Security

Security

1. Access Control

   • Capabilities
     • Focus on the subject access rights stored with the subject capabilities ≡ rows of the access control matrix
   • ACLs
     • access right of principals stored with the object ACLs ≡ columns of the access control matrix
   • DAC
   • MAC
   • IBAC
     • identity based access control Could be used instead of DAC
   • Roles
     • A role is a collection of procedures assigned to users; a user can have more than one role and more than one user can have the same role.
   • RBAC
     • Role based access control Roles are a good match for typical access control requirements in business.

2. Communications Security

   • Confedentiality
     • encryption algorithms hide the content of messages;
   • Integrity
     • : integrity check functions to detect whether a document has been changed;
   • Availability
     • message authentication codes or digital signature algorithms verify the source and integrity of a message.

3. Discrete Logarithm Problem (DLP)

   • Given a prime modulus p , a basis a, and a value y , find the discrete logarithm of y, i.e. an integer x so that y = ax mod p. 

4. Encryption

   • Symmetric Crypto
     • the decryption key is  the same as the encryption key.
   • Asymmetric crypto
     • It is computationally infeasible to derive the private decryption key from the corresponding public encryption key.
   • Block Ciphers and Stream Ciphers
     • Block Ciphers
       • encrypt sequences of “long” data blocks without changing the key.
     • Stream Ciphers
       • encrypt sequences of “short” data blocks under a changing key stream
       • Encryption can be quite simple, e.g. XOR.
   • Public Key Encryption
     • Each party has a private and a public key. Computing the private key from the public key should be computationally infeasiable.
   • Types of Encryption
     • Probabilistic
       • use random elements to make every encryption different.

5. HTTP Basic Authentication

   • Passoword sent in the clear, base 64 encoded
   • HTTP Digest Authentication
     • Challenge-Response Protocol Server sends Nonce to user
     • Server replies with : username+password+nonce+uri Better security but still vulnerable to offline dictionary attack
     • Nonce- Unique value used only once
       • Three ways of generating nonce: random number time stamp sequence numbers
       • Used to prevent replay attacks

6. Key-establishment protocols

   • AKEP
   • Needham-Schoeder
     • Basis for Kerberos
     • Key transport protocol based on a symmetric encryption algorithm: A and  B obtain a session key Kab from server S (Trusted Third Party).
   • Kerberos

7. Public Key Infrastructures

   • X.509
   • Certificates
   • Electronic Signatures