Firewalls and Intrusion Detection

Introduction to Firewalls

A firewall is a computer or group of computers that stand between  trusted networks (such as LAN) and untrusted networks (such as the Internet), inspecting all traffic passing between them.

A firewall can be a router, a personal computer, or a collection of hosts, that is set up specifically to shield a private network from security attack that comes from an external entity 

The basic function of a firewall is to screen network traffic for the purpose of Preventing unauthorized access between computer networks.

To be effective in their operation, firewalls must have the following attributes:

All communications must pass through the firewall

The firewall permits only traffic that is authorized

The firewalls can withstand attacks upon itself

 

Continue reading →

Transport Layer Security for Web Applications

Web Security

• Virtually all businesses including government agencies as well as individuals have web sites now-a-days.  
• The number of users of web sites and web applications increase rapidly day by day.  
• Web browsers are easy to use, web servers are relatively easy to configure and manage, and web content is increasingly easy to develop.
• But, Internet and World Wide Web (WWW) are vulnerable to compromises of various security threats that may challenge the web traffic security of an organisation or an individual.

• The World Wide Web (WWW) provides the platform for client/server applications to run over the Internet and TCP/IP intranets.
• Casual and untrained (in security matters) users are common clients for web based services.  Such users are not necessarily aware of the security risks that exist and do not have the tools or knowledge to take effective countermeasures

Web Security Threats:

• One way of classifying attacks on Web can be in terms of their impact on the web: passive attack and active attack
• Passive attacks include eavesdropping on network traffic between browser and server and gaining access to information on a Web site that is supposed to be restricted
• Active attacks include impersonating another user, altering message in transit between client and server, and altering information on a web site.

Table: A Comparison of Threats on the Web

• Another way of classifying the attack on the Web can be done in terms of the location of its occurrence on the web: web server, web browser, and network traffic between browser and the server.

Web Traffic Security Approaches:

• One way of providing web security is to use IP Security (IPSec) protocol as shown in Figure (a).  IPSec is a general-purpose solution for providing security on the internet, which is transparent to end users and applications.

• Another way of implementing web security is to implement security just above TCP (Figure b).  In this approach, the protocols such as Secure Socket Layer (SSL) and Transport Layer Security (TLS) could be used on top of the Transport Layer.
• The third approach is providing security at the application layer.  In this approach, the application-specific security service such as Kerberos is embedded within the particular application for securing its data transmission on the web.

Transport Layer Security (TLS)

• One of the most widely used security services for web security is Transport Layer Security (TCL) 
• TCL is an Internet standard that evolved from a commercial protocol known as Secure Socket Layer (SSL)
• TLS is a general-purpose service implemented as a set of protocols that rely on TCP
• TLS can be used for web security in two ways:
• TLS could be provided as part of the underlying protocol suit and therefore transparent to applications running above it
• TLS can be embedded in specific application packages, such as web browsers on which web clients are running
• TLS is designed to make use of TCP to provide a reliable end-to-end secure service for the applications running on the application layer

Fig. TLS Protocol Stack

Continue reading →

Hash Functions and Digital Signatures

Introduction to Hash Functions

A hash function H is a mathematical algorithm that accepts a variable-length block or message of data as input and produces a fixed-size output known as a hash value, hash code, or message digest (h =H(M)).

• The primary objective of a hash function is to verify data integrity, as any alteration to even a single bit in the input message will, with high probability, produce a different hash code. 

Applications of Hash Functions:

• A hash function maps a variable-length message into a fixed-length hash value, or message digest.
• Hash functions are widely used across various domains due to their efficiency and versatility:
• Hash Tables: The most common use of hash functions in DSA is in hash tables, which provide an efficient way to store and retrieve data.
• Data Integrity: Hash functions are used to ensure the integrity of data by generating checksum.
• Cryptography: In cryptographic applications, hash functions are used to create secure hash algorithms like SHA-256.

Properties of Hash Functions:

A good hash function should satisfy certain properties to ensure efficient and reliable data storage, retrieval, and security.

