Docstoc

Chapters 5 _ 6

Document Sample
Chapters 5 _ 6 Powered By Docstoc
					                                           UCLA EXTENSION


    Information Security
        and Auditing
                                   Presented by
                                   Dr. Hal Plain
                                  Chapters 5 & 6
Dr. Hal Plain, MIS Consulting & Training               1
                                                Authorization,
                                               Authentication,
                                          Accountability, and
                                     Availability Technologies
                                                     The 4 A’s




Dr. Hal Plain, MIS Consulting & Training                    2
        Authorization, Authentication,
       Accountability, and Availabilty
  • Authorization
        –ID, Passwords, Digital Certificates and
        Signatures
        –Biometric identification
        –Kerberos
  • Authentication and Intrusion Detection
  •Accountability and Non-Repudiation
  •Availability and Replication
Dr. Hal Plain, MIS Consulting & Training           3
                                              Authentication

• Authentication can be classified in terms of
      – Something you know: an ID, also known as a personal
        identification number (PIN), and a password.
      – Something you have: Token cards such as secure ID, smart cards,
        and Java rings.
      – Something you are: fingerprints, speech recognition, or other
        biometric identifications.
      – Something you belong to: digital certificates and digital signatures
        indicate that you belong to a digital enterprise infrastructure
     Multi-factor authentication combines more than one
    technology, e.g., PIN plus secure ID card, for stronger
    authentication.
Dr. Hal Plain, MIS Consulting & Training                                4
                       Authentication Technologies
• Old approaches
      –   User ID, PW for authentication
      –   Strengths
      –   Weaknesses
      –   Single signon could help
•    Token cards;
      – Secure ID card
      – Smart cards
      – Java Rings
• Sophisticated approaches use cryptography:
      – Digital signatures is a good technique
      – Digital certificate


Dr. Hal Plain, MIS Consulting & Training         5
                             Biometric Identification
  • Use physical attributes of a person for positive
    identification
  • What parts to use: voice patterns, retina (eyeball) scan, iris
    (around pupil), signature dynamics, handwriting,
    fingerprints
  • Many commercial systems
  • Suitability depends on:
        –   Accuracy (false rejections/acceptances)
        –   Speed and throughput
        –   Acceptable to users (social implications)
        –   Resistance to counterfeiting
        –   Storage requirements

Dr. Hal Plain, MIS Consulting & Training                      6
      Digital Signatures and Certificates


  • Digital signature: uses public and private key
  • Digital Certificate: A certificate Authority (CA)
    is a trusted party that keeps public key and other
    info
  • It creates and manages certificates (like birth
    certificate)



Dr. Hal Plain, MIS Consulting & Training            7
      Digital Signatures and Certificates




Dr. Hal Plain, MIS Consulting & Training   8
      Digital Signatures and Certificates

•   Before starting, ask receiver for a certificate
•   Apply CA’s public key to verify correctness
•   Extract receiver’s public key and send
•   Different type of certificates:
      – (server, user,,)
      – Certificates follow X509
      – PKI is a collection of technologies
Dr. Hal Plain, MIS Consulting & Training        9
                                         Single System Signon
                                                          System3

                Security                       Security
                Proxy                          Proxy
                  User                          Web
                  Client                        Server
                                                          System2

•Use one logon ID and PW for multiple
systems
•Security proxy can act on behalf of user
•Proxy can be at user client or a server                   System1


    Dr. Hal Plain, MIS Consulting & Training                        10
                 Kerberos for Authentication

• Includes a very wide range of security
  technologies:
      –   symmetric and asymmetric-key cryptography
      –   certificates
      –   token cards
      –   smart cards
      –   IDs, PWs
• Many free as well as commercial implementations
• Trust model: direct, third party

Dr. Hal Plain, MIS Consulting & Training              11
         Authorization and Intrusion Detection

• Authorization: Verify if authorized to access
  resources
• ACLs (authorization control lists(used commonly
                                           Sample Access Control List

 User name        Resource Name                      Access Type Allowed
 Joe              Payroll                            Read Only
 Alice            Account zc-11-35                   Read, Add, Withdraw
 Sam              Customer Database                  Read only
 Tim              Inventory control                  Read and Update




Dr. Hal Plain, MIS Consulting & Training                                   12
     Intrusion Detection Systems (IDSs)

• Intrusion detection systems are based on
  two major principles:
    – Anomaly detection: tries to determine whether
      a deviation from an established normal profile
      can be flagged as an intrusion,
    – Signature detection (also known as misuse
      detection). uses patterns of known intrusion to
      match and identify an intrusion.


