CS计算机代考程序代写 chain scheme algorithm database flex FIT1047 SETU Evaluation

FIT1047 SETU Evaluation
Dear Students,
Please give us the Unit Feedback:
The Student Evaluation of Teaching and Units (SETU) is now open and I would appreciate your assistance in giving response to SETU.
FIT1047 Semester Nov 12, 2020 units: In Moodle: Student Evaluation of Teaching and Units (SETU) – Task list
Click on FIT1047 Link to give Unit feedback
FIT1047

FIT1047 – Week 10
Part 1
A Short Introduction to Cryptography + Exam information !
Introduction to computer systems, networks and security
Abdul Malik Khan
W. Stallings. (2016). Network Security Essentials: Applications and Standards. Global Edition (6e) Pearson International. Ross Anderson. Security Engineering. Second edition, 2008. Wiley. This book is also available for free online: http://www.cl.cam.ac.uk/~rja14/book.html

FIT1047 Monash University
Security Attacks
• Any action that compromises the security of information owned by an organization
– Vulnerability: a weakness in a computer system that might be exploited to cause loss or harm
– Threat: circumstances that have the potential to cause loss or harm
– Control: a protective measure
• Information security is about how to prevent attacks, or failing
that, to detect attacks on information-based systems
• often threat & attack are used to mean the same thing
• Have a wide range of attacks
• Can focus on generic types of attacks

FIT1047 Monash University
Security Attacks – Taxonomy
• A security attack may attempt to do one or
more of the following:
– Interruption:anattackonavailability
– Interception:anattackonconfidentiality – Modification:anattackonintegrity
– Fabrication:anattackonauthenticity
• Classification of types of security attacks: – Passive Attacks
– Active Attacks

FIT1047 Monash University
Interruption
• Also known as denial of services.
• Information resources (hardware, software and data) are deliberately made
unavailable, lost or unusable, usually through malicious destruction.
Interception
• Also known as un-authorized access.
• Difficult to trace as no traces of intrusion might be left.
• e.g.: illegal eavesdropping or wiretapping or wireless packet sniffing.
Modification
• Also known as tampering a resource.
• Resources can be data, programs, hardware devices, etc.
Fabrication
• Also known as counterfeiting (of objects such as data, programs, devices, etc.).
• e.g.: insertion of spurious message, create falsification/fake messages in a network,
adding a record to a file. Etc..
• impersonation/masquerading
– to gain access to data, services etc..

FIT1047 Monash University
Security Attacks – Taxonomy
Interruption
Interception
Modification
Fabrication
Information Source
Information Destination
Normal
Information Information Source Destination
Information Information Source Destination
Information Information Source Destination
Information Information Source Destination

FIT1047 Monash University
Passive Attacks
• Nature: eavesdropping on, or monitoring of, transmission of information
between the communicating parties
• Goal: to capture information during transmission
• Method: protocol Analyzers (https://www.wireshark.org/download.html)
• Two types of Passive attack:
– Release of message content
 capture and read the content
Passive
Interception (confidentiality)
Release of Message contents
Traffic analysis
– Traffic analysis:
 can’t read the information, but observe the pattern
 determine the location and identity of communicating parties  observe frequency and length of communication

FIT1047 Monash University
Active Attacks
• Modifies a data stream or creates a false data streams
• Four types of active attacks:
– Masquerade:oneentitypretendstobeadifferententity • authenticationsequencesarecapturedandreplayed • anentitycangainextraprivileges
– Replay:passivecaptureofdataandsubsequentretransmission
– ModificationofMessage:messagescanbealtered,delayedorreordered
to produce unauthorized effect
– DenialofService:preventsnormaluseormanagementofcommunication facilities
• usuallyhaveaspecifictarget
• disruptionofservicesofanentirenetworkorsuppressionofall
messages directed to a particular destination
Active
Interruption (availability)
Modification (integrity)
Fabrication (integrity)

FIT1047 Monash University
Cryptography
• Whatiscryptography? • Whydoweneedit
Look at three types of algorithms:
• Symmetricencryption
• Publickeycryptography(asymmetric) • Hashfunctionsforsecurity

FIT1047 Monash University
Encryption: Protect communication from eavesdroppers
Alice
Bob says: Hello Alice!
Encrypted: Hello Alice
Bob
-AXFf>$g87FOPxc
Message: Hello Alice!
Evil Eavesdropper
Bob says to Alice: ????
Hello Alice!