• Deterministic: A hash function must consistently produce the same output for the same input.
• Variable Input Size: A has function can be applied to a data block or message of any arbitrary size.
• Fixed Output Size: The output of a hash function should have a fixed size, regardless of the size of the input, i.e., the function H produces a fixed-length output regardless of how large or small the input message is.
• Efficiency: The hash function should be able to process input quickly.  H(x) is relatively easy and fast to compute for any given input x, making both software and hardware implementations practical.
• Pre-image Resistance: It should be computationally infeasible to reverse the hash function.  For any given hash value h, it is computationally infeasible to find an input y such that H(y) = h.  This property ensures that the original message or a shared secret cannot be recovered simply by observing the hash value.
• Collision Resistance: It should be difficult to find two different inputs that produce the same hash value.  For any given message x, it is computationally infeasible to find a different message y ≠ × such that H(y) = H(x) This property prevents an attacker from forging an alternative message that yields the same hash code as a known message.
• Avalanche Effect: A small change in the input should produce a significantly different hash value.
• Pseudorandomness: The output of H meets standard tests for pseudorandomness, producing hash values that appear evenly distributed and random.

Here is a video lecture on Hash Functions.

Simple Hash Functions

• A hash function accepts a variable-length block of data as input and processes it to produce a fixed-length output known as a hash value, hash code, or message digest.
• Hashing enables efficient storage and fast retrieval of data.
• Applying modulo division on an integer is an example of a simple hash function.  Here is an exmple:

H(x) = x % 10

• The operation of module division by 10 converts any large number into a value between 0 and 9, making it suitable for indexing in a hash table.
• Here is another example.  When we apply the modulo division by 100 on an integer, we get a has value that falls between 0 and 99 

h(k) = k mod 100

• For a hash table of size 100, valid indices range from 0 to 99 that can be generated by the hash function mentioned above

Here is another video on Hash Functions and Its Applications.

Modular Additional Hash

• A modular addition hash is one of the simplest conceptual forms of an iterated hash function. It processes input data by breaking it into fixed-size blocks and summing them sequentially modulo a chosen number N.

Cryptographic Cash Function

• A cryptographic hash function is an algorithm specifically designed for security applications.
• These hash functions are designed for security rather than speed. They are used in applications where data protection is critical.
• All cryptographic hash functions involve the iterative use of a compression function.
• The compression function used in secure hash algorithms falls into one of two categories: 
• (i) a function specifically designed for the hash function 
• (ii) an algorithm based on a symmetric block cipher. SHA and Whirlpool are examples of these two approaches, respectively.
• For a hash function to be cryptographically secure and effective in practice, it must satisfy the following two properties:
• The function is one-way.  In other words, the function creates a checksum from the information, but it can't be the other way around, the checksum can't be used for creating the information.  This property is known as Pre-image Resistance.
• It should not be possible to produce two pieces of information that provide the same checksum when run through the function.  This property of the has function is known as Collision Resistance.
• The most two common secure hash functions are MD5, which produces a 128-bit checksum, and SHA, which produces a 160-bit checksum.  
• Among these two, SHA, which was developed by the government of USA and is believed to be more secure than MD5.

Digital Signatures

• Digital signatures are a form of encryption that can be utilised for enforcing integrity and authentication of messages during transmission from send to the receiver.  
• It is a method of electronic authentication of a message using cryptographic hash functions.  
• President Clinton signed a law to allow digital signatures to be used as a legal signature.  
• Given below are the steps involved in applying digital signatures for message authentication:

1. The information to be secured is first put through a message digest or hash function.  The hash function creates a check sum of the information.
2. The checksum is then encrypted by the user's private key. 
3. The information and the encrypted checksum are sent to the receiver of the information.
4. At the receiving side, the receiver gets the information and puts it through the same hash function to derive the checksum of the message being sent.
5. The encrypted checksum came along the message is decrypted and the two checksums (original and calculated) are compared.
6. If the received checksum and the calculated checksum do match with each other, it ensures that the information has not changed during transmission (integrity is secured).

The security and usefulness of a digital signature depends upton two critical elements:

• Protection of the user's private key
• A secure hash function that creates a checksum of atleast 128 bits.

