Chapter 1
A country's information and information technology systems are free from external threats and abuses
2. Information security (network security) feature (preventive end-of-purpose audit takes out the first and last) 3. Network security, level 4, meaning 4. Network security structure level 5. Network information security policy (pass access security)
6. Three components of the iso/osi security system
Iso: international organization for standardization
Osi: open system interconnected communication reference model
7. Network security systems, 2 models 8. Information systems security, 5 levels (self-routing) 9. Security assessment certification system
Tcsec (credible computer standards assessment guidelines): the current guidelines for cybersecurity are divided into three parts
Chapter 2: password basic theory 1
Express p, secret c, key k, encryption e, decryption d
2. Symmetric password system
Advantages: encryption, speed of decryption, high level of confidentiality
Disadvantages:
The key distribution process for symmetry algorithms is complex and costly
The number of key combinations during multiple communications has increased dramatically and distribution of key has become more complex
Only a single key for communications can send confidential messages to each other
Digital signature difficulties (false signatures can be forged by both recipients)
Representative algorithm: des, 3des, ida (international data encryption algorithm), aes
Asymmetric password system
Advantages:
Few keys, easy to manage
Key distribution is simple, no secret passages and complicated protocols
Can achieve digital signatures
Disadvantages: encryption, slow decryption, more key numbers required under the public key password system with equal security strength
Representative algorithm: rsa (based on difficult assumptions for decomposition of large integers), diffie-hellman key exchange agreement, eigamal public key password technology
Chapter 3: key management technology 1. Key type
2. Key distribution
Only key allocation in symmetric password technology is considered below
Kaka
Kaka
Shared key for a and kdc
Kbkb
Kbkb
Shared key for b and kdc
Ksks
Ksks
: a and b desired session keys obtained through kdc
A->kdc: ida || idb || n1ida || idb || n1
Ida || idb || n1ida || idb || n1
A sends a key request to kdc. N1n1
N1n1
Time stamp, counter, or random number to prevent the attackers from speculating about n1n1n1n1
Kdc-a: eka
Ks ida idb & n1 ekb
Ks ||ida
Eka
Ks ida idb & n1 ekb
Ks ||ida
Eka
Ks ida idb & n1 ekb
Ks ||ida
Eka
Ks ida idb & n1 ekb
Ks ||ida
Use kaka
Kaka
Encryption, guaranteed that only a can decrypt this information and a believes it was sent by kdc
A->b: ekb
Ks ||ida
Ekb
Ks ||ida
Ekb
Ks ||ida
Ekb
Ks ||ida
First b can get ksks
Ksks
And by ekbekbekbekb, we can make sure that ksksksks are actually from kdc, and finally, by ididaidida, we can verify that the other one is a
B->a: ekseks
Ekseks
The effect is to tell a. B. Is currently capable of communication
A->b: ekseks
Ekseks
A. Respond to b. Tell b
The first three steps have been completed with the distribution of keys, and the second two steps are the authentication process, allowing b to determine that the information received is not replayed
Mkmmkm
Mkmmkm
Primary key shared between a and b
Ksks
Ksks
Session keys between a and b
A->b: ida || n1ida || n1
Ida || n1ida || n1
A sent a request to b for a session key, requesting b to generate a session key for secure communications
B-: emkm
Ks ||ida || idb || f(n1) || n2
Emkm
Ks ||ida || idb || f(n1) || n2
Emkm
Ks ||ida || idb || f(n1) || n2
Emkm
Ks ||ida || idb || f(n1) || n2
F(n1)f (n1)
F(n1)f (n1)
It's a response to a's request, mainly to pass ksksksks to a
A->b: ekseks
Ekseks
In the centralized distribution, a gave theks to b, b determined once, a determined once, but in the distribution, b gave theks to a, a determined, but b did not
Chapter 4: digital signature and authentication technology 1. Concept of summary information & characteristics & common algorithms
Concept:
The same and only set of data can be obtained through the same message summary algorithm, which is known as the explicit summary of the message
A summary of the message is intended to ensure the integrity of the message. Unlike a digital signature, it also serves to verify the identity of the sender
Characteristics:
