Intro

In this lesson, we look at secure communication channel protocols and authentication protocols. Communication channels, or the secure communication channels, are the tools, techniques, and procedures used to safely move data from one point to another: either over the network or between networks. I also described the protocols used for secure device and user authentication. You can download the script for this video from above or at the end of the video. The script contains the graphics used in the video.

Overview

We use a set of secure communications protocols to ensure the confidentiality and integrity of data in motion over TCP/IP connections. They include simple key management for IP, or SKIP, internet key exchange, or IKE, software IP encryption, swIPe, secure remote procedure calls, S-RPC, transport layer security, TLS, the replacement for SSL, and secure electronic transaction, or SET.

SKIP

SKIP was designed to protect sessionless IP datagram protocols designed to work with IPSec, or IP security. It was replaced by IKE, internet key exchange, in 1998.

IKE

Internet key exchange, IKEv1 or IKEv2, is used within IPSec to establish security associations. Security association is a security session... or a secure session, established between two entities. It uses X.509 certificates for authentication and Diffie Hellman to exchange a shared secret used to encrypt each session.

swIPe

swIPe was specified in 1993 as an experimental IP protocol. Unlike IKE, swIPe does not manage connection policies and key exchange; it only manages the secure session to provide confidential confidentiality and integrity via the encapsulation of traffic.

S-RPC

S-RPC is a secure implementation of RPC, remote procedure call. It enables secure authentication when one device attempts to connect to another. Authentication is accomplished using Diffie Hellman.

TLS

Transport layer security, TLS, is a replacement for the no longer secure SSL. It is commonly used to secure sessions over the internet. This graphic shows the TLS handshake. The handshake authenticates one or more of the participants and creates a shared key for session encryption. Characteristics of TLS include supporting secure client-server communications across networks with higher than acceptable risk. This includes public wired and wireless networks. One- or two-way authentication with digital certificates, and what is still known as SSL VPN, or SSL virtual private network. Today, SSL VPN should use TLS.

SET

SET, or secure electronic transaction protocol, is used to protect internet transactions. While not widely accepted by e-commerce entities, it is supported by major credit card companies, including Visa and MasterCard. It does this with Rivest-Shamir- Adleman encryption, or RSA, and data encryption standard, or DES.

IPSec

IPSec, or IP security, which has appeared earlier in this lesson, is commonly used for both VPN and internal network connections. It can protect traffic between devices and between networks. IPSec is an IETF standard suite of protocols that help enable encrypted, decrypted, and authenticated packets. Organizations can implement IPSec in one of two ways: encapsulating security protocol, or ESP, or authentication header, AH. ESP is implemented in one of two ways: transport or tunnel.

IPSec ESP

Both approaches include authentication. This graphic shows the encapsulating security protocol, ESP. Transport mode encrypts the data but does not encrypt the original IP addressing information. This protects the payload but still allows a threat actor to understand the movement of traffic. In tunnel mode, the original packet is enveloped with ESP data. In addition to still protecting the payload, tunnel mode also encrypts the addressing information.

IPSec AH

AH only provides authentication in one of two modes: transport and tunnel. In transport mode, the TCP header and payload are authenticated. In tunnel mode, AH also authenticates the original IP header. In either mode, no encryption is provided.

SSH

SSH, or secure shell, enables encrypted sessions between a client and a server. It provides strong passwords and public-key encryption. It also encrypts the resulting session. SSH is often used by administrators to connect remotely to servers and network devices. This was a quick look at secure channel protocols now let's move to some authentication protocols.

Authentication Protocols

The challenge handshake authentication protocol, or CHAP, is one of the authentication protocols used by the point-to-point protocol, PPP, to protect the remote authentication process. It encrypts user names and passwords using a challenge-response handshake. Instead of only relying on point-in-time authentication, CHAP establishes a communication session that periodically verifies the identity of the user. tThe password authentication protocol, PAP, transmits usernames and passwords without encryption. It only provides a means to exchange credentials. EAP, or extensible authentication protocol, is not really a protocol; it's an authentication framework that enables customized authentication solutions like tokens and biometrics. PEAP, protected extensible authentication protocol, encapsulates EAP with a secure tunnel. It is commonly used over wireless connections and can be used by WPA communications. And finally, LEAP is Cisco's implementation of EAP, lightweight extensible authentication protocol, that was used to secure WEP, which should never be used today for wireless security. LEAP is broken, and a variety of tools, techniques, and procedures exist for cracking it. That's it for this lesson. If you have questions, please ask. ...and until next time be careful what you click.