Network Security and Cryptography E-Book

Sarhan M. Musa

• Herausgeber: Packt Publishing
• Kategorie: Fachliteratur
• Sprache: Englisch

Seitenzahl: 652

Veröffentlichungsjahr: 2024

Beschreibung

This new edition introduces fundamental concepts in computer networks, blockchain, cryptography, and network security. It covers classical cipher schemes, public key cryptography, authentication schemes, and Internet security, featuring new material on IoT, cloud computing, SCADA, blockchain, smart grid, big data analytics, and AI security.
Starting with computer network basics and mathematical foundations, it then explores classical and modern cipher schemes, public-key cryptography, and authentication methods. Later chapters address Internet and system security, and emerging technologies.
Intended as a textbook for computer science and electronics courses, it also serves as a comprehensive reference for professionals. Its structured approach ensures a thorough understanding of both foundational and advanced topics, making it essential for mastering cryptography and network security.

Leseprobe

NETWORK SECURITYAND CRYPTOGRAPHY

LICENSE, DISCLAIMER OF LIABILITY, AND LIMITED WARRANTY

By purchasing or using this book and its companion files (the “Work”), you agree that this license grants permission to use the contents contained herein, but does not give you the right of ownership to any of the textual content in the book or ownership to any of the information, files, or products contained in it. This license does not permit uploading of the Work onto the Internet or on a network (of any kind) without the written consent of the Publisher. Duplication or dissemination of any text, code, simulations, images, etc. contained herein is limited to and subject to licensing terms for the respective products, and permission must be obtained from the Publisher or the owner of the content, etc., in order to reproduce or network any portion of the textual material (in any media) that is contained in the Work.

MERCURY LEARNING AND INFORMATION (“MLI” or “the Publisher”) and anyone involved in the creation, writing, production, accompanying algorithms, code, or computer programs (“the software”), and any accompanying Web site or software of the Work, cannot and do not warrant the performance or results that might be obtained by using the contents of the Work. The author, developers, and the Publisher have used their best efforts to ensure the accuracy and functionality of the textual material and/or programs contained in this package; we, however, make no warranty of any kind, express or implied, regarding the performance of these contents or programs. The Work is sold “as is” without warranty (except for defective materials used in manufacturing the book or due to faulty workmanship).

The author, developers, and the publisher of any accompanying content, and anyone involved in the composition, production, and manufacturing of this work will not be liable for damages of any kind arising out of the use of (or the inability to use) the algorithms, source code, computer programs, or textual material contained in this publication. This includes, but is not limited to, loss of revenue or profit, or other incidental, physical, or consequential damages arising out of the use of this Work. The data used throughout this text, including names of persons and companies are for instructional purposes only. They have been researched with care but are not guaranteed for any intent beyond their educational purpose.

The sole remedy in the event of a claim of any kind is expressly limited to replacement of the book and only at the discretion of the Publisher. The use of “implied warranty” and certain “exclusions” vary from state to state, and might not apply to the purchaser of this product.

NETWORK SECURITYAND CRYPTOGRAPHY

A Self-Teaching Introduction

Second Edition

Sarhan M. Musa, Ph.D.

Prairie View A&M University

Copyright ©2022 by MERCURY LEARNING AND INFORMATION LLC. All rights reserved.

This publication, portions of it, or any accompanying software may not be reproduced in any way, stored in a retrieval system of any type, or transmitted by any means, media, electronic display or mechanical display, including, but not limited to, photocopy, recording, Internet postings, or scanning, without prior permission in writing from the publisher.

Publisher: David Pallai

MERCURY LEARNING AND INFORMATION

22841 Quicksilver Drive

Dulles, VA 20166

[email protected]

www.merclearning.com

1-800-232-0223

S. M. Musa. Network Security and Cryptography, Second Edition.

ISBN: 978-1-68392-883-6

The publisher recognizes and respects all marks used by companies, manufacturers, and developers as a means to distinguish their products. All brand names and product names mentioned in this book are trademarks or service marks of their respective companies. Any omission or misuse (of any kind) of service marks or trademarks, etc. is not an attempt to infringe on the property of others.

Library of Congress Control Number: 2022941507

222324321  Printed on acid-free paper in the United States of America.

Our titles are available for adoption, license, or bulk purchase by institutions, corporations, etc. For additional information, please contact the Customer Service Dept. at 800-232-0223(toll free).

All of our titles are available in digital format at academiccourseware.com and other digital vendors. The sole obligation of MERCURY LEARNING AND INFORMATION to the purchaser is to replace the book, based on defective materials or faulty workmanship, but not based on the operation or functionality of the product.

