2021~2022 Academic Year Second Semester "Information Security" Examination Questions (A Volume)

Beijing Information Science and Technology University
2021~2022 Academic Year Second Semester "Information Security" Examination Questions (A Volume)

School where the course is located: School of Computer Applicable professional class: Ji Ke 1901-06, retake exam form: (closed book)

1. Multiple-choice questions (the full score of this question is 10 points, including 10 small questions, each with 1 point)

A computer virus is ( D )

A. A chip B. A set of program codes capable of remotely controlling computers
C. A biological virus similar to the new crown D. A set of program codes capable of destroying computer functions or destroying data
The way to prevent repudiation by the sender is ( D )

A. Message authentication B. Encryption

C. Identity authentication D. Digital signature
In order to defend against network monitoring, the most common method is ( B )

A. Using physical transmission (not network) B. Information encryption

C. Wireless network D. Use dedicated line transmission
The attacker blocks the communication line between A and B, respectively forges the data of A or B and sends them to the other party. The attack method is ( A )

A. Man-in-the-middle attack B. Violent attack

C. Replay attack D. Dictionary attack
Many application systems are set to lock accounts after several invalid logins, this is to prevent ( B )

A. Trojan horse B. Brute force attack

C. DOS attack D. SQL injection
If m represents plaintext, c represents ciphertext, E represents encryption transformation, and D represents decryption transformation, then the encryption process described in the following expression is ( A )

A、c=E(m) B、c=D(m)

C、m=E© D、m=D©
Which of the following statements about DOS attacks is correct? ( C )

A. Compromise the integrity of the system B. For the purpose of stealing confidential information on the target system

C. Cause the target system to be unable to process normal user requests D. For the purpose of remotely controlling the host
In the case of not knowing the key, the method of recovering the plaintext by obtaining the ciphertext is ( A ).

A. Cryptanalysis B. Data encryption and decryption algorithm

C. Key management D. Password encoding
Which of the following is not an active attack ( C )

A. Spoofing attack B. Interception and modification of data information being transmitted
C. Eavesdropping political attack D. Denial of service attack

Active attacks directly affect system resources, while passive attacks focus on collecting information without interfering with the system

Examples of active attacks include: data tampering, denial of service attacks (DoS), fake identities, interruption of services, etc.

Examples of passive attacks include: eavesdropping (listening to communications), traffic analysis, password cracking, etc.
What kind of attack method is used to insert user data into the actual database operation language by using the external interface of some databases, so as to achieve the purpose of invading the database and even the operating system? ( A )

A. SQL injection attack B. Network monitoring

C. Buffer overflow attack D. IP spoofing

2. True or False Questions (The full score of this question is 10 points, including 10 small questions, each with 1 point)

Authentication is the process of verifying the subject in the network. There are usually three methods to verify the identity of the subject, one of which is to use the unique biological characteristics that only the subject has, such as fingerprints, voice, retina, etc. (√)

PPT Lecture 3 50 pages
The basic attributes of information security are confidentiality, integrity, non-repudiation, availability, and controllability. (√)

PPT Lecture 1 Page 31
In a public key cryptosystem, the private key can be deduced from the public key. ( × )
Misuse detection can detect unknown attacks. ( × )

PPT Lecture 6 Page 84

Misuse detection relies on known attack behavior characteristics or patterns to detect attacks, and cannot detect unknown attack behaviors
The IPSec protocol works at the application layer. ( × )

SSL works at the application layer, IPSec works at the network layer
Packet filtering firewall technology can check the state of the application. ( × )

Packet filtering firewalls work at the network layer and mainly filter based on information such as IP addresses, port numbers, and protocol types, and cannot check the status of application programs. Application-layer firewalls and stateful inspection firewalls can inspect the state of applications.
Discretionary access control policies are more flexible than mandatory access control policies. (√)

PPT Lecture 5, page 22
The security of cryptographic algorithms in classical cryptography is based on the security of keys, not the security of algorithm details. (√)

Typical Kerckhoffs principle
The Virginia (Vigencre) cipher is a commonly used multi-table substitution cipher. (√)

The Virginia cipher is a typical multi-table substitution cipher that uses a set of different Caesar ciphers to encrypt plaintext.
Diffusion is the spreading of statistical properties of plaintext into ciphertext. This is achieved by having each bit of the plaintext affect the value of multiple bits in the ciphertext. (√)

