Network Security Principles Quiz

Network Security Introduction

• Course title: Network Security
• Instructor: Prof. Dr. Torsten Braun, Institute for Informatics, University of Bern
• Dates: September 16, 2024 – September 23, 2024

Table of Contents

• Concepts
• Security Attacks
• Security Services and Mechanisms
• Encryption
• Number Theory

1. Concepts: Information and Network Security

• Information Security: Preservation of confidentiality, integrity, and availability of information
• Network Security: Protection against unauthorized modification, destruction, or disclosure of networks and their services. Provides that network functions correctly without side effects
• Additional factors: Authenticity, accountability, non-repudiation, and reliability

1. Concepts: Standardization Organizations

• National Institute of Standards and Technology (NIST): US federal agency
• Internet Society: Professional membership society
• International Telecommunication Union (ITU): Telecommunication
• United Nations:
• International Organization for Standardization (ISO): Federation of national standard organizations

1. Concepts: Key Security Objectives

• Confidentiality: Ensuring only authorized parties can access information
• Authenticity: Ensuring that data originates from the claimed source
• Integrity: Ensuring data is not altered during transmission

1. Concepts: Essential Information/Network Security Objectives

• Confidentiality: (plus privacy)
• Authenticity: Property of being genuine and verifiable
• Integrity: Data integrity, system integrity
• Availability: Timely and reliable access
• Accountability: Requirement for actions to be traced, including non-repudiation, deterrence, fault isolation, and intrusion detection

1. Concepts: Terminology

• OSI Security Attack: Actions compromising security information
• Security Mechanism: Processes for detecting, preventing, or recovering from attacks
• Security Service: Processing or communication services to enhance security
• Threat: Circumstance or event with potential to impact organizational operations
• Attack: Malicious activity to collect, disrupt, deny, degrade, or destroy information or system resources

1. Concepts: Security Design Principles

• Economy of mechanism, complexity
• Fail-safe defaults
• Complete mediation
• Open design
• Separation of privilege
• Least privilege
• Least common mechanism
• Psychological acceptability
• Isolation
• Encapsulation
• Modularity
• Layering
• Least astonishment

1. Concepts: Securing Networks

• Placement of security in protocol stack
• Practical considerations include end-to-end security and no operating system modifications

1. Concepts: Device Security

• Concern: Intrusions gaining access to network devices or end systems
• Systems: Example systems are:
  • Firewall: Hardware/software that limits access between networks
  • Intrusion Detection: Analysis of network traffic to identify malicious access attempts
  • Intrusion Prevention: Stopping malicious activities after detection

2. Security Attacks: Attacks and Concepts

• Interception: (confidentiality)
• Interruption: (availability)
• Modification: (integrity)
• Fabrication: (authenticity)

2. Security Attacks: Kent's Classification: Passive Attacks

• Packet Eavesdropping: Detection of data (e.g., passwords, credit card numbers)
• Traffic Analysis: Detection of end points and traffic type (e.g., addresses, packet lengths)

2. Security Attacks: Kent's Classification: Active Attacks

• Imitation of wrong identities: (masquerading), e.g. IP Spoofing
• Modification of messages: Altering the content of messages transmitted
• Replay Attacks: Repeated transmission of data
• Denial-of-Service Attacks: Blocking network or server functions like repetition of TCP SYN packets

2. Security Attacks: Surfaces

• Categories: Network, Software, Humans
• Examples: Open ports in servers, services inside firewalls, code processing incoming data, interfaces, SQL, web forms, employees

3. Security Services and Mechanisms: Network Security Services

• Peer-entity and data-origin authentication: Assures that the recipient's message is valid
• Access control: Limits access to authorized users
• Data confidentiality: Protects against unauthorized release
• Data integrity: Guarantees a message isn't altered
• Non-repudiation: Protects against sender/receiver denying sending/receiving a message
• Availability: Guarantees system services are accessible when needed
• Security audit: Keeps track of transactions

3. Security Services and Mechanisms: Security Mechanisms

• Cryptographic algorithms: (reversible, non-reversible), data integrity, digital signatures
• Authentication exchange:
• Traffic padding:
• Routing control:
• Notarization:
• Access control:

3. Security Services and Mechanisms: Cryptographic Algorithms

• Keyless Algorithms: Cryptographic hash functions, cryptographic random number generation
• Single-Key Algorithms: Symmetric encryption (e.g., AES), message authentication codes (e.g., HMAC)
• Two-Key Algorithms: Asymmetric encryption (e.g., RSA), digital signature (e.g., RSA), key exchange, user authentication

3. Security Services and Mechanisms: Relationship of Security Services and Mechanisms

• Table showing relationships between services and mechanisms

4. Encryption: Operation

• Communication over an insecure channel
• Encryption by sender
• Decryption by receiver
• Attacker cannot understand communication

4. Encryption: Algorithm Types - Block Ciphers

• Input: Block of n bits
• Output: Block of n bits
• Example: AES
• Can be used to build stream ciphers

4. Encryption: Algorithm Types - Stream Ciphers

• Input: Stream of symbols
• Output: Stream of symbols
• Example: GSM

4. Encryption: Models - Symmetric Encryption

• Encryption key = Decryption key
• Decryption key derived from encryption key
• Example: AES

4. Encryption: Models - Asymmetric Encryption

• Encryption key ≠ Decryption key
• Decryption key cannot be derived from encryption key
• Example: RSA

4. Encryption: Symmetric vs Asymmetric Algorithms

• Symmetric algorithms are much faster (e.g., 1000 times faster)
• Symmetric algorithms require shared secret (impractical if no secure channel)
• Both types are combined for practical secure communication (e.g., establish secret session key using asymmetric crypto, encrypt traffic with symmetric crypto)

4. Encryption: Kerchoff's Principle

• Cipher should be secure even if attacker knows all encryption details except for the secret key
• No security by obscurity

5. Number Theory: Finding Prime Numbers

• Euclidean algorithm for finding greatest common divisors (GCD) of two integers

5. Number Theory: Fermat Theorem

• If p is a prime and a > 0, and a isn't divisible by p, then ap-1 = 1 (mod p).
• Alternative form: If p is prime and a > 0, then ap = a (mod p).

5. Number Theory: Proof of Fermat's Theorem

• Proof demonstrates theorem with positive integers less than p (set P) by considering other positive integers less than p (sets X) and taking the results (mod p)

5. Number Theory: Euler's Totient Function

• Function ø(n) counts positive integers less than n that are relatively prime to n

5. Number Theory: Euler's Theorem

• For any a and n that are relatively prime, aø(n) = 1 (mod n)
• Alternative form: aø(n) + 1 = a (mod n)

5. Number Theory: Miller-Rabin Algorithm

• Used to test large numbers for primality
• Probability of a failed test < 1/4¹⁰

5. Number Theory: Miller-Rabin Algorithm (Example)

• Example usage of the algorithm for numbers 29 and 221

5. Number Theory: Deterministic Primality Algorithm

• Prior to 2002, no efficient method for proving primality of large numbers existed. Previous methods often produced probabilistic results.
• AKS algorithm (2002) provides a deterministic method for efficient primality testing of large numbers.

5. Number Theory: Discrete Logarithm

• Given y = gx (mod p), calculating x is computationally difficult, especially for large primes
• Used in Diffie-Hellman key exchange