Professional Documents
Culture Documents
IP Security Overview
IPSec is not a single protocol. Instead, IPSec provides a set of security algorithms plus a general framework that allows a pair of communicating entities to use whichever algorithms to provide security appropriate for the communication.
Applications of IPSec
Secure branch office connectivity over the Internet Secure remote access over the Internet Establsihing extranet and intranet connectivity with partners Enhancing electronic commerce security
http://sce.uhcl.edu/yang/teaching/. ...../IPsecurity.ppt
IP Security Scenario
http://sce.uhcl.edu/yang/teaching/. ...../IPsecurity.ppt
IP Security Overview
Benefits of IPSec
Transparent to applications - below transport layer (TCP, UDP) Provide security for individual users
Goal/Services of IPsec
Provides security services at IP layer
Access Control Connectionless integrity Data origin authentication Rejection of replayed packets Confidentiality (encryption) Limited traffic flow confidentiallity
IP Security Architecture
IPSec documents:
RFC 2401: Security Architecture for the Internet Protocol. S. Kent, R. Atkinson. November 1998. (An overview of security architecture) RFC 2402: IP Authentication Header. S. Kent, R. Atkinson. November 1998. (Description of a packet encryption extension to IPv4 and IPv6) RFC 2406: IP Encapsulating Security Payload (ESP). S. Kent, R. Atkinson. November 1998. (Description of a packet emcryption extension to IPv4 and IPv6) RFC 2408: Internet Security Association and Key Management Protocol (ISAKMP). D. Maughan, M. Schertler, M. Schneider, J. Turner. November 1998. (Specification of key managament capabilities)
IPsec Architecture
Components
Security Protocols Security Associations Key Management Algorithms for authentication and encryption
Security Protocols
Authentication Header (AH)
Data Origin Authentication Anti-replay service Data Integrity
AH
AH provides authentication for as much of the IP header as possible, as well as for upper level protocol data Two modes: transport mode/tunnel mode
IP Security (IPSec)
Different security tools function at different layers of the Open System Interconnection (OSI) model Secure/Multipurpose Internet Mail Extensions (S/MIME) and Pretty Good Privacy (PGP) operate at the Application layer Kerberos functions at the Session layer
IPSec accomplishes transport and tunnel modes by adding new headers to the IP packet The entire original packet is then treated as the data portion of the new packet
32.17
32.18
Note
IPSec in the transport mode does not protect the IP header; it only protects the information coming from the transport layer.
32.19
Note
IPSec in tunnel mode protects the original IP header.
32.20
32.21
Note
The AH Protocol provides source authentication and data integrity, but not privacy.
32.22
32.23
Note
ESP provides source authentication, data integrity, and privacy.
32.24
32.25
Note
IKE creates SAs for IPSec.
32.26
http://sce.uhcl.edu/yang/teaching/. ...../IPsecurity.ppt
27
Key Management
Two types:
Manual Automated
Oakley Key Determination Protocol Internet Security Association and Key Management Protocol (ISAKMP)
http://sce.uhcl.edu/yang/teaching/. ...../IPsecurity.ppt
28
Oakley
a key exchange protocol based on Diffie-Hellman key exchange adds features to address weaknesses
cookies, groups (global params), nonces, DH key exchange with authentication
Oakley
Three authentication methods:
Digital signatures Public-key encryption Symmetric-key encryption
http://sce.uhcl.edu/yang/teaching/. ...../IPsecurity.ppt
30
ISAKMP
http://sce.uhcl.edu/yang/teaching/. ...../IPsecurity.ppt
31
Recommended Reading
Comer, D. Internetworking with TCP/IP, Volume I: Principles, Protocols and Architecture. Prentic Hall, 1995 Stevens, W. TCP/IP Illustrated, Volume 1: The Protocols. Addison-Wesley, 1994
http://sce.uhcl.edu/yang/teaching/. ...../IPsecurity.ppt
32