Dr. Hal Plain, MIS Consulting & Training            13
     Intrusion Detection Systems (IDSs)

• IDSs use sensors at various levels
      – Application
      – Middleware
      – Network




Dr. Hal Plain, MIS Consulting & Training   14
Subject (Managed) Systems
                                       Intrusion Detection
                                                             IDS Monitor


Application Elements
                      Sensor




   Middleware Sevices
    (e.g., Web, email)
                            Sensor


System software Services
  (Operating systems,
  database managers) Sensor


   Network Services
    (IP, Wireless, Wired)
                            Sensor


 Dr. Hal Plain, MIS Consulting & Training                         15
            Data Mining for Intrusion Detection

• Challenge: How to use DM techniques to detect
   – associations (e.g., linking a user site with intrusions),
      – sequencing (e.g., tying events together such as break-ins at certain
        times of day),
      – classifications (e.g., recognize patterns such as the attributes and
        profiles of intruders),
      – forecasting (e.g., predicting future intrusions based on past
        patterns).
• A great deal of log analysis is needed


Dr. Hal Plain, MIS Consulting & Training                                16
 Accountability and Non-Repudiation

• Accountability is synonymous to
  answerability and indicates responsibility.
• Accountability= system should be able to
  tell who did what, when, and how.
• Requires track of who or what accessed
  and/or made changes to the system.
• Logs and audit trails are used to support
  accountability
Dr. Hal Plain, MIS Consulting & Training        17
                                            Non-Repudiation


• Non-repudiation (NR): the ability to provide proof of the
  origin or delivery of data
• Popular due to the increase in ecommerce with use of digital
  signatures.
• Legal and crypto technical views do not coincide
• The traditional legal meaning of "Non-Repudiation”: an
  alleged signatory to a document is always able to repudiate,
  i.e., deny, a signature that has been attributed to him or her.



 Dr. Hal Plain, MIS Consulting & Training                   18
                                           Non-Repudiation

• The reasons for a repudiation:
       The signature is a forgery.
       The signature was obtained via unconscionable
        conduct by a party to a transaction, fraud
        instigated by a third party, or undue influence
        exerted by a third party.



Dr. Hal Plain, MIS Consulting & Training                19
                                Cryptographic view of "non-
                                              repudiation”


• A service that provides proof of the integrity and origin of data,
  both in an unforgeable relationship, which can be verified by
  any third party at any time.
• A receiver cannot say that he/she never received the data or the
  sender cannot say that he/she never sent any data.
• Problems related to NR in the digital environments:
• In the paper-based environment, the signatory has complete
  control over the signing mechanism


 Dr. Hal Plain, MIS Consulting & Training                     20
  Cryptographic view of "non-repudiation

• In the digital environments because the signatory
  has to rely on the cryptographic technologies, i.e.,
  the public and private keys that are used to create
  the digital signatures.
• In addition, the signature and other documents
  have to be transmitted over networks and then
  stored on computers -- all subject to a variety of
  attacks.

Dr. Hal Plain, MIS Consulting & Training           21
                                             Main Issues


• The EC Environment (Article 13 Model Law) shifts
  the onus of proof to the signatory to prove that the
  digital signature is a forgery.
• In conventional environment, the onus of proof is on
  the relying party to prove that the signature is not a
  forgery.




