Presentation is loading. Please wait.

Presentation is loading. Please wait.

18 July 2004Bill Nickless / IPSec1 IPSec Internet Protocol Security And You.

Published byRosaline Candice James Modified over 8 years ago

Similar presentations

Presentation on theme: "18 July 2004Bill Nickless / IPSec1 IPSec Internet Protocol Security And You."— Presentation transcript:

1 18 July 2004Bill Nickless / IPSec1 IPSec Internet Protocol Security And You

2 18 July 2004Bill Nickless / IPSec2 Outline What is IPSec, and what is it for? The IPSec Framework How do IKE, AH, and ESP fit together? Routing and Technology Issues Management and Policy Issues How To Learn More

3 18 July 2004Bill Nickless / IPSec3 IPSec Scope (RFC 2401) Good news: IPSEC is designed to provide interoperable, high quality, cryptographically-based security for IPv4 and IPv6.

4 18 July 2004Bill Nickless / IPSec4 IPSec Scope (RFC 2401) Bad news: The set of IPSec protocols employed in any context, and the ways they are employed, will be determined by the security and system requirements of users, applications, and/or sites/organizations.

5 18 July 2004Bill Nickless / IPSec5 IPSec Scope IPSec is a technology. IPSec is NOT a solution. Better: IPSec is a technology framework.

6 18 July 2004Bill Nickless / IPSec6 Outline What is IPSec, and what is it for? The IPSec Framework How do IKE, AH, and ESP fit together? Routing and Technology Issues Management and Policy Issues How To Learn More

7 18 July 2004Bill Nickless / IPSec7 IPSec Standards-based IP Security Framework –Data Integrity –Data Confidentiality –Data Origin Authentication –Anti-Replay Protection Supported in modern router software –Cisco IOS 12.1(19) or later –Juniper JUNOS 5.3 or later (with Encryption Services PIC)

8 18 July 2004Bill Nickless / IPSec8 IPSec Router performs additional operations: 1.Receive the packet and verify/decrypt it 2.Inspect the headers of the packet 3.Based on that inspection, put the packet into an outbound queue 4.Transmit the packet when it reaches the front of the outbound queue and sign/encrypt it Version (4 or 6) Protocol (TCP, etc) Source IP Address Destination IP Address Source PortDestination Port FlagsTime To Live Data (possibly with sequence number) Checksum IP 1 2 3 4

9 18 July 2004Bill Nickless / IPSec9 Ciphers, Signing and Keys (Oh My!) IPSec is a framework that supports many cryptographic technologies. What fits into the IPSec framework? –Diffie-Hellman Key Exchange –Ciphers –Hashes –Shared Secrets –Certificates –Perfect Forward Secrecy

10 18 July 2004Bill Nickless / IPSec10 Diffie-Hellman Key Exchange Agree on a secret shared key, without a secure channel. Suppose Alice and Bob want to agree on a shared secret key using the Diffie-Hellman key agreement protocol. They proceed as follows: First, Alice generates a random private value a and Bob generates a random private value b. Both a and b are drawn from the set of integers. Then they derive their public values using parameters p and g and their private values. Alice's public value is g a mod p and Bob's public value is g b mod p. They then exchange their public values. Finally, Alice computes g ab = (g b ) a mod p, and Bob computes g ba = (g a ) b mod p. Since g ab = g ba = k, Alice and Bob now have a shared secret key k. http://www.rsasecurity.com/rsalabs/node.asp?id=2248

11 18 July 2004Bill Nickless / IPSec11 Ciphers Obscure data, so that it can only be read by someone with the right “key” DES, AES, RSA, RC5, Blowfish, Skipjack, etc.

12 18 July 2004Bill Nickless / IPSec12 Hashes Take a bunch of data, make a digest of it, so that changes can be detected MD5, SHA-1, RIPEMD-160

13 18 July 2004Bill Nickless / IPSec13 Shared Secrets Prove identity by demonstrating knowledge of the same data Not necessary to actually transmit the shared secret.