Common message summary algorithm:
Md2, md4, md5, sha
Digital signatures
Problems with digital signatures:
Resolution of fraud or forgery in communications between the parties
A summary of the message is intended only to ensure the integrity of the message, but a digital signature also serves to verify the identity of the sender and is non-substantiated, and may be confidential if encrypted algorithms are added
Add a digital signature process for summaries of messages and encryption algorithms
Sets the sender to a and the recipient to b and a with the private key to skaska
Skaska
, a's public key is pkapkappka, b's private key is skbskkbskkkbkbkbkbkbkbkb to be sent with m
Encryption algorithm is e() (for digital signature and message encryption) and decryption algorithm is d() (for signature authentication and message decryption)
Hash algorithm is h()
A calculates signature: calculates summary value h(m) of message, calculates signature eska(h)(m) eska(h)(m)) eska(h(m))
Encryption of a: encrypt epkb (m || eska(h)(m)) epkb (m || eska(h)(m)) epkb (m || eska(h(m)) epkb (m || eska(h)(m)) epkb (m || eska(m))
A to b: send the above calculation to b
B decrypt: dskb (epkb (m || eska(h)(m))) dskb (epkb (m || eska(h)(m))) dskb (epkb || eska(h(m)) dskb (epkb || eska(m))
B validation of signature: decrypt the signature with the public key of a (dpka(h(m)) dpka(eska(h(m)) dpka(eska(h(m)) dpka(eska(h(m)) obtained h(m)
B calculating message summary: get & h(m)'
Comparison of b: if h(m)=h(m)=h(m)=h(m)=h(m)=h(m)=h(m)=h(m)=h(m)=, it means that m(m) has not been tampered with to ensure the integrity of the information and, on the basis of digital signatures, the irrefutable character of the sender is guaranteed, as is the confidentiality due to the addition of encryption algorithms
Common algorithms
Rsa
3. Identification
Problems to be addressed
Ensuring physical and digital identity of operators
Four methods of identification
Kerberos technology
Purpose
Mutual identification of the entities that communicate on the network (which can also prevent listening and playback)
Details
Contains an authentication server (authorization server-as), a billboard licensing server (ticket granting server-tgs), and an application server (application server). In terms of encryption algorithms, its authentication is based on symmetric encryption (des)
Users receive a document licence tgt by sending a request to as to identify tgs
Service licence note (service granting ticket) distributed by tgs to users for the purpose server (the application server referred to above)
Users use service licence instruments to communicate with purpose servers
As and tgs are collectively known as kdc (key distribution center-key key distribution centre)
Note: tickettgstickettgs
Tickettgstickettgs
It's a permit, ticketvticketv
Ticketvticketv
It's a service permit
Strengths
Two advantages of using both as and tgs:
Disadvantages
We need to solve the problem of synchronizing the host nodes and resisting service attacks
Chapter 5: pki technology 1. Basic knowledge
Concept
Pki (public key infrastructure): public key infrastructure, infrastructure that supports public key management and provides authenticity, confidentiality, integrity and accountability services
Pki provides a number of security services and corresponding technologies: one entity is identified as the other. Use digital signature to achieve
Apply pki protocols
2. Process for acquiring user public keys (including ca)
Bob creates a public-private key pair and submits an application for public-key registration to the registrar (register authority-ra)
Ra reviews bob and, if so, requests for certification to the certificate authority (certificate authority-ca)
Ca issues certificates for bob, including: bob's identity information and public key, and ca's signature results for the certificate
When alice needs to communicate with bob, find bob's certificate in the certificate release system and verify the validity of the digital signature on the ca's public key certificate
Once the certificate is validated, alice can use the public key on the certificate to communicate with bob
3. Certificate revocation list (crl)
Ca-issued certificates untie the user's identity and public key
