安全与认证Week3 Tutorial+历年题补充

目录

1) 什么是重放攻击?

2)什么是Kerberos系统?它提供什么安全服务?

3)服务器验证客户端身份的一种简单方法是要求提供密码。在Kerberos中不使用这种身份验证，为什么?Kerberos如何对服务器和客户机进行身份验证?

4) Kerberos的四个要求是什么?Kerberos系统中使用什么机制来实现这些需求?

5)什么是公钥证书?说明证书包含哪些信息

6)定义X.509标准。给出三个证书在到期前应被撤销的理由? 如何撤销X.509证书?（“撤销”另一种问法：证书颁发机构(ca)如何保持所有用户的最新有效性并避免无效密钥?）

7)什么是IPsec?为什么它很重要?

8)IPsec的两种操作方式是什么?他们如何实现对流量分析的保护?

9)列出IPSec提供的服务。

10)在IPSec中，什么是解释域(DOI)?

11)在IPSec中，传输模式和隧道模式有什么区别? 简要介绍IPSec中隧道模式和传输模式的工作原理。

12)用来表征特定SA性质的参数是什么?

13)Oakley密钥确定协议和ISAKMP在IPsec中的作用是什么?

14)在防火墙中，什么是电路级网关?用图表支持你的答案

15)列出防火墙用于控制访问和实施安全策略的两种技术。

---

1) What is a replay attack?

1) 什么是重放攻击?

        It is when an attacker re-uses a valid sequence of data in order to access a particular service.

        它是指攻击者为了访问特定服务而重用有效的数据序列。

  

2) What is Kerberos system? What security services does it provide?

2)什么是Kerberos系统?它提供什么安全服务?

        • Kerberos is a centralised authentication service designed for use in a distributed environment.

        •Kerberos是专为在分布式环境中使用而设计的集中式身份验证服务。

        • It makes use of a trusted third-party authentication service that enables clients and servers to establish authenticated communication. Also, it provides access control.

        •它利用可信的第三方认证服务，使客户端和服务器能够建立身份验证通信。此外，它还提供访问控制。

  

3) A simple way for a server to authenticate a client, is to ask for a password. In Kerberos this authentication is not used, why? How does Kerberos authenticate the server and the clients?

3)服务器验证客户端身份的一种简单方法是要求提供密码。在Kerberos中不使用这种身份验证，为什么?Kerberos如何对服务器和客户机进行身份验证?

        • The main security weakness is that the password is transmitted. So anybody eavesdropping can get hold of it.

        •主要的安全弱点是密码会被传输。这样任何窃听者都能得到它。

        • A better way is: the client request from the server a “service granting ticket”. The client sends the request for using the server, and the user’s ID. The server, which knows the users password, creates a session key using the user’s password. Using this session key, the server sends the ticket granting a service. The client asks the user for his/her password, generates the session key and recovers the ticket. The password is never transmitted between server-client.

        •一个更好的方法是:客户端从服务器请求一个“服务授予票证”。客户端发送使用服务器的请求，以及用户的ID。服务器知道用户的密码，使用用户的密码创建会话密钥。使用此会话密钥，服务器发送授予服务的票证。客户端向用户询问密码，生成会话密钥并恢复票据。密码永远不会在服务器-客户端之间传输。

  

4) What are the four requirements for Kerberos? What mechanisms are used within Kerberos systems to achieve those requirements?

4) Kerberos的四个要求是什么?Kerberos系统中使用什么机制来实现这些需求?

Requirement	Mechanism
Secure	Provided by the secure steps, mostly achieved by using conventional encryption.  AUTHENTICATION is an alternative answer.
Reliable	Distributed architecture. Uses mirrored system backups.
Transparent	Limitation of user interaction to the authentication with the client  (password, or other methods).
Scalable	Principle of Kerberos realms.

要求	机制
安全	所提供的安全步骤，大多是通过使用常规加密实现的。身份验证是另一种解决方案。
可靠	分布式体系结构。使用镜像系统备份。
透明	限制用户与客户端的身份验证交互(密码或其他方法)。
可伸缩	Kerberos领域原理。

  
5) What is a public-key certificate? Explain what information a certificate contains

5)什么是公钥证书?说明证书包含哪些信息

        It is used to authenticate public-keys of users. A public--key certificate consists of a public—key, the user ID of the key owner and the whole block signed by the trusted third party, is signed and acreated by a certificate authority, and is given to the participant. A participant conveys its key information to another by transmitting its certificate. Other participants can verify that the certificate was created by the authority.

