Computer and Internet Security
Introduction • Both individuals and companies are vulnerable to data theft and hacker attacks that can compromise data, corrupt files and crash systems. • For these reasons, security is crucial to the success of e-business and Web services.
Introduction • Five fundamental requirements for a successful, secure transaction: – Privacy • How do you ensure that the information you transmit over the Internet has not been captured or passed to a third party without your knowledge? – Integrity • How do you ensure that the information you send or receive has not been compromised or altered? – Authentication • How do the sender and receiver of a message verify their identities to each other?
Introduction – Authorization • How do you manage access to protected resources on the basis of user credentials? – Non-repudiation. • How do you legally prove that a message was sent or received?
Ancient Ciphers to Modern Cryptosystems • Cryptography – Transforms data using a cipher • Cryptosystem – A mathematical algorithm for encrypting messages • A key – A string of digits that acts as a password – Input to the cipher • Unencrypted data is called plaintext; encrypted data is called ciphertext.
Ancient Ciphers • The two main types of ciphers were – substitution ciphers (Caesar Cipher) • “abc” “def” – transposition ciphers • “security” “scrt euiy” • Complicated ciphers combination of substitution ciphers transposition ciphers. – E. g. , using the substitution cipher in transposition cipher, the word "security" would encrypt to "tdsu fvjz”. • Problem of many historical ciphers – their security relied on the sender and receiver to remember the encryption algorithm and keep it secret.
Modern Cryptosystems • Modern cryptosystems are digital. • Their algorithms are based on the individual bits or blocks (a group of bits) of a message, rather than letters of alphabet. • Encryption and decryption keys are binary strings with a given key length. – For example, 128 -bit encryption systems have a key length of 128 bits.
The language of cryptography Alice’s K encryption A key plaintext encryption algorithm Bob’s K decryption B key ciphertext decryption plaintext algorithm symmetric key crypto: sender, receiver keys identical public-key crypto: encryption key public, decryption key secret (private) Network Security 8
Secret-Key Cryptography • In the past, organizations wishing to maintain a secure computing symmetric cryptography, also known as secret-key cryptography. – Uses the same secret key to encrypt and decrypt a message
secret-key cryptography
Secret-Key Cryptography • Have to find a secure way to exchange the secret key before communications – What is the best method? (use Fed. Ex? What are the problems for it? ) • • Not efficient Not secure Authentication problem Etc.
Secret-Key Cryptography – Another way • Have a central authority - an key distribution center (KDC)
Secret-Key Cryptography - Data Encryption Standard (DES) • One of the most commonly used symmetric encryption algorithms • Using block cipher – DES has a key length of 56 bits and encrypts data in 64 -bit blocks.
Public-Key Cryptography • Developed by Whitfield Diffie and Martin Hellman in 1976 at Stanford University. • Two keys – a public key • Freely distributed to outside world – a private key • Kept secret by its owner
Public-Key Cryptography
Public key cryptography + Bob’s public B key K K plaintext message, m encryption ciphertext algorithm + K (m) B Network Security - Bob’s private B key decryption plaintext algorithm message + m = K B(K (m)) B 16
RSA Algorithm • RSA – the most commonly used public-key algorithm • Developed by MIT professors Ron Rivest, Adi Shamir, and Leonard Adleman in 1977 • Play an important and crucial role in e. Commerce transactions
Public key encryption algorithms Requirements: 1 need 2 . . + KB( ) and K B( ) such - + K (K (m)) = m B B that + given public key KB , it should be impossible to compute private key K B RSA: Rivest, Shamir, Adelson algorithm Network Security 18
RSA: Choosing keys 1. Choose two large prime numbers p, q. (e. g. , 1024 bits each) 2. Compute n = pq, z = (p-1)(q-1) 3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”). 4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5. Public key is (n, e). Private key is (n, d). - + KB KB Network Security 19
RSA: Encryption, decryption 0. Given (n, e) and (n, d) as computed above 1. To encrypt bit pattern, m, compute e mod n (i. e. , remainder when m e is divided by n) c=m 2. To decrypt received bit pattern, c, compute d m = c d mod n (i. e. , remainder when c is divided by n) Magic d m = (m e mod n) mod n happens! c Network Security 20
RSA: another important property The following property will be very useful later: - + B B K (K (m)) + = m = K (K (m)) B B use public key first, followed by private key use private key first, followed by public key Result is the same! Network Security 21
Authentication using public-key algorithm
Authentication: yet another try Goal: avoid playback attack Nonce: number (R) used only once –in-a-lifetime ap 4. 0: to prove Alice “live”, Bob sends Alice nonce, R. Alice must return R, encrypted with shared secret key “I am Alice” R KA-B(R) Failures, drawbacks? Network Security Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice! 23
Key Agreement Protocols • A drawback of public-key algorithm – not efficient for sending large amounts of data. • Public key algorithms are not used to replace secret-key algorithm • Use Public key algorithms to exchange secret keys securely. • Key Agreement Protocol – The process by which two parties can exchange keys over unsecure medium
Digital Envelope • The most common key agreement protocol
Key Management • Maintaining the secrecy of private keys is crucial for keeping cryptographic systems secure. • Most compromises in security result from poor key management • Key generation – The process by which keys are created
Key Management • Brute-force cracking – Try to decrypt a message by using every possible decryption key • If the subset is too small for key generation, then the encrypted data is more susceptible to brute-force attacks Have a key-generation program that can generate a large number of keys as randomly as possible
Digital Signatures • The electronic equivalents of written signatures • Developed to be used in public-key cryptography to solve the problems of authentication and integrity • To create a digital signature, a sender first takes the original plaintext message and runs it through a hash function, which is a mathematical calculation that gives the message a hash value
Digital Signatures • A hash value identifies a message uniquely. – The hash value is also known as a message digest • Message integrity – If the hash value of the original message matches the message digest included in the signature – The message has not been altered in transmission.
