Security

Security

Security is very important to the proper operation of VPNs. This section describes the available security mechanisms and the anticipated developments in the realm of standards for encryption and key management.

Firewalls

A firewall is typically defined as a system or a group of systems that enforces and acts as a control policy between two networks. It can also be defined as a mechanism used to protect a trusted network from an untrusted network usually while still allowing traffic between the two. All traffic from inside to outside and vice versa must pass through the firewall. Only authorized traffic, as defined by the local security policy, is allowed to pass through it. The system itself is highly resistant to penetration. A firewall selectively permits or denies network traffic.

Viruses

Virus is a term that's used broadly to refer to a program that is designed to interfere with computers' normal operations. The tab for all computer viruses in 1999 was, shockingly, greater than US$12 billion.

The term virus can be used more narrowly to refer to programs that move from one file to another and can be transmitted to other PCs via an infected file. They generally don't seek out the Internet or e-mail to spread.

Another type of virus is the worm, such as the Love Bug. Worms make use of a LAN or the Internet (especially via e-mail) to replicate and forward themselves to new users.

Finally, a Trojan horse hides within another program or file and then becomes active when someone opens the unwitting host.

A big part of administrating security involves managing viruses. The fact that we can deploy such functionality on a proxy server is very attractive.

There are several variations of firewalls, including these:

         A firewall can use different protocols to separate Internet servers from internal servers.

         Routers can be programmed to define what protocols at the application, network, or transport layer can come in and out of the router so the router is basically acting as a packet filter.

         Proxy servers can be used to separate the internal network users and services from the public Internet. Additional functions can be included with proxy servers, including address translation, caching, encryption, and virus filtering.

Authentication

Another aspect of security is the authentication of users and access control, which is commonly handled by RADIUS. RADIUS servers are designed to block unauthorized access by remote users. RADIUS provides authentication, authorization, and accounting, and it relies on Challenge Handshake Authentication Protocol (CHAP) to authenticate remote users, which means that there's a back-and-forth dialogue to verify a user's identity. In fact, RADIUS makes use of CHAP, which uses a three-way handshake to periodically verify the identity of the peer throughout the connection. The server sends a random token to the remote workstation. The token is then encrypted, by using the user's password, and sent back to the server. The server performs a lookup to see whether it recognizes the password. If the values match, the authentication is acknowledged; if the values do not match, the connection is terminated. Because a different token is provided each time a remote user dials in, CHAP provides robust authentication.

Encryption

The best way to protect electronic data is to use encryption that is, to encode data so as to render a document unreadable by all except those who are authorized to have access to it. The content of an original document is referred to as plain text. When encryption is applied to the document, the plain text is scrambled, through the use of an algorithm and a variable or a key; the result is called ciphertext. The key is a randomly selected string of numbers. Generally, the longer the string, the stronger the security.

There are two major categories of encryption algorithms: symmetric and asymmetric (also called public key encryption).

Symmetric Encryption

In symmetric encryption, the sender and the receiver use the same key or machine setup. There are two approaches to encoding data using symmetric encryption: block cipher and streaming cipher. With the block cipher approach, the algorithm encodes text in fixed-bit blocks, using a key whose length is also fixed in length. With the streaming cipher approach, the algorithm encodes the stream of data sequentially, without segmenting it into blocks. Both of these techniques require a secure method of reexchanging keys between the participants.

Symmetric encryption algorithms include the following:

         Data Encryption Standard (DES) DES was developed in the 1970s and is very popular in the banking industry. It is a block cipher that encodes text into fixed-bit blocks, using a 56-bit key. DES is being replaced by the Advanced Encryption Standard (AES).

         Triple DES (3DES) 3DES is 168-bit encryption that uses three 56-bit keys. 3DES applies the DES algorithm to a plain text block three times.

         Rivest Cipher 4 (RC4) RC4 is a streaming cipher technique; a stream cipher adds the output of a pseudorandom number generator bit by bit to the sequential bits of the digitized plain text.

         Blowfish Blowfish is a 64-bit block code that has key lengths of 32 bits to 448 bits. Blowfish is used in more than 100 products, and it is viewed as one of the best available algorithms.

         International Data Encryption Algorithm (IDEA) IDEA, developed by ETH Zurich, is free of charge for noncommercial use. It is viewed as a good algorithm and is used in Pretty Good Privacy (PGP) and in Speak Freely, a program that allows encrypted digitized voice to be sent over the Internet.

         Twofish Twofish, developed by Bruce Schneier of Counterpane Internet Security, is very strong, and it was one of the five initial candidates for the AES.

According to the National Institute of Standards and Technology (NIST), it would take 149 trillion years to crack the U.S. government's AES, which uses the Rijndael algorithm and specifies three key lengths 128 bit, 192 bits, and 256 bits. In comparison, DES, which uses a 56-bit key, would take only a matter of hours using a powerful computer, but, of course, this is totally dependent on the speed of the hardware used for cracking the code; a typical desktop PC would require much more than a few hours to crack a 56-bit DES key.

Asymmetric Encryption

Key encryption requires a secure method for exchanging keys between participants. The solution to key distribution came, in 1975, with Diffie and Hellman's public key cryptography scheme. This permits the use of two keys, one of which can be openly published and still permit secure encrypted communications. This scheme later became known as asymmetric key cryptography.

Asymmetric cryptography can be used for authentication. After encrypting a signature by using a private key, anyone with access to the public key can verify that the signature belongs to the owner of the private key. As shown in Figure 11.10, the following are the steps in public key encryption:

1.       User A hashes the plain text.

2.       User A encrypts that hash value with a private key.

3.       User A encrypts the plain text with user B's public key.

4.       User B decodes the cipher text with the private key.

5.       User B decodes the hash value, using User A's public key, thereby confirming the sender's authenticity.

6.       User B compares the decrypted hash value with a hash value calculated locally on the just-encrypted plain text, thereby confirming the message's integrity.

