TCP/IP Security

TCP/IP is widely used throughout the world to provide network communications.  TCP/IP communications are composed of four layers that work together.  When a user wants to transfer data across networks, the data is passed from the highest layer through intermediate layers to the lowest layer, with each layer adding information.  At each layer, the logical units are typically composed of a header and a payload.  The payload consists of the information passed down from the previous layer, while the header contains layer-specific information such as addresses.  At the application layer, the payload is the actual application data.  The lowest layer sends the accumulated data through the physical network; the data is then passed up through the layers to its destination.  Essentially, the data produced by a layer is encapsulated in a larger container by the layer below it.  The four TCP/IP layers, from highest to lowest, are shown below.

• Application Layer.  This layer sends and receives data for particular applications, such as Domain Name System (DNS), HyperText Transfer Protocol (HTTP), and Simple Mail Transfer Protocol (SMTP).
• Transport Layer.  This layer provides connection-oriented or connectionless services for transporting application layer services between networks.  The transport layer can optionally assure the reliability of communications.  Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are commonly used transport layer protocols.
• Network Layer.  This layer routes packets across networks.  Internet Protocol (IP) is the fundamental network layer protocol for TCP/IP.  Other commonly used protocols at the network layer are Internet Control Message Protocol (ICMP) and Internet Group Management Protocol (IGMP).
• Data Link Layer.  This layer handles communications on the physical network components.  The best-known data link layer protocol is Ethernet.

Security controls exist for network communications at each layer of the TCP/IP model.  As previously explained, data is passed from the highest to the lowest layer, with each layer adding more information.  Because of this, a security control at a higher layer cannot provide protection for lower layers, because the lower layers perform functions of which the higher layers are not aware.  Security controls that are available at each layer include:

• Application Layer.  Separate controls must be established for each application.  For example, if an application needs to protect sensitive data sent across networks, the application may need to be modified to provide this protection.  While this provides a very high degree of control and flexibility over the application’s security, it may require a large resource investment to add and configure controls properly for each application.  Designing a cryptographically sound application protocol is very difficult, and implementing it properly is even more challenging, so creating new application layer security controls is likely to create vulnerabilities.  Also, some applications, particularly off-the-shelf software, may not be capable of providing such protection.  While application layer controls can protect application data, they cannot protect TCP/IP information such as IP addresses because this information exists at a lower layer.  Whenever possible, application layer controls for protecting network communications should be standards-based solutions that have been in use for some time.  One example is Secure Multipurpose Internet Mail Extensions (S/MIME), which is commonly used to encrypt email messages.
• Transport Layer.  Controls at this layer can be used to protect the data in a single communication session between two hosts.  Because IP information is added at the network layer, transport layer controls cannot protect it.  The most common use for transport layer protocols is securing HTTP traffic; the Transport Layer Security (TLS) protocol is usually used for this.  (TLS is the standards-based version of SSL version 3.  More information on TLS is available in RFC 4346, The TLS Protocol Version 1.1, available at http://www.ietf.org/rfc/rfc4346.txt.  Another good source of information is NIST SP 800-52, Guidelines on the Selection and Use of Transport Layer Security, available from http://csrc.nist.gov/publications/nistpubs/.) The use of TLS typically requires each application to support TLS; however, unlike application layer controls, which typically involve extensive customization of the application, transport layer controls such as TLS are much less intrusive because they do not need to understand the application’s functions or characteristics.  Although using TLS may require modifying some applications, TLS is a well-tested protocol that has several implementations that have been added to many applications, so it is a relatively low-risk option compared to adding protection at the application layer.  Traditionally TLS has been used to protect HTTP-based communications and can be used with SSL portal VPNs.
• Network Layer.  Controls at this layer can be applied to all applications; thus, they are not application-specific.  For example, all network communications between two hosts or networks can be protected at this layer without modifying any applications on the clients or the servers.  In some environments, network layer controls such as Internet Protocol Security (IPsec) provide a much better solution than transport or application layer controls because of the difficulties in adding controls to individual applications.  Network layer controls also provide a way for network administrators to enforce certain security policies.  Another advantage of network layer controls is that since IP information (e.g., IP addresses) is added at this layer, the controls can protect both the data within the packets and the IP information for each packet.  However, network layer controls provide less control and flexibility for protecting specific applications than transport and application layer controls.  SSL tunnel VPNs provide the ability to secure both TCP and UDP communications including client/server and other network traffic, and therefore act as network layer VPNs.
• Data Link Layer.  Data link layer controls are applied to all communications on a specific physical link, such as a dedicated circuit between two buildings or a dial-up modem connection to an Internet Service Provider (ISP).  Data link layer controls for dedicated circuits are most often provided by specialized hardware devices known asdata link encryptors; data link layer controls for other types of connections, such as dial-up modem communications, are usually provided through software.  Because the data link layer is below the network layer, controls at this layer can protect both data and IP information.  Compared to controls at the other layers, data link layer controls are relatively simple, which makes them easier to implement; also, they support other network layer protocols besides IP.  Because data link layer controls are specific to a particular physical link, they cannot protect connections with multiple links, such as establishing a VPN over the Internet.  An Internet-based connection is typically composed of several physical links chained together; protecting such a connection with data link layer controls would require deploying a separate control to each link, which is not feasible.  Data link layer protocols have been used for many years primarily to provide additional protection for specific physical links that should not be trusted.

Because they can provide protection for many applications at once without modifying them, network layer security controls have been used frequently for securing communications, particularly over shared networks such as the Internet.  Network layer security controls provide a single solution for protecting data from all applications, as well as protecting IP information.  Nevertheless, in many cases, controls at another layer are better suited to providing protection than network layer controls.  For example, if only one or two applications need protection, a network layer control may be excessive.  Transport layer protocols such as SSL are most commonly used to provide security for communications with individual HTTP-based applications, although they are also used to provide protection for communication sessions of other types of applications such as SMTP, Point of Presence (POP), Internet Message Access Protocol (IMAP), and File Transfer Protocol (FTP).  Because all major Web browsers include support for TLS, users who wish to use Web-based applications that are protected by TLS normally do not need to install any client software or reconfigure their systems.  Newer applications of transport layer security protocols protect both HTTP and non-HTTP application communications, including client/server applications and other network traffic.  Controls at each layer offer advantages and features that controls at other layers do not.

SSL is the most commonly used transport layer security control.  Depending on how SSL is implemented and configured, it can provide any combination of the following types of protection:

• Confidentiality.  SSL can ensure that data cannot be read by unauthorized parties.  This is accomplished by encrypting data using a cryptographic algorithm and a secret key—a value known only to the two parties exchanging data.  The data can only be decrypted by someone who has the secret key.
• Integrity.  SSL can determine if data has been changed (intentionally or unintentionally) during transit.  The integrity of data can be assured by generating a message authentication code (MAC) value, which is a keyed cryptographic checksum of the data.  If the data is altered and the MAC is recalculated, the old and new MACs will differ.
• Peer Authentication.  Each SSL endpoint can confirm the identity of the other SSL endpoint with which it wishes to communicate, ensuring that the network traffic and data is being sent from the expected host.  SSL authentication is typically performed one-way, authenticating the server to the client, but it can be performed mutually.
• Replay Protection.  The same data is not delivered multiple times, and data is not delivered grossly out of order.