W 13 SKR 3200

Communication and Computer Network (SKR 3200)
Network Security and Network

Management
:: Content::
1.Security Services
i. Confidential
ii. Integrity
iii. Authentication
iv. Non-repudiation
2.Integrity Authentication
3.Configuration Management
4.Fault Management
5.Performance Management
6.Security & Accounting Management
1
Learning Outcome
• Explain the network security services(C4)
• Show the cryptography techniques(P3)
• Explain the network management services (C4)
2
SECURITY SERVICES
• Network security can provide five services.

• Four of these services are related to the message
exchanged using the network.
• The fifth service provides entity authentication or
identification.
3
Message Confidentiality
• Message confidentiality or privacy means that the
sender and the receiver expect confidentiality.
• The transmitted message must make sense to only
the intended receiver.
• To all others, the message must be garbage.
• The message must be encrypted at the sender site
and decrypted at the receiver site.
• This can be done using either symmetric-key
cryptography or asymmetric-key cryptography.
Confidentiality with Symmetric-Key Cryptography
Confidentiality with Asymmetric-Key Cryptography
4
Message confidentiality using symmetric keys in two directions
5
Message confidentiality using asymmetric keys
6
Message Integrity
• Message integrity means that the data must arrive at
the receiver exactly as they were sent.
• Encryption and decryption provide secrecy, or
confidentiality, but not integrity.
• However, on occasion we may not even need secrecy,
but instead must have integrity.
 Document and Fingerprint
 Message and Message Digest
 Creating and Checking the Digest
 Hash Function Criteria
 Hash Algorithms: SHA-1
7
Note
To preserve the integrity of a document,

both the document and the fingerprint are needed.
8
Message and message digest
Note
The message digest needs to be kept secret.
9
Checking integrity
10
Criteria of a hash function
One wayness : Ensure a message digest is created by a one-way hashing

function and must not be able to recreate the message from the digest
Weak collision resistance : Ensure that a message cannot be easily be

forged
Strong collision resistance: Ensue that we cannot fine two messages that
hash to the same digest.
11
Message digest creation
12
Note
SHA-1 hash algorithms create an N-bit message digest

out of a message of 512-bit blocks.
SHA-1 has a message digest of 160 bits

(5 words of 32 bits).
13
Processing of one block in SHA-1
14
Message Authentication
• Message authentication is a service beyond message
integrity.
• In message authentication the receiver needs to be sure
of the sender’s identity and that an imposter has not sent
the message.
• A hash function per se cannot provide authentication.
• The digest created by a hash function can detect any
modification in the message, but not authentication.
MAC: A keyed Message Authentication Code
HMAC: Hashed MAC uses keyless hash function such as SHA-1
15
MAC, created by Alice and checked by Bob
16
HMAC
17
Message Non-repudiation
• Message non-repudiation means that a sender must not
be able to deny sending a message that he or she, in
fact, did send.
• The burden of proof falls on the receiver.
Note
Non-repudiation can be provided using a trusted party.
18
Using a trusted center for non-repudiation
19
Digital Signature
• When Alice sends a message to Bob, Bob needs to
check the authenticity of the sender; he needs to be
sure that the message comes from Alice and not Eve.
• Bob can ask Alice to sign the message electronically.
• In other words, an electronic signature can prove the
authenticity of Alice as the sender of the message.
• We refer to this type of signature as a digital signature.
Note
A digital signature needs a public-key system.
20
Signing the message itself in digital signature
21
Note
In a cryptosystem, we use the private and public keys of

the receiver;
in digital signature, we use the private and public keys of
the sender.
22
Signing the digest in a digital signature
23
Note
A digital signature today provides message integrity.

Digital signature provides message authentication.
24
Entity Authentication
• Entity authentication is a technique designed to let one

party prove the identity of another party.
• An entity can be a person, a process, a client, or a
server.
• The entity whose identity needs to be proved is called
the claimant; the party that tries to prove the identity of
the claimant is called the verifier.
25
Entity Authentication
• Passwords Authentication : fixed password and one-

time password
• Challenge Response Authentication:
1. Using a symmetric-key cipher
2. Using a Keyed hash function
3. Using an symmetric –key cipher
4. Using digital signature
26
Note
In challenge-response authentication,
the claimant proves that she knows a secret without
revealing it.
27
Note
The challenge is a time-varying value sent by the verifier;

the response is the result of a function applied on the
challenge.
28
Challenge/response authentication using a nonce
29
Challenge-response authentication using a timestamp
30
Challenge-response authentication using a keyed-hash function
31
Authentication, asymmetric-key
32
Authentication, using digital signature
33
Network Management System
• Network management are the monitoring, testing,

configuring, and troubleshooting network components
to meet a set of requirements defined by an
organization
• The functions performed by a network management
system can be divided into five broad categories:
– configuration management,
– fault management,
– performance management,
– security management, and
– accounting management.
34
Functions of a network management system
35
Configuration Management
• Configuration management system must know at any

time, the status of each entity and its relation to other
entities
• Reconfiguration: adjusting the network component and
features. 3 types of reconfiguration:
– Hardware reconfiguration
– Software reconfiguration
– User account reconfiguration
• Documentation: The original network configuration and
each subsequent change must be recorded
meticulously for hardware, software and user accounts.
36
Fault Management
• Reactive Fault Management System

– Is responsible for detecting, isolating, correcting, and recording
faults.
– It handles short term solutions to faults
• Proactive Fault Management System

– It tries to prevent faults from occurring.
– Although this is not always possible, some types of failures can
be predicted and prevented.
– E.g., if a fault happens frequently at one particular point of a
network, it is wise to carefully reconfigure the network to
prevent the fault from happening again
37
Performance Management
• Closely related to fault management, tries to monitor

and control the network to ensure that it is running as
efficiently as possible
• Capacity : limited capacity of a network
• Traffic: Number of packets travelling inside and outside
the network
• Throughput: Throughput of an individual device
• Response Time : measure the time a user requests a
service to the time the service is granted
38
Security and Accounting Management
• Security Management
– Is responsible for controlling access to the network based on
the predefined policy
• Accounting Management
– Is the control of users’ access to network resources through
charges.
– Individual users, departments, divisions are charged for the
services they receive from the network maybe for budgeting
purpose
39
Simple Network Management
Protocol (SNMP)
• The Simple Network Management Protocol
(SNMP) is a framework for managing devices in an
internet using the TCP/IP protocol suite.
• It provides a set of fundamental operations for

monitoring and maintaining an internet.
40

W 13 SKR 3200

Uploaded by

Copyright:

Available Formats

W 13 SKR 3200

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

W 13 SKR 3200

Uploaded by

Copyright:

Available Formats

Communication and Computer Network (SKR 3200)

Network Security and Network

• Network security can provide five services.

To preserve the integrity of a document,

The message digest needs to be kept secret.

One wayness : Ensure a message digest is created by a one-way hashing

Weak collision resistance : Ensure that a message cannot be easily be

SHA-1 hash algorithms create an N-bit message digest

SHA-1 has a message digest of 160 bits

Non-repudiation can be provided using a trusted party.

A digital signature needs a public-key system.

In a cryptosystem, we use the private and public keys of

A digital signature today provides message integrity.

• Entity authentication is a technique designed to let one

• Passwords Authentication : fixed password and one-

The challenge is a time-varying value sent by the verifier;

• Network management are the monitoring, testing,

• Configuration management system must know at any

• Reactive Fault Management System

• Proactive Fault Management System

• Closely related to fault management, tries to monitor

• It provides a set of fundamental operations for

You might also like