  Dr. Hal Plain, MIS Consulting & Training             22
                                           Main Issues

• Main technologies to support NR:
       Digital signatures
       Certificate authorities
       Extensive logs and audit trails
       Strong security measures at the computer
        systems to protect the private keys.
       Secure communication channels between the
        parties to assure safe transfer of certificates.
Dr. Hal Plain, MIS Consulting & Training             23
                   Availability and Denial of Service

• Availability: percentage of time a system can be
  used by a user (human or program).
• Natural causes can make a system unavailable
• Hackers and intruders can make a system
  unavailable by launching denial of service attacks.
• Replication is a common approach



 Dr. Hal Plain, MIS Consulting & Training          24
                                           Intrusion Tolerance

• Intrusion tolerance = security + availability
• Fragmentation-Redundancy-Scattering (FRS)
  scheme is a good approach to increase availability
  plus security.
       Fragmentation: Cutting all the sensitive information
        into several fragments such that no significant
        information is contained in any isolated fragment.



Dr. Hal Plain, MIS Consulting & Training                       25
                                           Intrusion Tolerance
       Redundancy: Multiple copies might be introduced by
        copying the fragments to tolerate destruction or
        alteration
       Scattering: The fragments along with their copies may
        be scattered amongst the different sites of the
        distributed system.




Dr. Hal Plain, MIS Consulting & Training                    26
 FRS (Fragmentation, Replication, Scattering)




Dr. Hal Plain, MIS Consulting & Training   27
                                Concluding Comments
  • Authorization
        –ID, Passwords, Digital Certificates and
        Signatures
        –Biometric identification
        –Kerberos
  • Authentication and Intrusion Detection
  •Accountability and Non-Repudiation
  •Availability and Replication
Dr. Hal Plain, MIS Consulting & Training           28
                   Commonly Used Security
                  Packages: PKI, VPN, SSL,
                         PGP and Kerberos




Dr. Hal Plain, MIS Consulting & Training   29
                 Common Security Packages
  • PKI
  •SSL
  •VPN
  •PGP
  •Kerberos
  •Others

Dr. Hal Plain, MIS Consulting & Training   30
          Security Technologies and Packages at a Glance

•   Encryption
•   Digital signatures
•   Message digests
•   Digital certificates
•   ID and passwords
•   Audit trails
•   Security packages to provide these services
      –   PKI
      –   PGP
      –   SSL
      –   VPN
      –   Many others
Dr. Hal Plain, MIS Consulting & Training             31
                         Common Security Packages
• PKI (Public Key Infrastructure) is an extensive collection of security
  technologies (encryption, digital signatures, digital certificates) for a
  wide range of applications. However, due to its extensive capabilities,
  PKI is somewhat difficult to use.
• PGP (Pretty Good Privacy) provides encryption and digital signature
  services. PGP is used commonly to protect email. Free and commercial
  versions of PGP are available.
• Kerberos is an open standard designed to provide strong authentication
  by using secret-key cryptography.
• SSL (Secure Socket Layer) is the de facto standard for securing the
  traffic between web clients and web servers. SSL uses, encryption,
  digital certificates, and digital signatures.
• IPSec is a standard used in Virtual Private Networks (VPNs) to encrypt
  and decrypt IP packets in the Internet. By using VPNs, customers can
  get a secure path over the public Internet by encrypting the IP traffic.

Dr. Hal Plain, MIS Consulting & Training                               32
          Different Packages apply at different levels)


                                           •PKI
                                           •PGP
                Applications               •Kerberos


                                           •SSL for Web traffic
                Middleware




                                             •IPSEC (VPN)
                  Network


Dr. Hal Plain, MIS Consulting & Training                          33
                Security Technologies, Standards, and
                                            Providers


                                              Standards
                                           (Specifications)



                                                          Commercial-off-
               Consumers
                                     Technologies         the-shelf (COTS)
              (Technology
                                                             Technology
                 Users)
                                                              Suppliers
                                       Researchers




Dr. Hal Plain, MIS Consulting & Training                                     34
                 Security Technologies, Standards, and
                                             Providers

• Technologies become available to the consumers
  in a variety of ways
      – Some standards specifications are adopted and
        developed by COTS suppliers
      – Some research efforts also result in COTS technologies
      – Some technologies not adopted by COTS providers are
        provided by individual groups




Dr. Hal Plain, MIS Consulting & Training                   35
     PKI (Public Key Infrastructure)
• Security systems include a wide range of options
  such as user ID and password, one-time
  passtokens, digital certificates, and biometrics.
• These mechanisms are typically part of Public
  Key Infrastructure (PKI).
• PKI capabilities help create and manage
  asymmetric cryptographic keys or public/private
  key pairs required by applications.

