Computer Science and Engineering Computer System Security CSE 5339/7339 Session 23 November 9, 2004

Computer Science and Engineering Contents  A6 Q/A  Database Security (cont.)  Security in Networks  Group Work  Wenyi’s presentation

Computer Science and Engineering Proposal for Multilevel security  Partitioning (Separation)  The database is divided into several databases, each at its own level of security  Encryption (Separation)  Sensitive data are encrypted  Each level of sensitive data can be stored in a table encrypted under a key unique to the level of sensitivity

Computer Science and Engineering Integrity Lock (Spray Paint)  The lock is a way to provide both integrity and limited access for a database  At the US Air Force Summer Study on DB Security Secret Agent10FBTS Data ItemSensitivityChecksum

Computer Science and Engineering Cryptographic Checksum  Data item  plain text  Sensitivity  unforgeable -- unique – concealed  Checksum  record number, attribute name, data item, sensitivity Secret Agent10FBTS Data ItemSensitivityChecksum AssignmentR07 Record numberAttribute name Checksum

Computer Science and Engineering Security Lock  Combination of a unique identifier (record number) and the sensitivity level  Graubert and Kramer Secret AgentTS Data ItemSensitivitySensitivity lock R07 Record number Encryption Function Key

Computer Science and Engineering Short Term Solution Untrusted DB manager Users Trusted Access Controller Sensitive database

Computer Science and Engineering Trusted Front End Untrusted DB manager Users Trusted Access Controller Sensitive databaseTrusted Front End

Computer Science and Engineering Commutative Filters  The filter screens the user’s request, reformats it so that only data of an appropriate sensitivity level are returned. Retrieve NAME where ((OCCUP = engineer) and (CITY = WashDC) retrieve NAME where ((OCCUP = engineer) and (CITY = WashDC) from all records R where (NAME-SEC-LEVEL (R )  USER-SEC-LEVEL) and (OCCUP-SEC-LEVEL (R )  USER-SEC-LEVEL) and (CITY-SEC-LEVEL (R )  USER-SEC-LEVEL)

Computer Science and Engineering Computer Network Basics  Wide Area Networks (WAN)  Metropolitan Area Network (MAN)  Local Area Network (LAN)  System or Storage Area Network (SAN)

Computer Science and Engineering Routing Schemes  Connection-oriented The entire message follows the same path from source to destination.  Connectionless A message is divided into packets. Packets may take different routes from source to destination Serial number

Computer Science and Engineering Network Performance  Gilder’s Law George Gilder projected that the total bandwidth of communication systems triples every twelve months. Ethernet: 10Mbps  10Gbps (1000 times) CPU clock frequency: 25MHz  2.5GHz (100 times)  Metcalfe's Law Robert Metcalfe projected that the value of a network is proportional to the square of the number of nodes Internet

Computer Science and Engineering Internet Internet is the collection of networks and routers that form a single cooperative virtual network, which spans the entire globe. The Internet relies on the combination of the Transmission Control Protocol and the Internet Protocol or TCP/IP. The majority of Internet traffic is carried using TCP/IP packets.

Computer Science and Engineering Country Internet Users Latest Data Population ( 2004 Est. ) % of Population United States209,518,183294,540, % China79,500,0001,327,976, % Japan63,884,205127,944, % Germany45,315,16682,633, % United Kingdom35,089,47059,157, % South Korea29,220,00047,135, % France22,534,96759,494, % Brazil20,551,168183,199, % Italy19,900,00056,153, % Canada16,841,81132,026, %

Computer Science and Engineering ISO OSI Network Model Application Presentation Session Transport Network Data Link Physical Application Presentation Session Transport Network Data Link Physical LAN Internet

Computer Science and Engineering Mail ftp Telnet Transmission Control Protocol (TCP) Internet Protocol (IP) Ethernet Token ring TCP/IP

Computer Science and Engineering Addressing  MAC (Media Access Control) address Every host connected to a network has a network interface card (NIC) with a unique physical address.  IP address IPv4  32 bits ( ) IPv6  128 bits

Computer Science and Engineering IP Protocol  Unreliable packet delivery service  Datagram (IPv4) Service TypeVERSHLENTOTAL LENGTH IDENTIFICATIONFLAGSFRAGMENT OFFSET TIME TO LIVEPROTOCOLHEADER CHECKSUM SOURCE ADDRESS DESTINATION ADDRESS PADDINGOPTIONS (IF ANY) DATA

Computer Science and Engineering Group Work  Discuss possible attacks on IP.  IP Spoofing  Teardrop attacks