PPT Lecture 2, page 36

3. Short answer questions (the full score of this question is 21, including 4 small questions)

(4 points) What are the common firewall architectures?
Answer: Common firewall architectures are
1. packet filtering firewall
2. Application Gateway Firewall
3. Stateful Inspection Firewall
4. Adaptive Filtering Firewall
(PPT Lecture 6, page 57)
(6 points) If you use an encryption algorithm for digital signature, should you use a symmetric key encryption algorithm or an asymmetric key encryption algorithm? Please choose an encryption algorithm and briefly describe the signing and verification process using this algorithm.
Answer: Asymmetric key encryption algorithm. Suppose Alice, the private key owner, wants to send Bob a signed message, she would do this:

Signing process :
1. Alice creates message M.
2. Alice encrypts the message M using her private key, producing a signature s.
3. Alice sends the original message M to Bob along with the signature s.
Verification process :
1. Bob receives message M and signature s.
2. Bob uses Alice's public key to decrypt the signature s to get the message M2.
3. Bob compares M and M2, and if they are the same, then Bob can confirm that the message was sent by Alice and has not been tampered with.
(6 points) If you want to protect the integrity of information, which access control model can you use? Why does this model protect the integrity of information?

Answer: To protect the integrity of information, you can usually use a mandatory access control model. In the mandatory access control model, access rights and controls are defined by system administrators or security policies, rather than determined by individual users or processes, and the model is based on labels or classification levels, which can classify data and users and assign them Different security levels, only users or processes with sufficient security levels can access the data of the corresponding security level.

(PPT Lecture 5, page 28)

(5 points) Can a digital certificate bind the user's identity to its public key? What would be the problem if not bound?

Answer: Yes, digital certificates are used to bind user identities with their public keys. A digital certificate contains some personal information (such as name, email address, etc.) of the public key owner, the public key, and a signature by the certification authority CA. Through the verification of personal information and public key, CA confirms that the public key really belongs to the user, and then signs the user's information and public key with its own private key to generate a digital certificate.

If the public key and user identity are not bound, there will be a big security problem. Since the public key is used to encrypt information, if the real owner of the public key cannot be confirmed, a "man-in-the-middle attack" may occur. For example, Alice wants to send an encrypted message to Bob, but what she gets is actually Charlie's public key, then Charlie can decrypt Alice's message, and then use Bob's public key to encrypt the message and send it to Bob. In this way, Charlie can intercept and tamper with information between Alice and Bob.

(PPT Lecture 4, page 22)

4. Comprehensive questions (the full score of this question is 59 points, including 7 sub-questions in total)

(6 points) In the Diffic-Hellman method, the public prime number q = 13, the primitive root a = 3, if the random number selected by user A is 5, and the random number selected by user B is 2, what is the shared key K ?

Answer: In this example we have q = 13, a = 3, x = 5 and y = 2, therefore, we can calculate:

Public value of user A: A = a^x mod q = 3^5 mod 13 = 9

User B's public value: B = a^y mod q = 3^2 mod 13 = 9

Then the shared key K is: K = B^y mod q = 9^2 mod 13 = A^x mod q = 9^5 mod 13 = 3

(PPT Lecture 2, page 103, need to remember the formula)

(4 points) The following is an S box of DES. If the input is 110100 and 100111, find the output.

S-box calculation method (PPT Lecture 2, page 70) : Given a 6-bit input, use the first and last two bits as the row condition, and the middle four bits as the column condition to look up the table, and finally obtain a 4-bit output. For example, input "011011", look up the table through the first and last two bits "01 (1 in decimal)" and the middle four bits "1101 (13 in decimal)", and the final output should be 11 in decimal.

answer:

The first and last two bits of 110100 are "10", that is, decimal 2; the middle four bits are "1010", that is, decimal 10, and the output is 4, that is, binary "0100".

The first and last two bits of 100111 are "11", that is, decimal 3; the middle four bits are "0011", that is, decimal 3, and the output is 13, that is, binary "1100".

So the final output is: 0100 1100

(10 points) The figure below is an example of key distribution, where E represents encryption, and MK _m represents the secret key shared by both parties. Please try to explain
the role of each step and the role of N ₁ , K _S , ID _B , f(N _n ).

answer:

What each step does:

(1) A sends a request to B to establish a session key and a one-time random number N1

(2) B encrypts the response message with the master key MK _{m shared with A, and sends it to A. The response message contains the session key K}_S selected by B , B's identity ID _B , f(N1) and other A one-time random number N2

(3) A uses the newly established session key K _S to encrypt f(N2) and returns it to B

N ₁ , K _S , ID _B , the role of f(N _{n ):}

N ₁ : This is a one-time random number sent by A to B to prevent replay attacks. Because even if the attacker intercepts the message, the random number will change in the next session, so the attacker cannot replay the captured message.

K _S : The session key shared by both parties for temporary communication. This approach increases the security of the system because even if the session key is compromised, the attacker will only have access to a portion of the communication.