14 18 July 2004Bill Nickless / IPSec14 Perfect Forward Secrecy RFC 2409: Perfect Forward Secrecy (PFS) refers to the notion that compromise of a single key will permit access to only data protected by a single key. For PFS to exist the key used to protect transmission of data MUST NOT be used to derive any additional keys, and if the key used to protect transmission of data was derived from some other keying material, that material MUST NOT be used to derive any more keys.

15 18 July 2004Bill Nickless / IPSec15 Certificates Establish trust based on mutual trust of a third party X.509

16 18 July 2004Bill Nickless / IPSec16 IPSec Security Associations IPSec Security Associations (SA) –between two routers (or hosts) –Unicast only –Unidirectional –Selection Criteria: Drop, Apply IPSec, Pass without IPSec

17 18 July 2004Bill Nickless / IPSec17 IPSec Router IPSec flow: 1.Receive the packet. 2.Inspect the headers of the packet. Matching Security Association (SA)? 3.If so, verify/decrypt 4.Inspect headers again. Make routing decision, and look for matching Security Association (SA). 5.If so, sign/encrypt 6.Transmit the packet. Version (4 or 6) Protocol (TCP, etc) Source IP Address Destination IP Address Source PortDestination Port FlagsTime To Live Data (possibly with sequence number) Checksum IP 1 2 5 3 4 6

18 18 July 2004Bill Nickless / IPSec18 Outline What is IPSec, and what is it for? The IPSec Framework How do IKE, AH, and ESP fit together? Routing and Technology Issues Management and Policy Issues How To Learn More

19 18 July 2004Bill Nickless / IPSec19 The Internet Key Exchange (IKE) RFC 2409: The purpose is to negotiate, and provide authenticated keying material for, security associations in a protected manner. Processes which implement this memo can be used for negotiating virtual private networks (VPNs) and also for providing a remote user from a remote site (whose IP address need not be known beforehand) access to a secure host or network.

20 18 July 2004Bill Nickless / IPSec20 IKE Phase 1 Phase 1 is where the two ISAKMP peers establish a secure, authenticated channel with which to communicate. This is called the ISAKMP Security Association (SA).

21 18 July 2004Bill Nickless / IPSec21 IKE Phase 2 Phase 2 is where Security Associations are negotiated on behalf of services such as IPsec or any other service which needs key material and/or parameter negotiation.

22 18 July 2004Bill Nickless / IPSec22 IKE New Group "New Group Mode" is not really a phase 1 or phase 2. It follows phase 1, but serves to establish a new group which can be used in future negotiations.

23 18 July 2004Bill Nickless / IPSec23 IKE In Operation

24 18 July 2004Bill Nickless / IPSec24 IKE In Operation

25 18 July 2004Bill Nickless / IPSec25 IKE In Operation

26 18 July 2004Bill Nickless / IPSec26 Authentication Header (AH) Uses a hash such as MD5 or SHA –Protects against modification –Protects against replay RFC 2402 Version (4 or 6) Protocol (TCP, etc) Source IP Address Destination IP Address Source PortDestination Port FlagsTime To Live Authentication Header Data (possibly with sequence number) Checksum

27 18 July 2004Bill Nickless / IPSec27 ESP: Encapsulating Security Payload Transport Mode Before applying ESP ---------------------------- IPv4 |orig IP hdr | | | |(any options)| TCP | Data | ---------------------------- After applying ESP ------------------------------------------------- IPv4 |orig IP hdr | ESP | | | ESP | ESP| |(any options)| Hdr | TCP | Data | Trailer |Auth| ------------------------------------------------- | | | | RFC 2406

28 18 July 2004Bill Nickless / IPSec28 Recursive Encapsulation: Tunneling Why? –Create a virtual connection between two parts of a private Internet that… …uses nonroutable addresses? …uses advanced services like IPv6 or multicast? –Encrypt the encapsulated packet

29 18 July 2004Bill Nickless / IPSec29 Recursive Encapsulation: Tunneling Encapsulate an IP packet inside the data portion of another IP packet Version (4 or 6) Protocol (TCP, etc) Source IP AddressDestination IP Address Source PortDestination Port FlagsTime To Live Data (possibly with sequence number) Checksum Version (4 or 6) Protocol (TCP, etc) Source IP Address Destination IP Address Source PortDestination Port FlagsTime To Live Data (possibly with sequence number) Checksum

