web應(yīng)用的安全模式-全文預(yù)覽
【正文】 decrypt = encrypt1 對(duì)稱加密 缺陷 ? 需要進(jìn)行私鑰交換 ? 規(guī)模復(fù)雜 ? 未知實(shí)體間通信困難 公鑰密碼機(jī)制 由 Deffie 和 Hellman發(fā)明 : ? “ New Directions in Cryptography” ,1976 原理 ? Publicly revealing an encryption key does not thereby reveal the correspongding decryption decryption. 重要結(jié)論 No need to transmit keys. ? only the intended recipient can decipher the message. A message can be “ signed” by a privately held decryption key. ? Signatures cannot be fed. ? A signer cannot later deny the validaity of his signature. 下面我們來看如何用這種機(jī)制來實(shí)現(xiàn)： ? 機(jī)密性和隱私性： privacy and confidentiality ? 數(shù)字簽名 :signature ? 實(shí)體鑒別 :authentication Privacy and confidenciality Bob向 Alice發(fā)一個(gè) private message的過程 : ? Get the public key Ea from the public file ? Send her Ea(M) ? Alice decpher it :Da(Ea(M))=M 特點(diǎn) ? No need to establish private transactions（保證了私密性） ? An intruder listening in on the channel cannot decipher any messages. Since derive decryption keys from encryption keys is impossible.（保證了機(jī)密性） 數(shù)字簽名 Signatures Alice首先用自己的私鑰對(duì)要發(fā)給 Bob的消息簽名 :s=Da(M) 然后用 Bob的公鑰加密 :Eb(S).并把結(jié)果發(fā)出 . Bob先用自己的私鑰解密得到 S,然后用 Alice的公鑰解密得到 M. 數(shù)字簽名 Signatures 完整性 :Bob或其他人不可修改 M,對(duì)輸入數(shù)據(jù)的任何修改都會(huì)引起輸出的變化。 ? MAC基于無法破譯或仿造的密碼機(jī)制工作。Web應(yīng)用的“外患”與“內(nèi)憂” 譚曉陽 Based on 《 Security models for Webbased application》 by James ,Walid ,Arif Ghafoor February 2023/ p3844 《 Communication of ACM》 本講內(nèi)容 介紹基本的安全概念和基本的安全機(jī)制 Web環(huán)境下的安全機(jī)制 防火墻的工作原理 常用的安全措施 Web應(yīng)用安全 “外患” “內(nèi)憂” “外患” ? Aspects of Security ? Authentication and Encryption ? Inter Firewalls and Packet Filtering ? Virtual Private Networks ? Secure HTTP (SHTTP) and Secure Socket Layer (SSL) ? Securing your Site Main risks: 信息被非法竊聽：未經(jīng)認(rèn)可的用戶對(duì)數(shù)據(jù)的非法訪問 假冒他人發(fā)送信息 信息被非法修改 拒絕服務(wù) 病毒 。 However, a attacker can create a valid checksum or CRC from the altered data. 完整性機(jī)制 Several mechanisms against malicious（惡意） intentional change of intercepted data exist： 用 MAC (Message Authentication Code)來編碼要發(fā)送的數(shù)據(jù)。 Simple password mechanisms are vulnerable（易受攻擊） on works because they are susceptible to eavesdropping（偷聽） . Wiretapping（搭線竊聽） is easy especially that passwords on tel, FTP or HTTP are clear text. “外患” ? Aspects of Security ? Authentication and Encryption ? Inter Firewalls and Packet Filtering ? Virtual Private Networks ? Secure HTTP (SHTTP) and Secure Socket Layer (SSL) ? Securing your Site 你是誰？ How do you know the customer is the customer he/she pretends to be? How do you know the server is the server it purports to be? Is it really the the web pa
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1