ID _B : This is the identity of B, which is used to confirm the sender of the message.

f(N _n ): These are functional processes on the one-time random numbers N1 and N2. This processing may be encryption, hashing, or some other transformation designed to keep these random numbers secure during transmission.

(PPT Lecture 2, page 123)

In the use of the hash function H in the figure below, what operations did the message sender and message receiver do?

Message sender: Hash the message M to get the value H, encrypt H with the private key KR _a to get the ciphertext E, and then package the message M and ciphertext E to the message receiver.

Message receiver: After receiving the request, take out the message M and ciphertext E. Use the public key KU a _to decrypt the ciphertext E to obtain the original text D (corresponding to H in the message sender); perform the same hash operation on the message M as the message sender, and compare the obtained value with D, if The same means that the message was indeed sent by the message sender and has not been tampered with; otherwise, it means that there is a risk.

(9 points) The following table is an example of the access control rules of the firewall. Please try to explain the meaning of each rule. Of the following rules, does the default rule focus more on security or flexibility?
A: Of the rules described below, the default rule is more security-oriented. The meaning of each rule is as follows:
1. Rule 1 prohibits intranet machines (10.1.1.* network segment) from accessing external network services;
2. Rule 2 prohibits the outside world from accessing the server 10.1.1.2 of the intranet through port 80, that is, the HTTP service of the opened web server 10.1.1.2;
3. Rule 3 prohibits the outside world from accessing the intranet server 10.1.1.3 through port 53, port 53 is DNS service;
4. Rule 4 allows all other types of packets.
(PPT Lecture 6, page 64)
(7 points) Can the educational administration system of our school be directly accessed through the external network? If you come to design a VPN system for the school to realize access to the school's educational administration system, which protocol (AH/ESP/AH&ESP) in IPSec do you think should be used? What services should be provided (authentication/encryption/authentication & encryption)? Please try to give the message format of the selected protocol in transport mode.
A: Off-campus visits are possible.

When designing a VPN system to achieve access to the school's educational administration system, I recommend using the Encapsulating Security Payload (ESP) protocol in IPSec and providing both authentication and encryption services. The ESP protocol not only provides data source authentication and integrity check, but also provides data confidentiality protection. It is very important to ensure the confidentiality and integrity of data for applications involving sensitive information exchange such as accessing educational administration systems.

Authentication & encryption services shall be provided. Because we need authentication services to verify the source of the data, but also to ensure that the data has not been tampered with during transmission.

The message format of ESP protocol in transmission mode is as follows:
- IP header: contains information such as source IP address and destination IP address.
- ESP header: Contains SPI (Security Parameter Index) and serial number, used to determine which security association to use for processing.
- ESP Payload Data: Contains the actual encapsulation data.
- ESP tail: contains information such as the length of the padding data and the type of the next header, and is used for auxiliary data processing.
- ESP Authentication Data: Contains data integrity checks and/or source authentication information.
(15 points) Assuming that the new campus invites you to design the security mechanism of the information system, please try to give design suggestions from the following aspects:

1) Which type of firewall to choose? What are the advantages of this choice?

2) Which access control technology to choose and why?

3) How to authenticate the user's identity?

4) What kind of encryption system is used? Recommend an encryption algorithm and explain why.

5) What should be done if the user forgets the password?

6) Please design the password policy of the system.

answer:

Firewall options: I recommend using an adaptive filtering firewall. This type of firewall uses machine learning techniques or other algorithms to dynamically adjust its filtering rules at runtime in response to changes in network threats. Its main advantage is that it can automatically adjust its filtering rules according to the real-time conditions of the current network environment to prevent various threats more effectively.

Access Control Techniques: I recommend using role-based access control. Access rights are based on user roles rather than personal identities, which makes rights management more convenient, and it is easy to define rights for different roles such as students and teachers.

User authentication: Multi-factor authentication techniques can be used, such as a combination of passwords, fingerprint or facial recognition, and SMS verification codes. Multi-factor authentication provides stronger security because an attacker needs to obtain multiple types of authentication factors at the same time to pass the authentication.

Encryption scheme and algorithm: I recommend using a hybrid encryption scheme, which combines the advantages of public key and symmetric encryption. For the encryption algorithm, I recommend using AES, AES is a symmetric encryption algorithm that provides high security and has good performance on most hardware and software platforms.

Handling of user forgetting password: A secure password reset process can be set up, such as sending a reset link through the user's preset email address or mobile phone number, or verifying the user's identity by answering preset security questions.

Password policy: The password policy of the system should require that the passwords created by users are strong enough, such as containing at least 8 characters, including numbers, uppercase and lowercase letters, and special characters, etc. In addition, user pages need to change passwords regularly and prohibit reuse of old passwords.