmitted data.
If you use both features of the protocol the data will first be encrypted and then there cryptograms
will be digitally signed
the implementation of VSP required to add the ESPN header to the IP header the first header field contains
information about security parameters and about security associations negotiated for the protocol.
The header also includes the package sequence number.
This means that the IP SEC and the ISP protect against replay attacks and a replay attack the attacker
uses a stolen password instead of cracking one ESPN automatically eliminates this threat.
The packet footer contains information about the amount of pseudo random data needed for the encryption
with a given algorithm encryption algorithms have certain requirements concerning the amount of data
to be encrypted the information about the amount of data that was supplemented is sent to the final
part of the header contains the information about the protocol protected by the ISP and the information
confirming the identity of the remote host
the ESPN protocol can operate in one of two modes the transport mode is used most often.
This is the mode shown in the diagram below.
Its function is to ensure the confidentiality and authenticity of communication between two hosts
everything that is above the third layer of the oocyte model gets encrypted.
In addition the ESB header is signed as well.
The authenticity of the header is verified.
The second mode is the tunnel mode in the picture below.
You can see its schematic representation this mode is used to secure the communication between routers.
That is to say between subnets
the same kind of data that is encrypted and signed in transport mode is encrypted and signed in tunnel
mode as well.
In addition the IP header is attached the original IP header is replaced with a router header.
The router establishes a secure connection channel between two networks.
The second protocol of the IP six suite is the authentication header.
It allows you to confirm the authenticity of data and the protocol headers contained in this data
authenticity is confirmed by attaching a signature to the data being transmitted.
We had a chance to examine this when we discussed calculating S.H. one or M.D five file hashes thanks
to this.
Any change in the data will change the hash value in IP protocols headers.
There are fields the values of which are inherently variable and example of such a field is the TTL
time to live.
Whose value is reduced by one for each rodder through which the packet is transmitted.
If the TTL field was signed its endpoint value would certainly not match its initial value.
A solution to this problem is that all header fields with variable values are reset before getting a
signature.
This information must be recorded at the age protocol header.
In the header you will find for example the information about the protocol of the package whose data
has been protected by the H protocol.
Moreover there is also the information about the data length and security parameter index.
That is the information about the IPv6 Security Association.
This is the information concerning the hash function that has been negotiated and used as in the case
with the ISP.
You also find the sequence number of the remote host and its credentials
the authentication header just like the espie can run in one of two modes a similar transport mode is
used to confirm the authenticity of communication between two hosts in the picture below you can see
all the data except the variable header fields are assigned
the tunnel mode is used to confirm the authenticity of data transferred between networks.
In this case to the IP header with the address pointing to the router that sent the packet is added
that can easily be encrypted and digitally signed.
As long as both communicating parties have access to the shared secret
the problem is how to establish a shared secret key over an insecure communications channel.
In the case of the secure Internet Protocol IP Seck this problem has been solved by the Diffie Helman
protocol.
This is a protocol for the exchange of cryptographic keys using asymmetric key encryption scheme.
The designers of the solution also took into consideration the FS perfect forward security role.
According to this rule disclosure of the key should not allow access to all the data encrypted in this
key regardless of whether the data has been encrypted before or after the key was disclosed.
This is a simple requirement to me and the solution is not technologically complex.
The key must be dynamically generated.
The master key is used to secure the establishment of one or more session keys.
The Diffie Helman protocol is computationally complex.
If it was used regularly it would have a perceptible impact on the efficiency of communication.
Moreover it cannot be used repeatedly for a long time because it would fail to meet FS requirements
to create an efficient and secure solution.
It was decided that the IPv6 security associations would be negotiated in a two faced process
during the first phase.
A secure connection is established the identity of the remote host is verified and the secure channel
is set up Phase 2 is very fast and computationally cheap but it only allows to renegotiate security
associations and replace the session key.