        用于验证用户的公钥。公钥证书由公钥、密钥所有者的用户ID和可信第三方签名的整个区块组成，由证书颁发机构签名和创建，并提供给参与者。参与者通过传输其证书将其密钥信息传递给另一个参与者。其他参与者可以验证证书是由权威机构创建的。

  

6) Define the X.509 standard. Give three reasons why a certificate should be revoked before its expiry date? How is an X.509 certificate revoked? (How can Certification Authorities (CAs) maintain an up-to-date validity of all users and avoid invalid keys?)

6)定义X.509标准。给出三个证书在到期前应被撤销的理由? 如何撤销X.509证书?（“撤销”另一种问法：证书颁发机构(ca)如何保持所有用户的最新有效性并避免无效密钥?）

i)

        • X.509 defines a framework for the provision of authentication services by the X.500 directory to its users.

        • the public key of a user and is signed with the private key of a trusted certification authority.

        • The X.509 defines alternative authentication protocols based on the use of public-key certificates.

        X.509定义了一个框架，用于X.500目录向其用户提供认证服务。

        用户的公钥，并使用可信证书颁发机构的私钥签名。

        X.509定义了基于使用公钥证书的可选认证协议。

ii)

        · User’s Private-Key has been compromised

        · Certification Authority has been compromised

        · User is no longer certified by this Authority

        ·用户私钥被泄露

        ·证书颁发机构已被入侵

        ·用户不再获得该机构的认证

iii)

        • Each CA must maintain a certificate revocation list (CRL) consisting of all revoked certificates issued by that CA.

        • The list is signed by the issuer and includes the issuer’s name, the date the list was created, the date the next CRL is scheduled to be issued, and an entry for each revoked certificate. Each entry consists of the serial number of a certificate and revocation date for that certificate.

        • The user could check the CRL list each time a certificate is received to determine the certificate is not revoked.

        • DRAW A DIAGRAM FOR X.509 STACK AND THE CRL?

        • 每个CA必须维护一个证书撤销列表(CRL)，其中包含由该CA颁发的所有已撤销证书。

        • 该列表由颁发者签名，并包括颁发者的名称、创建列表的日期、计划颁发下一个CRL的日期以及每个被吊销证书的条目。每个条目由证书的序列号和该证书的撤销日期组成。

        • 用户可以在每次收到证书时检查CRL列表，以确定证书未被吊销。

        • 绘制x.509堆栈和crl?

  

7) What is IPsec?  Why is it significant?

7)什么是IPsec?为什么它很重要?

        • IPSec stands for IPSecurity as it protects IP packets

        •IPSec代表IPSecurity，用于保护IP报文

        • It is vital for providing additional security at the IP layer, and protects packets of all applications including security-ignorant applications

        •它对于在IP层提供额外的安全性至关重要，并保护所有应用程序的数据包，包括不了解安全的应用程序

        • It provides: confidentiality, authentication, or both for IP packets.

        •为IP包提供:机密性、身份验证或两者兼有。

  

8) What are the two modes of operations in IPsec? How can they achieve protection against traffic analysis?

8)IPsec的两种操作方式是什么?他们如何实现对流量分析的保护?

        • Tunnel Mode: protects entire packet.

        •隧道模式:保护整个报文。

        • Transport Mode: protects payload.  ESP provides protection against traffic analysis.

        •传输模式:保护有效载荷。ESP提供针对流量分析的保护。

        * In tunnel mode ESP provides protection against traffic analysis where the host on the internet networks use the Internet transportof data but do not interact with other Internet-based hosts.

        *在隧道模式下，ESP提供流量分析保护，其中internet网络上的主机使用internet传输数据，但不与其他基于internet的主机交互。

        * In Transport Mode, ESP only protects the payload, hence the IP header will not be hidden (limited protection against traffic analysis).

        *在传输模式下，ESP只保护有效载荷，因此IP头不会被隐藏(对流量分析的有限保护)。

  

9) List the services provided by IPSec.

9)列出IPSec提供的服务。

        Access control - 访问控制

        Connectionless integrity - 无连接完整性

        Data origin authentication - 数据来源认证

        Rejection of replayed packets - 拒绝重放的数据包

        Confidentiality (encryption) - 机密性（加密）

        Limited traffic flow confidentiality - 有限的流量机密性

  

10) In IPSec, what is the domain of interpretation (DOI)?

10)在IPSec中，什么是解释域(DOI)?

        Contains values to relate the different specifications of the protocol 

        包含值来关联协议的不同规范

        Identifiers for encryption and authentication algorithms 

        加密和身份验证算法的标识符

        Operational parameters, key lifetimes, key exchange, etc. 

