CS 285 Network Security Computer Network Review

1
CS 285 Network SecurityComputer Network Review

• Fall 2008

2
The goal of this lecture

• Suppose you want to build a computer network.
• What technologies would serve as the underlying
  building blocks
• what kind of software architecture would you
  design to integrate these building blocks into an
  effective communication service
• what would be the weaknesses in the design that
  may be exploited by attackers

3
Direct Link Network

• Point-to-point network
• Encoding
• Framing
• Error detection

4
Point-to-Point Network

• Encoding
• Turn binary data into the signals that the links
  are able to carry, and then to transform the
  signal back into the corresponding binary data at
  the receiving node.

5
Point-to-Point Network

• Error Detection
• Bit errors can be introduced into frames due to
  electrical interference or thermal noise.
• Error detection detects transmission errors.

6
Multiple Access Network

• Media Access Control Protocol
• When the link is shared by multiple hosts, their
  accesses to the link need mediation.
• Ethernet -- CSMA/CD (Carrier Sense Multiple
  Access / Collision Detection)
• Participating hosts monitor the traffic on the
  link.
• If no transmission, the host can transmit.
• If two hosts attempt to transmit simultaneously,
  this causes a collision, which is detected by all
  participating hosts.
• After a random time interval, the hosts that
  collided attempt to transmit again.
• If another collision occurs, the time intervals
  from which the random waiting time is selected
  are increased step by step. (exponential back
  off)

7
Where the functions are implemented?

• Network adaptor
• encoding, framing, error detection, and media
  access control.
• MAC Address
• In Ethernet, each adaptor has a unique Ethernet
  address, which is also the MAC address of the
  corresponding host.

8
Where the functions are implemented?

• Packet reception
• Each frame transmitted on an Ethernet is received
  by every adaptor connected to that Ethernet.
• Each adaptor recognizes those frames addressed to
  its own address, and passes only those frames to
  the host.
• An adaptor can also be programmed to run in
  promiscuous mode, in which case it delivers all
  received frames to the host.

9
Where does the security issue come from?

• Frequency jamming
• Eavesdropping (e.g., packet sniffing)
• MAC address spoofing
• Etc.

10
From Direct Link Network To InterNetworking
11
InterNetworking

• Issues
• Heterogeneity
• internetwork connects networks with different
  technologies
• Scale
• the Internet doubled in size each year for 20
  years.
• Solution
• Internet Protocol (IP) is the key tool to build
  scalable, heterogeneous internetworks.
• Functions
• Addressing
• Fragmentation and Reassembly
• Routing and Forwarding

12
Addressing

• Addressing
• providing suitable identifiers for all these
  hosts in internetworks.
• Hierarchical addresses
• a network part a host part.
• Address classes
• flexibility, allowing networks of vastly
  different sizes to be accommodated fairly
  efficiently.

13
Fragmentation and Reassembly

• Problem
• Each network technology has its own definition of
  packet size.
• Solution
• packets can be fragmented and reassembled when
  they are too big to cover a given network.
• Each IP datagram is re-encapsulated for each
  physical network over which it travels.

14
Routing and Forwarding

• Forwarding

15
Routing and Forwarding

• Routing
• Distance vector
• Link state

16
Internet Routing

• Internet is organized into autonomous systems
• provide hierarchically aggregate routing
  information in a large internetwork to improve
  scalability.
• intra-domain routing within a single autonomous
  system
• RIP and OSPF are used for intra-domain routing
• inter-domain routing between autonomous systems.
• BGP (Border Gateway Protocol) is the routing
  protocol used in Internet for inter-domain
  routing.

17
More Security Issues

• IP spoofing
• Authentication of routing messages
• Etc

18
End-to-End Protocols

• Problem
• turn this host-to-host packet delivery service
  into a communication channel between application
  processes.
• End-to-end protocols of Internet
• UDP and TCP

19
Network Architecture