FIT1047 Monash University
Symmetric Encryption Model
Symmetric Encryption Model
A simplified model of symmetric encryption

FIT1047 Monash University
Integrity: Protect communication from changes
Alice
Bob says: I don’t like you Alice!
Encrypted: -AXFf>$g87FOPxc
Bob
Message: Hello Alice!
Evil Interceptor
Changed: XvGc76gFa23.df

FIT1047 Monash University
Symmetric Cryptography
A cryptographic key is shared between two (or more) principals. Has been used for more than 3000 years.
• Early example: Alphabetic substitution (we will try this in the next weeks tutorial/lab). CAESAR cipher or Vigenère cipher.
• Main idea: Use the shared secret to scramble a message in a way that it cannot be understood without knowledge of the secret.

FIT1047 Monash University
Substitution & Permutation
Substitution
– Symmetric cryptography often is based on so- called S-Boxes (Substitution Boxes). They work like a look-up table for a part of the message block.
– a binary word is replaced/substituted by some other binary word
– also known as S-box Permutation:
• In addition to substitutions (S-Boxes), the order of message parts is changed using P-Box. A transposition block cipher are modelled on permutation
• A binary word has its bits reordered (permute)
– Also known as P-box
• Example: 1st bit may become 7th bit, 2nd bit 12th bit and so on

AES – Advanced Encryption Standard
FIT1047
Monash University

FIT1047 Monash University
A modern Algorithm for Symmetric Cryptography: AES
• OpenselectionprocessbyNIST(NationalInstitutefor Standards and Technology, U.S.)
• 15designsweresubmitted
• WinnerwasannouncedinOctober2000
• RijndaeldevelopedbytwoBelgiancryptographers (Joan Daemen and Vincent Rijmen) was chosen to become AES

FIT1047 Monash University
Security Properties of Symmetric Encryption (AES)
• AES works on message blocks. It provides confidentiality. Integrity is not straightforward (e.g. change order of blocks, change bits etc.)
• Different types of block chaining
• Start with an initialization vector and then combine each encrypted block with the next block. Thus, blocks in wrong order cannot be decrypted and a changed block will disable decryption of next bock.

FIT1047 Monash University
WPA2/CCMP uses AES and a CBC-MAC
• CBC – Cipher Block Chaining
• MAC – Message Authentication Code
• Result is one block that can be used to check integrity of the complete message: m1 m2 ….mx

FIT1047 Monash University
Symmetric Cryptography
• Traditional private/secret/single key cryptography uses only one key
• The key is shared by both sender and receiver
• Security is compromised if this key is disclosed, intentionally or unintentionally
• Symmetric cryptography is very efficient, but has a number of disadvantages:
• Concern:
– Key exchange or distribution: somehow, one needs to establish a shared secret.
An alternative secure channel for key distribution is necessary.
– Scalability: Each pair of sender and receiver needs a unique secret key.
The number of keys grows exponentially with the number of participants (12 participants need 66 keys, 1000 need 499,500 keys and a million participants need an unrealistic 499,999,500,000 keys)
– Non-repudiation is not possible. Does not protect sender from receiver forging a message & claiming it is sent by sender

FIT1047 Monash University
Public Key Cryptography
• In the early 1970s cryptographers developed the idea of “non-secret encryption”.
• First (public) practically usable schemes were developed in 1976 by Diffie and Hellman (influenced by Merkle) (known as Diffie-Hellman Key Exchange)
and in 1978 by Rivest, Shamir and Adleman (known as RSA).
• uses two keys – a public & a private key
• Asymmetric since parties are not equal
• Uses clever application of number theory concepts to function
• Complements rather than replaces symmetric key crypto
• General idea: Based on a “hard“ mathematical problem and a large random number, a key-pair is generated, such that the private key cannot be derived from the public key without solving the underlying mathematical problem. Every principal owns a unique pair of keys.

FIT1047 Monash University
Asymmetric Encryption
A simplified model of asymmetric encryption

FIT1047 Monash University
GREEN = PUBLIC KEY
RED == PRIVATE KEY
Alice
Message: Hello Alice!
Bob
Cryptography
Encryption using Public Key
Message: Hello Alice!
Encrypted: 356jK$^klmGxL1dF

FIT1047
Monash University
GREEN = PUBLIC KEY
RED == PRIVATE KEY
Alice
Alice
Sh
Bob
Bob
Bob
S
Key Establishment using Public Key Cryptography
Alice
S
t
Key derivation using both keys
Key derivation using both keys
ha
S
h
a
r
h
a
re
ed
ar
dS
r
e
ed
S
e
e
c
dS
S
e
cr
re
e
c
e
c
t
r
re
et
t

