4.3.31 · D1Network security — DDoS, man-in-the-middle, replay attacks,
Network security ka matlab hai un messages ko protect karna jo do trusting parties ke beech ek aise wire par travel karte hain jise koi stranger touch kar sakta hai . Is page par jo kuch bhi hai woh sirf teen sawaalon ka jawab dene ke liye tools hain: kisne bheja? (authentication), kya yeh naya hai? (freshness), aur kya main fake kaam mein duba diya ja raha hoon? (resource limits).
Parent note Network security — DDoS, MITM, replay & countermeasures padhne se pehle, tumhe uske symbols ek nazar mein padhne aane chahiye. Yeh page har ek symbol ko scratch se build karta hai, ek aisi order mein jahan har idea sirf upar wale ideas par tika ho.
Ek simple drawing socho. Left side par ek insaan — uska naam Alice hai. Right side par Bob hai. Dono ke beech mein ek line — yeh network wire hai. Us wire par baitha hua , har cheez dekhne aur chhoone ke saath, hai Eve — attacker.
Alice / Bob — do honest parties jo baat karna chahte hain. Picture mein, dono ends par khade do log.Eve — attacker jo wire par messages ko read, copy, delete, ya inject kar sakti hai. Line par baitha dikhayi jaati hai, kyunki woh literally medium ke middle mein hai.Message m SYN packet). Arrow par ek chhota sa envelope bana kar dikhaate hain.
Parent note mein jo bhi attack hai woh sirf Eve ka usi kaam karna hai jo uski position allow karti hai. Humein symbols chahiye jo yeh describe karein ki woh kya karti hai aur hum use kaise rokte hain — yeh hi is page ka baaki hissa hai.
Parent note SYN, SYN-ACK, ACK, "half-open", "backlog" baar baar use karta hai. Yeh wahan se aate hain.
Packet ek chhota labelled data ka envelope hai. Uske label par hamesha ek source address hota hai ("main kahan se claim karta hoon") aur ek destination address ("main kahan ja raha hoon"). Bas — ek envelope jisme from-line aur to-line hai.
From-line bahut important hai: basic network par koi bhi check nahi karta ki from-line sach hai. Jhoothi from-line likhna spoofing kehlata hai — SYN floods aur reflection ke peeche yahi ek trick hai.
Definition TCP three-way handshakeDo computers TCP par data exchange karne se pehle ek teen-step greeting karte hain:
Client → Server: SYNsynchronize ).
Server → Client: SYN-ACK
Client → Server: ACKacknowledge ).
Poori detail yahan hai: Transport Layer — TCP three-way handshake .
Topic ko yeh kyun chahiye: step 2 ke baad server ne likh liya hai ki yeh half-finished connection kiske saath hai, taaki woh ACK aane par pehchaan sake. Yeh likh-rakha note half-open connection kehlata hai, aur jis shelf par yeh rakhta hai woh hai backlog queue . Poora SYN-flood attack yahi hai ki Eve us shelf ko aise greetings se bhara de jo woh kabhi khatam nahi karti.
B T
B slots ki sankhya . Ek fixed, limited number (jaise 128).T T ACK ka intezaar karte hue rakhta hai==.
B T
SYN-flood formula hai λ ≥ B / T
λ λ rate hai: kitni cheezein per second hoti hain. Attacker har second 5000 SYNs bhej raha hai matlab λ = 5000 s − 1 λ
L W
L abhi system ke andar baithe items ki average sankhya (currently held slots).W har item kitni der tak andar rehta hai ka average (yahan W = T
c a c s
c a attacker ko ek attack packet ki kitni cost aati hai (effort, bytes, memory).c s server ko kitna kharch karwa deta hai .
Ek see-saw socho: attacker ka chhota weight ek taraf, server ka bada forced weight doosri taraf.
≫ ∥
≫ ∥ concatenation : do data pieces ko end se end se jodhna. m ∥ n m n
MITM aur replay dono keys par depend karte hain. Yeh minimum vocabulary hai.