30 18 July 2004Bill Nickless / IPSec30 ESP: Encapsulating Security Payload Tunnel Mode Before applying ESP ---------------------------- IPv4 |orig IP hdr | | | |(any options)| TCP | Data | ---------------------------- After applying ESP --------------------------------------------------------------- IPv4 | new IP hdr | ESP | orig IP hdr | | | ESP | ESP| |(any options)| HDR | (any options)| TCP | Data |Trailer |Auth| --------------------------------------------------------------- | | | | RFC 2406

31 18 July 2004Bill Nickless / IPSec31 IPSec Router IPSec flow: 1.Receive the packet. 2.Inspect the headers of the packet. Matching Security Association (SA)? 3.If so, verify/decrypt 4.Inspect headers again. Make routing decision, and look for matching Security Association (SA). 5.If so, sign/encrypt 6.Transmit the packet. Version (4 or 6) Protocol (TCP, etc) Source IP Address Destination IP Address Source PortDestination Port FlagsTime To Live Data (possibly with sequence number) Checksum IP 1 2 5 3 4 6

32 18 July 2004Bill Nickless / IPSec32 ESP in Operation

33 18 July 2004Bill Nickless / IPSec33 Outline What is IPSEC, and what is it for? The IPSEC Framework How do IKE, AH, and ESP fit together? Routing and Technology Issues Management and Policy Issues How To Learn More

34 18 July 2004Bill Nickless / IPSec34 ESP and AH Additional Header Information –Smaller payload –MTU ugliness Cryptographic Operations –Additional Complexity –More CPU load?

35 18 July 2004Bill Nickless / IPSec35 ESP Tunnel Mode Original headers obscured –Bad guys can’t see the headers...neither can your firewall!...neither can your router! Creates a Virtual Circuit –Encapsulated IP TTL isn’t decremented –Intermediate hops are obscured –Remember debugging ATM VCs? …or MPLS?

36 18 July 2004Bill Nickless / IPSec36 ESP in Operation

37 18 July 2004Bill Nickless / IPSec37 Outline What is IPSEC, and what is it for? The IPSEC Framework How do IKE, AH, and ESP fit together? Routing and Technology Issues Management and Policy Issues How To Learn More

38 18 July 2004Bill Nickless / IPSec38 Where is your Security Perimeter? Firewalls and ACLs protect your network IPSec VPN solutions bring external hosts inside your network Should you trust those external hosts? –Viruses, Worms, Trojans –OS Vendor Patch-of-the-week –“Art and Music” sharing Split tunneling vs. Host-based Firewalls

39 18 July 2004Bill Nickless / IPSec39 Policy Enforcement Enforcement Requires Visibility ESP Tunnel Mode –Bad guys can’t see the headers ….neither can your firewall! ….neither can your router! Encryption Obscures Activity –Is this traffic work-related or “Art and Music”?

40 18 July 2004Bill Nickless / IPSec40 IPSec: A Two-Edged Sword Powerful set of options –Data Confidentiality –Data Integrity –Data Origin Authentication Bad Guys can use IPSec too –Back doors –Hiding “bad” activity

41 18 July 2004Bill Nickless / IPSec41 IPSec Legal/Societal Issues Cryptography: Controlled as a Munition Lawful Intercept U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Not a comprehensive list)

42 18 July 2004Bill Nickless / IPSec42 Outline What is IPSEC, and what is it for? The IPSEC Framework How do IKE, AH, and ESP fit together? Routing and Technology Issues Management and Policy Issues How To Learn More

43 18 July 2004Bill Nickless / IPSec43 Example Solution: Cisco Easy VPN

44 18 July 2004Bill Nickless / IPSec44 Example Solution: Cisco Easy VPN

45 18 July 2004Bill Nickless / IPSec45 Cisco and Linux Interoperate http://www.sans.org/rr/papers/20/753.pdf

46 18 July 2004Bill Nickless / IPSec46 Juniper IPSec Configuration http://www.juniper.net/techpubs/software/junos/junos63/ swconfig63-services/html/ipsec-config.html IETF IPSec Working Group http://www.ietf.org/html.charters/ipsec-charter.html http://www.vpnc.org/vpn-standards.html Virtual Private Network Consortium http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/ 122cgcr/fsecur_c/fipsenc/scfipsec.htm Cisco IPSec Configuration

Download ppt "18 July 2004Bill Nickless / IPSec1 IPSec Internet Protocol Security And You."

