公司网站二维码怎么做的,莱芜百度推广电话,wordpress评论代码,网站做搜索引擎优化目录
1) 什么是重放攻击?
2)什么是Kerberos系统?它提供什么安全服务?
3)服务器验证客户端身份的一种简单方法是要求提供密码。在Kerberos中不使用这种身份验证#xff0c;为什么?Kerberos如何对服务器和客户机进行身份验证?
4) Kerberos的四个要求是什么?Kerberos系…目录
1) 什么是重放攻击?
2)什么是Kerberos系统?它提供什么安全服务?
3)服务器验证客户端身份的一种简单方法是要求提供密码。在Kerberos中不使用这种身份验证为什么?Kerberos如何对服务器和客户机进行身份验证?
4) Kerberos的四个要求是什么?Kerberos系统中使用什么机制来实现这些需求?
5)什么是公钥证书?说明证书包含哪些信息
6)定义X.509标准。给出三个证书在到期前应被撤销的理由? 如何撤销X.509证书?“撤销”另一种问法证书颁发机构(ca)如何保持所有用户的最新有效性并避免无效密钥?
7)什么是IPsec?为什么它很重要?
8)IPsec的两种操作方式是什么?他们如何实现对流量分析的保护?
9)列出IPSec提供的服务。
10)在IPSec中什么是解释域(DOI)?
11)在IPSec中传输模式和隧道模式有什么区别? 简要介绍IPSec中隧道模式和传输模式的工作原理。
12)用来表征特定SA性质的参数是什么?
13)Oakley密钥确定协议和ISAKMP在IPsec中的作用是什么?
14)在防火墙中什么是电路级网关?用图表支持你的答案
15)列出防火墙用于控制访问和实施安全策略的两种技术。 1) What is a replay attack?
1) 什么是重放攻击? It is when an attacker re-uses a valid sequence of data in order to access a particular service. 它是指攻击者为了访问特定服务而重用有效的数据序列。 2) What is Kerberos system? What security services does it provide?
2)什么是Kerberos系统?它提供什么安全服务? • Kerberos is a centralised authentication service designed for use in a distributed environment. •Kerberos是专为在分布式环境中使用而设计的集中式身份验证服务。 • It makes use of a trusted third-party authentication service that enables clients and servers to establish authenticated communication. Also, it provides access control. •它利用可信的第三方认证服务使客户端和服务器能够建立身份验证通信。此外它还提供访问控制。 3) A simple way for a server to authenticate a client, is to ask for a password. In Kerberos this authentication is not used, why? How does Kerberos authenticate the server and the clients?
3)服务器验证客户端身份的一种简单方法是要求提供密码。在Kerberos中不使用这种身份验证为什么?Kerberos如何对服务器和客户机进行身份验证? • The main security weakness is that the password is transmitted. So anybody eavesdropping can get hold of it. •主要的安全弱点是密码会被传输。这样任何窃听者都能得到它。 • A better way is: the client request from the server a “service granting ticket”. The client sends the request for using the server, and the user’s ID. The server, which knows the users password, creates a session key using the user’s password. Using this session key, the server sends the ticket granting a service. The client asks the user for his/her password, generates the session key and recovers the ticket. The password is never transmitted between server-client. •一个更好的方法是:客户端从服务器请求一个“服务授予票证”。客户端发送使用服务器的请求以及用户的ID。服务器知道用户的密码使用用户的密码创建会话密钥。使用此会话密钥服务器发送授予服务的票证。客户端向用户询问密码生成会话密钥并恢复票据。密码永远不会在服务器-客户端之间传输。 4) What are the four requirements for Kerberos? What mechanisms are used within Kerberos systems to achieve those requirements?
4) Kerberos的四个要求是什么?Kerberos系统中使用什么机制来实现这些需求?
RequirementMechanismSecure Provided by the secure steps, mostly achieved by using conventional encryption. AUTHENTICATION is an alternative answer. ReliableDistributed architecture. Uses mirrored system backups. Transparent Limitation of user interaction to the authentication with the client (password, or other methods). ScalablePrinciple of Kerberos realms.