Need for Public Key Encryption in Authentication:

• Public key encryption uses a key pair - one key to encrypt the data and another key to decrypt the data
• Proper use of public key encryption can provide confidentiality, authentication and integrity of information.
• In public key encryption , the private key is kept secret by the owner; the public key is published identifying who the owner is.  One key can't be used for creating another key.
• If authentication is desired, the owner of the key pair encrypts information with the private key and the encrypted message to the recipient.  
• Only the correct public key can decrypt the information, and successful decryption provides the assurance that only the owner the key pair could have sent the information.i.e., the received message has been authenticated.

Continue reading →

Question Bank on Cryptography & Network Security

Frequently Asked Questions (FAQ)

UNIT-1

Multiple Choice Questions:

1.  The _______________ attack is related to confidentiality.

• Fabrication
• Interception
• Interruption
• Modification

2.  If the recipient of the message has to be satisfied with the identity of the sender, the principle of ________________ comes into picture.

• Authentication
• Confidentiality
• Integrity
• Access control

3.  The ______________ attack is related to availability. 

• Fabrication
• Interception
• Interruption
• Modification

4.  If we want to ensure the principle of __________________, the content of a message must not be modified while in transit.

• Authentication
• Access control
• Confidentiality
• Integrity

5.  Interruption attacks are also called as ______________ attack. 

• Alteration
• Denial of Service (DoS)
• Masquerade
• Replay attacks

Descriptive Questions (2 Marks):

1. Define Cryptography.
2. What is steganography? How is it different from cryptography?
3. What is masquerade?  Which principle of security is breached because of that?
4. What are replay attacks?  Give an example of a replay attack.
5. What are the two basic functions used in encryption algorithms?
6. Writ the differences between Symmetric and Asymmetric ciphers.
7. What is the main difference between a stream cipher and a block cipher?
8. Briefly define the monoalphabetic cipher.
9. What is the difference between a monoalphabetic cipher and a polyalphabetic cipher?
10. Differentiate between substitution and transposition techniques in classical cryptography.

Descriptive Questions (5 Marks):

1. Explain the importance of cryptography in the evolution of secure communication with suitable historical examples.
2. Discuss any one of the passive attacks in detail.
3. Discuss any two Substitution Technique and list their merits and demerits.
4. Explain the working principle of the Caesar cipher. Encrypt the text "NETWORK" using a key value of 3.
5. Explain the Play Fair cipher algorithm? Encrypt the message ‘MY BALLOON’ using the key ‘MONACHRY’
6. Compare and Contrast stream ciphers and block ciphers.
7. Explain the followings: (a) Playfair cipher. (b) Vernam cipher
8. Describe the working of a Columnar Transposition Cipher by encrypting the message “CRYPTOGRAPHY IS FUN” using the keyword “NETWORK.” Show column arrangement, transposition steps, and final ciphertext.
9. Explain the basic principle of rotor machine.
10. Explain the work of a Rotor Machine with a simple example. Show how a single plaintext letter is transformed through multiple rotors into ciphertext.

Continue reading →

Question Bank on Information Security

Frequently Asked Questions (FAQ)

(Unit-1)

Multiple Choice Questions:

1.  Which of the following term indicates that the data is not modified by unauthorised users? 

• Confidentiality
• Integrity
• Availability
• Flexibility

2.  Authentication is used for which of the following? 

• Provide access rights
• Verify identify of the user
• Monitor systems connected to a network
• Encrypt data at rest

3.  Which device connects multiple networks? 

• Hub
• Router
• Switch
• Repeater

4.  Information Security is for protecting which of the following? 

• Hardware
• Software
• Data
• Data Center

5.  Reconnaissance means ________________. 

• Gaining access
• Collecting information
• Exploiting system
• Clearing logs

6.  Which security service ensures that data is protected from unauthorised disclosure. 

• Confidentiality
• Authenticity
• Availability
• Integrity

Descriptive Questions (2 Marks):

1. What does the CIA Triad stand for?
2. What do you mean by Security Service?
3. Differentiate active and passive attack.
4. Define data confidentiality.
5. What is Cryptanalysis?
6. What are the ingredients of Symmetric Cipher model?
7. List the security services available for securing a system from various attacks.
8. What is the main purpose of a firewall?
9. Define stream ciphers.
10. Differentiate Symmetric and Asymmetric cryptography.
11. Describe the use of public key cryptography.
12. How many modes of operations are there for implementing a Block Cipher?  What are they?
13. Give example for mono alphabetic and poly alphabetic ciphers.