FIT1047 Monash University
Digital Signatures / Authenticity
GREEN = PUBLIC KEY
RED == PRIVATE KEY
Alice
Alice
Message: I agree! Bob
Message: I agree! Alice’s signature is verified.
Message: I agree! Signature: 147JkX78GhC
Alice
Sign message using private key
Verify signature using public key

FIT1047 Monash University
Other Uses of Public Key Cryptography
Based on the basic mechanisms, many cryptographic protocols and security applications have been developed.
Some examples:
• electronic cash
• non-repudiation protocols • fair exchange protocols
• electronic voting
• multi-party key agreement

FIT1047 Monash University
Mathematical Background: Prime Numbers • Prime Numbers:
– prime numbers only have divisors of 1 and self
• theycannotbewrittenasaproductofothernumbers • note:1isprime,butisgenerallynotofinterest
– Example:-
• 2,3,5,7areprime,
• 4,6,8,9,10arenotprime
– prime numbers are central to number theory – list of prime number less than 200 is:
• 2357111317192329313741434753596167717379838997101103107109113 127 131 137 139 149 151 157 163 167 173 179 181 191 193 197 199

FIT1047 Monash University
Mathematical Background: Factorization • Prime Factorization:
– to factor a number n is to write it as a product of other numbers: n = a×b×c
• Example:3600=24×32×52
– factoring a number is relatively hard compared to multiplying the
factors together to generate the number
– the prime factorisation of a number n is when it is written as a product of primes
• e.g. 91 = 7×13 ; 3600 = 24×32×52
• theprocessofdeterminingthesefactorsiscalledprimefactorization

FIT1047 Monash University
RSA Algorithm – Key generation
• Stepsinvolve:
– select two large primes number p, q at random
– calculateN=pq
– calculate Euler’s Totient – ø(N) = (p-1)(q-1) – Select public key an integer e such that
 1 < e < ø(N), gcd(e, ø(N))=1 – Select private key d such that  d . e  1 mod ø(N) , i.e., d . e mod ø(N)=1 – public key: KU={e, N} – private decryption key: KR={d, N} FIT1047 Monash University RSA Algorithm - Key generation • Example: – select p=17, q=11 at random – calculate N=p x q =1711=187 – calculate ø(N)=(p-1)x(q-1)=(17-1)(11-1)=160 – Select an integer e such that, 1 < e < ø(N), and (e, ø(N)) are coprime (e is publicly used for encryption) – 1 < e < 160, gcd(e,160)=1; choose e=7 – Select d such that d x e  1 mod ø(N), (the modular inverse d is privately used for decryption) • i.e., d7 1 mod 160; (d7 mod 160)=1; 161 mod 160=1 • The correct answer is : d = 23 – public key: KU={e, N} == {7,187} – private decryption key: KR={d, N} == {23,187} FIT1047 Monash University RSA Example - Encryption/Decryption sample RSA encryption/decryption is: given message M = 88 (note: M < N; i.e. 88 < 187); we selected p=17, q=11 at random and calculated N = p x q = 17 x 11 = 187, then e=7, d=23 • encryption: C = Me mod N C = 887 mod 187 = [(884 mod187) x (882 mod187) x (88 mod187) ] mod 187 =(132x77x88)mod187= 894432mod187=11 Hence the cipher = C = 11 • decryption: M = Cd mod N M = 1123 mod 187 = [(111 mod 187)x(112 mod 187)x(114 mod 187)x(118 mod 187)x(118 mod 187)] mod187 = (11x121x55x33x33) mod187 = 79720245 mod 187 = 88 Hence the Message = M = 88 FIT1047 Monash University Example for asymmetric cryptography: RSA • DevelopedbyRonRivest,AdiShamirandLeonardAlderman. • Firstpublishedin1977. • Privatekeyd,n & publickeye,n Encryption: Decryption: • means the remainder of divided by FIT1047 Monash University Random numbers • All types of cryptography need random numbers for – Key generation – Use in protocols to mark messages as new – Initialisation vectors • Many attacks on cryptography have been based on bad selection of random numbers. FIT1047 Monash University Cryptographic hash functions • A hash function maps input of arbitrary length to a fixed length output. • Cryptographic hash functions are infeasible to invert. • Used in digital signatures, for storing and comparing passwords, in message authentication codes, etc. FIT1047 Monash University Ideal cryptographic hash functions Need to have the following properties: • Computingahashvalueforamessageneedstobe fast and use low resources. • Givenjustahash,itisinfeasibletofindtheoriginal message (except by trying all possible messages) • Hashesforsimilarmessagesshouldnotbe correlated (small change in message -> large change in hash)
• Infeasibletofindcollisions(i.e.twomessageswith the same hash).