Digital Signatures Cryptographic technique analogous to handwritten signatures. • sender (Bob) digitally signs document, establishing he is document owner/creator. • verifiable, nonforgetable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document 30
Digital Signatures Simple digital signature for message m: • Bob signs m by encrypting with his private key KB, creating “signed” message, KB(m) Bob’s message, m Dear Alice Oh, how I have missed you. I think of you all the time! …(blah) Bob K B Bob’s private key Public key encryption algorithm K B(m) Bob’s message, m, signed (encrypted) with his private key 31
Digital Signatures (more) • Suppose Alice receives msg m, digital signature KB(m) - • Alice verifies m signed by Bob by applying Bob’s public key KB + + to KB(m) then checks KB(KB(m) ) = m. + - • If KB(KB(m) ) = m, whoever signed m must have used Bob’s private key. Alice thus verifies that: ü Bob signed m. ü No one else signed m. ü Bob signed m and not m’. Non-repudiation: ü Alice can take m, and signature KB(m) to court and prove that Bob signed m. 32
Message Digests large Computationally expensive to public-key-encrypt long messages Goal: fixed-length, easy- tocompute digital “fingerprint” • apply hash function H to m, get fixed size message digest, H(m). message m H: Hash Function H(m) Hash function properties: • many-to-1 • produces fixed-size msg digest (fingerprint) • given message digest x, computationally infeasible to find m such that x = H(m) 33
Digital signature = signed message digest Alice verifies signature and integrity of digitally signed message: Bob sends digitally signed message: large message m H: Hash function Bob’s private key + - KB encrypted msg digest H(m) digital signature (encrypt) encrypted msg digest KB(H(m)) large message m H: Hash function KB(H(m)) Bob’s public key + KB digital signature (decrypt) H(m) equal ? 34
Certification Authorities • Certification authority (CA): binds public key to particular entity, E. • E (person, router) registers its public key with CA. – E provides “proof of identity” to CA. – CA creates certificate binding E to its public key. – certificate containing E’s public key digitally signed by CA – CA says “this is E’s public key” Bob’s public key Bob’s identifying information + KB digital signature (encrypt) CA private key K- CA + KB certificate for Bob’s public key, signed by CA 35
Certification Authorities • When Alice wants Bob’s public key: – gets Bob’s certificate (Bob or elsewhere). – apply CA’s public key to Bob’s certificate, get Bob’s public key + KB digital signature (decrypt) CA public key Bob’s public + key KB + K CA 36
Secure Sockets Layer (SSL) • Currently, most e-businesses use SSL for secure online transactions • The Secure Sockets Layer (SSL) protocol is a non-proprietary protocol commonly used to secure communication betweens two computers on the Internet and the Web. • Use TCP/IP in the sockets
Secure Sockets Layer (SSL) • In a transaction using SSL, the sockets are secured using public-key cryptography. • SSL implements public-key cryptography using the RSA algorithm and digital certificates to authenticate the server in a transaction and to protect private information as it passes over the Internet.
Secure Sockets Layer (SSL) Client Server Socket 1. Encrypt packets with server’s public key 2. Send packets to the server Socket 1. Receive packets from the client 2. Decrypt packets with server’s private key
Security Attacks Denial-of-Service (Do. S) Attacks Viruses and Worms Eavesdrop: intercept messages Actively insert messages into connection Impersonation: can fake (spoof) source address in packet (or any field in packet) • Hijacking: “take over” ongoing connection by removing sender or receiver, inserting himself in place • • •
Network Security • Firewalls • Intrusion Detection Systems • Steganography – Hiding information within other information
Скачать презентацию Computer and Internet Security Introduction Both
36335c1eee8cf0f3f296a5c2ac785b4c.ppt