To my wife, Lama and my children,Mahmoud, Ibrahim, and Khalid

CONTENTS

Preface

Chapter 1: Overview of Computer Networks

1.1 Introduction

1.2 Open Systems Interconnection (OSI) Model

1.3 Transmission Control Protocol/Internetworking Protocol (TCP/IP) Model

1.4 Hierarchical Model

1.5 Computer Network Equipment

1.6 Computer Network Types

1.7 Computer Network Topology

1.8 Exercises

Chapter 2: Mathematical Foundations for Computer Networks

2.1 Introduction

2.2 Probability Fundamentals

2.2.1 Simple Probability

2.2.2 Joint Probability

2.2.3 Conditional Probability

2.2.4 Statistical Independence

2.3 Random Variables

2.3.1 Cumulative Distribution Function

2.3.2 Probability Density Function

2.3.3 Joint Distribution

2.4 Discrete Probability Models

2.4.1 Bernoulli Distribution

2.4.2 Binomial Distribution

2.4.3 Geometric Distribution

2.4.4 Poisson Distribution

2.5 Continuous Probability Models

2.5.1 Uniform Distribution

2.5.2 Exponential Distribution

2.5.3 Erlang Distribution

2.5.4 Hyperexponential Distribution

2.5.5 Gaussian Distribution

2.6 Transformation of a Random Variable

2.7 Generating Functions

2.8 Central Limit Theorem

2.9 Classification of Random Processes

2.9.1 Continuous versus Discrete Random Process

2.9.2 Deterministic versus Non-Deterministic Random Process

2.9.3 Stationary versus Nonstationary Random Process

2.9.4 Ergodic versus Nonergodic Random Process

2.10 Statistics of Random Processes and Stationarity

2.11 Time Averages of Random Processes and Ergodicity

2.12 Multiple Random Processes

2.13 Sample Random Processes

2.13.1 Random Walks

2.13.2 Markov Processes

2.13.3 Birth-and-Death Processes

2.13.4 Poisson Processes

2.14 Renewal Processes

2.15 Kendall’s Notation

2.16 Little’s Theorem

2.17 M/M/1 Queue

2.18 M/M/1 Queue With Bulk Arrivals/Service

2.18.1 Mx/M/1 (Bulk Arrivals) System

2.18.2 M/MY/1 (Bulk Service) System

2.18.3 M/M/1/k Queueing System

2.18.4 M/M/k Queueing System

2.18.5 M/M/∞ Queueing System

2.19 M/G/1 Queueing SYSTEM

2.20 M/Ek/1 Queueing SYSTEM

2.21 Networks of Queues

2.21.1 Tandem Queues

2.21.2 Queueing System with Splitting

2.21.3 Queueing System with Feedback

2.22 Jackson Networks

2.23 Exercises

Chapter 3: Overview of Cryptography

3.1 Introduction

3.2 Basic Terms Related to Cryptography

3.2.1 Cryptographic Primitives

3.2.2 Cryptographic Protocols

3.2.3 Encryption (at the Sender’s End)

3.2.4 Decryption (at the Recipient’s End)

3.3 Requirements of Secure Communication

3.4 Osi Security Architecture X.

3.4.1 Security Attacks

3.4.2 Security Services

3.4.3 Security Mechanisms

3.5 Categories of Cryptographic Systems

3.6 Symmetric (or Conventional) Encryption Model

3.6.1 Types of Attacks on a Conventional Encryption Scheme

3.6.2 Conventional Encryption for Confidentiality

3.6.3 Link Encryption

3.7 Exercises

Chapter 4: Mathematical Foundations for Cryptography

4.1 Introduction

4.2 Introduction to Groups, Rings, and Fields

4.2.1 Groups

4.2.2 Ring

4.2.3 Field

4.3 Modular Arithmetic

4.3.1 Residue Classes (mod n)

4.3.2 Properties of Zn

4.3.3 Multiplication within Set Zn

4.4 Introduction to Primes and Co-Primes

4.4.1 Prime Numbers

4.4.2 Co-Prime Numbers or Relatively Prime Numbers

4.5 Euclid’s Algorithm To Determine GCD

4.6 Extended Euclid’s Algorithm

4.7 Galols Finite Fields

4.7.1GF (p)

