Network Security: Firewalls and VPNs

Chapter 14Network Security:FirewallsandVPNsList and distinguish between the four conditions of security.Understand how privacy can be achieved through encryption/decryption.Understand the digital signature concept and how it can beused to provide authentication, integrity, and nonrepudiation.Understanding firewalls and their use in isolating an organization from intruders. After reading this chapter, the reader should be able to:OBJECTIVESOBJECTIVES (continued)Understand the different access control methods. Be familiar with VPN technology and how it provides privacy.INTRODUCTION14.1Figure 14-1Aspects of securityPRIVACY14.2Figure 14-2Secret-key encryptionIn secret-key encryption, the same keyis used by the sender (for encryption)and the receiver (for decryption). The key is shared.Note:Business Focus: DESOne common method of secret-key encryption is the data encryption standard (DES). DES was designed by IBM and adopted by the U.S. government as the standard encryption method for nonmilitary and nonclassified use. The algorithm manipulates a 64-bit plaintext with a 56-bit key. The text is put through 19 different and very complex procedures to create a 64-bit ciphertext.Figure 14-3Public-key encryptionTechnical Focus: RSAOne popular public-key encryption technique is called RSA . The technique uses number theory and the fact that it is easy to create two large numbers and multiply them, but difficult to find the original numbers when the product is given. The public key is made of two large numbers (n and e). The private key ismade of two numbers (n and d). The encryption algorithm is C = P e mod nThe receiver uses the same procedure but with the private key numbers as shown: C = P d mod nDIGITALSIGNATURE14.3Figure 14-4Signing the whole documentDigital signature cannot be achievedusing secret-key encryption.Note:Digital signature does not provide privacy. If there is a need for privacy, another layer of encryption/decryption must be applied. Note:Figure 14-5Signing the digestFigure 14-6Sender siteFigure 14-7Receiver siteSECURITY IN THEINTERNET14.4Technical Focus: Pretty Good Privacy (PGP)Pretty Good Privacy (PGP), invented by Phil Zimmermann, is an example of a security scheme designed to provide all four aspects of security (privacy, integrity, authentication, and nonrepudiation) in the sending of email. PGP uses digital signature to provide integrity, authentication, and non-repudiation. It uses a combination of secret-key and public-key encryption to provide privacy. Specifically, it uses one hash function, one secret key, and two private-public key pairs. Technical Focus: AH and ESPIPSec uses two protocols: authentication header (AH) and encapsulating security payload (ESP) to achieve security. The authentication header (AH) protocol is designed to provideintegrity. The method involves a digital signature using a hashing function. The message digest created by applying the hashing function is included in a header (AH header), and inserted between the IP header and transport-layer data and header. The AH protocol does not provide privacy, only integrity and message authentication (digital signature). IPSec defines another protocol that provides privacy as well as a combination of integrity and message authentication. This protocol is called encapsulating security payload (ESP).FIREWALLS14.5Figure 14-8FirewallA proxy firewall filters at the application layer. Note:VIRTUALPRIVATENETWORKS14.6Figure 14-9Private networkFigure 14-10Hybrid networkFigure 14-11Virtual private networkACCESSCONTROL14.4Figure 14-12Access control methods