要求机制安全所提供的安全步骤大多是通过使用常规加密实现的。身份验证是另一种解决方案。可靠分布式体系结构。使用镜像系统备份。透明限制用户与客户端的身份验证交互(密码或其他方法)。可伸缩Kerberos领域原理。 5) What is a public-key certificate? Explain what information a certificate contains
5)什么是公钥证书?说明证书包含哪些信息 It is used to authenticate public-keys of users. A public--key certificate consists of a public—key, the user ID of the key owner and the whole block signed by the trusted third party, is signed and acreated by a certificate authority, and is given to the participant. A participant conveys its key information to another by transmitting its certificate. Other participants can verify that the certificate was created by the authority. 用于验证用户的公钥。公钥证书由公钥、密钥所有者的用户ID和可信第三方签名的整个区块组成由证书颁发机构签名和创建并提供给参与者。参与者通过传输其证书将其密钥信息传递给另一个参与者。其他参与者可以验证证书是由权威机构创建的。 6) Define the X.509 standard. Give three reasons why a certificate should be revoked before its expiry date? How is an X.509 certificate revoked? (How can Certification Authorities (CAs) maintain an up-to-date validity of all users and avoid invalid keys?)
6)定义X.509标准。给出三个证书在到期前应被撤销的理由? 如何撤销X.509证书?“撤销”另一种问法证书颁发机构(ca)如何保持所有用户的最新有效性并避免无效密钥?
i) • X.509 defines a framework for the provision of authentication services by the X.500 directory to its users. • the public key of a user and is signed with the private key of a trusted certification authority. • The X.509 defines alternative authentication protocols based on the use of public-key certificates. X.509定义了一个框架用于X.500目录向其用户提供认证服务。 用户的公钥并使用可信证书颁发机构的私钥签名。 X.509定义了基于使用公钥证书的可选认证协议。
ii) · User’s Private-Key has been compromised · Certification Authority has been compromised · User is no longer certified by this Authority ·用户私钥被泄露 ·证书颁发机构已被入侵 ·用户不再获得该机构的认证
iii) • Each CA must maintain a certificate revocation list (CRL) consisting of all revoked certificates issued by that CA. • The list is signed by the issuer and includes the issuer’s name, the date the list was created, the date the next CRL is scheduled to be issued, and an entry for each revoked certificate. Each entry consists of the serial number of a certificate and revocation date for that certificate. • The user could check the CRL list each time a certificate is received to determine the certificate is not revoked. • DRAW A DIAGRAM FOR X.509 STACK AND THE CRL? • 每个CA必须维护一个证书撤销列表(CRL)其中包含由该CA颁发的所有已撤销证书。 • 该列表由颁发者签名并包括颁发者的名称、创建列表的日期、计划颁发下一个CRL的日期以及每个被吊销证书的条目。每个条目由证书的序列号和该证书的撤销日期组成。 • 用户可以在每次收到证书时检查CRL列表以确定证书未被吊销。 • 绘制x.509堆栈和crl? 7) What is IPsec? Why is it significant?
7)什么是IPsec?为什么它很重要? • IPSec stands for IPSecurity as it protects IP packets •IPSec代表IPSecurity用于保护IP报文 • It is vital for providing additional security at the IP layer, and protects packets of all applications including security-ignorant applications •它对于在IP层提供额外的安全性至关重要并保护所有应用程序的数据包包括不了解安全的应用程序 • It provides: confidentiality, authentication, or both for IP packets. •为IP包提供:机密性、身份验证或两者兼有。 8) What are the two modes of operations in IPsec? How can they achieve protection against traffic analysis?
8)IPsec的两种操作方式是什么?他们如何实现对流量分析的保护? • Tunnel Mode: protects entire packet. •隧道模式:保护整个报文。 • Transport Mode: protects payload. ESP provides protection against traffic analysis. •传输模式:保护有效载荷。ESP提供针对流量分析的保护。 * In tunnel mode ESP provides protection against traffic analysis where the host on the internet networks use the Internet transportof data but do not interact with other Internet-based hosts. *在隧道模式下ESP提供流量分析保护其中internet网络上的主机使用internet传输数据但不与其他基于internet的主机交互。 * In Transport Mode, ESP only protects the payload, hence the IP header will not be hidden (limited protection against traffic analysis). *在传输模式下ESP只保护有效载荷因此IP头不会被隐藏(对流量分析的有限保护)。 9) List the services provided by IPSec.
9)列出IPSec提供的服务。 Access control - 访问控制 Connectionless integrity - 无连接完整性 Data origin authentication - 数据来源认证 Rejection of replayed packets - 拒绝重放的数据包 Confidentiality (encryption) - 机密性加密 Limited traffic flow confidentiality - 有限的流量机密性 10) In IPSec, what is the domain of interpretation (DOI)?