4.7.2 Set Z*p

4.7.3 Galois Finite Fields of Order 2n

4.7.4 Arithmetic Operations within GF (2n)

4.7.5 Addition (+) Operation within GF (23)

4.7.6 Addition Inverse of GF (23)

4.7.7 Multiplication (x) Operation within GF (23) Using m(x) x3+x2+ 1 for Reducing the Polynomials

4.7.8 Multiplication Inverse within GF (23)

4.7.9 Multiplicative Inverses of All Integers in GF (23)

4.8 Fermat’s Little Theorem

4.8.1 A Corollary of Fermat’s Little Theorem

4.9 Euler’s Totient Function

4.9.1 General Formula for Computation of Totient Function ϕ(n)

4.10 Euler’s Theorem

4.10.1 A Corollary of Euler’s Theorem

4.11 Prime Numbers

4.11.1 Primitive Roots

4.12 Discrete Logarithms

4.12.1 Difficulty of Computing Discrete Logarithms

4.12.2 Algorithm to Determine the Primitive Roots of a Number n

4.12.3 Another Method of Determining the Primitive Roots of a Number n

4.13 Primality Testing

4.13.1 Miller and Rabin’s Method

4.14 Chinese Remainder Theorem

4.14.1 Alternate Interpretation of the Chinese Remainder Theorem

4.15 Exercises

Chapter 5: Classical Cipher Schemes

5.1 Introduction

5.2 Classical Substitution Ciphers

5.2.1 Caesar Cipher

5.2.2 Mono-Alphabetic Cipher

5.2.3 Hill Cipher

5.2.4 Play-Fair Cipher

5.2.5 Poly-Alphabetic Cipher (Vigenere Cipher)

5.2.6 One-Time Pad

5.3 Transposition Ciphers

5.3.1 Rail-Fence Cipher

5.3.2 Rectangular Transposition Cipher

5.4 Steganography

5.4.1 Limitation of Steganography

5.4.2 Steganography Combined with Cryptography

5.5 Exercises

Chapter 6: Modern Symmetric Ciphers

6.1 Introduction

6.2 Some Basic Concepts for Symmetric Ciphers

6.2.1 Concept of Binary Block Substitution

6.2.2 Strength of the Substitution Cipher

6.2.3 Key Size for the Simple Substitution Cipher

6.3 Claude Shannon’s Theory of Diffusion and Confusion

6.3.1 Diffusion

6.3.2 Confusion

6.4 Feistel Cipher

6.4.1 Strength of the Feistel Cipher

6.5 Data Encryption Standard (DES)

6.5.1 Description of the Critical Functions of Each Round of DES

6.5.2 S-Box Transformation

6.5.3 Generation of Sub-Keys (K1... K16)

6.5.4 DES Decryption Algorithm

6.6 Avalanche Effect

6.6.1 Strength of DES

6.6.2 Possible Attacks on DES

6.6.3 Differential Cryptanalysis vs. Linear Cryptanalysis

6.7 Multiple Des

6.7.1 Double DES

6.7.2 Triple DES

6.7.3 Block Cipher vs. Stream Cipher

6.7.4 Block/Stream Cipher Modes of Operation

6.8 International Data Encryption Algorithm (IDEA)

6.8.1 Description of IDEA

6.8.2 Generation of Sub-Keys in IDEA

6.8.3 IDEA Modes of Operation

6.9 Advanced Encryption Standard (AES)

6.9.1 Processing of Plaintext

6.10 Key Management: Symmetric Encryption

6.10.1 Secure Distribution of Keys

6.10.2 Key Distribution Schemes

6.11 Pseudo-Random Number Generators

6.11.1 Pseudo-Random Number Generation (PRNG) Algorithms

6.12 Exercises

Chapter 7: Public-Key Cryptography for Data Confidentiality

7.1 Introduction

7.2 Requirements of Public-Key Cryptography

7.3 Data Confidentiality Using Public-Key Cryptography

7.4 RSA Algorithm

7.4.1 Main Components

7.4.2 Strength of RSA

7.5 Key Management Using Public-Key Cryptography

7.5.1 Diffie-Hellman Algorithm for Key Distribution

7.5.2 Global Parameters

7.5.3 Strength of Diffie-Hellman Key-Exchange Scheme

7.5.4 Types of Attacks against Diffie-Hellman

7.6 El-Gamal Encryption Scheme

7.6.1 Determination of Private Key and Public Key (by User “A”)

7.7 Elliptic Curve Cryptography (ECC)

7.7.1 Elliptic Curves

7.7.2 Elliptic Curves in Cryptography (ECC)

7.7.3 Prime Elliptic Curves

7.7.4 Prime Elliptic Curve Set

7.7.5 Computation of Elliptic Curve Set E11 (1, 1)

7.7.6 Rules for Addition (+) Operation over EP (a, b)

7.7.7 Multiplication over the Set EP (a, b)

7.7.8 Strength of ECC-Based Schemes

7.7.9 ECC-Based Key-Exchange Algorithm

7.7.10 Strength of ECC Key-Exchange Algorithm

7.7.11 ECC-Based Encryption/Decryption Scheme

7.7.12 Strength of ECC-based Encryption/Decryption Scheme

7.7.13 ECC Encryption/Decryption vs. RSA

7.7.14 Efficient Hardware Implementation

7.8 Exercises

Chapter 8: Authentication Schemes

8.1 Introduction

8.2 What is Message Authentication?

8.3 Types of Authentication Services

8.3.1 Different Techniques of Message Authentication

8.3.2 Digital Signatures Using Public-Key Cryptography

8.3.3 Message Authentication Code (MAC)

8.3.4 Many-to-One Relationship between Messages and MAC Values

8.3.5 Use of MAC for Message Authentication

8.3.6 Chosen Plaintext Attack on MAC

8.3.7 Hash Function

8.4 Application Modes of Digital Signatures

8.4.1 Direct Digital Signature

8.4.2 Arbitrated Digital Signature

8.5 Authentication Protocols

8.5.1 Mutual Authentication

8.5.2 Symmetric Encryption Approaches

8.5.3 Needham Schroeder Protocol

8.5.4 Denning Protocol

8.5.5 NEUM Protocol

8.5.6 Public-Key Encryption Approaches

8.5.7 One-Way Authentication

8.5.8 Symmetric Encryption Approach

8.5.9 Public Key Encryption Approach

8.5.10 The Birthday Paradox

8.5.11 Probability of Two Sets Overlapping

8.5.12 Mathematical Basis for Birthday Attack

8.5.13 Birthday Attack

8.5.14 Verification of the Digital Signature at the Recipient End

8.5.15 How to Create Many Variants of a Message

8.5.16 Weak Collision Resistance

8.5.17 Strengths of Hash Functions

8.6 Message Digest (Hash Function) Algorithms

8.6.1 MD5 Message Digest Algorithm

8.6.2 Sequence of Use of Message Words in Various Rounds

8.6.3 Primitive Logical Functions Used in Various Rounds

8.6.4 Strength of MD5

8.7 Secure Hash Algorithm (SHA-1)

8.7.1 Difference between MD5 and SHA-1

8.7.2 Various Upgrades of SHA

8.8 Digital Signature Schemes

8.8.1 RSA Digital Signature Scheme

8.8.2 ElGamal’s Digital Signature Scheme

8.8.3 Digital Signature Algorithm (DSA)

8.9 Exercises

Chapter 9: Centralized Authentication Service

9.1 Introduction

9.2 Centralized Authentication Service

9.3 Motivation for Centralized Authentication Service

9.4 Simple Authentication Exchange in Open Environment

9.4.1 Problems with Simple Authentication Exchange

9.4.2 Full-Service Kerberos Environment (Kerberos Realm)

9.4.3 Kerberos Version

9.5 Architecture of Kerberos V.4

9.5.1 lnter-Kerberos Authentication

9.5.2 Kerberos Version 5 Authentication Sequence

9.5.3 Differences between Kerberos V.4 and Kerberos V.5

9.6 Exercises

Chapter 10: Public Key Infrastructure (PKI)

