Bài giảng môn Cryptography and network security - Chapter 1: Overview - Nguyễn Đức Thái
Cryptography and Network Security
1. Overview
Lectured by
Nguyễn Đức Thái
Outline
. Security concepts
. X.800 security architecture
. Security attacks, services, mechanisms
. Models for network (access) security
. Network security terminologies
2
Computer Security Objectives
Confidentiality
•Data confidentiality
• Assures that private or confidential information is not made available or disclosed
to unauthorized individuals
•Privacy
• Assures that individuals control or influence what information related to them may
be collected and stored and by whom and to whom that information may be
disclosed
Integrity
•Data integrity
• Assures that information and programs are changed only in a specified and
authorized manner
•System integrity
• Assures that a system performs its intended function in an unimpaired manner,
free from deliberate or inadvertent unauthorized manipulation of the system
Availability
•Assures that systems work promptly and service is not denied to authorized
users
3
CIA Triad
The Security Requirements Triad
4
Possible Additional Concepts
Authenticity
Accountability
•Verifying that users
are who they say they
are and that each
input arriving at the
system came from a
trusted source
•The security goal that
generates the
requirement for
actions of an entity to
be traced uniquely to
that entity
5
Terms
6
Security Attacks
. A means of classifying
security attacks, used both in
X.800 and RFC 4949, is in terms
of passive attacks and active
attacks
. A passive attack attempts to
learn or make use of
information from the system
but does not affect system
resources
. An active attack attempts to
alter system resources or affect
their operation
Passive Attacks
. Passive attacks are in the nature of
eavesdropping on, or monitoring of,
transmissions.
. The goal of the opponent is to obtain
information that is being transmitted.
. Two types of passive attacks are
i. the release of message contents and
ii. traffic analysis.
8
Active Attacks
•Takes place when one entity
. Involve some modification of
the data stream or the creation
of a false stream
pretends to be a different entity
Masquerade
Replay
•Usually includes one of the other
forms of active attack
. Difficult to prevent because of
the wide variety of potential
physical, software, and
•Involves the passive capture of a
data unit and its subsequent
retransmission to produce an
unauthorized effect
network vulnerabilities
. Goal is to detect attacks and to
recover from any disruption or
delays caused by them
•Some portion of a legitimate
message is altered, or messages
are delayed or reordered to
Modification
of messages
produce an unauthorized effect
•Prevents or inhibits the normal
use or management of
communications facilities
Denial of
service
9
Passive Attacks - Interception
Release of message contents
10
Passive Attacks – Traffic Analysis
Observe traffic pattern
Traffic analysis
11
Handling Attacks
. Passive attacks – focus on Prevention
• Easy to stop
• Hard to detect
. Active attacks – focus on Detection and Recovery
• Hard to stop
• Easy to detect
12
Security Services (X.800)
. Authentication - assurance that communicating entity is
the one claimed
• have both peer-entity & data origin authentication
. Access Control - prevention of the unauthorized use of a
resource
. Data Confidentiality – protection of data from
unauthorized disclosure
. Data Integrity - assurance that data received is as sent by
an authorized entity
. Non-Repudiation - protection against denial by one of the
parties in a communication
. Availability – resource accessible/usable
13
Authentication
. Concerned with assuring that a communication is
authentic
• In the case of a single message, assures the recipient
that the message is from the source that it claims to
be from
• In the case of ongoing interaction, assures the two
entities are authentic and that the connection is not
interfered with in such a way that a third party can
masquerade as one of the two legitimate parties
Two specific authentication services are defined in X.800:
• Peer entity authentication
• Data origin authentication
14
Access Control
. The ability to limit and control the access to host
systems and applications via communications links
. To achieve this, each entity trying to gain access
must first be identified, or authenticated, so that
access rights can be tailored to the individual
15
Data Confidentiality
. The protection of transmitted data from passive
attacks
• Broadest service protects all user data transmitted
between two users over a period of time
• Narrower forms of service includes the protection of a
single message or even specific fields within a message
. The protection of traffic flow from analysis
• This requires that an attacker not be able to
observe the source and destination, frequency,
length, or other characteristics of the traffic on a
communications facility
16
Data Integrity
Can apply to a stream of messages, a single
message, or selected fields within a message
Connection-oriented integrity service, one that
deals with a stream of messages, assures that
messages are received as sent with no duplication,
insertion, modification, reordering, or replays
A connectionless integrity service, one that deals
with individual messages without regard to any
larger context, generally provides protection
against message modification only
17
Non-repudiation
. Prevents either sender or receiver from denying a
transmitted message
. When a message is sent, the receiver can prove
that the alleged sender in fact sent the message
. When a message is received, the sender can prove
that the alleged receiver in fact received the
message
18
Security Mechanism
. As known as control
. Feature designed to detect, prevent, or recover from
a security attack
. No single mechanism that will support all services
required
. However one particular element underlies many of
the security mechanisms in use:
•cryptographic techniques
19
Security Mechanism (X.800)
Specific Security Mechanisms
• Encipherment
• Digital signatures
• Access controls
• Data integrity
• Authentication exchange
• Traffic padding
Pervasive Security Mechanisms
• Trusted functionality
• Security labels
• Event detection
• Security audit trails
• Security recovery
• Routing control
• Notarization
20
Tải về để xem bản đầy đủ
28 trang
20860
Free
Bạn đang xem 20 trang mẫu của tài liệu "Bài giảng môn Cryptography and network security - Chapter 1: Overview - Nguyễn Đức Thái", để tải tài liệu gốc về máy hãy click vào nút Download ở trên
File đính kèm:
- bai_giang_mon_cryptography_and_network_security_chapter_1_ov.pdf
