Lecture16-security

Lecture16-security - CSCE313Introductionto ComputerSystems

Info iconThis preview shows pages 1–15. Sign up to view the full content.

View Full Document Right Arrow Icon
CSCE 313 Introduction to  Computer Systems Instructor: Dr. Ronnie Ward Based on material from Dr. Riccardo Bettati
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Security Overview Security Goals  The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies
Background image of page 2
Security Today…
Background image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Typical Attacks: Penetration Attempts Two basic forms: completely bypass authentication mechanism obtain information or alter the system so as to enter system as authorized user Attempts: Wire tapping (active vs. passive) Trial and error (brute force, replay attack) Browsing  - Search storage (in particular previously allocated, but now  available) for unauthorized information. Trap doors  - Unspecified and undocumented features of the system that may be  exploited to perform unauthorized actions. Trojan horse Searching of waste
Background image of page 4
Typical Attacks: Man-In-The-Middle
Background image of page 5

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Typical Attacks: Masquerading
Background image of page 6
Man-In-The-Middle: Example Passive tapping Listen to communication without altering contents. Active wire tapping Modify data being transmitted Example: user intruder server fine! X logoff! Intruder takes over identity of user (masquerading)
Background image of page 7

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Security Threats Information Disclosure: unauthorized dissemination of information result of theft or illegal action of who has access to information Information Destruction: loss of internal data structures loss of stored information information may be destroyed without being disclosed Unauthorized Use of Service: bypass system accounting policies unauthorized access to proprietary services Denial of Service: prevent an authorized user from utilizing the system’s services in a timely manner  (eg. SYN flooding)
Background image of page 8
Security Goals Authentication  of Alice (the client) Authorization  of request from Alice Confidentiality  (e.g. protect the content of request) Accountability  (non-repudiation) Availability “Alice” “Bob” “Eve” “Lucifer”
Background image of page 9

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Security: Systems Overview Functionality Authentication Authorization Confidentiality Primitives sign() verify() Access control lists Capabilities “magic cookies” encrypt() decrypt() Cryptography cyphers and hashes
Background image of page 10
Cryptography Functionality Authentication Authorization Confidentiality Primitives sign() verify() Access control lists Capabilities “magic cookies” encrypt() decrypt() Cryptography cyphers and hashes Cryptography:  Closed-Design vs. Open-Design Cryptography  Symmetric Encryption  Asymmetric (“Public-Key”) Encryption
Background image of page 11

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Closed-Design Cryptography “Alice” “Bob” “crypto box” (closed) “de-crypto box” (closed)
Background image of page 12
Open-Design Cryptography
Background image of page 13

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Encryption Restricts the number of receivers Encryption algorithm consists of
Background image of page 14
Image of page 15
This is the end of the preview. Sign up to access the rest of the document.

This note was uploaded on 02/14/2012 for the course CSCE 313 taught by Professor Gu during the Spring '11 term at Texas A&M.

Page1 / 39

Lecture16-security - CSCE313Introductionto ComputerSystems

This preview shows document pages 1 - 15. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online