10.1 Introduction

10.2 Format of X.509 Certificate

10.2.1 Version.3 Extensions

10.3 Hierarchical Organization of Certification Authorities (CAs)

10.4 Creation of Certificates’ Chain for CA’s Signature Verification

10.5 Revocation of X.509 Certificates

10.5.1 Rules for Revocation

10.6 Authentication Procedures Defined in X.509

10.7 Exercises

Chapter 11: Pretty Good Privacy

11.1 Introduction

11.2 Services Supported by Pretty Good Privacy (PGP)

11.2.1 Implementation of the Security Services in PGP

11.2.2 Functions at the Sender End and at the Recipient End

11.2.3 Placement of Compression/Decompression Functions in PGP

11.3 Radix-64 (R64) Transformation

11.3.1 Segmentation and Reassembly

11.4 Concept of the Public Key Ring and Private Key Ring in PGP

11.4.1 Fields of the Private Key Ring

11.4.2 Generation of Session Keys

11.4.3 Use of Key Rings in Authentication

11.4.4 Use of Key Rings in Data Confidentiality

11.4.5 The Trust Model for Management of Public Keys in PGP

11.5 S/Mime (Secure/Multipurpose Internet Mail Extension)

11.5.1 S/Mime Functionality

11.6 Exercises

Chapter 12: Internet Security Services

12.1 Introduction

12.2 Internet Protocol Security (IPSec)

12.3 Services Provided by IPSec

12.3.1 IPSec Headers

12.3.2 Authentication Header (AH)

12.3.3 AH Fields

12.3.4 Algorithm for Generation of Integrity Check Value (ICV)

12.3.5 Encapsulating Security Payload (ESP)

12.4 Security Association (SA)

12.4.1 SA Parameters

12.5 Security Policies

12.5.1 Security Policy Database (SPD)

12.5.2 Security Association Selectors (SA Selectors)

12.5.3 Combining of Security Associations

12.5.4 IPSec Protocol Modes

12.5.5 Tunnel Mode

12.5.6 Anti-Replay Window

12.5.7 IPSec Key Management

12.5.8 Features of Oakley Key-Exchange Protocol

12.6 ISAKMP

12.6.1 Payload Types

12.6.2 Important IPSec Documents

12.7 Secure Socket Layer/Transport Layer Security (SSL/TLS)

12.7.1 Components of SSL

12.7.2 SSL Handshake Protocol

12.7.3 SSL Change Specs Protocol

12.7.4 SSL Alerts Protocol

12.7.5 SSL Record Protocol

12.7.6 Some Terms Related to SSL

12.7.7 Transport Layer Security (TLS)

12.7.8 TLS Record Protocol

12.7.9 TLS Handshake Protocol

12.8 Secure Electronic Transaction

12.8.1 Business Requirements of SET

12.9 Key Features of Set

12.9.1 Use of Public Key Certificates in SET

12.9.2 Sequence of Events in SET

12.9.3 Payment Capture

12.10 Exercises

Chapter 13: System Security

13.1 Introduction

13.2 Intruders

13.3 Intrusion Detection

13.3.1 Intrusion Detection Techniques

13.4 Password Management

13.5 Malicious Programs

13.5.1 Different Phases in the Lifetime of a Virus

13.6 Anti-Virus Scanners

13.6.1 Different Generations of Anti-Virus Scanners

13.7 Worms

13.8 Firewall

13.8.1 Firewall Characteristics

13.8.2 Firewall Techniques to Control Access

13.9 Types of Firewalls

13.9.1 Firewall Configurations

13.10 Trusted Systems

13.11 Exercises

Chapter 14: Security of Emerging Technology

14.1 Introduction

14.2 Security of Big Data Analytics

14.2.1 Big data analysis can transform security analytics in the following ways:

14.2.2 Big data analytics for security issues and privacy challenges:

14.3 Security of Cloud Computing

14.3.1 Cloud Deployment models:

14.3.2 The three layers of the Cloud computing services model (Software, Platform or Infrastructure (SPI) Model):

14.3.3 Security concerns and challenges of Cloud computing:

14.3.4 Cloud Security as Consumer Service:

14.4 Security of Internet of Things (IoT)

14.4.1 Evolution of IoT

14.4.2 Building Blocks of the Internet of Things (IoT)

14.4.3 Difference between IoT and Machine-to-Machine (M2M)

14.4.4 IoT Layer Models

14.4.5 Applications of IoT

14.4.6 New Challenges Created by the IoT

14.4.7 Security Requirements of the IoT

14.4.8 Three Primary Targets of Attack against the IoT

14.4.9 Hybrid Encryption Technique

14.4.10 Hybrid Encryption Algorithm Based on DES and DSA

14.4.11 Advanced Encryption Standard (AES)

14.4.12 Requirements for Lightweight Cryptography

14.4.13 Lightweight Cryptography in the IoT

14.4.14 Prevention of Attacks on IoT

14.5 Security of Smart Grids

14.5.1 Smart Grid Challenges

14.5.2 Smart Grid Layers

14.5.3 Information Security Risks and Demands of a Smart Grid

14.5.4 Smart Grid Security Objectives

14.5.5 The Smart Grid System Can Be Divided into Three Major Systems

14.5.6 Types of Security Attacks That Can Compromise the Smart Grid Security

14.5.7 Cybersecurity Attacks in a Smart Grid

14.6 Security of Scada Control Systems

14.6.1 Components of SCADA Systems

14.6.2 SCADA System Layers

14.6.3 Requirements and Features for the Security of Control Systems

14.6.4 Categories for Security Threats to Modern SCADA Systems

14.7 Security of Wireless Sensor Networks (WSNs)

14.7.1 WSN Layers

14.7.2 Security Requirements in WSNs

14.7.3 The Attack Categories in WSNs

14.7.4 Attacks and Defense in WSNs at Different Layers

14.7.5 Security Protocols in WSNs

14.8 Security of Smart City

14.8.1 Challenges and Benefits of Smart City

14.8.2 The security and privacy of information in a smart city

14.9 Security of Blockchain

14.9.1 Features of Blockchain Technology

14.9.2 Benefits and Challenges of Blockchain

14.9.3 Advantages of Blockchain for Security

14.9.4 Security Issues of Blockchain

14.10 Exercises

Chapter 15: Artificial Intelligence Security

15.1 Introduction

15.2 Machine Learning

15.3 Types of Machine Learning

15.3.1 Supervised Learning

15.3.2 Unsupervised Learning

15.3.3 Semi-supervised Learning

15.3.4 Reinforcement Learning

15.4 Deep Learning

15.4.1 Deep Learning Applications: A Brief Overview

15.4.2 DL Network Layers

15.5 Types of Deep Learning

15.5.1 Multilayer Neural Network

15.5.2 Convolutional Neural Networks (CNN)

15.5.3 Recurrent Neural Networks (RNNs)

15.5.4 Long Short-Term Memory Networks (LSTMs)

15.5.5 Recursive Neural Network (RvNNs)

15.5.6 Stacked Autoencoders

15.5.7 Extreme Learning Machine (ELM)

15.6 AI for Intrusion Detection System

15.7 Exercises

Bibliography

Index

PREFACE

Network Security and Cryptography, Second Edition introduces the basic concepts in computer networks and the latest trends and technologies in cryptography and network security. Primarily intended as a textbook for courses in computer science, electronics and communication, and electrical engineering, the book also serves as a basic reference and refresher for professionals in these areas. Mainly this book is organized into fifteen chapters.

Chapter 1 is an overview of computer networks that defines its various terms and concepts. It also covers the Open Systems Interconnection (OSI) Model, the Transmission Control Protocol/Internetworking Protocol (TCP/IP) Model, the Hierarchical model, computer network equipment, computer network types, and computer network topology.

Chapter 2 covers the mathematical foundations for computer networks including probability fundamentals, random variables, discrete probability models, continuous probability models, transformation of random variables, generating functions, central limit theorem, classification of random processes, statistics of random processes and stationary, time averages of random processes and Ergodicity, multiple random processes, sample random processes, and Kendall’s notation.

Chapter 3 is an overview of cryptography that defines its various terms and concepts. It also covers the genetic model of secure communication, OSI security architecture, security attacks, security services, security mechanisms, categorization of security attacks, categorization of cryptographic systems, symmetric encryption model, link encryption, end-to-end encryption, and traffic pattern confidentiality.

Chapter 4 covers the mathematical foundations for cryptography including groups, rings, integral domain and fields, modular arithmetic, residue classes, primes and co-primes, the Euclidean Algorithm and the extended Euclidean Algorithm, the Galois Field, Fermat’s little theorem and its corollaries, Euler’s totient function, Euler’s theorem, prime numbers, discrete logarithms, primitive roots, primality testing, and Chinese remainder theorem.