Reasons for revocation of the certificate: change in the name of the user, theft or disclosure of the private key, change in the relationship between the user and the enterprise to which he belongs, etc
4. Digital certificates
Since the digital certificate itself should be issued by the ca, the digital certificate itself should be signed by the ca
Standard
Digital certificate is x. 509x. 509
X. 509x. 509
Synonyms for public key certificates, matching itu-tx. 509v3itu-tx. 509v3
Itu-tx. 509v3itu-tx. 509v3
Agreements
Contents
Certification process
Certificate unsealing: digital signature with ca public key to certify certificate and certificate issued by ca
Serial number verification: authentication certificate authenticity
Validation of validity
Undo list query
The certificate's updated serial number changes, while the private key pair changes, not just one valid one. Period
Chapter 6: cyberattack and defence technology
Step 1 of the attack: loopholes and information gathering (scan and sniffing techniques)
1. Scan technology
3 purposes
2. Sniffing techniques
Need to move the card to mixed mode
The difference between hub and switchboard
Hub (multi-port transponder): send the received data frame directly to all ports except the data source (violent transmission)
Switch: port map of interfaces with host physical address mac stored in the switch, only package matching target physical address allowed
Arp cheating
One of the most common sniffing techniques in the exchange network
Arp protocol: mac address based on ip address
Classification: 1. Fraud against router arp cache forms (interception of gateway data); 2. Fraud against intranet pc gateways (false gateways)
Reasons for fraud: 1. Arp protocol does not have security guarantees and any computer can send an arp data package; 2. Arp protocol is non-state; 3. Arp cache needs regular updates and the attackers have access to it
Deception fulfils conditions: lan, in which the aggressor must obtain a legal identity to enter lan in order to cheat
Common sniffing tool: tcpdump sniffer software, wireshank network package analysis tool
3. Oral attacks
Method of attack
Precautionary measures (choice of protection)
4. Spilling attacks in the buffer zone
Concept
The amount of data entered by the user exceeds the memory space assigned to the program, and the data will cover the memory space allocated by the program to other data, creating a buffer zone spill
3 types
5. Refusal of service attacks
Concept
Services: some functionalities provided by the system, as required by users
Denial of services (dos): interference in services to reduce or render less available
Refusal of service attacks: resulting in dos attack aimed at preventing computers or networks from providing normal services
Ddos: multiple attackers in different locations attack one or more targets simultaneously
Chapter 7: malicious code and prevention technology, category 1
Computer virus: unindependent virus, dependent on host, by copying
Worm virus: cybervirus; transmission channels are network, e-mail, flash drive, mobile hard drive, system loopholes; pandas are burned, morris virus (first worm)
Logical bomb: "nature function" added by a legitimate application; for example, the application automatically deletes after running for copyright protection
Wood horse: server end and client (controler end) implanted into the target machine as the server end (server or client for the horse owner); mode of transmission: binding, scanning 2-dimensional code; representative: trojan horse, blue of eternal
Downloader virus: destroying poison-killing software, downloading viruses and wooden horses; representative: machine dog, conduit
A joke program: interrupting normal computer behavior and creating disgusting things; representative: a ghost
2. Dissemination cycles
Design-transmission-infection-trigger-run-disappearance
3. Scattered knowledge point 4. Trigger mechanism
Date, time, keyboard, infection, startup, number of accesses to disk, call-out, cpu model/master plate as trigger condition
Chapter 8: access control technology 1. Classification 2. Fire protection wall
Intranet: network within the firewall
Extranet: network outside the firewall
Letter-accepted and unaccepted hosts refer to intranet and extranet hosts, respectively
Servers in the intranet that require external services are placed in the demilitarized zone
3. Nat
Work on the transmission level
