Computer Network Security Protocols And Techniques

Explain how plain text becomes cipher text using an encryption algorithm and key, and how decryption with a key and decryption algorithm recovers the original message.

Explore the two cryptography domains: symmetric key cryptography and public key cryptography, and learn how shared secret keys secure communication while public keys enable encryption with private keys for decryption.

Examine traditional ciphers, including transposition and substitution methods, and distinguish monoalphabetic from polyalphabetic ciphers, with position-based substitutions and grouped ciphertext using keys.

Explore the Caesar cipher, a monoalphabetic shift cipher, showing encryption by shifting letters down by a key and decryption by shifting up, with wraparound at the alphabet ends.

The transposition cipher reorders symbols with a key to create ciphertext, and the receiver reverses the permutation to recover plaintext. An example shows block processing with four-character blocks and padding.

Discover how modern ciphers operate on bits to secure text, audio, video, and graphics, by combining simple techniques like xor, rotation, substitution, and transposition.

Explore des and triple des, detailing 16 rounds, a 64-bit input, and 56-bit master key. See how triple des uses two or three 56-bit keys to strengthen security.

Explore the advanced encryption standard (AES), its 128-bit, 192-bit, and 256-bit keys, and the rounds that transform plaintext into ciphertext.

Explore the four block cipher modes—ECB, CBC, CFB, and OFB—and how they handle blocks, encryption, and decryption, including initialization vectors and error propagation.

Learn how RSA generates public and private keys, encrypts and decrypts messages, and why RSA secures key exchange for subsequent AES or triple DES encryption.

Demonstrates the Diffie-Hellman key exchange, where Alice and Bob derive a common symmetric key over a public network by exchanging calculated values from private exponents and public numbers.

Explain the Diffie-Hellman key exchange, where one third of the key is public, and its vulnerability to man-in-the-middle attacks, where an intruder intercepts keys with each party, necessitating endpoint authentication.

Explain how digital signatures protect message authenticity and integrity by signing with a private key and verifying with a public key, and use hash digests for efficiency.

Explore two widely used hash functions: md5, detailed in IETF RFC 1321 and producing a 128-bit digest in four steps, and sha-1, producing a 160-bit digest from 512-bit blocks.

Learn how a certification authority binds a public key to an identity, issues certificates, and enables recipients to verify authenticity and integrity of messages with CA-signed keys.

Explore endpoint authentication to prevent man-in-the-middle attacks, using nonce-based challenges, password and public-key approaches, and the role of digital certificates and certification authorities in secure online communication.

Secure email by encrypting the message with a session key, encrypting the session key with Bob's public key, and signing the message hash with Alice's private key.

Learn how Pretty Good Privacy secures email by encrypting a session key with the recipient’s public key, then encrypting the message and signing its digest with the sender’s private key.

Introduce transport layer security (TLS) as an upgraded security layer between the application and transport layers, widely used for web browsing and online banking to protect e-commerce transactions.

Explore TLS security services that enable authentication with digital signatures between Alice and the e-commerce site. Experience encryption, integrity protection, and replay attack prevention safeguarding communication from interception and tampering.

Discover the VLS protocol, an upgrade of SSL, focusing on the handshake with certificates, shared secret keys, encryption and integrity, and secure data transfer via records.

Simulate a tls handshake where Ellis and Bob exchange a verified certificate, derive a master secret from public-private keys, and derive four keys for encryption and authentication.

Alice sends data in records, each ending with a message authentication code. Bob verifies each frame on arrival, using a length header to separate data from the MAC.

Learn how sequence numbers protect data integrity by tying a message authentication code to a per-message counter, and how nonces during handshake create session-based keys to prevent replay attacks.

Explore how a truncation attack uses Fehn flag in the header to truncate data, and how including the type field with the sequence number in the MAC hash protects integrity.

Explore the ssl tls handshake where alice and bob exchange hello messages, nonces, and a digital certificate to derive a shared master secret and secure data transfer.

Explore why toy TLS is incomplete by highlighting unknown field lengths, encryption algorithms, and the message authentication code, and how Alice and Bob negotiate an encryption algorithm during the handshake.