Chapter 5 provides classical cipher schemes. It contains the Caesar cipher, the mono-alphabetic cipher, Hill cipher, play fair cipher, polyalphabetic cipher, one time pad and rail fence ciphers, rectangular transposition cipher, and steganography.

Chapter 6 discusses modern symmetric ciphers. It covers the concepts of the symmetric cipher, Claude Shannon’s theory of diffusion and confusion, the Feistel cipher, the Data Encryption Standard (DES), avalanche effect, differential cryptanalysis attack on the DES, linear cryptanalysis attack on the DES, double DES, meet-in-the-middle attack on double DES, triple DES, block/stream cipher modes of operation, International Data Encryption Algorithm (IDEA), Advanced Encryption Standard (AES), key management in symmetric schemes, and Pseudo-Random Number Generator (PRNG) algorithms.

Chapter 7 addresses public-key cryptography for data confidentiality. It covers requirements of public key cryptography, data confidentiality using public key cryptography, the RSA algorithm, types of attacks against RSA, Diffie-Hellman Key Exchange Algorithm, man-in-the-middle attack against Diffie-Hellman Key exchange algorithm, ElGamal encryption scheme, and elliptic curve cryptography (ECC).

Chapter 8 addresses the authentication schemes including message authentication, authentication services and techniques, digital signature for message authentication; message authentication code (MAC) and secure hash functions, characteristics of hash functions, authentication protocols, birthday paradox, birthday attack against digital signatures, message digest algorithm (MD5), Secure Hash Algorithm (SHA-1), and the Digital Signature Algorithm (DSA).

Chapter 9 covers the concept and details of the Centralized Authentication Service, motivation for the Centralized Authentication Service, the Simple Authentication Exchange in Open Environment, Centralized Authentication Service Kerberos Version 4, Inter-Kerberos Authentication Service, and Authentication Service Kerberos Version 5.

Chapter 10 discusses the public key infrastructure (PKI) including X.509 public key certificate; Hierarchical Organization of Certification Authorities (CAs), creation of certificates’ chain for CA’s Signature Verification; revocation of X.509 certificates, and X.509 authentication protocols.

Chapter 11 explains in detail all aspects of Pretty Good Privacy including Email service PGP, services supported by PGP, components of PGP, concept of R64 transformation, the concept of public key ring and private key ring, the trust model of key management in PGP, Email service secure Internet mail extension, and functions supported by S/MIME.

Chapter 12 discusses the Internet Security Services including Internet Protocol Security (IPSec), services provided by IPSec, Authentication Header (AH), Encapsulating Security Payload, the concept of Integrity Check Value (ICV) in IPSec, AH and ESP Packet Formats in IPV.4, the concept of Security Association (SA); Security Policy and Security Policy Database (SPD), combining of SAs; IPSec Protocol Modes e.g., Transport Mode Tunnel Mode, and Wildcard Mode. It covers the Oakley Key Exchange Protocol in IPSec, Secure Socket Layer (SSL) Protocol and its components, Transport Layer Security (TLS) Protocol and its components, the Secure Electronic Transaction (SET) Protocol, and sequence of events in SET message exchange, including concepts of dual signature and payment gateways.

Chapter 13 covers system security including intrusion, intrusion detection techniques, password management, malicious programs, different phases in the life of a virus, types of virus and antivirus scanners, worms, firewalls (characteristics, types, and configurations), and trusted systems.

Chapter 14 provides the security aspects of emerging technology. It contains big data analytics, cloud computing, Internet of Things (IoT), the Smart Grid, supervisory control and data acquisition (SCADA), control systems, and wireless sensor networks (WSN).

Chapter 15 is an overview of perspective and ideas on Artificial Intelligence (AI) security. It covers Machine Learning (ML), types of ML, Deep Learning (DL), and types of DL, AI for Intrusion Detection System (IDS).

Finally, the Bullet Point Reading (BPR) technique is used in the book to simplify the concepts and to enforce the understanding and learning.

Sarhan M. Musa

Cypress, TX

July 2022

CHAPTER 1

OVERVIEW OF COMPUTER NETWORKS

Chapter Outline

1.1Introduction Signed Numbers

1.2Open Systems Interconnection (OSI) Model

1.3Transmission Control Protocol/Internetworking Protocol (TCP/IP) Model

1.4Hierarchical Model

1.5Computer Network Equipment

1.6Computer Network Types

1.7Computer Network Topology

1.8Exercises

1.1 INTRODUCTION

Computer networks have grown rapidly in recent years due to critical users’ needs in their daily living. A computer network is a collection of devices (nodes) connected to each other (wired or wireless) in order to allow every device to communicate, access, and share its resources with other devices. This chapter gives a basic introduction and overview of computer networking to help in understanding and learning network security.

1.2 OPEN SYSTEMS INTERCONNECTION (OSI) MODEL

The Open Systems Interconnection (OSI) is a reference model that was created by the International Organization for Standardization (ISO). The OSI model defines a networking conceptual framework to implement protocols in seven layers. It is an ideal tool for learning how networks function. The advantages for the OSI model to be a layered network model are to simplify the learning of the network and reduce its complexity, accelerate evolution, standardize interfaces, ensure interoperability, and facilitate modular engineering. Figure 1.1 shows the OSI model.

FIGURE 1.1  The OSI model.

The Data Link Layer has two sub-layers, the Logical Link Control (LLC) and the Media Access Control (MAC). The Logical Link Control (LLC) is responsible for error correction, flow control, and Service Access Points. The Media Access Control (MAC) is responsible for physical addressing and providing access to shared physical media (wire). It is assigned by the manufacturer. The Ethernet is a standardized way of connecting computers to create a network. Figure 1.2 illustrates the OSI model devices and protocols.

FIGURE 1.2  The OSI model devices and protocols.

1.3 TRANSMISSION CONTROL PROTOCOL/INTERNETWORKING PROTOCOL (TCP/IP) MODEL

The Transmission Control Protocol/Internetworking Protocol (TCP/IP) is the networking model used in today’s Internet. The TCP/IP is the basic protocol system by which computers on a network talk to each other. It is a logical address, and without TCP/IP, networks wouldn’t work. The TCP/IP consists of four layers—Application, Transport, Internet, and Network Access—as shown in Figure 1.3.