FIT1047 Monash University
Some Hash functions
• MD5waswidelyused,butisnotsecure. Sometimes it is still used for integrity protection.
• SHA1isbetter,butattackingitismucheasier than brute-force. Attacks get more efficient. Is no longer recommended for digital signatures.
• CurrentrecommendationsareSHA-256,SHA- 384 and SHA-512

FIT1047 Monash University
Q1. What would you use if you want to protect the integrity of a message?
A. RSA
B. MAC
C. SHA-256 D. SHA-1

FIT1047 Monash University
Q2. In symmetric key cryptography, how many keys are used and who knows them?
A. Two keys, one for each side.
B. One key known to both sides.
C. Depends on the actual algorithm. D. One key pair each, on both sides.

FIT1047 Monash University
Q3. Can public key cryptography keep a message secret?
A. No, that is why it is called public.
B. Only if it is protected by an additional MAC.
C. No, public key cryptography can only be used for digital signatures.
D. Yes. Encrypt with the public key. This message can only be decrypted with the correct private key.

FIT1047 Monash University
Recommended key lengths
• AES(symmetric):Currently,128bitisconsidered secure. Long term recommendations (after 2030) go towards 256 bit.
• RSA(Asymmetricorpublickey):Currently,2048 bits is considered secure. Some agencies/government bodies recommend 3072 bits after 2020, others after 2030.
• RecommendationsfromNIST,NSAandthe German BSI differ in details.

FIT1047
FIT1047 – Week 10
Part 2 Introduction to Cryptography
Introduction to computer systems, networks and security
Abdul Malik Khan
W. Stallings. (2016). Network Security Essentials: Applications and Standards. Global Edition (6e) Pearson International. Ross Anderson. Security Engineering. Second edition, 2008. Wiley. This book is also available for free online: http://www.cl.cam.ac.uk/~rja14/book.html

FIT1047

FIT1047
A central question in cyber security is about who (persons, processes, devices, etc.) has access to which resources in the system.
Resources: read files, execute programs, change data-base content, share data with others, etc.
ACCESS CONTROL
How to Authenticate a user?
Identify at Login
Authenticate particular transaction Identity  Authentication:
Most Common: Password

FIT1047
Problems with passwords:
• Password re-used
• Weak passwords
• Can be stolen through Phishing / Malware
• Stored passwords
• Difficult to remember / reset processes
…Lets look at the use of a password in a computer

FIT1047
User Authentication:

FIT1047
How NOT to store a password:
• Clear text
• As a HASH value
Better way to store a password:
• Use a SALTED Hash
 Password is the MOST commonly used way of authenticating..
 Multi-factor authentication combines different ways of Authentication

FIT1047
Biometrics:
• Fingerprint identification: Fingerprints remain constant throughout life. No two fingerprints have ever been found to be alike, not even those of identical twins.
• Retina scan: There is no known way to replicate a retina. As far as anyone knows, the pattern of the blood vessels at the back of the eye is unique and stays the same for a lifetime.
• Iris Scan Recognition: Like a retina scan, an iris scan also provides unique biometric data that is very difficult to duplicate and remains the same for a lifetime.
• Face Recognition: Of the various biometric identification methods, face recognition is one of the most flexible, and works best. Face recognition systems work by systematically analysing specific face features.
• Signature Recognition: Digitized signatures are sometimes used, but usually have insufficient resolution to ensure authentication.
• Hand geometry biometrics: It is often the authentication method of choice in industrial environments.
• Voice analysis: Like face recognition, voice biometrics provide a way to authenticate. It is easier to fake (using a tape recording); it is not possible to fool an analyst by imitating another person’s voice.

FIT1047
Biometrics:
• Biometrics have high usability
• Not really secret information
• Cannot be revoked/replaced
• No Pseudonymous/Anonymous access
Hardware Tokens:
Another way of Authentication:
• Separate device / additional security
Note that even with secure authentication, the computer can still be vulnerable to attack
Ref: (Wikimedia Commons)

FIT1047
Authentication for Transactions:
 Example: for money transfer in banking
 Transaction numbers (TANs) are not linked to actual transaction
 SMS TAN can show info on transaction. Two devices need to be manipulated.
 TAN generator reads barcode from screen and generates TAN linked to transaction.
 What is an SMS TAN?
Some processes in the Internet Banking system require the input of an TAN
(transaction authorisation number) for security reasons.
For example an TAN might be required when you make a transfer between your own accounts.