Dr. Hal Plain, MIS Consulting & Training          36
      PKI (Public Key Infrastructure)

                                             CA
      User’s public
      key
                                           CA’s Private
                                           Key

     User’s                  Certificate                  Signed
     name                                                 Certificate




Dr. Hal Plain, MIS Consulting & Training                          37
                                           Key Management

  •      Protection of the keys that in turn are used to protect the
         assets is also important.
  •      Private keys and shared secrets, once acquired, must be
         protected.
  •      End-to-end security must include consideration of the
         security of the end user device.
  •      Private keys stored on a personal computer disk file may
         be stolen via access to the file system or outright theft of
         the device.


Dr. Hal Plain, MIS Consulting & Training                         38
                                           Key Management
Security can be enhanced by
      – use of smart cards
      – use a security chip embedded in end user systems.
      – server-side hardware devices can provide tamper
        resistant key storage as well as assistance for
        encrypting and decrypting messages and public/private
        key operations, etc. that require heavy computational
        load.



Dr. Hal Plain, MIS Consulting & Training                   39
                                           PKI Components

 • The Certification Authority (CA)
       • creates and signs digital certificates
       • maintains a list of certificates that have been revoked
         before the expiration date (certificate revocation lists)
       • makes these certificates and revocation lists available
       • provides an interface so administrators can manage
         certificates.



Dr. Hal Plain, MIS Consulting & Training                        40
                                           PKI Components
• The Registration Authority (RA)
      • evaluates the credentials and relevant evidence that a
        person requesting a certificate is who they claim to be.
      • approves the request for issuance of a certificate by a
        CA.
• Directory Services
      • define and implement a common schema for users and
        groups.
      • based on the Lightweight Directory Access Protocol
        (LDAP),

Dr. Hal Plain, MIS Consulting & Training                      41
                                        Digital Certificates
     • A certificate Authority (CA) is a trusted party
       that keeps public key and other info
     • It creates and manages certificates (like birth
       certificate)
                                              CA
 User’s public
 key
                                           CA’s Private
                                           Key

User’s            Certificate                                Signed
name                                                         Certificate


•Before starting, ask receiver for a certificate Different type of certificates:
•Apply CA’s public key to verify correctness •(server, user,,)
  Dr. Hal Plain, MIS Consulting & Training
•Extract receiver’s public key and send          •Certificates follow X509 42
                                                 • PKI is a collection of technologies
        PKI Versus Certificate authorities

• Suppose you need a certificate that you can use for
  your Web server for a secure payment system.
• Then you have the following two choices:
      – Outsource (rent) a CA service from an external agency.
        The agency will, for a fee, issue a certificate and then
        verify and certify that you indeed are the holder of the
        certificate whenever needed. Verisign
        (www.verisign,com) is such an agency.



Dr. Hal Plain, MIS Consulting & Training                     43
        PKI Versus Certificate authorities

      – You buy your own PKI package, from a company such
        as Entrust, and install, maintain, and manage your own
        PKI system. This requires considerable effort.
• The tradeoff is control versus effort.




Dr. Hal Plain, MIS Consulting & Training                   44
        Entrust -- An Example of PKI Package

• Entrust (www.entrust.com), Entrust.net, a subsidiary
  of Entrust Technologies
• Offers a portfolio of service solutions to securely
  manage e-business transactions.
• Solutions include secure e-business transactions from
  e-commerce Web sites to interactive cell phones.
• Entered the secure transaction business for wireless.