FIGURE 1.3  The TCP/IP model.

A TCP/IP can provide the following operations:

Responsible for dividing messages into controllable portions of data that will send efficiently through the transmission medium.

Responsible to interface with the network adapter hardware.

Capability of addressing data. The source device must be capable of targeting data to a destination. The destination device must be capable of recognizing a message that it is supposed to receive.

Capability of routing data to the subnet of the destination device, even if the source subnet and the destination subnet are in different physical networks.

Responsible for performing error control, flow control, and acknowledgment. For reliable communication, the sending and receiving network devices must be able to identify and correct faulty transmissions and control the flow of data.

Responsible for accepting data from an application and sending it to the network.

Responsible for receiving data from the network and sending it to an application.

Figure 1.4 illustrates the TCP/IP model mapped to the OSI model.

FIGURE 1.4  The TCP/IP model Mapped to the OSI model.

The common protocols can be summarized as below:

Domain Name System (DNS): DNS is the TCP/IP facility that lets us use names rather than numbers to refer to host computers. For example, 74.125.224.147 is www.google.com. DNS allows the IP addresses to change without affecting connectivity.

Address Resolution Protocol (ARP): ARP is used to convert an IP address to a physical address such as an Ethernet address. ARP is a low-level network protocol, operating at Layer 2 of the OSI model. When any device wishes to send data to another target device over the Ethernet, it must first determine the MAC address of that target, given its IP address. ARP resolves or discovers the appropriate destination MAC (layer 2) address to use by using a destination IP address. Map a Layer 3 address to a Layer 2 address.

Dynamic Host Configuration Protocol (DHCP): DHCP automatically configures the IP address for every host on a network, thus ensuring that each host has a valid, unique IP address. DHCP even automatically reconfigures IP addresses as hosts come and go. DHCP can save a network administrator many hours of tedious configuration work.

Internet Protocol (IP): IP is a routable protocol that uses IP addresses to deliver packets to network devices. IP is an intentionally unreliable protocol, so it doesn’t guarantee delivery of information.

Internet Control Message Protocol (ICMP): It provides control and feedback messages between IP devices. ICMP sends and receives diagnostic messages. ICMP is the basis of the everywhere ping command. It sends query and error reporting messages.

Internet Group Management Protocol (IGMP): Used to multicast (has more than one destination) messages to multiple IP addresses at once.

Layer 2 Protocols are responsible for providing a reliable link between two directly connected nodes, by detecting and possibly correcting errors that may occur in the physical layer. Some of the common Layer 2 Protocols today are:

ARP – Address Resolution ProtocolSTP – Spanning Tree ProtocolSPB – Shortest Path Bridging

Layer 3 Protocols are responsible for providing the functional and procedural means of transferring variable length data sequences (called datagrams) from a source to a destination host connected via one or more networks, while maintaining the quality of service standards.

Some of the common Layer 3 Protocols today are:IP – Internet ProtocolOSPF – Open Shortest Path FirstRIP – Routing Information ProtocolICMP – Internet Control Message Protocol

These protocols enable routers to route data between networks via the shortest path, or alternate paths, if one path is unavailable. They also define how routers across networks can dynamically share this information so all routers are aware of the available paths.

Layer 4 Protocols are responsible for the reliable transport between nodes on the network. These protocols ensure that a packet makes it to its destination—kind of like a return receipt. TCP is the transport layer protocol for IP.

Some of the common Layer 4 Protocols today are:TCP – Transport Control Protocol; this is the transport layer for IP. It ensures that IP packets are delivered to their destination.UDP – Unified Datagram Protocol; this is a lighter weight transport layer for IP. It does not provide the overhead of error checking for simple queries like DNS or NTP.SPX – Sequenced Package Exchange; this is the transport layer for IPX. It ensures that IPX packets are delivered to their destination.

Open Shortest Path First (OSPF): Link-state, hierarchical IGP routing algorithm proposed as a successor to RIP in the Internet community. OSPF features include least-cost routing, multipath routing, and load balancing. OSPF was derived from an early version of the Intermediate System to Intermediate System (IS-IS) protocol.

Intermediate System-Intermediate System (ISIS): One of a family of IP Routing protocols, it is an Interior Gateway Protocol (IGP) for the Internet, used to distribute IP routing information throughout a single Autonomous System (AS) in an IP network. IS-IS is a link-state routing protocol, which means that the routers exchange topology information with their nearest neighbors. The topology information is flooded throughout the AS, so that every router within the AS has a complete picture of the topology of the AS. This picture is then used to calculate end-to-end paths through the AS, normally using a variant of the Dijkstra algorithm. Therefore, in a link-state routing protocol, the next hop address to which data is forwarded is determined by choosing the best end-to-end path to the eventual destination.

Autonomous System (AS): Collection of networks under a common administration sharing a common routing strategy. Autonomous systems are subdivided by areas.

Spanning Tree Protocol (STP): It is a Layer 2 Protocol that runs on bridges and switches. The specification for STP is IEEE 802.1D. The primary purpose of STP is to ensure that the network does not create redundant loops.

Shortest Path Bridging (SPB): SPB is the IEEE 802.1aq specification for enabling multipath routing in the data center. It allows all paths to be active with multiple equal cost paths, provides much larger layer 2 topologies, supports faster convergence times, and improves the efficiency by allowing traffic to load share across all paths of a mesh network.

1.4 HIERARCHICAL MODEL

A Hierarchical model simplifies design, implementation, and management of the network. As shown in Figure 1.5, a Hierarchical model consists of three layers: Core, Distribution, and Access.

Hierarchical modelLayer NumberLayer NameFunction3Core or BackboneIt is a high-speed backbone that is designed to switch packets as quickly as possible to optimize communication transport within the network. It provides fast and efficient data transport. It represents the enterprise in a network that is available to end users (clients). Network devices used in the core layer are: High-speed routers or Multi-layer switches.2Distribution or AggregationIt is a separation layer between the access and core layers and a connection point between the diverse access sites and the core layer. It determines the quickest, shortest, and least expensive route the data need to pass through to arrive at the destination. It defines the local policies and local routing. Distribution layer devices control access to resources that are available at the core layer in order to use bandwidth efficiently. Network devices used in the distribution layer are Routers.1AccessIt represents the end users’ connection to the network. The end users’ data transmissions access the network at the access layer. It is used to control user (client) access to the network resources. Access layer devices control traffic by localizing service requests to the access media. Network devices used in the access layer are Switches, Bridges, or Hubs.

