The idea
The earlier topics gave you the tools: encryption, hashes, key pairs. This topic is where they get deployed. Two protocols apply them to traffic (TLS above transport, and a network-layer protocol that works on whole datagrams). A third approach does not secure the traffic at all and instead controls what is allowed in or out of a network. That is a firewall.
How it works
Transport-layer security (TLS)
TLS is a widely deployed security protocol above the transport layer. It is supported by almost all browsers and web servers, and it is what https on port 443 uses.
It provides three services, and each uses a technique from this module.
- Confidentiality, via symmetric encryption.
- Integrity, via cryptographic hashing.
- Authentication, via public-key cryptography.
The lecture’s history: early research and implementation was secure network programming and secure sockets. The secure socket layer (SSL) was deprecated in 2015. TLS 1.3 followed in 2018.
How it works
Network layer security
Network layer security provides datagram-level encryption, authentication and integrity. It covers both user traffic and control traffic, for example BGP and DNS messages. The lecture names two modes.
| Mode | What is protected |
|---|---|
| Transport mode | Only the datagram payload is encrypted and authenticated. |
| Tunnel mode | The entire datagram is encrypted and authenticated. The encrypted datagram is encapsulated in a new datagram with a new IP header and tunneled to the destination. |
The slide has a figure marking the payload in each mode. It extracted to the word payload only.
How it works
Firewalls
A firewall isolates an organization’s internal network from the larger Internet. It allows some packets to pass and blocks others. The lecture’s figure shows an administered network of trusted “good guys” on one side, the public Internet of untrusted “bad guys” on the other, and the firewall between them.
How it works
Application gateways
An application gateway filters packets on application data as well as on IP, TCP and UDP fields. The lecture’s example is allowing select internal users to telnet outside.
- Require all telnet users to telnet through the gateway.
- For authorized users, the gateway sets up a telnet connection to the destination host. The gateway relays data between the two connections: a host-to-gateway telnet session and a gateway-to-remote-host telnet session.
- The router filter blocks all telnet connections not originating from the gateway.
How it works
Limitations of firewalls and gateways
- IP spoofing: the router cannot know if data really comes from the claimed source.
- If multiple applications need special treatment, each has its own application gateway.
- Client software must know how to contact the gateway. For example, the IP address of the proxy must be set in the web browser.
- Filters often use an all-or-nothing policy for UDP.
- There is a trade-off between the degree of communication with the outside world and the level of security.
- Many highly protected sites still suffer from attacks.
Where marks get lost
A firewall is not encryption
TLS and the network-layer modes protect the content of traffic. A firewall decides what traffic passes. A packet can pass a firewall with a spoofed address, which is why the lecture lists spoofing as a limitation.
In the exam
- TLS: confidentiality by symmetric encryption, integrity by hashing, authentication by public key.
httpsis port443. - Network layer security: transport mode protects the payload, tunnel mode protects the whole datagram inside a new one.
- Be able to walk through the three steps of the telnet application gateway example.
- Know at least three limitations.
Aside
Lecture slips to note
The slide gives the TLS 1.3 reference as RFC 8846. The RFC that defines TLS 1.3 is RFC 8446, so the slide’s number looks like a typo. The lecture’s network-layer section does not name the protocol. It is usually called IPsec, which the lecture does not state. The page keeps the lecture’s wording and flags both.
Check yourself
- TLS gives confidentiality, integrity and authentication using symmetric encryption, hashing and public-key cryptography.
- Transport mode protects the payload. Tunnel mode protects the whole datagram and adds a new IP header.
- A firewall blocks some packets and passes others.
- An application gateway forces users through a proxy, and the router blocks telnet that bypasses it.
- Firewalls cannot detect IP spoofing.