  Dr. Hal Plain, MIS Consulting & Training          45
                                    Verisign (www.verisign.com)
                                               The ASP for CAs

• A wide range of security solutions for:
      –   Certificates
      –   Secure messaging
      –   Wireless systems
      –   Payment systems
• Can rent these services for monthly fees




Dr. Hal Plain, MIS Consulting & Training                     46
                                     Verisign (www.verisign.com)
                                                The ASP for CAs

• Industry specific solutions:
      –   Retail industry
      –   Enterprises
      –   Telcoms
      –   Healthcare
      –   Govt


Dr. Hal Plain, MIS Consulting & Training                     47
                       Secure Socket Layer (SSL)

 • Runs on top of TCP/IP
 • Manages secure messaging on the network
       – Client and server negotiate encryption scheme, key size
         (flexible)
       – Uses RSA Public encryption for key session negotiation, DSA
         for session encryption
       – Used heavily in Web
       – Web clients and servers agree on a “session” key




Dr. Hal Plain, MIS Consulting & Training                               48
                   Secure Socket Layer (SSL)

                                           Applications



                     Middleware


                                               Security Layer (SSL)


                                 Transport Layer (TCP)




Dr. Hal Plain, MIS Consulting & Training                              49
                                           SSL (cont.)

• Not designed specifically for HTTP
• Gives many choices symmetric key: DES, triple
  Des,
      – asymmetric key (for authentication): RSA public key
        and certificates
      – Integrity: Message digest with MD5 or SHA algorithms
      – Various key lengths
• The choices known as “cipher suite” with different
  strength:
      – Example: DES-RSA-MD5 in SSL 3.0 (very high)
Dr. Hal Plain, MIS Consulting & Training                 50
                                           SSL (cont.)
• Each web browser and server supports several
  cipher suites
• When an SSL client connects to a server
      – both negotiate a cipher suite that is strongest but
        available on both sides
      – Common problem: international web sites have smaller
        key lengths (40 bit) -- session uses 40 bit keys even
        though higher available
• SSL has performance issues - can use SSL
  accelerators.
Dr. Hal Plain, MIS Consulting & Training                  51
                                                   SSL (cont.)


Web                                                      Un-
                                                         encrypted
Browser                     SSL            SSL                     Web
                            Encrypted                    Traffic
                                           Accelerator           Server
                            Traffic
 Web
 Browser




Dr. Hal Plain, MIS Consulting & Training                                 52
                                              SSL (cont.)

• Once an SSL session is established, all web server to client
  traffic (both ways) are encrypted. This includes
     –   URL of the requested document
     –   Contents of the requested document
     –   contents of any filled out forms
     –   Cookies sent from client to server
     –   Cookies sent from server to client
     –   Contents of the HTTP header




 Dr. Hal Plain, MIS Consulting & Training                   53
                                                       SSL (cont.)

• Cannot hide that a particular browser is talking to a particular
  server
     – can use a proxy for ananmity
• Screen appearance with SSL is very similar
     – use https instead of http (e.g., https://www.fedex.com)
     – lock appears in the bottom




 Dr. Hal Plain, MIS Consulting & Training                        54
    Web Client
                                       SSL Session          Web Server
1.send Client Hello
                                                     2. Respond with Server Hello
                                                     3. Sever sends certificate
                                                     4. Server requests client
5. Send client                                       certificates (optional)
certificate (optional)
6. Send client key
exchange message
7. Send a certificate
verify message(optional)
8. Change cipherspec                                 8. Change cipherspec
message                                              message
9. Send finished message                             9. Send finished message
    Exchange traffic
10.Dr. Hal Plain, MIS Consulting & Training                                    55
                                                     10. Exchange traffic
             Web-based application security Model
   Client side security                                                       Back-end Security
                                             Middle Tier Security
                                                                                     Back-end
                                                  Web Server
       Client (Browser)                                                              Systems
                                                Purchase   SQL
                                                System
       HTML                                                  Catalog
                                                  CGI                                Back-end
                                                                                     Databases
                  Middleware                      Middleware
                  (browser )                      (Web Server)

                                                                                     Back-end
       Local                                   Local                                  APPs
      Ethernet            TCP/                 System            TCP/
       System             IP
      LAN                                      Software          IP
       Software


