* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download TCP/IP Overview
Survey
Document related concepts
Net neutrality wikipedia , lookup
Wake-on-LAN wikipedia , lookup
Computer network wikipedia , lookup
Net neutrality law wikipedia , lookup
Wireless security wikipedia , lookup
Zero-configuration networking wikipedia , lookup
Distributed firewall wikipedia , lookup
Cracking of wireless networks wikipedia , lookup
List of wireless community networks by region wikipedia , lookup
Computer security wikipedia , lookup
UniPro protocol stack wikipedia , lookup
Piggybacking (Internet access) wikipedia , lookup
Deep packet inspection wikipedia , lookup
Internet protocol suite wikipedia , lookup
Recursive InterNetwork Architecture (RINA) wikipedia , lookup
Transcript
CSCE 813 Internet Security TCP/IP Internet Security - Farkas 1 Reading Assignment Reading: R. Oppliger, Internet and Intranet Security, Artech House, Google Book, http://books.google.com/books/about/Internet_and_Intranet_S ecurity.html?id=vtyowiyW9BkC, Chapter 2 Recommended Reading: CISCO: TCP/IP Technology, http://www.cisco.com/en/US/tech/tk365/technologies_white_ paper09186a008014f8a9.shtml Internet Security - Farkas 2 Before the Internet Isolated, local packet-switching networks – only nodes on the same network could communicate Each network was autonomous – different services – different interfaces – different protocols Internet Security - Farkas 3 Before the Internet (cont.) ARPANET: sponsored by Defense Advanced Research Projects Agency (DARPA): • 1969: interconnected 4 hosts • 1970: host-to-host protocol: Network Control Protocol (NCP) • 1972: first application: e-mail Stanford Research Institute (SRI) Univ. of California at Santa Barbara (UCSB) Univ. of California at LA (UCLA) Univ. of Utah Internet Security - Farkas 4 Internet Connect Existing Networks: ARPANET, Packet Radio, and Packet Satellite NCP not sufficient Develop new protocol 1970s: Transmission Control Protocol (Kahn and Vinton) – Based on packet switching technology – Good for file transfer and remote terminal access Divide TCP into 2 protocols – Internet Protocol (IP): addressing and forwarding of packets – Transmission Control Protocol (TCP): sophisticated services, e.g., flow control, recovery 1980: TCP/IP adopted as a DoD standard 1983: ARPANET protocol officially changed from NCP to TCP/IP 1985: Existing Internet technology 1995: U.S. Federal Networking Council (FNC) defines the term Internet Internet Security - Farkas 5 Goals (Clark’88) Connect existing networks 1. Survivability 2. Support multiple types of services 3. Must accommodate a variety of networks 4. Allow distributed management 5. Allow host attachment with a low level of effort 6. Be cost effective 7. Allow resource accountability Internet Security - Farkas 6 Internet Challenge Interconnected networks differ (protocols, interfaces, services, etc.) Possibilities: Reengineer and develop one global packet switching network standard: not economically feasible 2. Have every host implement the protocols of every network it wants to communicate with: too complex, very high engineering cost 3. Add an extra layer: internetworking layer Hosts: one higher-level protocol Network connecting use the same protocol Interface between the new protocol and network 1. Internet Security - Farkas 7 Layering Organize a network system into logically distinct entities – the service provided by one entity is based only on the service provided by the lower level entity Internet Security - Farkas 8 Without Layering Application Transmission Media SMTP FTP Coaxial cable HTTP Fiber optic Each application has to be implemented for every network technology! Internet Security - Farkas 9 With Layering Intermediate layer provides a unique abstraction for various network technologies Application SMTP FTP HTTP Intermediate layer Transmission Media Coaxial cable Fiber optic Internet Security - Farkas 10 Layering Advantages – Modularity – protocols easier to manage and maintain – Abstract functionality –lower layers can be changed without affecting the upper layers – Reuse – upper layers can reuse the functionality provided by lower layers Disadvantages – Information hiding – inefficient implementations Internet Security - Farkas 11 ISO OSI Reference Model ISO – International Standard Organization OSI – Open System Interconnection Goal: a general open standard – allow vendors to enter the market by using their own implementation and protocols Internet Security - Farkas 12 OSI Model Concepts Service – says what a layer does Interface – says how to access the service Protocol – says how is the service implemented – a set of rules and formats that govern the communication between two peers Internet Security - Farkas 13 TCP/IP Protocol Stack Application Layer Transport Layer Internetwork Layer Network Access Layer • Each layer interacts with neighboring layers above and below • Each layer can be defined independently • Complexity of the networking is hidden from the application Internet Security - Farkas 14 OSI vs. TCP/IP OSI: conceptually define: service, interface, protocol Internet: provide a successful implementation Application Presentation Session Transport Network Datalink Physical Application Transport Internet Host-tonetwork Internet Security - Farkas Telnet FTP DNS TCP UDP IP LAN Packet