Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COSC362 > Lecture 19: IPSec and VPN > Flashcards

Lecture 19: IPSec and VPN Flashcards

1
Q

What is IPsec a framework for?

A

ensuring secure communications over IP (internet protocol) networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does IPsec stand for?

A

IP security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does IPsec provide?

A

Security services similar as TLS, but at a lower layer in the communications protocol stack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the security in the application layer in the TCP/IP stack?

A

SSH, S-MIME, PGP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the security in the transport layer in the TCP/IP stack?

A

SSL, TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the security in the network layer in the TCP/IP stack?

A

IPsec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the security in the data-link layer in the TCP/IP stack?

A

WEP, WPA, WPA2, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Give the diagram for cryptography in the TCP/IP stack

A

See slide 5 in set 19

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does IP layer security provide?

A

protection for any higher layer protocol, including arbitrary TCP and UDP sessions

commonly used to provide virtual private networks (VPNs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the IP layer security use?

A

encryption
authentication
key management algorithms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 5 security services that the IP layer security has?

A

1) message confidentiality
2) message integrity
3) limited traffic analysis protection
4) message replay protection
5) peer authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the security service of message confidentiality i.t.o IP layer security?

A

Protecting against unauthorized data disclosure

–> By using encryption mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the security service of message integrity i.t.o IP layer security?

A

Determining if data has been changed(either intentionally or unintentionally)
–> By using message authentication codes (MACs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the security service of limited traffic analysis protection i.t.o IP layer security?

A

Possibly difficult to know which parties are communicating, how often, or how much data is being sent when monitoring network traffic

–> By concealing IP datagram details such as source and destination addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the security service of message replay protection i.t.o IP layer security?

A

Data not delivered multiple times, and not delivered badly out of order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the security service of peer authentication i.t.o IP layer security?

A

Ensuring network traffic to be sent from the expected host

–> Each IPsec endpoint confirms its identity of the other IPsec endpoint with which it wishes to communicate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does gateway-to-gateway security provide?

A

secure communications between 2 networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where is network traffic routed through in gateway-to-gateway architecture?

A

through IPsec connection, protecting it appropriately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Where does gataway-to-gateway architecture protect data?

IMPORTANT

A

only between 2 gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When is gateway-to-gateway architecture used?

A

Often used when connecting 2 secured networks

e.g. Linking a branch office to headquarters over the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Is gateway-to-gateway architecture more or less costly than private wide area network (WAN) circuits?

A

less costly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is host-to-gateway architecture commonly used to provide?

A

secure remote access

–> e.g. organization deploys a VPN gateway onto its network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does each remote access user establish and between what in a host-to-gateway architecture

A

Each remote access user establishes a VPN connection between the local computer (host) and the gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In a host-to-gateway architecture, what are the two options for a VPN gateway to be?

A

1) dedicated device

2) part of another network device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

When is a host-to-gateway architecture often used?

A

when connecting hosts on unsecured networks to resources on secured networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is host-to-host architecture typically used for?

A

special purpose needs

e.g. System administrators performing remote management of a single server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

In a host-to-host architecture, where does it provide data protection?

IMPORTANT

A

throughout its transit(end-to-end)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Is a host-to-host architecture resource-intensive to implement and maintain in terms of user and host management?

A

yes!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What do all user systems and servers participating in VPNS in a host-to-host architecture need to have?

A

VPN software installed and/or configured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Comment on host-to-host architectures key management process

A

through a manual process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the 3 types of IP layer security protocols?

A

1) ESP
2) AH
3) IKE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does ESP stand for i.t.o IP layer security protocols?

A

Encapsulating security payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does AH stand for i.t.o IP layer security protocols?

A

Authentication header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What does IKE stand for i.t.o IP layer security protocols?

A

Internet key exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What does the EPS protocol provide?

A

Providing confidentiality, authentication, integrity and replay protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What does the AH protocol provide?

