1 Firewalls. 2 What is a firewall? Device that provides secure connectivity between networks (internal/external; varying levels of trust) Used to implement

1

Firewalls

2

What is a firewall?

• Device that provides secure connectivity between networks (internal/external; varying levels of trust)

• Used to implement and enforce a security policy for communication between networks

Trusted Networks

Untrusted Networks & ServersFirewall

Router

Internet

Intranet

DMZ Public Accessible Servers & Networks

Trusted Users

Untrusted Users

3

Firewalls

• From Webster’s Dictionary: a wall constructed to prevent the spread of fire

• Internet firewalls are more the moat around a castle than a building firewall

• Controlled access point

4

Firewalls can:

• Restrict incoming and outgoing traffic by IP address, ports, or users

• Block invalid packets

5

Firewalls Cannot Protect…

• Traffic that does not cross it– routing around – Internal traffic

• When misconfigured

6

InternetInternet

DMZ NetWeb Server Pool

Corporate

Network

ALERT!!ALERT!!ALERT!!

Security Requirement• Control access to network information and resources• Protect the network from attacks

Access Control

7

Filtering• Packets checked then passed – typically route packets• Inbound & outbound affect when policy is checked• Packet filtering

– Access Control Lists

• Session filtering– Dynamic Packet Filtering

– Stateful Inspection

– Context Based Access Control

• Fragmentation/reassembly• Sequence number checking• ICMP

8

Packet Filtering

• Decisions made on a per-packet basis

• No state information saved

ApplicationsApplications

PresentationsPresentations

SessionsSessions

TransportTransport

DataLinkDataLink

PhysicalPhysical

DataLinkDataLink

PhysicalPhysical

RouterRouter



SessionsSessions

TransportTransport

DataLinkDataLink

PhysicalPhysical

NetworkNetwork NetworkNetwork

Packet Filter

10

Session Filtering

• Packet decision made in the context of a connection

• If packet is a new connection, check against security policy

• If packet is part of an existing connection, match it up in the state table & update table

11

Session Filtering

Applications

Presentations

Sessions

Transport

DataLink

Physical

DataLink

Physical

Applications

Presentations

Sessions

Transport

DataLink

Physical

Network Network

Network

Presentations

Sessions

Transport


Dynamic Dynamic State TablesState Tables

Dynamic Dynamic State TablesState Tables

Dynamic State Tables

Screens ALL attempts, Protects All applications

Extracts & maintains ‘state’ information

Makes an intelligent security / traffic decision

12

Proxy Firewalls

• Relay for connections

• Client <-> Proxy <->Server

• Two flavors– Application Level– Circuit Level

13

Application Gateway• Understand specific applications

– Limited proxies available– Proxy “impersonate” both sides of the connection

• Resource intensive– Process per connection

• HTTP proxies may cache we pages• More appropriate for TCP• Block all unless specifically allowed• Must write a new proxy application to support new

applications– Non Trivial



SessionsSessions

TransportTransport

DataLinkDataLink

PhysicalPhysical

NetworkNetwork

DataLinkDataLink

PhysicalPhysical



SessionsSessions

TransportTransport

DataLinkDataLink

PhysicalPhysical

Application GatewayApplication Gateway



SessionsSessions

TransportTransport

NetworkNetwork NetworkNetwork

TelnetTelnetTelnetTelnet HTTPHTTPHTTPHTTPFTPFTPFTPFTP

Application Layer GW/proxy

15

Encryption (VPNs)

• Allows trusted users to access sensitive information while traversing untrusted networks

• Useful for remote users/sites

• IPSec

• Encrypted Tunnels

16

PGP

17

Pretty Good Privacy (PGP)

• widely used de facto secure email

• developed by Phil Zimmermann

• selected best available crypto algs to use

• integrated into a single program

• available on Unix, PC, Macintosh and Amiga systems

• originally free, now have commercial versions available also

18

PGP

• Five services– Authentication, confidentiality, compression,

email compatibility, segmentation

• Functions– Digital signature– Message encryption– Compression– Email compatibility– segmentation

19

PGP Operation – Integrity and Authentication

1. Sender creates a message2. SHA-1 used to generate 160-bit hash code of

message3. hash code is encrypted with RSA using the sender's

private key, and result is attached to message4. receiver uses RSA or DSS with sender's public key

to decrypt and recover hash code5. receiver generates new hash code for message and

compares with decrypted hash code, if match, message is accepted as authentic

20

Pretty Good Privacy (PGP) - Message Integrity and Authentication

Sender identity and messageintegrity confirmedif checksums match

Calculate MD5 checksum onreceived message and compare

against received value

Decrypt signed checksumwith senderÕs public key

Calculate MD5 checksumover message contents

Sign checksum using RSAwith senderÕs private key

Transmitted message

21

PGP Operation – Confidentiality

1. sender generates message and random 128-bit number to be used as session key for this message only

2. message is encrypted, using CAST-128 / IDEA/3DES with session key

3. session key is encrypted using RSA with recipient's public key, then attached to message

4. receiver uses RSA with its private key to decrypt and recover session key

5. session key is used to decrypt message

22

PGP Message Encryption

Decrypt message using

DES with secret key k

Decrypt E(k) using RSA with

my private key k

Convert ASCII message

Encrypt k using RSA with

recipient ‘s public key

Encode message + E (k )

in ASCII for transmission

Encrypt message using

DES with secret key k

Create a random secret key k Original message

Transmitted message

23

PGP Operation – Compression

• by default PGP compresses message after signing but before encrypting– so can store uncompressed message & signature

for later verification– & because compression is non deterministic

• uses ZIP compression algorithm

24

Segmentation & Reassembly

• Email systems impose maximum length– 50 Kb, for example

• PGP provides automatic segmentation– Done after all other operations– Thus only one session key needed

25

PGP

• Alice wants to provide secrecy, sender authentication, message integrity.

Alice uses three keys: her private key, Bob’s public key, newly created symmetric key

H( ). KA( ).-

+

KA(H(m))-

m

KA-

m

KS( ).

KB( ).+

+

KB(KS )+

KS

KB+

Internet

KS

26

Folklore

27

Perfect Forward Security

• A protocol property that prevents someone who records an encrypted conversation from being able to later decrypt the conversation

• Keep the conversation secret from– Someone (an escrow agent, attacker..) who knows

the long-term key

• Two ways– A Diffie-Hellman exchange, then forget DH

information– Ephemeral public/private key pair

28

Change Keys Periodically

• The more examples of ciphertexts you can see, the more likely you can break the encryption and find the key

• Change keys (key rollover)

29

Continue..

• Use different keys in the two directions

• Use different secret keys for encryption vs. integrity protection

• Use different keys for different purposes

30

Continue..• Have both sides contribute to the master key

• HMAC rather than Simple MD

• Key expansion

• Randomly Chosen IVs

• Use nonce in protocols

• Compress data before encrypting it

• Do not do encryption only

• Minimal vs. redundant designs

31

Continue…

• Put Checksums at the end of data

• Forward Compatibility

• Negotiating Parameters– Different Algorithms

Documents

1 Firewalls. 2 What is a firewall? Device that provides secure connectivity between networks (internal/external; varying levels of trust) Used to implement