文档介绍：Cryptography and Data Security
Peter Gutmann
University of Auckland
/~pgut001
Security Requirements
Confidentiality
• Protection from disclosure to unauthorised persons
Integrity
• Maintaining data consistency
Authentication
• Assurance of identity of person or originator of data
Non-repudiation
• Originator munications can’t deny it later
Security Requirements (ctd)
Availability
• Legitimate users have access when they need it
Access control
• Unauthorised users are kept out
These are bined
• User authentication used for access control purposes
• Non-bined with authentication
Security Threats
Information disclosure/information leakage
Integrity violation
Masquerading
Denial of service
Illegitimate use
Generic threat: Backdoors, trojan horses, insider attacks
Most security problems are access control or
authentication ones
• Denial of service is also popular, but mostly an annoyance
Attack Types
Passive attack can only munications or data
Active attack can actively munications or data
• Often difficult to perform, but very powerful
– Mail forgery/modification
– TCP/IP spoofing/session hijacking
Security Services
From the OSI definition:
• Access control: Protects against unauthorised use
• Authentication: Provides assurance of someone's identity
• Confidentiality: Protects against disclosure to unauthorised
identities
• Integrity: Protects from unauthorised data alteration
• Non-repudiation: Protects against originator of
communications later denying it
Security Mechanisms
Three basic building blocks are used:
• Encryption is used to provide confidentiality, can provide
authentication and integrity protection
• Digital signatures are used to provide authentication, integrity
protection, and non-repudiation
• Checksums/hash algorithms are used to provide integrity
protection, can provide authentication
One or more security mechanisms bined to provide
a security service
Servi