                      Router                                     Router              Router/
                                                                                     Gateway


                                                Network
Dr. Hal Plain, MIS Consulting & Training                                                   56
                                  Firewall                                Firewall
                                       VPN and IPSEC

          Computer 1                                                Computer 2

Applications and Services (principals)                Applications and Services (principals)
Telnet FTP SMTP HTTP Others                            Telnet FTP SMTP HTTP Others



          TCP                   UDP                                TCP             UDP

                    IP                                                     IP

       Physical Network                                          Physical Network
                                        Information Channel

      Dr. Hal Plain, MIS Consulting & Training                                     57
                              VPN -- conceptual View
                      Non-                                  Non-
                      encrypted                             encrypted
                      traffic                               traffic
                    local                                     local
                    network
                                            Public
                                           Public             network
                                            network
                                           Internet


                        encrypted                     encrypted
                        traffic                       traffic




Dr. Hal Plain, MIS Consulting & Training                                58
                                                               Mainframe     VPN
                           POP
                           (VPN)



                                           IP
                                           Network
                                                                   POP
                                           (Public Internet)       (VPN)

                                                                                 Non-encrypted
                                                                                 Traffic

                                      POP                                           Encrypted
                                      (VPN)                                         Traffic
                                                                                    (Tunnel)

•POP(Point of Presence) provided by an NSP or ISP only provides a local phone access
•NAP (Network Access Point) provides a secure tunnel over a shared network to support a VPN.
An ISP may own a NAP also.

Dr. Hal Plain, MIS Consulting & Training                                             59
                                  IPSEC -- A Closer Look
             IP     IPSec  Secure IP
             Header Header Payload                                 LAN2
                                                 Public                                 IP     IP
                                                 Internet                               Header Payload
                                                 or
                                                 Private
IPSEC-enabled                                    Network
                                                                                      IPSEC Device
Workstation
                                                            IP     IPSec  Secure IP
                                                            Header Header Payload




                         IP     IPSec  Secure IP
                         Header Header Payload                                        Encrypted
                                                                                      Traffic
                                                                                      (Tunnel)
                                        IPSEC
                                        Device


LAN1Dr. Hal Plain, MIS Consulting & Training
                             IP        IP                                                   60
                              Header Payload
                                           IPSEC Documents
                                       Architecture


           ESP
                                                                   AH
           Protocol
                                                                   Protocol


                         Encryption               Authentication
                         Algorithms               Algorithms

                          Domain of Interpretation (DOI)


                                              Key
Dr. Hal Plain, MIS Consulting & Training   management                         61
                    PGP (Pretty Good privacy)


• Packaged several encryption technologies into a
  product
• Used heavily in group communications (among
  individuals)
• Implemented in software – free for individual use
• Used to encrypt files for storage and encrypt
  messages for transmission


Dr. Hal Plain, MIS Consulting & Training         62
                    PGP (Pretty Good privacy)


• Uses block cipher with 128 bit key to encrypt files
  or messages
• A key is generated automatically for files and
  messages
• Uses RSA to exchange the key (uses recipients
  public key to encrypt)



Dr. Hal Plain, MIS Consulting & Training          63
                                  Example of using PGP

•   Send secure email to joe
•   Start email
•   Encrypt it by using pgp (gives you a key) K
•   Send email
•   To send the key:
      – Get Joe’s public key
      – Encrypt it by using joe’s public key
      – Send it to joe


Dr. Hal Plain, MIS Consulting & Training            64
                                  Example of using PGP

• Joe does the following:
      – Decrypts the key by using his private key
      – Uses the key to decrypt email
• For more info: www.pgpi.com




Dr. Hal Plain, MIS Consulting & Training            65
                                           Kerberos

•     Kerberos (http://ww.mit.edu/kerberos/) developed
      at MIT
•     A cryptographic authentication scheme using a
      third-party authentication server to grant
      cryptographic "tokens" that authenticate users to a
      given service.
•     Open standard designed to provide strong
      authentication by using secret-key cryptography.