Figure 11.10. Encryption and authentication

Public key management involves the exchange of secrets that both ends use to produce random short-term session keys for authenticating each other. It is a method of encrypting data by using two separate keys or codes. The sender uses a public key that is generally provided as part of a certificate issued by a CA to scramble data for transmission. The receiver then uses a unique private key to decrypt the data upon receipt. The CA is an entity that, like a bank, is government regulated. It issues certificates that contain data about individuals or enterprises that has been verified to be authentic. In essence, the CA vouches for the authenticity of other parties so that their communications are secured.

Message authentication verifies the integrity of an electronic message and also verifies that an electronic message was sent by a particular entity. Before an outgoing message is encrypted, a cryptographic hash function which is like an elaborate version of a checksum is performed on it. The hash function compresses the bits of the plain-text message into a fixed-size digest, or hash value, of 128 or more bits. It is then extremely difficult to alter the plain-text message without altering the hash value.

Message authentication mechanisms include Message Digest-5 (MD5) and Secure Hash Algorithm-1 (SHA-1). MD5 hashes a file of arbitrary lengths into 128-bit value. SHA-1 hashes a file of arbitrary length into 160-bit value; it is more processor intensive but it renders higher security.

Public key management provides a secure method for obtaining a person's or an organization's public key, with sufficient assurance that the key is correct. There are three main public key algorithms: RSA (named for its creators, Rivest, Shamir, and Adelman), Diffie-Hellman, and PGP. RSA is 22 years old, and its security derives from the difficulty of factoring large prime integers. Diffie-Hellman is used mostly for exchanging keys; its security rests on the difficulty of computing discrete algorithms in a finite field, generated by a large prime number. PGP, which is a commercial product sold by Network Associates, was created in 1991. It is one of the most popular public key exchange (PKE) schemes.

Without a functioning universal public key infrastructure, we cannot reliably and easily acquire certificates that contain public keys for persons or organizations we want to communicate with. Standards are emerging, including Public Key Infrastructure (PKI), IETF Public Key Infrastructure X.509 (PKIX), Simple PKI (SPKI), and Public-Key Cryptography Standards (PKCS).

PKI is a system that provides protocols and services for managing public keys in an intranet or an Internet environment it involves distributing keys in a secure way. PKI secures e-business applications such as private e-mail, purchase orders, and workflow automation. It uses digital certificates and digital signatures to authenticate and encrypt messages and a CA to handle the verification process. It permits the creation of legally verifiable identification objects, and it also dictates an encryption technique to protect data transmitted over the Internet. Trusted PKI suppliers include Entrust and VeriSign. PKI technology is now moving from pilot testing into the real world of e-commerce. Web browsers such as Microsoft Internet Explorer and Netscape Navigator include rudimentary support for PKI by providing an interface into a computer's certificate store, and browsers often include the certificates for some top-level CAs, so that the users can know, incontrovertibly, that the roots are valid and trustworthy.

IKE is the key exchange protocol used by IPSec, in computers that need to negotiate security associations with one another. A security association is a connection between two systems, established for the purpose of securing the packets transmitted across the connection. It supports preshared keys, which is a simplified form of key exchange. It does not require digital certificates. Every node must be linked to every other node by a unique key, and the number of keys needed can grow out of control; for example, 2 devices need 1 key, and 8 devices need 28 keys. New versions of IKE generate new keys through a CA. Legal and political problems will most likely delay widescale use of IKE.

One of the biggest hurdles e-commerce companies face is confirming the identity of the parties involved. Ensuring identity requires an encrypted ID object that can be verified by a third party and accepted by a user's browser. Personal digital IDs contained in the user's browser accomplish this. Historically, these client certificates have been used to control access to resources on a business network, but they can also contain other user information, including identity discount level or customer type. Third parties (that is, CAs) guarantee these types of certificates. The user's browser reads the server certificate, and if it's accepted, the browser generates a symmetric session key, using the server's public key. The server then decrypts the symmetric key, which is then used to encrypt the rest of the transaction. The transaction is then signed, using the user's digital ID, verifying the user's identity and legally binding the user to the transaction.

Digital Certificates

Digital certificates, based on the ANSI X.509 specification, have become a de facto Internet standard for establishing a trusting relationship using technology. Digital certificates are a method for registering user identities with a third party, a CA (such as Entrust, UserTrust, or VeriSign). A digital certificate binds a user to an electronic signature that can be trusted like a written signature and includes authentication, access rights, and verification information. CAs prepare, issue, and manage the digital certificates, and they keep a directory database of user information, verify its accuracy and completeness, and issue the electronic certificates based on that information. A CA signs a certificate, verifying the integrity of the information in it.

By becoming their own digital CAs, service providers can package electronic security with offerings such as VPN and applications services. Vendors that provide the technology required to set up as a CA include Baltimore Technologies (in Ireland), Security Dynamics Technologies, and Xcert.

Server certificates ensure Internet buyers of the identity of the seller's Web site. They contain details about the Web site, such as the domain name of the site and who owns it. Third parties, such as Thawthe in South Africa, then guarantee this information. Sites with server certificates post the CA, and Internet browsers accept their certificates for secure transactions.

There are still many security developments to come and there is a bit of unsettlement in this area. Standards need to be defined and formalized before e-commerce will truly be able to function with the security that it mandates. For now, these are the types of mechanisms that are necessary to ensure that your data remains with you.