lecturenotes教程.ppt

* Objectives After going through this lecture, you will be able to Understand what are security protocols Understand the operation of several authentication protocols Understand the operation of the Secure Socket Layer (SSL) protocol * Protocol A Protocol is a collection of rules and procedures to accomplish some task between two or more parties A protocol defines: A sequence of steps to be performed in an orderly manner The format of data * State i Input Data State j Output Data State Transition Diagram * Security Protocols Security protocols are protocols designed to perform security functions, and to provide security services It may use some basic operations such as: random number generation encryption/decryption digital signature generation/verification * Security Protocols (cont’d) Notable examples of security protocol are: Authentication Key management Access control Secure Internet applications Secure electronic mail, secure sockets layer (SSL), virtual private networks * Authentication Protocols * Simple Authentication (cont’d) A claimant (“C”, e.g. a user) authenticates itself to a verifier (“V”, e.g. a server) Done by providing some proof of identity User ID Password * Simple Authentication (cont’d) Claimant Verifier Password? UserID! Password! Check Result! Accept or Reject * Simple Authentication (cont’d) Some flaws exist Eavesdroppers can learn the password One-way authentication only, the claimant cannot confirm the identity of the verifier If the verifier is not the intended verifier, the password would have been mis-transmitted to someone else * Password Protection Protocol Guard against eavesdropping by using a public, one-way function f(·) to protect the password Passwords are transmitted and stored as f(·) Eavesdroppers cannot compute f-1(·) to figure out the password, password is secure * Password Protection (cont’d) Claimant Verifier Password? UserID! f(Password)! Check Result! Accept or Reject * Replay Attack (cont’d) A flaw of the previous