Data Security in Local Network Using Distributed Firewall

DATA SECURITY IN LOCAL NETWORK USING DISTRIBUTED FIREWALL A SEMINAR REPORT Submitted by ANAND KUMAR in partial fulfillment of requirement of the Degree of Bachelor of Technology (B.Tech) IN COMPUTER SCIENCE AND ENGINEERING SCHOOL OF ENGINEERING COCHIN UNIVERSITY OF SCIENCE AND TECHNOLOGY KOCHI- 682022 AUGUST 2008 DIVISION OF COMPUTER SCIENCE AND ENGINEERING SCHOOL OF ENGINEERING COCHIN UNIVERSITY OF SCIENCE AND TECHNOLOGY KOCHI-682022 Certificat e Certified that this is a bonafide record of the seminar entitled “DATA SECURITY IN LOCAL NETWORK USING DISTRIBUTED FIREWALL ” presented by the following student ANAND KUMAR of the VII semester, Computer Science and Engineering in the year 2008 in partial fulfillment of the requirements in the award of Degree of Bachelor of Technology in Computer Science and Engineering of Cochin University of Science and Technology. Ms. Latha R. Nair. Dr. David Peter S. Seminar Guide Head of Division Date : Acknowledgement Many people have contributed to the success of this. Although a single sentence hardly suffices, I would like to thank Almighty God for blessing us with His grace. I extend my sincere and heart felt thanks to Dr. David Peter, Head of Department, Computer Science and Engineering, for providing us the right ambience for carrying out this work. I am profoundly indebted to my seminar guide, Ms. Latha R. Nair for innumerable acts of timely advice, encouragement and I sincerely express my gratitude to her. I express my immense pleasure and thankfulness to all the teachers and staff of the Department of Computer Science and Engineering, CUSAT for their cooperation and support. Last but not the least, I thank all others, and especially my classmates who in one way or another helped me in the successful completion of this work. ANAND KUMAR ABSTRAC T Today, computer and networking are inseparable. A number of confidential transactions occur every second and today computers are used mostly for transmission rather than processing of data. So Network Security is needed to prevent hacking of data and to provide authenticated data transfer. Network Security can be achieved by Firewall. Conventional firewalls rely on the notions of restricted topology and controlled entry points to function. Restricting the network topology, difficulty in filtering of certain protocols, End-to-End encryption problems and few more problems lead to the evolution of Distributed Firewalls. Distributed firewalls secure the network by protecting critical network endpoints, exactly where hackers want to penetrate. It filters traffic from both the Internet and the internal network because the most destructive and costly hacking attacks still originate from within the organization. They provide virtually unlimited scalability. In addition, they overcome the single point-of-failure problem presented by the perimeter firewall. Some problems with the conventional firewalls that lead to Distributed Firewalls are as follows. Depends on the topology of the network. Do not protect networks from the internal attacks. Unable to handle protocols like FTP and RealAudio. Have single entry point and the failure of this leads to problems. Unable to stop spoofed transmissions (i.e., using false source addresses). Distribute firewall solves these problems and protecting critical network end points where hackers want to penetrate. It filters the traffic from both the internal network and internet because most destructive and costly hacking attacks still originate within organization. TABLE OF CONTENTS Chapter No. Title Page LIST OF FIGURES ii 1 Introduction 1 2 Policy and Identifiers 5 3 Distributed Firewall 6 3.1 Standard Firewall Example 10 3.2 Distributed Firewall Example 13 4 KeyNote 15 5 Implementation 20 5.1 Kernel Extensions 21 5. 2 Policy Device 24 5.3 Policy Daemon 25 5.4 Example Scenario 27 6 Work in Development 28 7 Related Work 30 8 Conclusion 32 9 References 35 i LIST OF FIGURES NO: NAME PAGE 1 Architecture of Distributed Firewall 7 2 Architecture of standard firewall 10 3 Connection to the Web Server in standard firewall 11 4 Connection to the Intranet in standard firewall 12 5 Distributed Firewall 13 6 Connection to the Web Server distributed firewall 14 7 Connection to the Intranet in distributed firewall 15 8 Interactions with KeyNote 16 9 Graphical representation with all components 21 10 Filtering connect( ) and accept( ) system calls 22 ii Data Security in Local network Using Distributed Firewall 1. Introduction Conventional firewalls rely on the notions of restricted topology and control entry points to function. More precisely, they rely on the assumption that everyone on one side of the entry point--the firewall--is to be trusted, and that anyone on the other side is, at least