Lecture 6 (Chapter 16,17,18) Network and Internet Security Prepared by Dr. Lamiaa M. Elshenawy 1

 Transport-level security (Chapter 16)  Web Security Considerations  Secure Socket Layer and Transport Layer Security  Transport Layer Security (TLS)  HTTPS  Secure Shell (SSH)

 Internet security : is a branch of computer security browser security  Secure Socket Layer (SSL) security services between TCP (Transmission Control Protocol) and applications use TCP via Transport Layer Service  SSL/TLS confidentiality & data integrity symmetric encryption & message authentication code (MAC)  HTTPS (HTTP over SSL) combination of HTTP and SSL secure communication between Web browser & Web server  Secure Shell (SSH) secure remote logon and other secure client/server facilities involves provides by Refers to implemen t provides

 Internet is two-way Web is vulnerable to attacks  Business transactions Reputations damaged and money lost Web servers subverted  Web software hide many potential security flaws vulnerable to a variety of security attacks

 Web server launching pad attacker access data systems connected to server at local site  Untrained (in security matters) users are common clients Web-based services not have tools or knowledge to effective countermeasures

 SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private  TLS (Transport Layer Security) is just an updated, more secure, version of SSL  SSL was developed by Netscape is an American computer services company, best known for Netscape navigator, its web browser

 SSL Record Protocol provides two security services  Confidentiality: Handshake Protocol defines a shared secret key that is used for conventional encryption  Message Integrity: Handshake Protocol defines a shared secret key that is used to form a message authentication code (MAC) SSL Protocol Stack

 Most complex part of SSL  Used before any application data is transmitted  Allows the server and client to authenticate each other  Negotiate an encryption & MAC algorithm & cryptographic keys to protect data

 Type (1 byte) Indicates one of 10 messages  Length (3 bytes) length of the message in bytes  Content (≥ 0 bytes) parameters associated with this message

 Least complex part of SSL  Consists of a single message (single byte with the value 1)  Updates cipher suite to be used on this connection

 Convey SSL-related alerts to the peer entity  Alert messages are compressed and encrypted  Each message in this protocol consists of two bytes warning fatal 1 2 Unexpected _ message An appropriate message was received

 What is HTTPS?  HTTPS built into all modern Web browsers  URL (Uniform Resource Locator)  port 443  port 80 Hypertext Transfer Protocol (HTTPS): is an application protocol to exchange or transfer hypertext Hypertext: is text displayed on a computer display with hyperlinks to other text which the reader can immediately access

Protocol Identifier Domain Name Protocol Type Source Location  URL is a web address  ftp://  Uniform Resource Locator (URL) was developed by Tim Berners-Lee in 1994 and the Internet Engineering Task Force (IETF) URI working group

 What is SSH?  SSH is a protocol for secure network communications designed to be simple and inexpensive  What are versions of SSH?  SSH1 /file transfer  SSH2 fixes security flaws of SSH1 SSH Communications Security Corporation is a Finnish company was founded by Tatu Ylönen in It is known as the inventor and original developer of the Secure Shell protocol and it currently has about 100 employees

 SSH uses public-key cryptography to authenticate the remote computer and allow it to authenticate the user  There are several ways to use SSH 1. Automatically generated public-private key pair to simply encrypt a network connection and use password authentication to log on 2. Manually generated public-private key pair

Thank you for your attention

1. information-center information-center 2. checker/views/certCheck.jsp checker/views/certCheck.jsp 3. networks/comparison-osi-tcp-model networks/comparison-osi-tcp-model SSYKE2_8.0.0/com.ibm.java.security.compone nt.80.doc/security- component/jsse2Docs/ssloverview.html SSYKE2_8.0.0/com.ibm.java.security.compone nt.80.doc/security- component/jsse2Docs/ssloverview.html

/from-netscape-to-firefox-the-story-of- mozilla-firefox/ 12/from-netscape-to-firefox-the-story-of- mozilla-firefox/