Dr. Hal Plain, MIS Consulting & Training              66
                                           Kerberos

•     Used primarily for secure interoperation of existing
      systems
•     Kerberos is used for user authentication.




Dr. Hal Plain, MIS Consulting & Training             67
                                             Kerberos

• Currently on version 5
• Includes a very wide range of security
  technologies:
      –   symmetric and asymmetric-key cryptography
      –   certificates
      –   token cards
      –   smart cards
      –   IDs, PWs

Dr. Hal Plain, MIS Consulting & Training              68
                                           Kerberos

• Many free as well as commercial implementations
• Trust model: direct, third party




Dr. Hal Plain, MIS Consulting & Training         69
                                           Kerberos approach

•   Authentication - session key and tickets
•   Confidentiality -- symetric/asymetric keys
•   Integrity - hashing functions
•   Access control and Authorization
     – requires confidentiality and integrity
     – capability based (tickets)



Dr. Hal Plain, MIS Consulting & Training                  70
                                           Kerberos approach


• non-repudiation- not fully supported (symetric key
  plus process controls)
• secure channel - encryption




Dr. Hal Plain, MIS Consulting & Training                  71
      Kerberos - Functional Overview


                                                                         Kp.
                                                        Principal
              Joe’s                 Key Distribution                     Kj
              key Kj 1              Center (KDC)         Database
                                             Payroll
      Client                   2             key Kp Server
      Software                                       (payroll)
                                     5
(Joe)     3, 4                 Session key



  Dr. Hal Plain, MIS Consulting & Training                          72
    Kerberos - Functional Overview
• The principal database has the secret keys Kp(payroll),
  Kj(Joe)
• 1.The client asks for Joe’s ID request (Joe, payroll) and
  sends to KDC
• 2. KDC Authent server (AS)constructs two replies and
  sends to client
      – service ticket: Joe, payroll, session key (random) - encrypted by
        Kp
      – client ticket: service ticket - encrypted by Kj




Dr. Hal Plain, MIS Consulting & Training                                73
    Kerberos - Functional Overview
• 3. The client decrypts the client ticket by using Kj. If not,
  something wrong
• 4. Client constructs a service request: service ticket +
  request (print check)
• 5. Sends the service request to server. The server decrypts
  it by using Kp




Dr. Hal Plain, MIS Consulting & Training                     74
 Kerberos standards and products

• Many standards and implementations
• Standards
      – IETF activities
• Products
      – OSF DCE - integrated into a product (mid 1990s)
      – GSS-API - general security service API (hides underlying
        technology)
      – Microsoft SSPI -- close to GSS-API



Dr. Hal Plain, MIS Consulting & Training                           75
 Kerberos standards and products

• SSL- uses public key for network security
      –   IPSEC - encrypts packets
      –   RADIUS - Remote access dial-in user service
      –   Token cards -- user gets a key, types; host side synchs
      –   Smart cards -- micro-processor with IDs, etc




Dr. Hal Plain, MIS Consulting & Training                            76
                                 Tivoli (www.ibm.com)

 • Started as a systems management company
   (managing performance and faults)
 • Bought by IBM
 • Provides a set of security services under the Tivoli
   Access Manager
       – control both wired and wireless access to applications
         and data; keeping unauthorized users out.



Dr. Hal Plain, MIS Consulting & Training                     77
                                 Tivoli (www.ibm.com)

       – integrates with e-business applications to
         deliver a secure personalized e-business
         experience for authorized users.
       – includes integrated security for key CRM,
         ERP, and SCM e-business solutions
       – enhancements for securing J2EE-conforming
         applications running on WebSphere
         Application Server or BEA WebLogic Server.

Dr. Hal Plain, MIS Consulting & Training           78
                                 Concluding Comments

•    Many security packages commercially available
      –   PKI
      –   SSL
      –   VPN
      –   PGP
      –   Kerberos
      –   Others
• Each provides its own strengths/weaknesses and operates
  at different levels


Dr. Hal Plain, MIS Consulting & Training                79

				
DOCUMENT INFO
Shared By:
Categories:
Stats:
views:8
posted:7/13/2011
language:English
pages:79