FIGURE 1.5  The Hierarchical model.

1.5 COMPUTER NETWORK EQUIPMENT

Network equipment includes network devices that connect directly to a network segment. There are two types of devices (equipment):

End devices or user devices

User devices are network devices that provide services directly to the user (host), Examples of end devices are scanners, fax machines, PCs, laptops, printers, servers, iPhones, smart TVs, and iPads.

Network Devices (Hardware)

Network devices provide transport for the data that needs to be transferred between end users’ devices.

Network interface cards (NICs)

• Network interface cards (NICs) are printed circuit boards that are installed in workstations to enable systems to connect to the network.

• They provide the physical connection between the network cable and the workstation. In addition, they possess the circuitry necessary to gain access to the network.

• The NIC formats information from the workstation so that it can be transmitted across the network. The NIC operates at the physical layer (Layer 1) of the OSI model, and it is also considered a data link layer device. Part of the NIC’s function is to format information between the workstation and the network, and also to control the transmission of data onto the wire.

• The NIC converts the data to electrical impulses if copper wire is used, or to light signals if a fiber-optic cable is used. Each NIC carries a unique Media Access Control (MAC) address. The NIC controls user (host) access to the networking medium. Figure 1.6 shows a NIC card.

FIGURE 1.6  NIC card.

Repeaters

Repeaters work against attenuation (degradation of signal) by cleaning and repeating signals that they receive on a network, as shown in Figure 1.7. A repeater enables signals to travel longer distances over a network.

FIGURE 1.7  A Repeater.

Repeaters operate at the Physical layer (Layer 1) of the OSI model. They cannot connect different network architectures. Also, they can’t reformat, resize, or manipulate the data signal. A repeater is used to re-time, re-shape, and re-amplify the data signal to its original shape. A repeater receives data on one port and repeats them on the other port. It can be used as a connection device on a network. Figure 1.8 shows a repeater on a network.

FIGURE 1.8  Repeater in the network.

Hub

• A hub is a multiple port repeater. It generates and re-times network signals. A hub connects devices on an Ethernet twisted pair network.

• It forms a central point on a network where the cables of other network devices come together at its ports.

• Hubs operate at the physical layer (Layer 1) of the OSI model.

• A hub does not perform any tasks besides signal regeneration. A hub receives data on one port and transmits it on all the other ports. Figure 1.9 shows a network with a hub in the center.

FIGURE 1.9  A hub in the network.

There are two types of Hubs:

•Active hub: It amplifies or repeats signals that pass through it; it provides a path for the data signals and regenerates the signal before it forwards it to all of the connected devices.

•Passive hub: It just connects cables on a network and provides no signal regeneration; it provides only a pathway for the electrical signals to travel along.

Bridges

• A Bridge is a network device that connects multiple network segments. It breaks networks into separate segments and directs the transmission to the appropriate segment in order to filter traffic between network segments. Bridges reduce network traffic by keeping local traffic on the local segment. A Bridge examines the destination Media Access Control (MAC) address (hardware address) in order to either forward or discard the frame. It operates at the Data Link layer (Layer 2) of the OSI model.

• Network Bridging allows two or more communication networks or network segments to create and aggregate a Network. Bridging is different than routing, which allows networks to communicate independently as separate networks.

• A Bridge is more intelligent than a hub. A Bridge maintains a MAC address table known as a “Bridge Table,” which is stored on the Bridge memory.

Switches

• A switch is a multi-port bridge, and it creates a network.

• A switch is a network device with several inputs and outputs leading to and from the hosts that the switch interconnects.

• A switch allows multiple physical LAN segments to be interconnected into single larger networks.

• A switch connects devices on twisted pair networks, and it forwards data to its destination by using the MAC address embedded in each packet.

• A switch takes packets that arrive on an input and forwards them to the right output so that they will reach their appropriate destination.

• A switch increases network performance by reducing the number of frames transmitted to the rest of the network. It operates at the Data Link layer (Layer 2) of the OSI model.

FIGURE 1.10  Sending data through a switch.

Routers

• Routers connect networks.

• A router acts as a dispatcher, choosing the best path for information to travel so it is received quickly.

• They connect multiple segments and multiple networks.

• Routers provide filtering and network traffic control on LANs and WANs.

• They operate at the Network layer (Layer 3) of the OSI model.

• Routers use the logical address (IP Address).

• Internetworks are Networks connected by multiple routers.

• A router is a type of internetworking device that passes data packets between networks based on layer 3 addresses.

Gateways

• Gateways are usually a combination of hardware and software.

• They translate between different protocol suites; that is, they convert information from one protocol stack to another.

• Gateways have the most negative effect on network performance.

• Packets must be rebuilt not just at the lower levels but at the very upper levels so that actual data content can be converted into a format the destination can process.

• Gateways create the most latency.

Firewalls

• Firewalls act as a security guard between the Internet and your local area network (LAN). All network traffic into and out of the LAN must pass through the firewall, which prevents unauthorized access to the network.

• Firewalls protect a private network’s resources from users in other networks.

• They provide controlled data access between networks. Firewalls can be hardware or software.

Access points (APs)

• An AP is a wireless LAN transceiver that can act as a center point of a standalone wireless network or as connection point between wireless and wired networks.

• It provides cell-based areas where hosts can connect to the network by associating with the AP.

• An AP operates at the Physical layer (Layer 1) and Data Link layer (Layer 2) of the OSI model.

Servers

• A server is a device that handles user requests for access to computer and network resources.

• It provides authentication, authorization, and accounting services for an enterprise.

Media Access Control (MAC)

• A MAC address may be called a “Physical address” or “Hardware address” or “Ethernet address.”

• It is found at the Data Link layer (Layer 2) of the OSI model.

• Bridges and switches use the MAC address to make forwarding decisions within a network or subnetwork.

• The MAC address consists of six bytes.

Carrier Sense Multiple Access with Collision Detection (CSMA/CD):

IP address format:

Every byte of the IP address is equal to a decimal number in the range of 0 (minimum value) to 255 (maximum value).

The IP address is a combination of the Host Portion (H) and Network Portion (N).

IP Classes:

• IP addresses are grouped into five different IP classes (A, B, C, D, and E) depending on the value of the first byte on the left-hand side in every IP address.

