1. Chapter 8 roadmap 8.1 What is network security?
8.2 Principles of cryptography
8.3 Message integrity and digital signatures
8.4 End-point authentication
8.5 Securing
8.6 Securing TCP connections: SSL
8.7 Network layer security: IPsec and VPNs
8.8 Securing wireless LANs
8.9 Operational security: firewalls and IDS
Security
8-1

2. WEP design goals symmetric key crypto
confidentiality
end host authorization
data integrity
self-synchronizing: each packet separately encrypted
given encrypted packet and key, can decrypt; can continue to decrypt packets when preceding packet was lost (unlike Cipher Block Chaining (CBC) in block ciphers)
Efficient
implementable in hardware or software
Security
8-2

3. Review: symmetric stream ciphers
keystream
generator
key
combine each byte of keystream with byte of plaintext to get ciphertext:
m(i) = ith unit of message
ks(i) = ith unit of keystream
c(i) = ith unit of ciphertext
c(i) = ks(i)  m(i) ( = exclusive or)
m(i) = ks(i)  c(i)
WEP uses RC4
Security
8-3

4. About WEP
Encryption algorithm in IEE – 1999 Standard (Wired Eqivalent Privacy)
User Stream Cipher – RC4 for confidentiality and CRC for integrity
WEP is broken and is deprecated form wireless security measuers
Network Security

5. Stream cipher and packet independence
recall design goal: each packet separately encrypted
if for frame n+1, use keystream from where we left off for frame n, then each frame is not separately encrypted
need to know where we left off for packet n
WEP approach: initialize keystream with key + new IV for each packet:
keystream
generator
Key+IVpacket
keystreampacket
Security
8-5

6. + WEP Working Seed = IV + Key
RC4 takes seed as input and gives Keystream as output
IV (Initializing Vector): 24 bits (fixed size)
Key : 40 or 104 bits
Seed = 16 or 128 bits (IV+ key)
RC4 1 + 1 1

7. WEP encryption (1)
sender calculates Integrity Check Value (ICV, four-byte hash/CRC over data
each side has 104-bit shared key
sender creates 24-bit initialization vector (IV), appends to key: gives 128-bit key
sender also appends keyID (in 8-bit field)
128-bit key inputted into pseudo random number generator to get keystream
data in frame + ICV is encrypted with RC4:
bytes of keystream are XORed with bytes of data & ICV
IV & keyID are appended to encrypted data to create payload
payload inserted into frame
encrypted
data
ICV IV
MAC payload
Key ID
Security
8-7

8. WEP encryption (2)
new IV for each frame
Security
8-8

9. WEP decryption overview
encrypted
data
ICV IV
MAC payload
Key ID
receiver extracts IV
inputs IV, shared secret key into pseudo random generator, gets keystream
XORs keystream with encrypted data to decrypt data + ICV
verifies integrity of data with ICV
note: message integrity approach used here is different from MAC (message authentication code) and signatures (using PKI).
Security
8-9

10. End-point authentication w/ nonce
Nonce: number (R) used only once –in-a-lifetime
How to prove Alice “live”: Bob sends Alice nonce, R. Alice
must return R, encrypted with shared secret key
“I am Alice” R
K (R)
A-B
Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice!
Security
8-10

11. WEP authentication Notes: not all APs do it, even if WEP is being used
authentication request
nonce (128 bytes)
nonce encrypted shared key
success if decrypted value equals nonce
Notes:
not all APs do it, even if WEP is being used
AP indicates if authentication is necessary in beacon frame
done before association
Security
8-11

12. Why WEP is weak No Key Management Key stream MUST NEVER be reused
One key for all
Key stream MUST NEVER be reused
IV space is too small satisfy this since key is always the same (214 is small number)
IV is transmitted as clear text
No Standard procedure for IV generation
Frist few key stream bytes are predictable in RC4 algorithm with weak IV

13. Breaking 802.11 WEP encryption
security hole:
24-bit IV, one IV per frame, -> IV’s eventually reused
IV transmitted in plaintext -> IV reuse detected
attack:
Trudy causes Alice to encrypt known plaintext d1 d2 d3 d4 …
Trudy sees: ci = di XOR kiIV
Trudy knows ci di, so can compute kiIV
Trudy knows encrypting key sequence k1IV k2IV k3IV …
Next time IV is used, Trudy can decrypt!
Security
8-13

