Trusted Intermediaries

Transcript

1 Sicurezza

2 Trusted Intermediaries Symmetric key problem: How do two entities establish shared secret key over network? Solution: trusted key distribution center (KDC) acting as intermediary between entities Public key problem: When Alice obtains Bob s public key (from web site, , diskette), how does she know it is Bob s public key, not Trudy s? Solution: trusted certification authority (CA)

3 Key Distribution Center (KDC) Alice, Bob need shared symmetric key. KDC: server shares different secret key with each registered user (many users) Alice, Bob know own symmetric keys, K A-KDC K B-KDC, for communicating with KDC. KDC K B-KDC K K P-KDC A-KDC K X-KDC K Y-KDC K Z-KDC K A-KDC K B-KDC

4 Key Distribution Center (KDC) Q: How does KDC allow Bob, Alice to determine shared symmetric secret key to communicate with each other? KDC generates R1 Alice knows R1 Bob knows to use R1 to communicate with Alice Alice and Bob communicate: using R1 as session key for shared symmetric encryption

5 Certification Authorities binds public key to particular entity, E. E (person, router) registers its public key with CA. E provides proof of identity to CA. CA creates certificate binding E to its public key. certificate containing E s public key digitally signed by CA CA says this is E s public key Bob s public key K + B Bob s identifying information digital signature (encrypt) CA - private key K CA K B + certificate for Bob s public key, signed by CA

6 Un certificato contiene...

7 Un mio certificato

8 Certification Authorities When Alice wants Bob s public key: gets Bob s certificate (Bob or elsewhere). apply CA s public key to Bob s certificate, get Bob s public key K B + digital signature (decrypt) K B + Bob s public key CA public key K + CA

9 Osservazione I due modelli sono equivalenti? Cosa succede nel caso di mancanza del servizio di KDC o CA? Quale è la loro scalabilità?

10 Web of Trust invece di avere compagnie alla base delle catene cluster indipendenti di persone tipo club in cui si entra se presentati da qualcuno che garantisce per te ma meno esclusivi

11 Altri servizi per le ? conferma di ricezione conferma di lettura ripensamento e ritiro autodistruzione divieti di stampa, salvataggio consegna ritardata timestamp certificato

12 Password manager Locali Disco remoto PM remoto Ricreazione al momento

13 HTTPS (SSL)

14 Firewall Serve a gestire la sicurezza riguardo una rete Si pone come guardiano sull unico punto di accesso ed controlla tutti i pacchetti in transito Siccome tutto il traffico transita dal firewall questo diventa un collo di bottiglia per la rete L obiettivo è quello di lasciare fuori i cattivi

15

16 Dual homed firewall intranet extranet

17 Bastion host

18 Packet Filtering Example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23. All incoming and outgoing UDP flows and telnet connections are blocked. Example 2: Block inbound TCP segments with ACK=0. Prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside. IP spoofing: router can t know if data really comes from claimed source

19 Gateways (Application level firewall) Analizzano i pacchetti a livello applicativo Possono forzare politiche basate ad esempio su identificazione utenti Client software devono sapere che devono contattare l intermediario. server Proxy...