Definition Shared secret / keyK Key K aisa number hai jo sirf dono honest parties jaante hain, Eve nahi . Socho ek identical physical key jo sirf Alice aur Bob ke paas hai. Isse woh messages lock (encrypt) kar sakte hain aur authorship prove kar sakte hain (MAC).
Definition Diffie–Hellman shared keyK 1 K 2 Diffie–Hellman key exchange Alice K 1 Eve K 2 Bob , K 1 K 2 YEH KYUN MATTER KARTA HAI: DH secrecy deta hai lekin yeh nahi batata ki tumne kiske saath agree kiya — toh Eve beech mein baith ke do agreements chala sakti hai. Yahi gap poore MITM section ka aadhar hai.
Definition MAC aur notationMAC K ( m ) Message Authentication Code ek chhota ==tag hai jo message m K MAC K ( m ) K m K K Message Authentication Codes (MAC) & HMAC .
Yeh ek saath do sawaalon ka jawab deta hai: kya yeh sach mein K aur kya isme koi badlaav hua? — kyunki m
n T s
Nonce n — ek baar use hone wala number ("n umber used once "). Har fresh message naya n n Timestamp T s — message banane ka clock time . Tabhi accept karo jab yeh recent ho, yaani window Δ
Δ ∣ T now − T s ∣ ≤ Δ Δ tolerance hai — hum message ko kitna stale hone denge. Bars ∣ ⋅ ∣ absolute value hai: gap ka size , sign ignore karke, toh future ya past ka message dono hi distance se judge hote hain. Socho ek sliding time-window; sirf andar ke messages andar aane dete hain.
Topic ko yeh sab kyun chahiye: ek replay attack ek genuine, valid message dobara bhejta hai. Encryption ise rok nahi sakta — copy abhi bhi theek se decrypt hogi. Sirf ek one-time ingredient (n T s n t = MAC K ( m ∥ n )
Definition Certificate & CACertificate ek signed statement hai "yeh public key is naam se belong karti hai" jo ek trusted Certificate Authority (CA) issue karta hai. Socho ek passport: ek trusted office vouches karta hai ki photo (key) us insaan (domain) se match karti hai. Yahi unauthenticated DH ko safe TLS handshake banata hai; trust chain hai Public Key Infrastructure & Certificates .
r Challenge r fresh random number hai jo verifier bhejta hai ("prove karo tum abhi zinda ho"). Response MAC K ( r ) K abhi, is r . Agली baar naya r
Packet with spoofable source
TCP handshake SYN SYN-ACK ACK
Little's Law L equals lambda W
Nonce n and timestamp T_s
Har cue padho, aawaaz mein jawab do, phir reveal karo.
Spoofed source address se attacker kya kar sakta hai?Aisi packets bhej sakta hai jo kisi aur ki taraf se aati lagin, taaki replies (ya blame) ek victim ko jayein aur asli bhejna wala chhupa rahe.
TCP handshake teen shabdon mein batao. SYN, SYN-ACK, ACK.
λ ≥ B / T λ B T λ B T
Little's Law ek equation mein. L = λW
Amplification factor A = c s / c a Attacker ki ek unit effort par server ka kitna cost jalta hai; A ≫ 1
m ∥ n Concatenation — pehle m n
MAC K ( m ) Ki message key K
Encryption akele replay kyun nahi rok sakti? Ek copied valid ciphertext abhi bhi sahi se decrypt hogi; freshness ke liye ek one-time nonce ya timestamp chahiye.
Nonce n Ki message sirf ek baar use ho; receiver ek "dekha hua" set rakhta hai aur koi bhi repeated n
∣ T now − T s ∣ ≤ Δ Aisi messages jinka timestamp abhi se Δ
Plain Diffie–Hellman mein jo gap hai usse certificate kaise fill karta hai? Authentication — yeh ek public key ko ek identity se bind karta hai, taaki tum jaano kiske saath tumne secret agree kiya.