Understand how TLS/SSL cipher suites combine a public key algorithm, an asymmetric exchange, and a hash to secure data with symmetric encryption. See how the handshake selects a supported cipher.

Explore the four tls protocols—handshake, change cyphers protocol, alert, and record—between the application and transport layers, to set security parameters, start secure data transfer, report errors, and carry application data.

Explore the tls handshake: negotiate security capabilities, perform server authentication and key exchange, and optionally client authentication, then derive the master secret and encryption and mac keys.

TLS record protocol fragments data into records, then compresses, applies a message authentication code, and encrypts each record before attaching a header that includes content type, version, and length.

The tls handshake describes client hello with cipher list, server hello with chosen cipher and certificate, client key exchange, key generation, finished MAC, then change cipher spec and encrypted transfer.

Explore how virtual private networks enable secure, encrypted communication over the public internet, linking offices and mobile users via VPN tunnels without costly private networks.

Demonstrates how IPsec secures VPN tunnels by protecting network-layer traffic for IPv4 and IPv6, using encryption and integrity to create IPsec packets between headquarters and branch offices.

Explore the IPsec security services, including access control, data origin authentication, integrity protection, replay detection, and confidentiality through encryption.

The IPsec framework secures networks by providing authentication, integrity, and encryption, enabling shared secret key exchange via Diffie-Hellman, using hash-based message authentication, and optionally combining authentication header with encryption.

IPsec uses security associations to establish unidirectional connections; bidirectional transfers require two SAs, each defined by SPI and destination address and secured by encryption, integrity, and authentication keys.

Examine how bidirectional ipsec security associations are established using internet key exchange versions 1 and 2, including phase one, phase two, and the keep-alive mechanism.

Negotiate IKE phase 1 security association parameters—authentication, encryption, integrity, and lifetime—then perform Diffie-Hellman to derive a shared key and authenticate, establishing a management tunnel and an IPsec data tunnel.

Explore IKE phase two negotiations for an IPsec tunnel, including ESP selection, mode (tunnel versus transport), encryption and integrity algorithms, and tunnel lifetime, culminating in secured data transfer.

Compare authentication header (AH) and encapsulating security payload (ESP) modes in IPsec, highlighting AH's integrity protection without encryption and ESP's combined encryption, integrity, and optional packet encapsulation.

Compare transport mode and tunnel mode, showing how IP packet is encapsulated with IP header in transport mode, versus tunnel mode encrypts and wraps it with a new IP header.

Authenticate header (AH) provides integrity protection without encryption, usable in transport or tunnel mode. It hashes the packet and stores a digital signature in AH for verification, excluding TTL changes.

Encapsulating security payload (ESP) provides integrity and encryption for IP traffic in transport or tunnel mode, encrypting the payload and, in tunnel mode, the entire IP packet including IP header.

The lecture outlines the four IPsec modes—transport and tunnel, each with authentication header or encapsulating security payload—and notes that tunnel mode with encapsulating security payload is the most commonly used.

A firewall combines hardware and software to isolate a private data network from the public internet, enforcing the local security policy and remaining immune to penetration.

Firewalls prevent denial of service by filtering bogus TCP connections that overwhelm a web server, and enforce rules so only authorized users and traffic access the network.

Inspect stateless packet filtering firewalls at the access router, blocking or allowing packets. Block ICMP traceroute and unwanted TCP connections to protect private networks.

Implement firewall rules from the network security policy to filter packets, block web browsing and DNS, and drop ICMP and broadcast traffic to deter traceroute and smart DoS.

Explain how a firewall uses access control lists to implement stateless packet filtering, permitting internal hosts to reach external networks via tcp/80 and dns/53, while blocking other traffic.

Relying on stateless packet filtering yields less accurate decisions per packet, allowing spoofed or unsolicited packets to pass and potentially enabling denial-of-service attacks against private network servers.

Track the status of every active ESP connection with a stateful packet filter, check packets against these connections, drop mismatches, and delete idle connections after inactivity.

Implement stateful packet filtering inside the access control list by checking incoming ESP and UDP traffic against an active connection table to allow or drop packets.

Explore application gateway firewalls that operate at the application layer, relaying telnet sessions after user authentication and filtering non-gateway traffic.