数据通讯与计算机网络讲义 32章.ppt

Chapter 32 Security in the Internet:IPSec, SSL/TLS, PGP,VPN, and Firewalls 三类安全协议的报文结构 (IPSec，TLS，PGP) IPSecurity (IPSec) is a collection of protocols designed by the Internet Engineering Task Force (IETF) to provide security for a packet at the network level. 32.1 IPSecurity (IPSec ) 对原IP包进行“修改”，以提供认证或机密 Transport mode tunnel modes Two modes of IPSec Transport mode IPSec in the transport mode does not protect the IP header; it only protects the information coming from the transport layer. Tunnel mode IPSec in tunnel mode protects the original IP header. Authentication Header (AH) Protocol ( in transport mode ) The AH Protocol provides source authentication and data integrity, but not privacy. Encapsulating Security Payload (ESP) Protocol ( in transport mode ) ESP provides source authentication, data integrity, and privacy. AH versus ESP Security associations A set of security parameters can be established between the sender and the receiver at first. Using security association, IPSec changes a connection-less IP to a connection-oriented protocol. Simple security associations 1. SADB 2. SPI 3. Sa的建立过程：IKE协议 Addresses for private networks VPN (virtual private network) Intranet—— 采用因特网协议族的内部网 Extranet—— 可让外部用户受控访问的内部网 Addressing Hybrid network Private network Achieving privacy Virtual private network Physically public, Logically private VPN technology VPN uses IPSec in the tunnel mode (authentication, integrity, privacy) 32.2 Transport Layer Security Position of TLS 主要用于B/S的客户端 (browser)实现: server’s authentication message’s integrity message’s privacy Server’s authentication; Secret key delivery; Encryption of data/digest Two protocols in TLS Data exchange protocol (用kClient 加密data或digest) Handshake protocol SKCA PKServer PKServer KClient KClient 含若干参数 (加密、认证算法选择等) KClient 32.3 PGP Position of PGP in the TCP/IP protocol suite PGP: Pretty Good Pri