Internet Security Architectures and Protocols

Internet Security Architectures and Protocols (BMEVIHI9367)

General information

Level:	undergraduate (optional)
Volume:	14 weeks, 2 hours/week
Schedule:	12:15 - 14:00, every Friday, from 10 Feb 2003 to 16 May 2003
Room:	E.1.B
Lecturer:	Dr. Levente Buttyán assistant professor Laboratory of Cryptography and Systems Security (CrySyS) Department of Telecommunications Budapest University of Technology and Economics
Office hours:	14:00 - 15:00, every Thursday (until 20 June 2003), in I.E.419

Objective

The objective of the course is to introduce some of the known security problems related to the protocols and applications of the Internet, and to overview the contemporary solutions to these problems. The focus of the course is on architectures and protocols; cryptography will be introduced only to the extent that is necessary to understand the security protocols. Legal issues will be omitted.

Course outline

Preamble [ppt slides]

Introduction (vulnerabilities, examples for known attacks) [ppt slides]
Brief introduction to cryptography [ppt slides]
- cryptographic primitives (symmetric and asymmetric key ciphers, one-way hash functions, message authentication codes, digital signatures)
- key establishment protocols, public-key certification structures
E-mail security: PGP and S/MIME [ppt slides]
Secure remote access: SSH [ppt slides]
Web security: SSL/TLS [ppt slides]
Network layer security: IPSec, ISAKMP/Oakley [ppt slides]
E-commerce security: SET and other e-cash and micropayment schemes [ppt slides]
Privacy protection and anonymity services (Onion routing and Crowds) [ppt slides]
Java security [ppt slides]
Firewalls and intrusion detection systems [ppt slides]
Security in wireless ad hoc networks [intro, fc03, rex]

Evaluation

Evaluation of the students is based on their performance on the oral exam.

Schedule of the exams is as follows:
May 16, 12:15 - 14:00, E.1.B, max 7 persons
May 23, 09:00 - 12:00, IE.218, max 10 persons
May 30, 09:00 - 12:00, IE.218, max 10 persons
June 6, 09:00 - 12:00, IE.218, max 10 persons
June 13, 09:00 - 12:00, IE.218, max 10 persons
June 20, 09:00 - 12:00, IE.218, max 10 persons

Important! If you intend to come for the exam of May 16, then please notify me in e-mail and sign up for the exam of May 23 in the NEPTUN system.

Useful readings and background material

Books

W. Stallings, Cryptography and Network Security, third edition, Prentice Hall, 2003.
R. Oppliger, Internet and Intranet Security, second edition, Artech House, 2002.
A. Rubin, D. Geer and M. Ranum, Web Security Sourcebook, Wiley, 1997.
W. Cheswick and S. Bellovin, Firewalls and Internet Security, Addison-Wesley, 1994.
M. Pistoia et al., Java 2 Network Security, second edition, Prentice Hall, 1999.

Web sites

CERT web site: http://www.cert.org/
Internet RFCs on-line: http://www.faqs.org/rfcs/
PGP web site: http://www.pgpi.org/
S/MIME charter: http://www.ietf.org/html.charters/smime-charter.html
RSA Inc., S/MIME central: http://www.rsasecurity.com/standards/smime/
RSA Inc., Public-Key Cryptography Standards: http://www.rsasecurity.com/rsalabs/pkcs/
SSH charter: http://www.ietf.org/html.charters/secsh-charter.html
OpenSSH: http://www.openssh.com/
SSL v3 specification: http://wp.netscape.com/eng/ssl3/index.html
TLS charter: http://www.ietf.org/html.charters/tls-charter.html
DNS security: http://www.dnssec.net/
SET specifications: http://www.setco.org/set_specifications.html
IPSec charter: http://www.ietf.org/html.charters/ipsec-charter.html
L2TP Extensions charter: http://www.ietf.org/html.charters/l2tpext-charter.html
Onion routing: http://www.onion-router.net/
Crowds: http://www.research.att.com/projects/crowds/
IEEE 802.11 security: http://www.drizzle.com/~aboba/IEEE/
Firewalls: http://www.cerias.purdue.edu/coast/firewalls/
Intrusion detection: http://www.cerias.purdue.edu/coast/intrusion-detection/welcome.html

Research papers

S. Bellovin, Security Problems in the TCP/IP Protocol Suite, In Computer Communications Review, 19(2), 1989. *
R. Rivest and A. Shamir, PayWord and MicroMint -- Two Simple Micropayment Schemes, In Proceedings of 1996 International Workshop on Security Protocols, ed. Mark Lomas, Springer, 1997, Lecture Notes in Computer Science No. 1189, pages 69--87. *
S. Micali and R. Rivest, Micropayments Revisited, In Proceedings of the Cryptographer's Track at the RSA Conference 2002, Bart Preneel (ed.), Springer Verlag CT-RSA 2002, LNCS 2271, pages 149--163. *
M. Reed, P. Syverson, and D. Goldschlag, Anonymous Connections and Onion Routing, In IEEE Journal on Selected Areas in Communication, Special Issue on Copyright and Privacy Protection, 1998. *
P. Syverson, G. Tsudik, M. Reed and C. Landwehr, Towards an Analysis of Onion Routing Security, Workshop on Design Issues in Anonymity and Unobservability, Berkeley, CA, July 2000. *
M. Reiter and A. Rubin, Crowds: Anonymity for web transactions, In ACM Transactions on Information and System Security, 1(1):66-92, November 1998. *
L. Buttyan and J.-P. Hubaux (eds.), Report on a Working Session on Security in Wireless Ad Hoc Networks, In ACM Mobile Computing and Communications Review, 7(1), March 2003. *
M. Jakobsson, J.-P. Hubaux, and L. Buttyan, A Micropayment Scheme Encouraging Collaboration in Multi-Hop Cellular Networks, In Proceedings of the 7th Financial Cryptography Conference, January 2003. *
L. Buttyan, J.-P. Hubaux, and S. Capkun, A Formal Model of Rational Exchange and its Application to the Analysis of Syverson's Protocol, to appear in Journal on Computer Security, special issue on selected papers from CSFW15, 2003. *

For further information on the course, please, write to buttyan (at) hit.bme.hu