Bài giảng An toàn đường truyền

Bài giảng "An toàn đường truyền" có nội dung trình bày tổng quan về IP security, cách bảo mật IP, chế độ ESP, thiết lập IPsec trong Linux, . Hy vọng thông qua bài giảng này, các bạn sẽ nắm vững nội dung bài học và ứng dụng vào thực tế thật tốt. Mời các bạn cùng tham khảo. | AN TOÀN TRÊN ĐƯỜNG TRUYỀN 1 TÀI LIỆU THAM KHẢO Andrew Lockhart Network Security Hacks 2ed Eric Cole Network Security Fundamentals Daniel J. Barrett Richard E. Silverman SSH the Secure Shell The Definitive Guide 2 CONTENTS IP SECURITY IPsec SSH SSL amp TLS VPN 3 IP security Overview 1 3 IPsec is a security protocol that operates at the Internet layer of the TCP IP protocol stack. IPsec is optional with IPv4 and is not implemented by all operating systems. IPsec is required by the IPv6 specification. 4 IP security Overview 2 3 IPsec can be used to secure traffic on a LAN or on a VPN. IPsec can be configured to offer the following Confidentiality Authentication Data integrity Packet filtering Protection against data reply attacks IPsec can be configured to use multiple security algorithm options. An administrator can decide which security algorithm to use for an application based on security requirements. 5 IP security Overview 3 3 IPsec architecture is described in RFC 2401. IPsec includes two major security mechanisms Authentication Header AH described in RFC 2402 andn Encapsulating Security Payload ESP covered in RFC 2406. 6 IP security Authentication Header AH protects the integrity and authenticity of IP packets but does not protect confidentiality. 7 IP security Encapsulating Security Payload ESP ESP can be used to provide confidentiality data origin authentication data integrity some replay protection and limited traffic flow confidentiality 8 ESP Modes 1 2 Transport mode the upper-layer protocol frame is IP header is not encrypted. Transport mode provides end-to-end protection of packets exchanged between two end hosts. Both nodes have to be IPsec aware 9 ESP Modes 2 2 Tunnel mode an entire datagram plus security fields are treated as a new payload of an outer IP datagram. The original inner IP datagram is encapsulated within the outer IP datagram This mode can be used when IPsec processing is performed at security gateways on behalf of end .