2-4-1 Secure Protocols

Highlighted text? Practice this concept. Highlighted passages and figures open related questions.

Practice related questions (10)Progress & bookmarks

Current section

2-4 Security Implementation Technology

p. 388

Practice this section 10 linked exam questions with default filters

Progress

Not marked complete

2 - 4 Security Implementation Technology

Security implementation technology refers to the technological measures implemented for

p. 389

each target of attacks (threats), such as networks and databases. It is important to use the security technology that is optimal against each of these attacks.

Secure protocols are protocols to prevent eavesdropping of communication data or unauthorized connections. A variety of secure protocols are used in TCP/IP networks.

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • IPsec (Security Architecture for Internet Protocol) This is a secure protocol that is a standard specification for IPv6. Since IPsec performs packet cryptography and authentication in the Internet layer, it enhances the confidentiality and validity of data. • SSL (Secure Sockets Layer) This is a secure protocol that is used between the application layer and the TCP layer, and performs authentication (digital signature) and encryption of communication content (session key cryptography) between client and server. TLS (Transport Layer Security) 1.0 was drafted by the IETF as RFC 2246 that was standardized on the basis of SSL. Original protocol Secure protocols combined with SSL MIME S/MIME (Secure MIME) HTTP HTTPS (HTTP over SSL/TLS) FTP FTPS (FTP over SSL/TLS) SMTP SMTP over SSL/TLS POP3 POP3 over SSL/TLS • SSL accelerator This is hardware that reduces the cryptographic processing load on servers to increase speed. • SSH (Secure SHell) This is a protocol that performs encryption of passwords and data at the TCP layer and application layer, and enhances the security of a UNIX-like command (e.g., rsh). • PGP (Pretty Good Privacy) This is an individual-oriented secure protocol that encrypts the body text of e-mail by using a hybrid method (common key: IDEA; public key: RSA). • APOP (Authenticated POP) This is a protocol that uses the POP with added security functions and encrypts passwords during login to mail servers. However, it does not encrypt the body text of e-mail. • SET (Secure Electronic Transactions) — p. 389 · Enlarge

SSL authentication and encryption · 2 practice questions

p. 390

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: This is a credit card settlement protocol that uses cryptography and digital signatures. It restricts information that can be looked up at the retail store and credit card company, offering high confidentiality. — p. 390 · Enlarge

The protocols used for SPF and DKIM, described in “2-2 Technical Security Measures,” are called authentication protocols. Authentication protocols can be called a type of secure protocol used to prevent unauthorized use of services or unauthorized connections caused by or resulting from spoofing.

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • SMTP-AUTH This is a protocol by which authentication of users is performed by the mail server during transmission of e-mail. SMTP does not have a user authentication mechanism, which creates a problem in the increasing unauthorized use of mail servers for sending spam e-mail. SMTP-AUTH authenticates users by specifying user IDs and passwords in advance. • OAuth This is an authentication protocol that performs handover of user privileges, with user consent, between services (i.e., applications) that have an already-established relationship of trust. Specifically, it accesses resources on Web servers on behalf of users, and enables a service to perform acquisition, addition, updating, and deletion of information that is managed by another service. With OAuth, a user can transfer access privileges to a service without handing over a password, and can set the scope of applicability and the period of validity. • DNSSEC (DNS SECurity Extensions) This is an extended specification that improves the security of DNS. While a normal DNS server is unable to authenticate communicating parties, DNSSEC is able to confirm the creator and integrity of data by using digital signatures. The responding DNS server signs with a private key, and the recipient validates with a public key. • EAP (PPP Extensible Authentication Protocol) This is a protocol that is used to authenticate remote access users. Authentication methods using EAP, which adds authentication functions to PPP, include the following. • EAP-TLS (EAP Transport Layer Security) This uses digital certificates on both server and client. It is defined by the IETF as RFC 2716. • PEAP (Protected EAP) This issues digital certificates on the server side, and authenticates on the client side by user ID and password. It was developed by three companies: Microsoft, Cisco Systems, and RSA Security. — p. 390 · Enlarge

SMTP-AUTH user authentication during sending · 1 practice questions

p. 391

In contrast to authentication protocols aimed at user authentication, the anonymous FTP protocol enables provision of service to unspecified users. This protocol enables anyone to use an FTP service by entering “anonymous” as a user ID. While it is convenient as a means of reducing workload such as registering and administering user IDs, it is easily targeted by crackers and requires that sufficient security measures be taken.

Section progress

Practice ssl authentication and encryption (2) Practice smtp-auth user authentication during sending (1)

Original chapter exercises

Original chapter exercises →

New FE Textbook Vol.1 · IT Fundamentals · First Edition, April 2015

ကိုယ်ပိုင်အကောင့်နဲ့
ဒေတာတွေကို Save ပါ

Video Lesson တွေက Haru အတန်းသားတွေအတွက်ပါ

FROM OUR STUDENTS

အတန်းမအပ်သေးပဲ Haru ဆီမှာ အစမ်းသင်ကြည့်ချင်ပါသလား?

သင်တန်းသားတွေရဲ့ စကားသံများ

2-4 Security Implementation Technology

Progress

Related questions in this lesson 3

2 - 4 Security Implementation Technology