e-Xpert Gate / Reverse Proxy - WAF 1ere génération
Download as PPT, PDF1 like735 views
The document discusses e-Xpert Gate, a web-based secure access solution that allows users to access internal applications from any device with a web browser. It provides strong authentication using RSA SecurID or SSL client certificates to securely access intranet resources through a firewall. The solution uses SSL/TLS to encrypt traffic and authenticate users, preventing direct unsecured access to internal servers and networks.
![e-Xpert Gate e-Xpert Solutions SA [email_address] 2 mars 2001](https://image.slidesharecdn.com/e-xpertgate-090531095145-phpapp02/85/e-Xpert-Gate-Reverse-Proxy-WAF-1ere-generation-1-320.jpg)
e-Xpert Gate / Reverse Proxy - WAF 1ere génération
- 1. e-Xpert Gate e-Xpert Solutions SA [email_address] 2 mars 2001
- 2. e-Xpert Gate ? Access your applications from everywhere with strong confidentiality and authentication
- 3. About your need Access internal information from everywhere Access information with high security No specific client software Simple to use No dedicated station Cost effective solution
- 4. Solution ? Use your favorite browser
- 5. Why my browser ? Very good « footprint » Standard sofware client Free Very good level of security (with SSL) PKI enabled application
- 6. But how to solve security issue ? Web-based Internal Resources What should I do ? Firewall Dmz Browser
- 7. Direct access with http or https ? Firewall Dmz Browser Web-based Internal Resources Why not ?
- 8. Direct access drawback Direct access using HTTP Clear traffic (password and content snifing) No authentication No data integrity Direct access to internal content servers Permit attacks DoS Direct access to internal networks Permit to access other resources if server compromised
- 9. Secure access with e-Xpert Gate Firewall Dmz Browser Web-based Internal Resources E-Xpert Gate SSL
- 10. Secure access thrue e-Xpert Gate Use SSL technology (PKI) Provide authentication (server and client) Provide confidentiality Provide data integrity No direct access to internal ressources URL content checking and blocking Permit content analysis with IDS system
- 11. Reverse Proxy Technology Server within a firewall The proxy server appears to be the content server A client computer on the Internet sends a request to the proxy server Firewall CACHE The proxy server uses a regular mapping to forward the client request to the internal content server You can configure the firewall router to allow a specific server on a specific port (in this case, the proxy on its assigned port) to have access through the firewall without allowing any other machine in or out. https (SSL) http or https
- 12. SSL/TLS Technology S ecure S ockets L ayer TCP/IP socket encryption Provides end-to-end protection of communications sections Confidentiality protection via encryption Integrity protection with MAC’s Can authenticate client (option)
- 13. SSL/TLS Technology The SSL protocol runs above TCP/IP The SSL protocol runs below higher-level protocols such as HTTP or IMAP
- 14. Applications that use SSL or TLS e- C ommerce – orders – e-Banking protects contents of forms sent to server protects sensitive personal data provides authentication Secure web-based intranet access ensures secure transmission of confidential content provides authentication Etc.
- 15. SSL/TLS history SSL v1 designed by Netscape in 1994 SSL v2 shipped with Navigator 1.0 and 2.0 SSL v3 latest version TLS v1 developed by IETF aka SSL v3.1
- 16. About authentication ? Your business is on the line. But do you really know who’s on the other end?
- 18. One-Factor User Authentication Drawback Users choose weak password Easy to guess (Brute force, dictionary) Easy to use a key logger or sniffer Learn password by « Social Engineering »
- 19. e-Xpert Gate’s Authentication method Native RSA SecurID authentication SSL Client authentication (PKI) Certificate store on SmartCard or iKey Certificate store on a file External authentication with firewall Radius, Tacacs, Ldap Basic HTTP authentication* * Method not recommended
- 20. RSA SecurID implementation Dmz Web-based Internal Resources E-Xpert Gate
- 21. RSA tokens
- 22. How it works ? Seed Time 482392 ACE/Server Token Algorithm Seed Time 482392 Algorithm Same Seed Same Time
- 23. SecurID exemple
- 24. SSL client authentication implementation Dmz Web-based Internal Resources PKI architecture Client X509 Certificate E-Xpert Gate
- 25. What is a certificate
- 26. X509 Authentication Uses SSL client X.509 certificate Provides strong authentication (“something you have, something you know”) Requires a Certificate authority (Public or Private) Certificate can be stored on local host or on smart card or IKey
- 27. Client side authentication Web Client Web Server Challenge Client Certificate Request Challenge answer Client Certificate
- 28. How secure is the private key ? How does the user get access? Where is it stored? Smart Card PIN Password Local Browser store Private key
- 29. SmartCard and iKey Provides strong authentication (protect the private key) Serial, PCMCIA, USB Requires smart card reader...
- 30. e-Xpert Gate Applications Consults Email system like Microsoft Exchange, Lotus, Netscape, etc… Accesses Intranet applications E-Banking solution (front-end) Extranet applications with partners Etc.
- 31. Lotus access with e-Xpert Gate
- 33. e-Xpert Gate ’s key features Authentication method RSA SecurID SSL client authentication Basic HTTP External authentication with firewall PKI enabled application Support Revocation CRL Ldap
- 34. e-Xpert Gate ’s key features Security protocols SSL version 2.0, 3.0 TLS version 1.0 Ciphers and Algorithms Key exchange: RSA Symmetric ciphers: DES 56, 3DES 168, RC4, RC2, IDEA 128 Hashes: MD5, SHA-1
- 35. e-Xpert Gate ’s key features Fully supports Verisign Global Server IDs (128 bits for every browser) Supports hardware cryptographic accelerators Rainbow
- 36. e-Xpert Gate ’s key features Secure OS (Linux or Solaris) FIA with Tripwire Management with SSH server Secure file transfer with SSH Syslog messages Appliance solution IBM Sun Microsystems
- 37. Questions ?