14. Other Possibilities
Bit flip attacks possible since CRC is linear and RC4 is transparent to XOR
ICV uses CRC32, ICV is good for noise detection, but extremely poor as a cryptographic hash
WEP is weak against Replay Attacks, fragmentation Attacks, known plain text replay attacks etc.
Share key authentication is poor – it reveals 128 byte key stream
Network Security

15. Tools Airsnort Aircrack-ng: FMS, COREC, REPLAY attacks
Aircrack-ptw: ARP packet based attcatck
Aireplay-ng: BIT FLIPPING, REPALY attacks
WEPCrack ……
And many more

16. 802.11i: improved security
numerous (stronger) forms of encryption possible
provides key distribution
uses authentication server separate from access point
Security
8-16

17. 802.11i: four phases of operation
AP: access point
STA:
client station
AS:
Authentication
server
wired
network
1 Discovery of
security capabilities
STA and AS mutually authenticate, together
generate Master Key (MK). AP serves as “pass through” 2 3
STA derives
Pairwise Master
Key (PMK)
AS derives
same PMK,
sends to AP 4
STA, AP use PMK to derive
Temporal Key (TK) used for message
encryption, integrity
Security
8-17

18. EAP: extensible authentication protocol
EAP: end-end client (mobile) to authentication server protocol
EAP sent over separate “links”
mobile-to-AP (EAP over LAN)
AP to authentication server (RADIUS over UDP)
wired
network
EAP TLS
EAP
EAP over LAN (EAPoL)
RADIUS
IEEE
UDP/IP
Security
8-18

19. 802.1x Authentications Authentication Server Verification Server AP
Supplicant
EAPoL Start
EAP Request/Identity
EAP Response/Identity
Access Request
Valid User - Challenge
EAP Challenge Request
Access Challenge
EAP Challenge Response
Access Request
Challenge Response
Correct Response
EAP Success
Access Accept
The Master Key is shared only between the AS and supplicant
The supplicant and AS derive a Pairwise Master Key (PMK) &
This is moved form the AS to the authenticator
The Master Key is generated between the AS and Supplicant upon a successful 802.1x authentication and bound for the entire session

20. Summary WPA-Personal TKIP PSK WPA2 – Personal AES-CCMP
WPA – Enterprise
802.1X/EAP
WPA2 – Enterprise

21. Chapter 8 roadmap 8.1 What is network security?
8.2 Principles of cryptography
8.3 Message integrity and digital signatures
8.4 End-point authentication
8.5 Securing
8.6 Securing TCP connections: SSL
8.7 Network layer security: IPsec and VPNs
8.8 Securing wireless LANs
8.9 Operational security: firewalls and IDS
Security
8-21

22. Firewalls
firewall
isolates organization’s internal net from larger Internet, allowing some packets to pass, blocking others
administered
network
public
Internet
trusted “good guys”
untrusted “bad guys”
firewall
Security
8-22

23. Firewalls: why prevent denial of service attacks:
SYN flooding: attacker establishes many bogus TCP connections, no resources left for “real” connections
prevent illegal modification/access of internal data
e.g., attacker replaces CIA’s homepage with something else
allow only authorized access to inside network
set of authenticated users/hosts
three types of firewalls:
stateless packet filters
stateful packet filters
application gateways
Security
8-23

24. Stateless packet filtering
Should arriving packet be allowed in? Departing packet let out?
internal network connected to Internet via router firewall
router filters packet-by-packet, decision to forward/drop packet based on:
source IP address, destination IP address
TCP/UDP source and destination port numbers
ICMP message type
TCP SYN and ACK bits
Security
8-24

25. Stateless packet filtering: example
example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23
result: all incoming, outgoing UDP flows and telnet connections are blocked
example 2: block inbound TCP segments with ACK=0.
result: prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside.
Security
8-25

26. Stateless packet filtering: more examples
Policy
Firewall Setting
No outside Web access.
Drop all outgoing packets to any IP address, port 80
No incoming TCP connections, except those for institution’s public Web server only.
Drop all incoming TCP SYN packets to any IP except , port 80
Prevent Web-radios from eating up the available bandwidth.
Drop all incoming UDP packets - except DNS and router broadcasts.
Prevent your network from being used for a smurf DoS attack.
Drop all ICMP packets going to a “broadcast” address (e.g ).
Prevent your network from being tracerouted
Drop all outgoing ICMP TTL expired traffic
Security
8-26