FIT1047
Access control on Operating System level
 Distinguish users, groups of users
 Controls access to files, ports, devices, and other resources
 User authentication (e.g. password, fingerprint)
 Allocate processes to users and enforce separation
 OSs can support complex policies for individual programs (e.g. Sun Solaris, IBM Unix, SE Linux, MS Windows Server …)
Basic File permission (Linux)
Main actions for Files & Directories
 Read, Write, Execute
 Can be defined for Owner, Group, All users

FIT1047
Basic File permission (Linux)
Main actions for Files & Directories
 Read, Write, Execute
 Can be defined for Owner, Group, All users
Access rights:
• r permission to read
• w permission to write
• x permission to execute
• – no permission at all

FIT1047
Access control on application level
 Thisiswhatuserusuallycansee(andalsoconfigure)
 Oftencomplexsecuritypolicies
 Enterpriseapplications:Staffwithvariousroles,andfine-grainedaccessto transactions
 Socialnetworks:Rulesonwhocansee,copy,forward,searchwhatdata
Access control in enterprise applications
 Can enforce protection properties.
 Controls access to resources, data-bases, transactions, etc.
 Can be role-based (not just user-based

FIT1047
Authentication for Access control on applications
 Ticketortoken-basedaccesscontrol.
 Acentralserverchecksauthenticityandissuestickets.
 Ticketcontainsidentityinformationandcanalsorestrictcapabilities(i.e.what is the user allowed to do)
 Example:Kerberos,MicrosoftActiveDirectory

FIT1047
Single sign-on
Single sign-on (SSO) is an authentication process that allows a user to access multiple applications with just one set of login credentials. SSO is a common procedure in enterprise networks, where a client accesses multiple resources and services when part of the enterprise intranet network.
SSO advantages include:
 Eliminates credential re-authentication and help desk requests; thus, improving productivity.
 Streamlines local and remote application and desktop workflow.
 Minimizes phishing.
 Improves compliance through a centralized database.
 Provides detailed user access reporting.
Example:
 Just log in once and access many services (e.g. Monash University authcate)
 Very convenient. High usability
 Single point of failure. Needs secure implementation and high level of control
Objective or Main goal of access control is:
 limit the damage that can be done by users or groups of users.
 Privilege escalation is a goal for attacks
 Many ways how access control can go wrong

FIT1047
What can go WRONG?
 Weaknesses in software, interfaces, protocols
 Physical attacks
 Race conditions, feature interaction problems
 Connect devices (USB)
 Social engineering
Additional security mechanisms
 Hard disk encryption
 Virus protection
 Backups
 Security updates
 Trusted Computing (special security hardware

FIT1047
End of lecture 10

FIT1047
Final Exam – 17 February 2021
Final Exam Link: https://eassessment.monash.edu/my/
Instructions
THIS EXAM IS FOR STUDENTS STUDYING AT: AUSTRALIA & MALAYSIA CAMPUSES
1.This exam is marked out of 100 marks.
2.It is an closed book exam. (Permitted to use one blank worksheet for rough calculations).
3.No hand written notes or printed material allowed. No online/electronic access.
4.There are a total of 47 MCQ’s, 1 Matching Question and 15 Theory & Concepts Short Answer Questions. 5.Students have 130 minutes to complete the exam.
6.Students must attempt ALL questions.
7.No uploading of any attachments. Only submit the answers via this platform.

FIT1047
Final Exam:
THIS EXAM IS FOR STUDENTS STUDYING AT: CLAYTON & MALAYSIA CAMPUSES
1. This exam is marked out of 100 marks.
2. It is a close book exam.(Permitted to one blank worksheet for rough calculations).
3. No online/electronic resources access.
4. There are a total of 47 MCQ’s, 1 Matching and 15 Theory & Concepts Short Answer Questions. 5. You have 130 minutes to complete the exam.
6. Students must attempt ALL questions.
7. No uploading of any attachments. Only submit the answers via this platform
More details of the final exam in week-12, including the Mock/Sample exam in eAssessment platform
FITl047 Week11 Part 1 FITl047 Week 11

FIT1047
Sample Exam:
FITl047 Week11 Part 1 FITl047 Week 11

FIT1047
Practice Quizzes Weeks1-6 & Weeks7-12:
FITl047 Week11 Part 1 FITl047 Week 11

FIT1047
Sample Exam on Students eAssessment Platform:
self enrol:- https://student-eassessment.monash.edu/mod/quiz/view.php?id=6470
FITl047 Week11 Part 1 FITl047 Week 11

Related Posts