A

Providing authentication, integrity and replay protection, but NOT confidentiality

–> IAH is now deprecated.

37
Q

What does the IKE protocol provide?

A

Negotiating, creating and managing session keys insecurity associations (SAs)

38
Q

What protocol is used in the IPsec connection setup?

A

IKEv2 protocol

39
Q

What protocol does the IKEv2 protocol in the IPsec connection setup and how is it authenticated?

A

a Diffie-Hellman protocol authenticated using signatures with public keys in X.509 certificates

40
Q

Why does IPsec connection setup include cookies?

A

to mitigate denial-of-service (DoS) attacks

–> Providing Proof of Reachability before any expensive cryptographic processing is completed

41
Q

What is a mechanism to mitigate the DoS attack called?

A

stateless cookie

42
Q

Explain how the mechanism of a stateless cookie is used

A

the initial request is responded with a calculated stateless cookie
–> a value that can be re-calculated based on values in the initial request without storing responder-side state

The initial request is then expected to repeat, this time including the stateless cookie

43
Q

Which standard is the mechanism of stateless cookie in?

A

RFC 7296 Section 2.6

44
Q

RFC 7296 Section 2.6 contained the mechanism of stateless cookie.

What did RFC 7296 Section 3 add?

A

Proof of Work
–> by calculating a pre-image for a partial hash value

Setting an upper bound determined by the attacker’s CPU to the number of negotiations it can initiate in a unit of time

45
Q

What does proof of work involved?

A

calculating a pre-image for a partial hash value

46
Q

What do security associations contain?

A

1) info needed by an IPsec endpoint to support an IPsec connection
2) possibly cryptographic keys and algorithms, key lifetimes, security parameter index (SPI), security protocol identifier (ESP and/or AH)
3) SPI included in IPsec header to associate a packet with the appropriate SA

47
Q

What do security associations tell the endpoint?

A

how to process inbound IPsec packets and/or how to generate outbound packets

48
Q

Are security associations unidirectional?

A

yes

49
Q

What does it mean for security associations to be unidirectional?

A

one SA for each direction of connection

50
Q

What must IKEv2 established?

A

keys used in SAs

51
Q

What does SA stand for?

A

security association

52
Q

What are cryptographic suites similar to? Explain

A

TLS cipher suites

–> Several standardised cryptographic suites, incorporating both public key and symmetric key algorithms

53
Q

What are special groups of cryptographic suites available for?

A

Diffie-Hellman (in finite fields and on elliptic curves)

54
Q

In cryptographic suits, what are used for encryption? In which modes?

A

3DES and AES

either in CBC or GCM mode

55
Q

In cryptographic suits, what are used for integrity?

A

HMAC or CMAC (variant) used for integrity if GCM mode is not used

56
Q

What are the two modes that each protocol (either ESH or AH) operate in?

A

transport or tunnel mode

57
Q

Outline the transport mode of operation

A

Maintaining IP header of the original packet and protecting the payload
–> Generally used in host-to-host architectures

58
Q

Outline the tunnel mode of operation

A

Encapsulating the original packet into a new one, and letting the payload be the original packet

–> Generally used in gateway-to-gateway and host-to-gateway architectures

59
Q

Give and explain the diagram for transport mode

A

See slide 18 in set 19

60
Q

Give and explain the diagrams for tunnel mode

A

See slide 18 in set 19

61
Q

Explain the server to client example (gateway to host)

A

See slide 19 in set 19

62
Q

What does the ESP header contain?

A

SPI identifying the SA and sequence numbers

63
Q

What does the EPS trailer contain?

A

padding and its length, and possibly including extra padding to enhance traffic flow confidentiality

64
Q

What does the ESP auth contain?

A

MAC of the encrypted data and ESP header

–> Possibly not required if an authenticated encryption mode is used

65
Q

Give the diagram of the original IP packet i.t.o the transport mode with ESP

A

See slide 21 in set 19

66
Q

Give the diagram of the original IP packet protected by transport mode ESP i.t.o the transport mode with ESP

A

See slide 21 in set 19

67
Q

In terms of outbounding packet processing for transport mode ESP, what is the data after the original IP header padded by?