10)在IPSec中什么是解释域(DOI)? Contains values to relate the different specifications of the protocol 包含值来关联协议的不同规范 Identifiers for encryption and authentication algorithms 加密和身份验证算法的标识符 Operational parameters, key lifetimes, key exchange, etc. 操作参数、密钥寿命、密钥交换等方面的参数 11) In IPSec, what is the difference between transport mode and tunnel mode? Briefly explain how the Tunnel and Transport Modes operate in IPSec.
11)在IPSec中传输模式和隧道模式有什么区别? 简要介绍IPSec中隧道模式和传输模式的工作原理。
i) Transport mode: Provides protection primarily for upper-layer protocols. That is, transport mode protection extends to the payload of an IP packet. Tunnel mode: Provides protection to the entire IP packet. 传输模式主要为上层协议提供保护。也就是说传输模式的保护范围延伸到了IP数据包的负载。 隧道模式为整个IP数据包提供保护。
ii) Transport mode, in this mode the load of the datagram is encrypted (ESP) or authenticated (AH) depending which protocol is used. Tunnel mode the whole IP packet is encrypted (ESP) or authenticated (AH). This mode can be used to create a virtual private network VPN. 传输模式在此模式下根据使用的协议对数据报的负载进行加密(ESP)或身份验证(AH)。 隧道模式对整个IP报文进行ESP (encryption)或AH (authenticated)加密。该方式可用于创建虚拟私网VPN。 12) What are the parameters used to characterize the nature of a particular SA?
12)用来表征特定SA性质的参数是什么? Sequence Number Counter序列号计数器 Sequence Counter Overflow序列计数器溢出 Anti-Replay Window防重放窗口 AH Information身份验证头信息 ESP Information封装安全有效负载信息 Lifetime of this Security Association安全关联的生命周期 IPSec Protocol ModeIPSec协议模式 Path MTU路径最大传输单元 13) What are the roles of the Oakley key determination protocol and ISAKMP in IPsec?
13)Oakley密钥确定协议和ISAKMP在IPsec中的作用是什么? ISAKMP by itself does not dictate a specific key exchange algorithm; rather, ISAKMP consists of a set of message types that enable the use of a variety of key exchange algorithms. ISAKMP本身不规定特定的密钥交换算法相反ISAKMP由一组消息类型组成使得可以使用各种密钥交换算法。 Oakley is the specific key exchange algorithm mandated for use with the initial version of ISAKMP. Oakley是在ISAKMP的初始版本中规定使用的具体密钥交换算法。 14) In Firewalls, what is a circuit-level gateway? Support your answer with a diagram
14)在防火墙中什么是电路级网关?用图表支持你的答案
电路层网关器 AKA Network Address Translation (NAT) 网络地址转换(NAT) Translates the addresses of internal hosts in order to hide them from the outside world. 转换内部主机的地址以便对外部世界隐藏它们。
图不是端到端的TCP连接而是中继它们。在自身和内部主机以及自身和外部主机之间建立两个连接。 15) List two techniques used by firewalls to control access and enforce a security policy. Explain each of them.
15)列出防火墙用于控制访问和实施安全策略的两种技术。 • Service control: Determines the types of Internet services that can be accessed, inbound or outbound. The firewall may filter traffic on the basis of IP address and TCP port number; may provide proxy software that receives and interprets each service request before passing it on; or may host the server software itself, such as a Web or mail service. •服务控制:决定可以访问的Internet服务类型包括入站和出站。防火墙可以根据IP地址和TCP端口号对流量进行过滤;可以提供代理软件接收和解释每个服务请求然后再传递;或者可以托管服务器软件本身例如Web或邮件服务。 • Direction control: Determines the direction in which particular service requests may be initiated and allowed to flow through the firewall. •方向控制:确定特定服务请求可能被发起和允许流过防火墙的方向。 • User control: Controls access to a service according to which user is attempting to access it. This feature is typically applied to users inside the firewall perimeter (local users). It may also be applied to incoming traffic from external users; the latter requires some form of secure authentication technology, such as is provided in IPSec. •用户控制:根据试图访问服务的用户来控制对服务的访问。此特性通常应用于防火墙边界内的用户(本地用户)。它也可以应用于来自外部用户的传入流量;后者需要某种形式的安全身份验证技术例如IPSec所提供的技术。 • Behaviour control: Controls how particular services are used. For example, the firewall may filter e-mail to eliminate spam, or it may enable external access to only a portion of the information on a local Web server. •行为控制:控制特定服务的使用方式。例如防火墙可以过滤电子邮件以消除垃圾邮件或者它可能只允许外部访问本地Web服务器上的部分信息。
