西电电子对抗所

NetworkSecurityandPrivacyChapter1:SecurityIntroduction西电电子对抗所Security:IntheBeginning……Intheearlydaysofdataprocessing,thesecurityofinformationwasprovidedprimarilybyphysicalandadministrativemeans.Computerbuildings,floors,roomswereguardedandalarmedtopreventoutsidesfromintrudinganddisruptingoperations.Thefocuswasonphysicalbreak-ins,thetheftofcomputerequipment,andthephysicaltheftordestructionofdiskpacks,tapereels,punchcards,orothermedia.Insiderswerekeptatbyandaccesswaslimitedtoasmallsetofcomputerprofessionals.西电电子对抗所InformationSecurityTherequirementsofinformationsecuritywithinorganizationshaveundergonetwomajorchanges:Theintroductionofsharedsystemssuchastime-sharedand/orsystemsthatcanbeaccessedoverthepublictelephoneordatanetworks.Theintroductionofdistributedsystemsandtheuseofnetworksandcommunicationsfacilitiesforcarryingdatabetweenterminaluserandcomputerandbetweencomputerandcomputer.西电电子对抗所SecurityIntroduction

Computervs.NetworkSecurityComputersecurityisthegenerictermforacollectionoftoolsdesignedtoprotectdataandtothwarthackers.Networksecurityisthesecuritymeasuresthatareneededtoprotectduringtheirtransmission.Inmostsystems,theboundariesbetweencomputersecurityandnetworksecurityareblurredsincemost,ifnotall,oftoday’ssystemsaredistributedinnature.Networkingisacorepartoftoday’senvironment.西电电子对抗所ThedegreeofSecurityCurtainLockDemi-wolfSecurityalarmingsystemFencing,guard西电电子对抗所SecurityGoalsIntegrityConfidentialityAvailability西电电子对抗所SecurityIntroduction

SecurityServicesConfidentialityistheprotectionoftransmitteddatafrompassiveattacks.Authenticationisconcernedwithassuringthatacommunicationisauthentic.Integrityassuresthatmessagesarereceivedassent.Aconnection-orientedintegrityserviceshouldassurethattherearenoduplicates,insertions,deletions,modifications,reordering,orreplays.Aconnectionlessintegrityservicesdealsonlywithanindividualmessage.西电电子对抗所SecurityIntroduction

SecurityServicesNon-repudiationpreventseitherthesenderorreceiverfromdenyingatransmittedmessage.AccessControlistheabilitytolimitandcontroltheaccesshostsystemsandapplicationsviacommunicationslinks.Availabilityistheabilitytopreventthelossorareductioninavailabilityofelementsofadistributedsystem.西电电子对抗所NetworkTopology西电电子对抗所HierarchyofNetworkSecurityPhysicalSecuritySecurityControlSecurityServicePhysicalmediumOS,NICInternetworkingDeviceSecurityMechanismSecurityconnectionSecurityprotocolSecuritypolicy西电电子对抗所SecurityRisksExploitationofvulnerabilityUnauthorizedAccessInformationdisclosureInformationexhaustInformationtheft西电电子对抗所TypesofRisksSniffer

窃听Impersonate

假冒Replay

重放Trafficanalysis

通信量分析Loseofintegrity

破坏完整性Denialofservice

拒绝服务UnauthorizedAccess

非授权访问Trapdoor/TrojanHorse/Virii

恶意代码西电电子对抗所MotivesIndustryespionageFinancialgainsRevenge/publicityInnocence西电电子对抗所NetworkAttacksSecurityAttack:Anyactionthatcompromisesthesecurityofinformationownedbyanorganization.SecurityMechanism:Amechanismthatisdesignedtodetect,prevent,orrecoverfromasecurityattack.SecurityService:Aservicethatenhancesthesecurityofdataprocessingsystemsandinformationtransfers.Asecurityservicemakesuseofoneormoresecuritymechanisms.Designedtocountersecurityattacks西电电子对抗所StepsofNetworkAttacksInformationgatheringScanningvulnerabilitiesAttacking…西电电子对抗所16TheStagesofaNetworkIntrusion1.Scanthenetworkto: •locatewhichIPaddressesareinuse, •whatoperatingsystemisinuse, •whatTCPorUDPportsare“open”.2.Run“Exploit”scriptsagainstopenports3.GetaccesstoShellprogramwhichis“suid”(has“root”privileges).4.DownloadfromHackerWebsitespecialversionsofsystemsfilesthatwillletCrackerhavefreeaccessinthefuturewithouthiscputimeordiskstoragespacebeingnoticedbyauditingprograms.5.UseIRC(InternetRelayChat)toinvitefriendstothefeast.西电电子对抗所AttackingMethodsSystembugs/BackdoorsSecurityAwarenessFirewallInternalusersLackofMeanstoSecurityAuditingPasswordDenialofServiceWeb/CGI西电电子对抗所FourSecurityAttackCategoriesInterruptionAttackonavailabilityInterceptionAttackonconfidentialityModificationAttackonintegrityFabricationAttackonauthenticity西电电子对抗所

