【正文】 nication on the Inter Inter上通信的協(xié)定 ? Consists of five layers of software 包含 5層軟件 10 Chapter 6 TCP/IP Layers TCP/IP層 Fig Layer Number Layer Name 5 (Highest) Application 4 Transport 3 Inter 2 Data link 1 (Lowest) Physical 11 Chapter 6 TCP/IP Layers Fig Application Layer Transport Layer Inter Layer Data Link Layer Physical Layer 12 Chapter 6 TCP/IP Concept TCP/IP概念 ? All layers except physical layer municate with adjacent layers on the same puter 除了物理層的所有層都和同一計(jì)算機(jī)上的相鄰層進(jìn)行通信 ? Physical layer is the only layer where actual transmission between two puters happens 物理層是唯一在兩個(gè)計(jì)算機(jī)間進(jìn)行實(shí)際數(shù)據(jù)傳輸?shù)膶? 13 Chapter 6 TCP/IP Communication TCP/IP通信 Fig X Y Intermediate nodes Application Transport Network Data Link Physical Network Data Link Physical Application Transport Network Data Link Physical Communication link Network Data Link Physical Network Data Link Physical 14 Chapter 6 Data Exchange using TCP/IP Layers 使用 TCP/IP層交換數(shù)據(jù) X L5 data H4 010101010100010101010010 Transmission medium L5 data H3 L4 data H2 L3 data Y L5 data H4 010101010100010101010010 L5 data H3 L4 data H2 L3 data Application Transport Inter Data link Physical 15 Chapter 6 Secure Socket Layer (SSL) 安全套接層 ? World’s most widely used security mechanism on the Inter 全世界最廣泛使用的 Inter安全機(jī)制 ? Secures munication between a client and a server 實(shí)現(xiàn)客戶端和服務(wù)器端的安全通信 ? Located between the Application and Transport Layers of TCP/IP protocol suite 位于 TCP/IP協(xié)議組的應(yīng)用層和傳輸層之間 16 Chapter 6 Secure Socket Layer (SSL) 安全套接層 ? originally developed by Netscape 最初由 Netscape 公司開發(fā) ? SSL has two layers of protocols SSL有兩層協(xié)議 SSL Architecture 17 Chapter 6 Position of SSL in TCP/IP TCP/IP中 SSL的位置 Fig Application Layer Transport Layer Inter Layer Data Link Layer Physical Layer SSL Layer 18 Chapter 6 Data Exchange including SSL 包含 SSL的數(shù)據(jù)交換 Fig X L5 data 010101010100010101010010 Transmission medium H4 L5 data H3 L4 data Application Transport Inter Physical L5 data SSL SH H2 L3 data Data Link Y L5 data 010101010100010101010010 H4 L5 data H3 L4 data L5 data SH H2 L3 data 19 Chapter 6 SSL SubProtocols SSL子協(xié)議 ? Handshake Protocol 握手協(xié)議 ? Record Protocol 記錄協(xié)議 ? Alert Protocol 警報(bào)協(xié)議 20 Chapter 6 SSL Handshake Message Format SSL握手消息格式 Fig Type Length Content 1 byte 3 bytes 1 or more bytes 21 Chapter 6 SSL Handshake Messages SSL握手消息 Fig Message Type Parameters Hello request None Client hello Version, Random number, Session id, Cipher suite, Compression method Server hello Version, Random number, Session id, Cipher suite, Compression method Certificate Chain of certificates Server key exchange Parameters, signature Certificate request Type, authorities Server hello done None Certificate verify Signature Client key exchange Parameters, signature Finished Hash value 22 Chapter 6 SSL Handshake Protocol SSL握手協(xié)議 prises a series of messages in phases 由當(dāng)前狀態(tài)的一系列消息組成 –Establish Security Capabilities（ 建立安全能力） –Server Authentication and Key Exchange（ 服務(wù)器認(rèn)證和密鑰交換） –Client Authentication and Key Exchange（ 客戶端認(rèn)證和密鑰交換） –Finish（ 完成） 23 Chapter 6 SSL Handshake Process SSL握手處理 Fig Web Browser Web Server 1. Establish security capabilities 2. Server authentication and key exchange 3. Client authentication and key exchange 4. Finish 24 Chapter 6 SSL Handshake – Phase 1 SSL握手 1階段 Fig Web Browser Web Server Step 1: Client hello Step 2: Server hello 25 Chapter 6 SSL Handshake – Phase 2 SSL握手 2階段 Fig Web Browser Web Server Step 1: Certificate Step 2: Server key exchange Step 3: Certificate request Step 4: Server hello done 26 Chapter 6 SSL Handshake – Phase 3 SSL握手 3階段 Fig Web Browser Web Server Step 1: Certificate Step 2: Client key exchange Step 3: Certificate request 27 Chapter 6 SSL Handshake – Phase 4 SSL握手 4階段 Fig Web Browser Web Server Step 3: Change cipher specs Step 4: Finished 1. Change cipher specs 2. Finished 28 Chapter 6 SSL Handshake SSL握手 Finished Clint Server Client Hello SSL Server Hello Certificate Server Key Exchange Certificate Request Server Hello done Certificate Client Key Exchange Certificate Verify Change Cipher Spec Finishe