potentially, an enemy. The vastly expanded Internet connectivity in recent years has called that assumption into question. So-called "extranets" can allow outsiders to reach the "inside" of the firewall; on the other hand, telecommuters' machines that use the Internet for connectivity need protection when encrypted tunnels are not in place. While this model worked well for small to medium size networks, several trends in networking threaten to make it obsolete: Due to the increasing line speeds and the more computation intensive protocols that a firewall must support (especially IPsec), firewalls tend to become congestion points. This gap between processing and networking speeds is likely to increase, at least for the foreseeable future; while computers (and hence firewalls) are getting faster, the combination of more complex protocols and the tremendous increase in the amount of data that must be passed through the firewall has been and likely will continue to outpace Moore’s Law. There exist protocols, and new protocols are designed, that are difficult to process at the firewall, because the latter lacks certain knowledge that is readily available at the endpoints. FTP and RealAudio are two such protocols. Although there exist application-level proxies that handle such protocols, such solutions are viewed as architecturally “unclean” and in some cases too invasive. The assumption that all insiders are trusted has not been valid for a long time. Specific individuals or remote networks may be allowed access to all or parts of the protected infrastructure (extranets, telecommuting, etc.). Consequently, the traditional notion of a security perimeter can no longer hold unmodified; for example, it is desirable that telecommuters’ systems comply with the corporate security policy. Department of Computer Science,SOE,CUSAT 1 Worse yet, it has become trivial for anyone to establish a new, unauthorized entry point to the network without the administrator’s knowledge and consent. Various forms of tunnels, wireless, and dial-up access methods allow individuals to establish backdoor access that bypasses all the security mechanisms provided by traditional firewalls. While firewalls are in general not intended to guard against misbehavior by insiders, there is a tension between internal needs for more connectivity and the difficulty of satisfying such needs with a centralized firewall. IPsec is a protocol suite, recently standardized by the IETF that provides network-layer security services such as packet confidentiality, authentication, data integrity, replay protection, and automated key management. This is an artifact of firewall deployment: internal traffic that is not seen by the firewall cannot be filtered; as a result, internal users can mount attacks on other users and networks without the firewall being able to intervene. If firewalls were placed everywhere, this would not be necessary. Large (and even not-so-large) networks today tend to have a large number of entry points (for performance, failover, and other reasons). Furthermore, many sites employ internal firewalls to provide some form of compartmentalization. This makes administration particularly difficult, both from a practical point of view and with regard to policy consistency, since no unified and comprehensive management mechanism exists. End-to-end encryption can also be a threat to firewalls, as it prevents them from looking at the packet fields necessary to do filtering. Allowing end-to-end encryption through a firewall implies considerable trust to the users on behalf of the administrators. Finally, there is an increasing need for finer-grained (and even application specific) access control which standard firewalls cannot readily accommodate without greatly increasing their complexity and processing requirements. 2 Other trends are also threatening firewalls. For example, some machines need more access to the outside than do others. Conventional firewalls can do this, but only with difficulty, especially as internal IP addresses change. End-to-end encryption is another threat, since the firewall generally does not have the necessary keys to peek through the encryption. More subtly, firewalls are a mechanism for policy control. That is, they permit a site's administrator to set a policy on external access. Just as file permissions enforce an internal security policy, a firewall can enforce an external security policy. Despite their shortcomings, firewalls are still usef ul in providing some measure of security. The key reason that firewalls are still useful is that they provide an obvious, mostly hassle-free, mechanism for enforcing network security policy. For legacy applications and networks, they are the only mechanism for security. While newer protocols typically have some

Load more