NormalFlowNormalFlowistheflowofinformationfromaninformationsource,suchasafile,oraregionofmainmemory,toadestination,suchasanotherfileoruser.西电电子对抗所InterruptionAnassetofthesystemisdestroyedorbecomesunavailableorunusable.Thisisanattackonavailability.Examples:Thedestructionofhardware,thecuttingofacommunicationline,orthedisablingofthefilemanagementsystem.西电电子对抗所InterceptionAnunauthorizedpartygainsaccesstoanasset.Thisisanattackonconfidentiality.Theunauthorizedpartycouldbeaperson,aprogram,oracomputer.Examples:Wiretappingtocapturedatainanetworkandtheunauthorizedcopyingoffilesorprograms.西电电子对抗所ModificationAnauthorizedpartynotonlygainsaccesstobuttamperswithanasset.Thisisanattackonintegrity.Examples:Changingvaluesinadatafile,alteringaprogramsothatitperformsdifferently,ormodifyingthecontentofmessagesbeingtransmittedinanetwork.西电电子对抗所FabricationAnauthorizedpartyinsertscounterfeitobjectsintothesystem.Thisanattackonauthenticity.Examples:theinsertionofspuriousmessagesinanetworkortheadditionofrecordstoafile.西电电子对抗所PassiveAttacksPassiveattackseavesdrop,ormonitor,transmission.Goal:Toobtaintransmittedinformation.2Typesofpassiveattacks西电电子对抗所

PassiveAttackTypesReleaseofcontents:Atelephoneconversation,anelectronicmailmessage,orconfidentialinformation.Trafficanalysis:Usingthelocationandidentitiesofhostsandthefrequencyandlengthofmessagestodeterminethetypeofcommunicationtakingplace.Passiveattacksaredifficulttodetectsincetheydonotinvolveanyalterationofdata.Theemphasisisonpreventionratherthandetection.西电电子对抗所ActiveAttacksAnactiveattackinvolvethemodificationofthedatastreamorthecreationofafalsestream.4Typesofactiveattacks.西电电子对抗所ActiveAttackTypesMasqueradetakesplacewhenoneentitypretendstobeadifferententity.Thisformusuallyincludesoneoftheothersformsofactiveattack.Replayinvolvesthepassivecaptureofadataunitanditssubsequentretransmissiontoproduceanunauthorizedeffect.西电电子对抗所ActiveAttackTypesIIModificationoccurswhenanunauthorizedpartygainsaccesstoandtamperswithanasset.Thisisanattackonintegrity.DenialofServicepreventsorinhibitsthenormaluseormanagementofcommunicationsfacilities.西电电子对抗所ModelforNetworkSecurity西电电子对抗所ModelforNetworkSecurityThismodeloperatesasfollows:Amessageispresentedtobetransferredfromonepartytoanotheracrosssomesortofinternet.Thetwoparties(principals)inthetransactionmustcooperatefortheexchangetotakeplace.AlogicalinformationchannelisestablishedbydefiningaroutethroughtheinternetfromsourcetodestinationusingacommunicationsprotocolsuchasTCP/IP.西电电子对抗所SecurityComponentsSecurityisanissuewhenitisnecessarytoprotectthetransmissionfromanopponent.Alltechniquesforprovidingsecurityhavetwocomponents:Asecurity-relatedtransformationontheinformationtobesent.Somesecretinformationsharebythetwoprincipalsandhopefullyunknowntoopponent.Additionally,insomecasesatrustedthirdpartymaybeusedfordistributingthesecretinformationorarbitratingdisputesbetweenthetwopartiesoverauthenticity.西电电子对抗所DesignGoalsforASecurityServiceDesignanalgorithmforperformingthesecurity-relatedtransformations.Anopponentshouldnotbeabletodefeatit!Generatethesecretinformationtobeusedwiththealgorithm.Developmethodsfordistributionandsharingofthesecretinformation.Specifyaprotocoltobeusedbythetwoprincipalsthatmakeuseofthesecurityalgorithmsandthesecretinformationtoachieveaparticularsecurityservice.西电电子对抗所NetworkAccessSecurityModel西电电子对抗所SecuritytechnologiesFirewallEncryptionAuthenticationDigitalsignatureContentinspection西电电子对抗所35Application

Layer

(HTTP)TransportLayer(TCP,UDP)NetworkLayer(IP)E'netDataLinkLayerEthernetPhys.LayerNetworkLayerE'net