A

adding an ESP trailer

68
Q

In terms of outbounding packet processing for transport mode ESP, what is the data after the original IP encrypted using?

A

symmetric cipher and key agreed in the SA

69
Q

In terms of outbounding packet processing for transport mode ESP, where is the ESP header?

A

prepended to data after the original IP header

70
Q

In terms of outbounding packet processing for transport mode ESP, if SA uses the authentication service, what is calculated and appended?

A

ESP MAC calculated over the data prepared so far and appended

71
Q

In terms of outbounding packet processing for transport mode ESP, the original IP header prepended BUT some fields must be changed.

What are these?

A

1) Protocol field changed from TCP to ESP
2) Total length field changed to reflect the addition of ESP header
3) Checksums recalculated

72
Q

Give the diagram of the original IP packet protected by tunnel mode ESP i.t.o the tunnel mode with ESP

A

See slide 23 in set 19

73
Q

In terms of outbounding packet processing for tunnel mode ESP, what is done to the entire original packet?

A

1) padded by adding EPS trailer

2) encrypted using symmetric cipher and key agreed in the SA

74
Q

In terms of outbounding packet processing for tunnel mode ESP, where is the header?

A

EPS header prepended to entire original packet

75
Q

In terms of outbounding packet processing for tunnel mode ESP, if SA uses the authentication service, what is calculated and appended?

A

ESP MAC calculated over the data prepared so far and appended

76
Q

In terms of outbounding packet processing for tunnel mode ESP, what is the new outer IP header that is prepended?

A

1) Inner IP header of original IP packet carrying the ultimate source and destination addresses
2) Outer IP header may contain distinct IP addresses (e.g. addresses of security gateways)
3) Outer IP header protocol field set to ESP

77
Q

Comment on the active attacks that exist for encryption-only mode of EPS protocol i.t.o IP layer security

A

Providing encryption without integrity is known to be insecure

Unlike earlier IPsec versions, the 2005 version does not require implementations to support encryption-only modes, but still allows it

78
Q

Comment on attacks due to MAC-then-encrypt configurations i.t.o modes used in IP layer security

A

AH applies encryption after MAC (MAC-then-encrypt)

ESP applies encryption before MAC (encrypt-then-MAC)

79
Q

What doe VPNs provide?

A

a secure distributed network

80
Q

What doe VPNs create?

A

secure channels over the insecure Internet

81
Q

What are the three types of VPNs?

A

1) Branch office interconnect (Intranet VPN)
2) Supplier/business partner access (Extranet VPN)
3) Remote access

82
Q

Explain the VPN diagram on slide 27 in set 19

A

See slide 27 in set 19

83
Q

In terms of the branch office interconnect type of VPN, how is a VPN established and between what?

A

Establishing a VPN tunnel between router/firewall 1 and router/firewall 2

–> Using AH to authenticate data from tunnel endpoints(routers/firewalls)

–> Using ESP to encrypt data over the Internet

84
Q

In terms of the branch office interconnect type of VPN, what are the only things that need to support IPsec?

A

routers/firewalls

–> no change to Intranet resoures

85
Q

Give the diagram for the branch office interconnect type of VNP

A

See slide 28 in set 19

86
Q

In terms of the supplier network type of VPN, comment on the supplier

A

supplier may not be part of the entreprise

–> VPN extended to operate between router/firewall 1 and individual parts of supplier network

87
Q

Give the diagram for the supplier network type of VNP

A

See slide 29 in set 19

88
Q

In terms of remote access type of VPN, what can ISPs provide?

A

ISPs can provide VPN services across the untrusted Internet

89
Q

Give the diagram for the remove access type of VNP

A

See slide 30 in set 19

COSC362 (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions