2018~2019 school year second semester "Information Security" exam questions (B paper)

Beijing Information Science and Technology University 2018~2019 academic year 2nd semester
"Information Security" course final exam paper B

School where the course is located: School of Computer
Applicable professional classes: Jike 1601-06, retaking
Examination format: (closed book)

1. Multiple-choice questions (the full score for this question is 10 points, including 10 sub-questions, each with 1 point)

1. The main security loopholes in the network are ( D ).

   (1) Weak password (2) Inappropriate access control policy

   (3) User permissions are not classified and managed (4) A reasonable security risk management mechanism has not been established

   A.1 B. 1 2 C. 1 2 3 D. 1 2 3 4

2. There are ( D ) technologies that cannot prevent information from being illegally accessed .

   A. Cryptography technology B. Intrusion detection technology C. Access control technology D. Remote access technology

3. The main use of host-based intrusion detection systems ( A ) as a data source.
   A. Audit records B. Log records C. Network packets D. Encrypted data

The model proposed by Denning is a host-based intrusion detection model that uses audit records as a data source. For details, see PPT Lecture 6, page 35

4. Which of the following is not a network availability goal is ( D ).

   A. Legal users can access network applications with agreed performance B. Unauthorized users cannot access protected network applications

   C. Attacks that affect network service quality can be detected in time D. Unauthorized users cannot decrypt encrypted data of network applications

   The main goal of network availability is to ensure that network services can continue to provide services to authorized users normally, including maintaining operation in the face of various possible disturbances and attacks. Option D does not belong to the goal of network availability. This option is more related to the goal of confidentiality of the network, that is, preventing unauthorized access, interception of data, etc.

5. Undetected replay of network data undermines network security ( D ).

   A. Availability B. Confidentiality C. Integrity D. Unforgeability

6. In order to ensure the confidentiality of the information processing objects, the usual method is ( A ).

   A. Information encryption and decryption B. Access control list C. Digital signature and identity authentication technology D. Digital watermark

7. Which of the following descriptions of the characteristics of the packet-filtering firewall is incorrect ( C ).

   A. It is difficult to accurately define the filtering rules of data packets

   B. With the increase of filtering rules, the throughput rate of the router will decrease

   C. Processing packets slower than the proxy server

   D. Cannot protect against most types of IP address spoofing

   Option C is incorrect. The working method of packet filtering firewall is to check the header information (such as source IP address, destination IP address, port number, etc.) of each data packet in transmission, and then decide whether to allow the data packet to pass according to the predefined rule set . Since the packet filtering firewall only processes at the network layer and does not perform deeper packet content analysis and processing, the processing speed is usually faster than that of the proxy server.

8. The following algorithms that cannot be used for data encryption are ( D ).

   A. DES B. AES C. RSA D. SHA-1

   SHA-1 is a hash algorithm, not a data encryption algorithm

9. Which of the following attacks can obtain unauthorized information is ( C ).

   A. SYN attack B. Replay attack C. Buffer overflow attack D. Ping of Death attack

   A buffer overflow attack occurs when a program attempts to write data to a buffer that is already full, and this additional information can overflow into an adjacent memory area, overwriting and changing the contents of that area. In this way, attackers can execute arbitrary commands, including obtaining unauthorized information.

10. Which of the following attacks is passive-aggressive is ( D ).

    A. Interrupt B. Tampering C. Forgery D. Eavesdropping

2. True or False Questions (The full score of this question is 10 points, including 10 small questions, each with 1 point)

1. ( × ) The more protective measures the system has, the more secure the system is.
2. (√) Threats to network security mainly come from malicious users, improper operations by users, natural disasters, etc.
3. ( × ) Digital signature technology can be used to ensure the confidentiality of information.
4. ( × ) Use the key k to encrypt the data, must use k to realize the data decryption.
5. (√) In network security technology, a firewall is a means of access control.
6. ( × ) Cryptanalysis refers to finding the plaintext corresponding to a given ciphertext.
7. (√) Vulnerability scanning tools can be used for network attacks.
8. (√) The private key of the RSA encryption algorithm can be used to digitally sign the data.
9. ( × ) For network security purposes, high-level users should have all the permissions of lower-level users.
10. (√) The intrusion detection system needs to collect access data traffic and conduct comparative analysis.

explain:

1. In some cases, too many safeguards can lead to increased system complexity, thereby introducing more security holes.

2. Digital signature technology is mainly used to ensure the integrity and non-repudiation of information, rather than confidentiality. The confidentiality of information is usually ensured by encryption.

3. For asymmetric encryption, such as RSA, encryption and decryption use a pair of keys, which are different.

4. In actual system security design, higher-level subjects do not necessarily have all the permissions of lower-level subjects. Sometimes, even higher-level principals may not be able to access certain resources or perform certain operations, because these resources or operations may only be open to specific principals

3. Short answer questions

1. (5 points) Briefly explain the 5-tuples that describe the cryptosystem; choose a rule and explain the classification of the cryptosystem.

   A cryptographic system is usually represented by a quintuple (M, C, K, E, D), where M is Message, C is Cipher, K is Key, E is Encryption, and D is Decryption:

   1. M: plaintext space, including all possible plaintexts.
   2. C: Ciphertext space, including all possible ciphertexts.
   3. K: key space, including all possible keys.
   4. E: A set of encryption algorithms, each key k ∈ K corresponds to an encryption algorithm Ek ∈ E, so that Ek: M → C.
   5. D: A collection of decryption algorithms, each key k ∈ K corresponds to a decryption algorithm Dk ∈ D, so that Dk: C → M.

   We can divide cryptographic systems into two categories based on how the keys are used:

   1. Symmetric Cryptosystem: In a symmetric cryptosystem, the same key is used for encryption and decryption.
   2. Asymmetric Cryptosystem: In an asymmetric cryptosystem, separate keys are used for encryption and decryption.

2. For any Hash algorithm, is there necessarily two pieces of information with the same Hash value? Describe the characteristics that an ideal Hash algorithm should satisfy.

   Answer: For any Hash algorithm, theoretically there are always two different input information with the same Hash value. This phenomenon is called "Hash conflict". The ideal Hash algorithm should satisfy the following characteristics:

   • Efficiency : For any given input, computing its hash value should be relatively fast and simple.
   • Avalanche property : changing any one bit of a given value produces a huge change in H(M).
   • Anti-prediction : For a given input and hash value, it should be very difficult to predict the hash value of other inputs.
   • Strong Collision : Finding two different inputs that have the same hash should be very difficult.
   • Weak collision : given an input and its hash value, it should be very difficult to find another input with the same hash value.

   (PPT Lecture 3, page 10)

3. Briefly describe the firewall deployment modes and explain their respective characteristics

   A: Firewalls can be classified into several different types based on where and how they are deployed, here are some common patterns:

   1. Border firewall: This is the most common firewall deployment model, and is generally deployed on the border between the corporate network and the Internet, also known as the network edge.
   2. Internal firewall: An internal firewall is usually used to protect a specific area of ​​the network, such as a sensitive internal department or some special network resources, which can prevent internal threats (such as internal malicious users) and limit the lateral flow of the network.
   3. Host firewall: A host firewall is a firewall installed on an individual host that filters and controls network traffic to and from that host.
   4. Virtual firewall: A virtual firewall is a firewall deployed in a virtual environment, which can protect virtual networks and virtual machines. It provides similar functions to traditional firewalls, but it can better adapt to virtualization and cloud computing environments.

   (PPT Lecture 6, page 69)

4. IPsec is a common VPN technology, which uses encryption technology to establish a dedicated data communication channel in the public network. Please take IPsec as an example to illustrate the implementation steps of encrypted communication.

   Answer: IPsec is mainly used for VPN. It can create a secure channel on an insecure network. The implementation steps are:

   1. Establishing a security association (SA) : SA is a set of parameters used to define how both communicating parties use IPsec to encrypt and authenticate communications. An SA will contain information such as how to encrypt data, how to verify data integrity, and how to manage keys.
   2. Key exchange : IPsec uses the Internet Key Exchange (IKE) protocol for key exchange. The IKE protocol securely exchanges keys over insecure networks, and periodically changes keys for increased security.
   3. Data Encryption : Once the SA and keys are established, IPsec begins to encrypt data.
   4. Data sending : Encrypted data packets can be sent to the destination address through an insecure network. Because the packets are encrypted, even if the packets are intercepted, an attacker cannot read or modify the data.
   5. Data decryption : After receiving the data packet, the receiver uses the same SA and key to decrypt and verify. If the packet is authenticated, the receiver can read the original data.

   (PPT Lecture 6, page 128)

5. Please briefly describe the BIBA access control model.

   Answer: The main function of the Biba model is to ensure the integrity of resources. It is characterized by "no writing, no reading", which can effectively prevent unauthorized modification of information. The Biba model defines two basic rules:

   1. Unreadable : A subject cannot read information with a lower integrity level, preventing information with lower integrity from polluting subjects with higher integrity.
   2. 不可上写：一个主体不能写入到完整性等级较高的对象，防止主体将可能有问题的数据写入到需要保持高完整性的对象中。

   Biba模型确保了数据完整性，使得不可信的、低完整性的信息不能污染或破坏高完整性的信息。这种模型在需要保证信息没有被篡改、不包含错误或恶意代码的环境中非常有用，例如在银行、医疗、军事等领域。(PPT第五讲31页)

   

四. 综合题

1. （10 分）Alice 和 Bob 之间采用 RSA 公钥体制进行保密通信，其中，Alice 的私钥 e_A = 13，选择的大素数 p_A=7、q_A=11；Bob 的私钥 e_B = 5，选择的大素数 p_B=5、q_B=13。

   （1）分别计算 Alice 和Bob 的公钥，说明应该向对方公开的信息。

   （2）若 Alice 需要向 Bob 发送的消息 m=10，计算对应的密文和 Bob 的解密过程。

   答：（1）PPT第三讲35页

   • Alice:
     • 因为 n_A = p_A * q_A = 7 * 11 = 77，φ( n_A) = (p_A-1) * (q_A-1) = 6 * 10 = 60
     • According to the conditions, Alice's private key e _A =13, so there is 13 * k _A ≡ 1 (mod 60), and the public key k _A = 37, so Alice's public key is (77, 37).
   • Bob:
     • Since n _B = _B * q _B = 5 * 13 = 65, φ( n _B ) = (p _B -1) * (q _B -1) = 4 * 12 = 48
     • According to the conditions, Bob's private key e _B =5, then according to the relationship between the public key and the private key, 5 * k _B ≡ 1 (mod 48), the public key k _B = 29, so Bob's public key is (65 , 29).

   (2) Alice needs to send a message to Bob, so Alice should use Bob's public key to encrypt the message to ensure the confidentiality of the communication. The encryption process is: c = m kB mod n B = 10 ²⁹ mod ₆₅ = ³⁰ ; Bob uses his own private key to decrypt, and the decryption process is: m = c ^eB mod 65 = 30 ⁵ mod 65 = 10.

2. (10 points) In the Diffie-Hellman method, the public prime q = 13, the primitive root α = 2

   (1) If the secret number X A selected by user _A = 5, what is the public key Y _A sent by A to B ?

   (2) If user A receives user B's public key Y _B = 3, what is the shared key K?

   (3) Use this method for key agreement, whether there are loopholes, and analyze and explain.

   Answer: PPT Lecture 2, page 103

   _{(1) The public key Y A} sent by A to B is: Y _A = a ^ X _A mod q = 2 ⁵ mod 13 = 6

   (2) Shared key: K = Y _B ^ X _A mod q = 3 ⁵ mod 13 = 9

   (3) Vulnerabilities exist, the main security issues include:

   • Man-in-the-middle attack: If an attacker can control the communication channel between A and B, then he can intercept and replace the public key sent by A and B, so that A and B actually share the key with the attacker, not each other shared secret.
   • Logarithm problem: The security of the DH algorithm is based on the difficulty of the discrete logarithm problem. However, if an attacker has enough computing resources, he may be able to find out the secret number of A or B by computing the discrete logarithm, and thus crack the shared secret key.

3. (10 points) Look at the pictures and answer the questions.

   

   (1) Name an encryption algorithm designed using the above structure.

   (2) What are the block lengths and key lengths encrypted each time in the above encryption algorithm?

   (3) For a file with a size of 1.2K bits, please design an encryption scheme using the above encryption algorithm, and explain the corresponding relationship between the plaintext and the ciphertext of the file.

   answer:

   (1) DES symmetric encryption algorithm [PPT Lecture 2, page 60]

   (2) 64 bits, 64 bits (effective length 56 bits) [PPT Lecture 2, page 57]

   (3) If we use the DES algorithm to encrypt a file with a size of 1.2K bits, we can follow the following steps [PPT Lecture 2, page 64]:

   1. First of all, because the length of each encrypted packet of the DES algorithm is 64 bits, we need to divide the 1.2K-bit file into multiple 64-bit packets. 1.2K bits equals 1200 bits, so we can divide the file into 18 64-bit groups (the last group is only 48 bits).
   2. Next, we can encrypt each packet using the DES algorithm and a 56-bit key. During this process, each block is replaced with a ciphertext block of the same length.
   3. Finally, we can concatenate all the ciphertext groups to form a 1.2K bit ciphertext file.

4. (10 points) Please describe the encryption/decryption and authentication steps used in the communication process in the figure below, and analyze and explain what security goals have been achieved? (confidentiality/integrity/availability/non-repudiation)

   

   Answer: The steps are as follows:

   (1) First, the message sender applies a specific message authentication code algorithm to the message M, that is, uses the key K ₁ to process the message M to generate MAC(K ₁ , M)

   (2) Then the message sender packs MAC(K ₁ , M) and the original message M, encrypts it with the symmetric key K ₂ , and sends it to the message receiver.

   (3) After receiving the message, the message receiver first decrypts the message using the symmetric key K 2 to obtain M and C(K _{1 ,} M), C(K ₁ , M) corresponding to the MAC(K ₁ , M).

   (4) The message receiver processes the message M using the key K ₁ and compares the result with C(K ₁ , M). If they are the same, it means that the message was indeed sent by the message sender and has not been tampered with ; Otherwise, it indicates that there is a risk.

   The communication process achieves the security goals of confidentiality/integrity/availability/non-repudiation at the same time, the analysis is as follows:

   (1) Confidentiality: During the entire communication process, since all messages are encrypted with the symmetric key K (2) and then sent, only the receiver who knows the symmetric key can decrypt and obtain the original message, thus ensuring confidentiality of the message.

   (2) Integrity: After receiving the message, the receiver will use the same message authentication code algorithm and key K (1) to process the original message, and compare the processing result with the received MAC(K (1) , M) for comparison, thereby realizing the integrity check of the message.

   (3) Availability: As long as the sender and receiver know the correct symmetric key and message authentication code algorithm, they can communicate securely at any time, ensuring the availability of the system.

   (4) Non-repudiation: Since the MAC of the message is calculated by the sender using the key K (1) and the original message, only the sender who knows the symmetric key can generate the correct MAC. Therefore, the receiver can prove that the message is indeed sent by a specific sender by checking the MAC, and the sender cannot deny that the message has been sent, thus realizing the non-repudiation of the message.

5. (12 points) Suppose you are a security manager of a campus network, and you want to promote safe online skills to teachers and students

   (1) Please list the network security protection means (equipment) you know to teachers and students based on your personal experience, and explain what kind of network security attacks they can deal with;

   (2) Please give feasible suggestions from the perspective of personal information protection and preventing intrusion into personal computer systems, and list at least 2;

   (3) To ensure the confidentiality of a secret-related system, please design a feasible access control rights management model according to the hierarchical management method.

   Answer: (1) Network security equipment and the security attacks it can cope with:

   • Firewall : Firewall can intercept unsafe network connection requests, prevent unauthorized access, port scanning, denial of service attacks and other behaviors.
   • Security gateway : Use technologies such as VPN to provide encryption and security mechanisms for network communications, preventing man-in-the-middle attacks and network eavesdropping.
   • Anti-virus software : prevent malicious software from attacking computers, and clear infected computer viruses.
   • Intrusion Detection/Prevention System : Detect abnormal behavior or suspicious activities in the network, and block the detected attacks, so as to prevent the occurrence of attacks, such as vulnerability exploitation, malware propagation, etc.

   (2) In terms of personal information protection and preventing intrusion into personal computer systems, I have the following suggestions:

   1. Use strong passwords. Strong passwords usually include a combination of uppercase letters, numbers, and special characters and are at least 8 characters long.
   2. Do not access sensitive information in an unsafe network environment, such as online shopping on a public Wi-Fi network.

   (3) To ensure the confidentiality of confidential systems, I recommend using a role-based access control model. In this model, we can assign corresponding roles according to the user's responsibilities, and each role has certain permissions, such as:

   • System Administrator : Has the highest level of access, including managing user accounts, setting security policies, and more.
   • Level 2 administrators : Can manage and operate sensitive data, but cannot change system settings or security policies.
   • Ordinary users : can only access and operate the data they need, and cannot access and operate other users' data.

   Each user can only access the resources and operations allowed by their role. New users can be assigned corresponding roles according to their responsibilities, and there is no need to set permissions for each user individually. This model can effectively implement hierarchical management, and also simplifies the work of permission management.