CCNA网路基础- part3 basic security.ppt

1、網路訓練課程 - Part IIIBasic Security Concept,Encryption: What Is It?,&$!#l:Q,Secret,Encryption,Decryption,DES,DES,Secret,Encryption and Decryption,Clear-Text,Clear-Text,Cipher Text,8vyaleh31&d ktu.dtrw8743 $Fie*nP093h,Classical Cryptography vs. Public Key,Symmetric Algorithm,Asymmetric Algorithm,Dual-Pur

2、poseKey,Locking Key,Unlocking Key,Encryption Alternatives,Network-Layer Encryption,Application-Layer Encryption,Link-LayerEncryption,Link-LayerEncryption,Application Layers (5?),Transport/Network Layers (3?),Physical/Link Layers (1?),Link Encryption,Encrypts all traffic on a link, including network-

3、layer headers Specific to media/interface type, but protocol independent Topology dependent Traffic is encrypted/decrypted on link-by-link basis All alternative paths must be encrypted/decrypted,Application Encryption,Encrypts traffic to/from that application Specific to application, but network ind

4、ependent Application dependent All users must have same application,Encryption Options,Application Layer Needs to Be on Every Host,Data Link Layer Needs to Be on Every Link,Encrypts traffic on a flow-by-flow basis Media/interface independent Does not need to supported by intermediate network devices

5、,Network Encryption,HR Server,E-Mail Server,A to HR Serverncrypted,All Other Trafficlear,Public Key Encryption Example,Message,Alice,Bob,Encrypted Message,Message,Bob Public Key,Bob Private Key,Decrypt,Alice wants to send Bob encrypted data Alice gets Bob public key Alice encrypts the data with Bob

6、public key Alice sends the encrypted data to Bob Bob decrypts the data with his private key,Encryption,Diffie-HellmanPublic Key Exchange,Private Value, XA Public Value, YA,Private Value, XB Public Value, YB,(shared secret),Alice,Bob,YB mod p = g mod p = YA mod p,XB,XA XB,YA,YB,XA,Man-in-the-Middle A

7、ttack,Alice,Bob,Mallet,I Bob,I Alice,YA,YA,YB,YB,Signature Verification,Message,Decrypt the Received Signature,Decrypt Using Alice Public Key,Hash of Message,Hash Message,Message with Appended Signature,If Hashes are Equal, Signature is Authentic,Re-Hash the Received Message,Message,Signature,Signature,Keyed Hashingfor Authentication,983lna9458hk7436gq,ecret Key,Secret key and message are hashed together Recomputation of digest verifies that message originated with peer and that message was not altered in transit,Problem Is the Secret Key!,Cl