radio 15 Network Access Layer Responsible for packet transmission on the physical media Transmission between two devices that are physically connected The goal of the physical layer is to move information across one “hop” For example: Ethernet, token ring, Asynchronous Transfer Mode (ATM) Internet Security - Farkas 16 Internetwork Layer Provides connectionless and unreliable service Routing (routers): determine the path a path has to traverse to reach its destination Defines addressing mechanism – Hosts should conform to the addressing mechanism Internet Security - Farkas 17 IP Addresses IP provides logical address space and a corresponding addressing schema IP address is a globally unique or private number associated with a host network interface Every system which will send packets directly out across the Internet must have a unique IP address IP addresses are based on where the hosts are connected IP addresses are controlled by a single organization address ranges are assigned They are running out of space! Internet Security - Farkas 18 Routing Protocols • Enable routing decisions to be made • Manage and periodically update routing tables, stored at each router •Router : “which way” to send the packet •Protocol types: •Reachability •Distance vector Internet Security - Farkas 19 The Domain Name System Each system connected to the Internet also has one or more logical addresses. Unlike IP addresses, the domain address have no routing information - they are organized based on administrative units There are no limitations on the mapping from domain addresses to IP addresses Internet Security - Farkas 20 Domain Name Resolution Domain Name Resolution: looking up a logical name and finding a physical IP address There is a hierarchy of domain name servers Each client system uses one domain name server which in turn queries up and down the hierarchy to find the address If your server does not know the address, it goes up the hierarchy possibly to the top and works its way back down Internet Security - Farkas 21 Transport Layer Provides services to the application layer Services: – Connection-oriented or connectionless transport – Reliable or unreliable transport – Security (authenticity, confidentiality, integrity) Application has to choose the services it requires from the transport layer Limitations of combinations, e.g., connectionless and reliable transport is invalid Internet Security - Farkas 22 Application Layer Provides services for an application to send and recieve data over the network, e.g., telnet (port 23), mail (port 25), finger (port 79) Interface to the transport layer – Operating system dependent – Socket interface Internet Security - Farkas 23 Communication Between Layers Application Data Application layer Application layer Transport payload Transport layer Network layer Transport layer Network Payload Network layer Network layer Network layer Data Link layer Data Link Data Link layer Payload Data Link layer Data Link layer Router Host B Host A Router Internet Security - Farkas 24 Security -- At What Level? Secure traffic at various levels in the network Where to implement security? -- Depends on the security requirements of the application and the user Basic services that need to be implemented: Key management Confidentiality Nonrepudiation Integrity/authentication Authorization Internet Security - Farkas 25 Network Access Layer Security Dedicated link between hosts/routers hardware devices for encryption Advantages: – Speed Disadvantages: – Not scaleable – Works well only on dedicates links – Two hardware devices need to be physically connected Internet Security - Farkas 26 Internetwork Layer Security IP Security (IPSec) Advantages: – Overhead involved with key negotiation decreases <-- multiple protocols can share the same key management infrastructure – Ability to build VPN and intranet Disadvantages: – Difficult to handle low granularity security, e.g., nonrepudation, user-based security, Internet Security - Farkas 27 Transport Layer Security Advantages: – Does not require enhancement to each application Disadvantages: – Difficult to obtain user context – Implemented on an end system – Protocol specific implemented for each protocol Internet Security - Farkas 28 Transport Layer Security Advantages: – Does not require enhancement to each application Disadvantages: – Obtaining user context gets complicated – Protocol specific --> need to duplicated for each transport protocol – Need to maintain context for connection (not currently implemented for UDP) Internet Security - Farkas 29 Application Layer Security Advantages: – Executing in the context of the user --> easy access to user’s credentials – Complete access to data --> easier to ensure nonrepudation – Application can be extended to provide security (do not depend on the operating system) – Application understand data --> fine tune security Disadvantages: – Implemented in end hosts – Security mechanisms have to be implemented for each application --> – expensive – greated probability of making mistake Internet Security - Farkas 30 Application Example E-mail client using PGP Extended capabilities – Ability to look up public keys of the users – Ability to provide securiy services such as encryption/decrytion, nonrepudation, and authentication for e-mail messages Internet Security - Farkas 31