Similar presentations

Internet Protocol Security (IP Sec)

Internet Protocol Security (IP Sec)
CS470, A.SelcukIPsec – AH & ESP1 CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk.

CS470, A.SelcukIPsec – AH & ESP1 CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk.
Internet Security CSCE 813 IPsec

Internet Security CSCE 813 IPsec
Working Connection Computer and Network Security - SSL, IPsec, Firewalls – (Chapter 17, 18, 19, and 23)

Working Connection Computer and Network Security - SSL, IPsec, Firewalls – (Chapter 17, 18, 19, and 23)
IPSec In Depth. Encapsulated Security Payload (ESP) Must encrypt and/or authenticate in each packet Encryption occurs before authentication Authentication.

IPSec In Depth. Encapsulated Security Payload (ESP) Must encrypt and/or authenticate in each packet Encryption occurs before authentication Authentication.
IPSec: Authentication Header, Encapsulating Security Payload Protocols CSCI 5931 Web Security Edward Murphy.

IPSec: Authentication Header, Encapsulating Security Payload Protocols CSCI 5931 Web Security Edward Murphy.
Information System Security AABFS-Jordan Summer 2006 IP Security Supervisor :Dr. Lo'ai Ali Tawalbeh Done by: Wa’el Musa Hadi.

Information System Security AABFS-Jordan Summer 2006 IP Security Supervisor :Dr. Lo'ai Ali Tawalbeh Done by: Wa’el Musa Hadi.
Chapter 13 IPsec. IPsec (IP Security)  A collection of protocols used to create VPNs  A network layer security protocol providing cryptographic security.

Chapter 13 IPsec. IPsec (IP Security)  A collection of protocols used to create VPNs  A network layer security protocol providing cryptographic security.
ECE 454/CS 594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall.

ECE 454/CS 594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall.
1 Lecture 15: IPsec AH and ESP IPsec introduction: uses and modes IPsec concepts –security association –security policy database IPsec headers –authentication.

1 Lecture 15: IPsec AH and ESP IPsec introduction: uses and modes IPsec concepts –security association –security policy database IPsec headers –authentication.
Henric Johnson1 Ola Flygt Växjö University, Sweden +46 470 70 86 49 IP Security.

Henric Johnson1 Ola Flygt Växjö University, Sweden IP Security.
IP Security. Overview In 1994, Internet Architecture Board (IAB) issued a report titled “Security in the Internet Architecture”. This report identified.

IP Security. Overview In 1994, Internet Architecture Board (IAB) issued a report titled “Security in the Internet Architecture”. This report identified.
CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.
IPsec: Internet Protocol Security Chong, Luon, Prins, Trotter.

IPsec: Internet Protocol Security Chong, Luon, Prins, Trotter.
K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.

K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.
Configuration of a Site-to-Site IPsec Virtual Private Network Anuradha Kallury CS 580 Special Project August 23, 2005.

Configuration of a Site-to-Site IPsec Virtual Private Network Anuradha Kallury CS 580 Special Project August 23, 2005.
1 IPsec Youngjip Kim 2004. 05. 24. 2 Objective Providing interoperable, high quality, cryptographically-based security for IPv4 and IPv6 Services  Access.

1 IPsec Youngjip Kim Objective Providing interoperable, high quality, cryptographically-based security for IPv4 and IPv6 Services  Access.
Internet Protocol Security (IPSec)

Internet Protocol Security (IPSec)
K. Salah1 Security Protocols in the Internet IPSec.

K. Salah1 Security Protocols in the Internet IPSec.
Network Security. Contents Security Requirements and Attacks Confidentiality with Conventional Encryption Message Authentication and Hash Functions Public-Key.

Network Security. Contents Security Requirements and Attacks Confidentiality with Conventional Encryption Message Authentication and Hash Functions Public-Key.

Similar presentations

Ads by Google