Internet Network and Security

1. KERBEROS &
COVERT CHANNELS
©neo

2. TOPICS
COVERED
• KERBEROS
• COVERT CHANNELS
 What
 What
is Kerberos?
 How It Works?
 Applications of Kerberos
are Covert Channels?
 How It Works?
 Example
 Conclusion
©neo

3. KERBEROS
©neo

4. WHAT IS KERBEROS?
• Kerberos is a secure method for authenticating a
request for a service in a computer network.
• Kerberos was developed in the Athena Project at
the Massachusetts Institute of Technology (MIT).
• Kerberos lets a user request an encrypted "ticket"
from an authentication process that can then be
used to request a particular service from a server.
• The user's password does not have to pass
through the network.
©neo

5. XYZ Service
Think “Kerberos Server” and don’t
let yourself get mired in
terminology.
Ticket
Granting
Service
Key
Distribution
Center
AuthenTication
Service
Susan
Susan’s
Desktop
Computer
©neo

6. XYZ Service
Represents something
requiring Kerberos
authentication (web
server, ftp server, ssh
server, etc…)
Ticket
Granting
Service
Key
Distribution
Center
AuthenTication
Service
Susan
Susan’s
Desktop
Computer
©neo

7. Ticket
Granting
Service
XYZ Service
“I’d like to be allowed to
get tickets from the Ticket
Granting Server, please.
Key
Distribution
Center
AuthenTication
Service
Susan
Susan’s
Desktop
Computer
©neo

8. XYZ Service
“Okay. I locked this box with your
secret password. If you can unlock
it, you can use its contents to
access my Ticket Granting Service.”
Ticket
Granting
Service
Key
Distribution
Center
AuthenTication
Service
Susan
Susan’s
Desktop
Computer
©neo

9. Ticket
Granting
Service
XYZ Service
Key
Distribution
Center
TGT
Susan
AuthenTication
Service
Susan’s
Desktop
Computer
©neo

10. TGT
Because Susan was able to open the box
(decrypt a message) from the Authentication
Service, she is now the owner of a shiny
“Ticket-Granting Ticket”.
The Ticket-Granting Ticket (TGT) must be
presented to the Ticket Granting Service in
order to acquire “service tickets” for use with
services requiring Kerberos authentication.
The TGT contains no password information.
©neo

11. “Let me prove I am Susan
to XYZ Service.
XYZ Service
Here’s a copy of my TGT!”
Ticket
Granting
Service
Key
Distribution
Center
T
TGTGT
Susan
AuthenTication
Service
Susan’s
Desktop
Computer
©neo

12. Hey XYZ:
Susan is Susan.
CONFIRMED: TGS
XYZ Service
You’re Susan.
Here, take this.
TGT
Susan
Ticket
Granting
Service
Key
Distribution
Center
AuthenTication
Service
Susan’s
Desktop
Computer
©neo

13. XYZ Service
I’m Susan. I’ll prove it.
Here’s a copy of my legit
service ticket for XYZ.
Ticket
Granting
Service
Key
Distribution
Center
Hey XYZ:
Hey XYZ:
Susan is Susan.
Susan is Susan.
CONFIRMED: TGS
CONFIRMED: TGS
Susan
TGT
AuthenTication
Service
Susan’s
Desktop
Computer
©neo

14. That’s Susan alright. Let me
determine if she is authorized to
use me.
XYZ Service
Hey XYZ:
Susan is Susan.
CONFIRMED: TGS
Key
Distribution
Center
Hey XYZ:
Susan is Susan.
CONFIRMED: TGS
Susan
Ticket
Granting
Service
TGT
AuthenTication
Service
Susan’s
Desktop
Computer
©neo

15. Authorization checks are performed by the
XYZ service…
Just because Susan has authenticated herself
does not inherently mean she is authorized to
make use of the XYZ service.
©neo

16. One remaining note:
Tickets (your TGT as well as service-specific
tickets) have expiration dates configured by
your local system administrator(s). An expired
ticket is unusable.
Until a ticket’s expiration, it may be used
repeatedly.
©neo

17. XYZ Service
ME AGAIN! I’ll prove it.
Here’s another copy of my
legit service ticket for XYZ.
Ticket
Granting
Service
Key
Distribution
Center
Hey XYZ:
Hey XYZ:
Susan is Susan.
Susan is Susan.
CONFIRMED: TGS
CONFIRMED: TGS
Susan
TGT
AuthenTication
Service
Susan’s
Desktop
Computer
©neo

18. That’s Susan… again. Let me
determine if she is authorized to
use me.
XYZ Service
Hey XYZ:
Susan is Susan.
CONFIRMED: TGS
Key
Distribution
Center
Hey XYZ:
Susan is Susan.
CONFIRMED: TGS
Susan
Ticket
Granting
Service
TGT
AuthenTication
Service
Susan’s
Desktop
Computer
©neo

19. APPLICATIONS
 Authentication
 Authorization
 Confidentiality
 Within networks and small sets of
networks
©neo

20. COVERT CHANNELS
©neo

21. WHAT ARE COVERT CHANNELS ?
•“A path of communication that was not
designed to be used for communication.”
•Covert channels arise in many situations,
particularly in network communications.
•Covert channels are virtually impossible to
eliminate, and the emphasis is instead on
limiting the capacity of such channels.
©neo

22. FOR EXAMPLE
Suppose Alice has a TOP SECRET clearance while Bob only has a CONFIDENTIAL
clearance. If the file space is shared by all users then Alice and Bob can agree that
if Alice wants to send a 1 to Bob, she will create a file named, say, FileXYzW and if
she wants to send a 0 she will not create such a file.
Bob can check to see whether file FileXYzW exists, and, if it does he knows Alice
has sent him a 1, and if it does not, Alice has sent him a 0. In this way, a single bit
of information has been passed through a covert channel, that is, through a
means that was not intended for communication by the designers of the system.
©neo

23. COVERT CHANNELS
A single bit leaking from Alice to Bob is probably not a
concern, but Alice could leak any amount of
information by synchronizing with Bob.
For example, Alice and Bob could agree that Bob will
check for the file FileXYzW once each minute. As
before, if the file does not exist, Alice has sent 0, and, if
it does exists, Alice has sent a 1.
In this way Alice can (slowly) leak TOP SECRET
information to Bob. An printing queue can be similarly
used as a covert channel.
©neo

24. COVERT CHANNELS
Three things are required for a covert channel to exist.
• First, the sender and receiver must have access to a
shared resource.
• Second, the sender must be able to vary some property of
the shared resource that the receiver can observe.
• Finally, the sender and receiver must be able to
synchronize their communication.
It’s apparent that covert channels are extremely common.
Probably the only way to completely eliminate all covert
channels is to eliminate all shared resources and all
communication.
©neo

25. Thank you
©neo

26. Presentation By:
Shweta Agrawal
Puneet Bhat
Raj Bhatt
Shaun Bothelo
-
02
12
14
15
©neo