Descriptive Questions (5 Marks):

1. With the help of a neat diagram, explain the model for network security.
2. Make a comparison between Symmetric and Asymmetric cipher models.
3. For each of the following assets, assign a low, moderate or high impact level for the loss of confidentiality, availability and integrity respectively.  Justify your answer:
• Financial organisation managing routine administrative information
• Organisation managing public information on its web server
• Law enforcement organisation managing extremely sensitive information.
4. Draw a matrix that shows the relationship between security mechanisms and attacks.
5. State the difference between block cipher and stream cipher.
6. 
   

Continue reading →

Project Titles for Course Project on CNS

Project Titles on Cryptography and Network Security

S. No.	Project Title	Unit #	Key Concepts
1	Secure File Encryption System Using Classical Cryptographic Techniques	Unit I	Substitution techniques; Transposition techniques; Symmetric cipher model
2	Hybrid Encryption System Using Caesar, Playfair and Hill Ciphers	Unit I	Substitution techniques; Playfair cipher; Hill cipher; Classical encryption
3	Secure Data Hiding Using Cryptography and Steganography	Unit I	Steganography; Classical encryption techniques
4	Cryptanalysis and Attack Analysis of Classical Encryption Algorithms	Unit I	Classical encryption; Substitution; Transposition; Cryptanalysis and weaknesses
5	Comparative Analysis of Symmetric Encryption Algorithms	Unit II	Stream ciphers; Block ciphers; Block cipher principles; Attacks on block ciphers
6	DES-Based Secure File Encryption and Decryption System	Unit II	Data Encryption Standard (DES); Block cipher principles; Encryption and decryption
7	Secure Communication Using RC4 Stream Cipher	Unit III	Stream ciphers; RC4; Symmetric encryption
8	AES-Based Secure Data Storage and Retrieval System	Unit III	Advanced Encryption Standard (AES); Block cipher
9	RSA-Based Secure Message Encryption and Digital Key Management	Unit III	Public key cryptography; RSA algorithm; Key management
10	Secure Key Exchange System Using Diffie–Hellman Algorithm	Unit III	Diffie–Hellman key exchange; Public key cryptography
11	Elliptic Curve Cryptography Based Secure Communication System	Unit III	Elliptic Curve Cryptography (ECC); Public key cryptography
12	Hybrid RSA–AES Encryption System for Secure File Transfer	Units II & III	AES; RSA; Block ciphers; Public key cryptography; Key management
13	Secure Password Storage Using Cryptographic Hash Functions	Unit IV	Cryptographic hash functions; Security requirements; Password integrity
14	File Integrity Verification System Using SHA-256/SHA-3	Unit IV	Secure Hash Algorithm (SHA); SHA-3; Data integrity
15	Secure Digital Document Authentication Using Cryptographic Hashing	Unit IV	Cryptographic hash functions; Authentication; Integrity
16	Comparative Security Analysis of SHA-2 and SHA-3 Hash Algorithms	Unit IV	SHA; SHA-3; Hash-function security requirements
17	Blockchain-Based Secure Academic Certificate Verification System	Unit V	Blockchain; Cryptographic hashing; Blockchain applications
18	Blockchain-Based Student Attendance Management System	Unit V	Blockchain; Distributed ledger; Blockchain applications
19	Blockchain-Based Secure Voting System Using Distributed Consensus	Unit V	Blockchain; Distributed consensus; Blockchain applications
20	Ethereum-Based Smart Contract for Secure Digital Transactions	Unit V	Ethereum; Smart contracts; Blockchain development platforms and APIs
21	Blockchain-Based Secure File Integrity and Data Sharing System	Units IV & V	Cryptographic hash functions; Blockchain; Data integrity; Blockchain applications

Continue reading →