27. Access Control Lists
ACL: table of rules, applied top to bottom to incoming packets: (action, condition) pairs: looks like OpenFlow forwarding (Ch. 4)!
action
source
address
dest
protocol
port
flag
bit
allow
222.22/16
outside of
TCP
> 1023 80
any
ACK
UDP 53
---
----
deny
all
Security
8-27

28. Stateful packet filtering
stateless packet filter: heavy handed tool
admits packets that “make no sense,” e.g., dest port = 80, ACK bit set, even though no TCP connection established:
action
source
address
dest
protocol
port
flag
bit
allow
outside of
222.22/16
TCP 80
> 1023
ACK
stateful packet filter: track status of every TCP connection
track connection setup (SYN), teardown (FIN): determine whether incoming, outgoing packets “makes sense”
timeout inactive connections at firewall: no longer admit packets
Security
8-28

29. Stateful packet filtering
ACL augmented to indicate need to check connection state table before admitting packet
action
source
address
dest
proto
port
flag
bit
check conxion
allow
222.22/16
outside of
TCP
> 1023 80
any
ACK x
UDP 53
---
----
deny
all
Security
8-29

30. Application gateways
filter packets on application data as well as on IP/TCP/UDP fields.
example: allow select internal users to telnet outside
application
gateway
host-to-gateway
telnet session
router and filter
gateway-to-remote
host telnet session
1. require all telnet users to telnet through gateway.
2. for authorized users, gateway sets up telnet connection to dest host. Gateway relays data between 2 connections
3. router filter blocks all telnet connections not originating from gateway.
Security
8-30

31. Limitations of firewalls, gateways
IP spoofing: router can’t know if data “really” comes from claimed source
if multiple app’s. need special treatment, each has own app. gateway
client software must know how to contact gateway.
e.g., must set IP address of proxy in Web browser
filters often use all or nothing policy for UDP
tradeoff: degree of communication with outside world, level of security
many highly protected sites still suffer from attacks
Security
8-31

32. Intrusion detection systems
packet filtering:
operates on TCP/IP headers only
no correlation check among sessions
IDS: intrusion detection system
deep packet inspection: look at packet contents (e.g., check character strings in packet against database of known virus, attack strings)
examine correlation among multiple packets
port scanning
network mapping
DoS attack
Security
8-32

33. Examine Correlations
Assume intruder behaviour is different from that of legitimate user
False positives: Legitimate user identified as intruder
False negatives: Intruder not identified

34. IDS Measurements

35. IDS Architecture
Host-based IDS on multiple computers within organisation or internetwork
Host agent collects and analyse audit records on individual hosts
LAN monitor agent analyses LAN traffic
Host and LAN monitor agents send alerts to central manager
Central manager combines data to detect intrusion; may request data form specific hosts
Issues
Deal with different audit record formats
Data transmitted over network by agents needs to be secured
Central architecture: single point of failure
Complex coordination

36. Network-Based Intrusion Detection
Monitor traffic at selected points on network
Analyse traffic to detect intrusion patterns
Inline sensors
Inserted into network
Runs as software on existing switch, router or firewall
Can prevent attack as soon as detected
Passive sensor
Monitors copy of traffic
Extra device that receives copy of traffic
Minimal impact on performance of traffic

37. Example of Network Intrusion Detection System

38. Honeypots Decoy system designed to
Lure potential attacker away form critical systems
Collect information about the attacker’s activity
Encourage the attacker to stay on the long enough for administrators to respond
Filled with fabricated information that a legitimate user of the system wouldn’t access
Resource that has no production value
Incoming communications is most likely a probe, scan or attack
Outbound communication suggest that the system has probably been compromised
Once intruders are within the network, administrators can observe their behaviour to figure out defences.

39. Example of Honeypot Deployment

40. Summary: Intrusion detection systems
multiple IDSs: different types of checking at different locations
firewall
internal
network
Internet
IDS
sensors
Web
server
DNS
server
FTP
server
demilitarized
zone
Security
8-40

41. Network Security (summary)
basic techniques…...
cryptography (symmetric and public)
message integrity
end-point authentication
…. used in many different security scenarios
secure
secure transport (SSL)
IP sec
802.11
operational security: firewalls and IDS
Security
8-41