        操作参数、密钥寿命、密钥交换等方面的参数

  

11) In IPSec, what is the difference between transport mode and tunnel mode? Briefly explain how the Tunnel and Transport Modes operate in IPSec. 

11)在IPSec中，传输模式和隧道模式有什么区别? 简要介绍IPSec中隧道模式和传输模式的工作原理。

i)

        Transport mode: Provides protection primarily for upper-layer protocols. That is, transport mode protection extends to the payload of an IP packet. 

        Tunnel mode: Provides protection to the entire IP packet.

        传输模式：主要为上层协议提供保护。也就是说，传输模式的保护范围延伸到了IP数据包的负载。

        隧道模式：为整个IP数据包提供保护。

ii)

        Transport mode, in this mode the load of the datagram is encrypted (ESP) or authenticated (AH) depending which protocol is used.

        Tunnel mode the whole IP packet is encrypted (ESP) or authenticated (AH).    This mode can be used to create a virtual private network VPN.

        传输模式，在此模式下，根据使用的协议，对数据报的负载进行加密(ESP)或身份验证(AH)。

        隧道模式对整个IP报文进行ESP (encryption)或AH (authenticated)加密。该方式可用于创建虚拟私网VPN。

  

12) What are the parameters used to characterize the nature of a particular SA?

12)用来表征特定SA性质的参数是什么?

        Sequence Number Counter（序列号计数器）

        Sequence Counter Overflow（序列计数器溢出）

        Anti-Replay Window（防重放窗口）

        AH Information（身份验证头信息）

        ESP Information（封装安全有效负载信息）

        Lifetime of this Security Association（安全关联的生命周期）

        IPSec Protocol Mode（IPSec协议模式）

        Path MTU（路径最大传输单元）

  

13) What are the roles of the Oakley key determination protocol and ISAKMP in IPsec?

13)Oakley密钥确定协议和ISAKMP在IPsec中的作用是什么?

        ISAKMP by itself does not dictate a specific key exchange algorithm; rather, ISAKMP consists of a set of message types that enable the use of a variety of key exchange algorithms. 

        ISAKMP本身不规定特定的密钥交换算法；相反，ISAKMP由一组消息类型组成，使得可以使用各种密钥交换算法。

        Oakley is the specific key exchange algorithm mandated for use with the initial version of ISAKMP. 

        Oakley是在ISAKMP的初始版本中规定使用的具体密钥交换算法。

  

14) In Firewalls, what is a circuit-level gateway? Support your answer with a diagram

14)在防火墙中，什么是电路级网关?用图表支持你的答案

电路层网关器
AKA Network Address Translation (NAT) 网络地址转换(NAT)
Translates the addresses of internal hosts in order to hide them from the
outside world. 转换内部主机的地址，以便对外部世界隐藏它们。

（图：不是端到端的TCP连接，而是中继它们。在自身和内部主机以及自身和外部主机之间建立两个连接。）

  

15) List two techniques used by firewalls to control access and enforce a security policy.      Explain each of them.

15)列出防火墙用于控制访问和实施安全策略的两种技术。

        • Service control: Determines the types of Internet services that can be accessed, inbound or outbound.     The firewall may filter traffic on the basis of IP address and TCP port number;      may provide proxy software that receives and interprets each service request before passing it on; or may host the server software itself, such as a Web or mail service.

        •服务控制:决定可以访问的Internet服务类型，包括入站和出站。防火墙可以根据IP地址和TCP端口号对流量进行过滤;可以提供代理软件，接收和解释每个服务请求，然后再传递;或者可以托管服务器软件本身，例如Web或邮件服务。

        • Direction control: Determines the direction in which particular service requests may be initiated and allowed to flow through the firewall.

        •方向控制:确定特定服务请求可能被发起和允许流过防火墙的方向。

        • User control: Controls access to a service according to which user is attempting to access it. This feature is typically applied to users inside the firewall perimeter (local users). It may also be applied to incoming traffic from external users;    the latter requires some form of secure authentication technology, such as is provided in IPSec.

        •用户控制:根据试图访问服务的用户来控制对服务的访问。此特性通常应用于防火墙边界内的用户(本地用户)。它也可以应用于来自外部用户的传入流量;后者需要某种形式的安全身份验证技术，例如IPSec所提供的技术。

        • Behaviour control: Controls how particular services are used.  For example, the firewall may filter e-mail to eliminate spam, or it may enable external access to only a portion of the information on a local Web server.

        •行为控制:控制特定服务的使用方式。例如，防火墙可以过滤电子邮件以消除垃圾邮件，或者它可能只允许外部访问本地Web服务器上的部分信息。