Cisco PIX 525 Especificaciones descargar pdf (Pagina 220)

6-8

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Using Certification Authorities

CA Overview

Certification authorities (CAs) are responsible for managing certificate requests and issuing digital

certificates. A digital certificate contains information that identifies a user or device, such as a name,

serial number, company, department, or IP address. A digital certificate also contains a copy of the

entity’s public key. A CA can be a trusted third party, such as VeriSign, or a private (in-house) CA that

you establish within your organization.

Public Key Cryptography

Digital signatures, enabled by public key cryptography, provide a means to digitally authenticate devices

and individual users. In public key cryptography, such as the RSA encryption system, each user has a

key-pair containing both a public and a private key. The keys act as complements, and anything

encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed

when data is encrypted with a user’s private key. The receiver verifies the signature by decrypting the

message with the sender’s public key.

The fact that the message could be decrypted using the sender’s public key means that the holder of the

private key created the message. This process relies on the receiver having a copy of the sender’s public

key and knowing with a high degree of certainty that it really does belong to the sender, and not to

someone pretending to be the sender.

To validate the CA’s signature, the receiver must know the CA’s public key. Normally this is handled

out-of-band or through an operation done at installation. For instance, most web browsers are configured

with the root certificates of several CAs by default. The IKE, a key component of IPSec, can use digital

signatures to authenticate peer devices before setting up security associations.

Certificates Provide Scalability

Without digital certificates, each IPSec peer must be manually configured for every peer with which it

communicates. Without certificates, every new peer added to the network requires a configuration

change on every other peer it securely communicates with. However, when using digital certificates,

each peer is enrolled with a CA. When two peers wish to communicate, they exchange certificates and

digitally sign data to authenticate each other.

When a new peer is added to the network, one simply enrolls that peer with a CA, and none of the other

peers need modification. When the new peer attempts an IPSec connection, certificates are automatically

exchanged and the peer can be authenticated.

With a CA, a peer authenticates itself to the remote peer by sending a certificate to the remote peer and

performing some public key cryptography. Each peer sends its own unique certificate which was issued

and validated by the CA. This process works because each peer’s certificate encapsulates the peer’s

public key, each certificate is authenticated by the CA, and all participating peers recognize the CA as

an authenticating authority. This is called IKE with an RSA signature.

The peer can continue sending its own certificate for multiple IPSec sessions, and to multiple IPSec

peers, until the certificate expires. When its certificate expires, the peer administrator must obtain a new

one from the CA.

1 2 ... 215 216 217 218 219 220 221 222 223 224 225 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 220

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525