密码编码学与网络安全-原理与实践

CryptographyandNetworkSecurity

Overview&Chapter1FifthEditionbyWilliamStallings LectureslidesbyLawrieBrown.Chapter0–Reader’sGuideTheartofwarteachesustorelynotonthelikelihoodoftheenemy'snotcoming,butonourownreadinesstoreceivehim;notonthechanceofhisnotattacking,butratheronthefactthatwehavemadeourpositionunassailable. —TheArtofWar,SunTzu.RoadmapCryptographicalgorithmssymmetricciphersasymmetricencryptionhashfunctionsMutualTrustNetworkSecurityComputerSecurity.StandardsOrganizationsNationalInstituteofStandards&Technology(NIST)InternetSociety(ISOC)InternationalTelecommunicationUnionTelecommunicationStandardizationSector(ITU-T)InternationalOrganizationforStandardization(ISO).Chapter1–IntroductionThecombinationofspace,time,andstrengththatmustbeconsideredasthebasicelementsofthistheoryofdefensemakesthisafairlycomplicatedmatter.Consequently,itisnoteasytofindafixedpointofdeparture.. —OnWar,CarlVonClausewitz.ComputerSecuritytheprotectionaffordedtoanautomatedinformationsysteminordertoattaintheapplicableobjectivesofpreservingtheintegrity,availabilityandconfidentialityofinformationsystemresources(includeshardware,software,firmware,information/data,andtelecommunications).KeySecurityConcepts.LevelsofImpactcandefine3levelsofimpactfromasecuritybreachLowModerateHigh.ExamplesofSecurityRequirementsconfidentiality–studentgradesintegrity–patientinformationavailability–authenticationservice.ComputerSecurityChallengesnotsimplemustconsiderpotentialattacksproceduresusedcounter-intuitiveinvolvealgorithmsandsecretinfomustdecidewheretodeploymechanismsbattleofwitsbetweenattacker/adminnotperceivedonbenefituntilfailsrequiresregularmonitoringtoooftenanafter-thoughtregardedasimpedimenttousingsystem.OSISecurityArchitectureITU-TX.800“SecurityArchitectureforOSI”definesasystematicwayofdefiningandprovidingsecurityrequirementsforusitprovidesauseful,ifabstract,overviewofconceptswewillstudy.AspectsofSecurityconsider3aspectsofinformationsecurity:securityattacksecuritymechanismsecurityservicenotetermsthreat–apotentialforviolationofsecurityattack–anassaultonsystemsecurity,adeliberateattempttoevadesecurityservices.PassiveAttacks.ActiveAttacks.SecurityServiceenhancesecurityofdataprocessingsystemsandinformationtransfersofanorganizationintendedtocountersecurityattacksusingoneormoresecuritymechanismsoftenreplicatesfunctionsnormallyassociatedwithphysicaldocumentswhich,forexample,havesignatures,dates;needprotectionfromdisclosure,tampering,ordestruction;benotarizedorwitnessed;berecordedorlicensed.SecurityServicesX.800:“aserviceprovidedbyaprotocollayerofcommunicatingopensystems,whichensuresadequatesecurityofthesystemsorofdatatransfers”RFC2828:“aprocessingorcommunicationserviceprovidedbyasystemtogiveaspecifickindofprotectiontosystemresources”.SecurityServices(X.800)Authentication-assurancethatcommunicatingentityistheoneclaimedhavebothpeer-entity&dataoriginauthenticationAccessControl-preventionoftheunauthorizeduseofaresourceDataConfidentiality–protectionofdatafromunauthorizeddisclosureDataIntegrity-assurancethatdatareceivedisassentbyanauthorizedentityNon-Repudiation-protectionagainstdenialbyoneofthepartiesinacommunicationAvailability–resourceaccessible/usable.SecurityMechanismfeaturedesignedtodetect,prevent,orrecoverfromasecurityattacknosinglemechanismthatwillsupportallservicesrequiredhoweveroneparticularelementunderliesmanyofthesecuritymechanismsinuse:cryptographictechniqueshenceourfocusonthistopic.SecurityMechanisms(X.800)specificsecuritymechanisms:encipherment,digitalsignatures,accesscontrols,dataintegrity,authenticationexchange,trafficpadding,routingcontrol,notarizationpervasivesecuritymechanisms:trustedfunctionality,securitylabels,eventdetection,securityaudittrails,securityrecovery.ModelforNetworkSecurity.ModelforNetworkSecurityusingthismodelrequiresusto:designasuitablealgorithmforthesecuritytransformationgeneratethesecretinformation(keys)usedbythealgorithmdevelopmethodstodistributeandsharethesecretinformationspecifyaprotocolenablingtheprincipalstousethetransformationandsecretinformationforasecurityservice.ModelforNetworkAccessSecurity.ModelforNetworkAccessSecurityusingthismodelrequiresusto:selectappropriategatekeeperfunctionstoidentifyusersimplementsecuritycontrolstoensureonlyauthorisedusersa