• Only classes A, B, and C are available for commercial use. From the class of the IP address, the N and H portions can be determined.

• The network IP and the broadcast IP of the IP address can be determined by the N and H portions of the IP address.

Class A:

Class B:

Class C:

Class D:

Class E:

1.6 COMPUTER NETWORK TYPES

Personal Area Network (PAN)

• A PAN is a computer network that provides data transmission among devices that are located typically within a 10-meter radius close to a single user for a location on a body or in a room.

Local Area Network (LAN)

• A LAN is a data communications network which is in a geographically limited region (typically within a 1-mile radius—buildings/campus) allowing many users to access high bandwidth media.

• A LAN connects different devices and provides full-time connectivity.

• LAN traffic is transmitted in three ways:

1.Broadcast: data packets that are sent to all nodes on a network.

2.Multicast: single packets copied by the network and sent to a specific subset of network addresses.

3.Unicast: message sent to a single network destination.

Virtual Local Area Network (VLAN)

• The VLAN groups hosts with a common set of requirements (common broadcast domain) regardless of their physical location in the internetwork.

• It has the same attributes as a physical LAN, but is configured via software (virtual).

• To physically replicate the functions of a VLAN would require a separate, parallel collection of network equipment.

• The VLAN improves performance and security in the switched network by controlling the broadcast propagation.

• It is a logical broadcast domain that can cover multiple physical LAN segments.

• It enables switches to create multiple broadcast domains within a switched network.

Metropolitan Area Network (MAN)

• MAN is a network that covers a distance typically 10 km greater than LAN but lesser than WAN for a location such as a city or town.

WAN-Wide Area Network

• WAN covers a large distance, typically up to a 100 km away for one or more cities or countries.

• The speeds are limited by cost and bandwidth.

SAN-Storage Area Network

• SAN is a high-speed network of storage devices that connects them to servers.

1.7 COMPUTER NETWORK TOPOLOGY

Computer networks are connected based on a topology. Topology means how network equipment is arranged in order to communicate. It defines the structure of the network. There are two types of topology: physical topology and logical topology.

Physical topology: the way in which the devices of the network are physically connected. It is the actual layout of the wires or media.

Logical topology: the way the hosts access the media to send data. It shows the flow of data on a network.

The most common topologies are described as follows:

1.Point-to-Point Topology:

A point-to-point link is simply topology in which one device has one connection (link) to another device. Each device can add a secondary link connection, but if the device fails, then there will be no connectivity. It is used mainly for WAN links.

FIGURE 1.13  Point to Point topology.

2.Bus Topology:

Bus topology is a topology in which all devices are connected to a single thick backbone cable. If the backbone cable fails, then the network goes down. If a cable linking the device to the backbone cable fails, then only that device will lose connection.

10Base-2 (ThinNet) and 10Base-5 (ThickNet) are popular Ethernet cabling options in bus topology.

FIGURE 1.14  Bus topology.

3.Star Topology:

Each network device in a star topology is connected to a central device such as a hub or switch or router. If one of the cables to the devices fails, then only that device becomes disconnected. Devices typically connect to the hub with the Unshielded Twisted Pair (UTP) Ethernet. It is the most commonly used physical topology in the Ethernet LANs.

FIGURE 1.15  A Star topology.

4.Ring Topology:

A ring topology connects hosts in the form of a ring or a circle. Every device in the ring topology has exactly two neighbors for communication purposes. All messages travel through a ring in the same direction (either clockwise or counter-clockwise). A failure in any device or any cable breaks the loop and can take down the entire network.

FIGURE 1.16  Ring topology.

5.Mesh Topology:

A mesh topology allows multiple access links between network devices. A mesh topology provides network reliability because whenever one network device fails, the network does not stop operations; it finds a bypass to the failed node, and the network continues to operate. A mesh topology can handle high amounts of traffic, because multiple devices can transmit data simultaneously. In a mesh topology, every device has a directed point-to-point link to every other device. The link carries traffic only between the two devices it connects.

FIGURE 1.17  Mesh Network topology.

6.Tree (Hierarchical) Topology:

A tree topology puts the network devices in a hierarchical structure. A Central device on the top level of the hierarchy is connected to one or more other devices that are one level lower in the hierarchy. A tree topology is a combination of a Bus and a Star topology.

FIGURE 1.18  Tree Network topology.

7.Hybrid Topology:

A hybrid topology is an integration of two or more different previously illustrated topologies connected to each other.

FIGURE 1.19  Hybrid topology.

Simplex, Half-Duplex, and Full-Duplex Communications modes:

•Half-duplex communications: Devices can send and receive signals, but not at the same time.

•Full-duplex communications: Devices can send and receive signals simultaneously.

•Simplex: One of the devices is always the sender, while the other device is always the receiver.

1.8 EXERCISES

CHAPTER 2

MATHEMATICAL FOUNDATIONS FOR COMPUTER NETWORKS

Chapter Outline

2.1Introduction

2.2Probability Fundamentals

2.3Random Variables

2.4Discrete Probability Models

2.5Continuous Probability Models

2.6Transformation of Random Variables

2.7Generating Functions

2.8Central Limit Theorem

2.9Classification of Random Processes

2.10Statistics of Random Processes and Stationary

2.11Time Averages of Random Processes and Ergodicity

2.12Multiple Random Processes

2.13Sample Random Processes

2.14Kendall’s Notation

2.15Queueing Networks

2.16Exercises

2.1 INTRODUCTION

2.2 PROBABILITY FUNDAMENTALS

A fundamental concept in probability theory is the idea of an experiment. An experiment (or trial) is the performance of an operation that leads to results called outcomes. In other words, an outcome is a result of performing the experiment once. An event is one or more outcomes of an experiment. The relationship between outcomes and events is shown in the Venn diagram of Figure 2.2. Thus,

FIGURE 2.2  Sample space (rectangle) illustrating the relationship between outcomes (dots) and events (cirles).

An experiment consists of making a measurement or observation.

An outcome is a possible result of an experiment.

An event is a collection of outcomes.

An experiment is said to be random if its outcome cannot be predicted. Thus, a random experiment is one that can be repeated a number of times but yields unpredictable outcomes at each trial. Examples of random experiments are tossing a coin, observing the number of cars arriving at a toll booth, and keeping track of the number of telephone calls on your iPhone.

2.2.1 Simple Probability

2.2.2 Joint Probability