Distributed Systems reading notes (11)-----Security

First, Introduction

In distributed systems, the guarantee of the privacy of data, completeness and availability are important. The means of security attack can go to steal, tamper with user's information. It is precisely because of such a variety of circumstances, there is a series of security related defense methods behind.

1. These security mechanisms are essentially a layer of packaging of resources in a way that is expected. The means of packaging isolation can be physical isolation, for example, in the company's resources, only allow people in the intranet to use, the outside people are inaccessible, of course, can also be the network level of isolation.

2, the security closely related to the word is cryptography, most of the implementation of security strategy is inseparable from his role. The rapid development of cryptography has spawned many priority encryption and decryption algorithms.

3, the current security of attack means: 1, the disclosure of information, was not certified by the person received. 2. Tampering with information. 3, the intentional destruction of information. 4. There is a similar approach to denial of service attacks. 5, there are mobile code attacks, such as XSS cross-site scripting attacks.

4, for mobile code attacks, there are good restrictions in the JVM, the code runs in the JVM, the downloaded code is not directly accessible to the local class, in which also through the type-checking and code-validation byte code validity detection, to prevent illegal access to the address.

5, some may have security problems in the use of the scene: 1Email of information to send and receive. 2, e-commerce merchandise purchase. 3, banking and financial industry transactions. 4, micro-commerce, similar to the release-subscription model, the provider provides information, corresponding to a bunch of consumers.

6, it is because of the above various hazards exist, so need to have a system security design, often to the worst case of the most assumptions and design, while in the design of the system at the same time to consider the cost of security, and the normal system allows, at least not affect the normal operation of the system.

II. Summary of safety technology

With the rapid development of the field of security technology, a lot of related technologies have been derived, and the following are some specific classifications.

1, cryptography related technology. The main include many of the encryption algorithms involved.

2, certificate authentication technology. Sometimes certification requires the participation of third-party services, this technology is relatively high security.
3, digital signature technology, simulates the traditional way of signing data documents.

4, access control means. This has been adopted in the major operating systems, the 2 small categories are called Protection domain protection field, there is a call ACL access control list, the concept is very similar.

5, the concept of authorization, in the system many resources access needs to authorize users to be access to, but the authorization is easy, revoke the right is more difficult, once the right to authorize a malicious user, the consequences of unimaginable.

6, firewall. The firewall acts as a barrier to the internal communication between the computer and the external connection, intercepts the externally sent information, and blocks the suspicious packets.

Three, cryptography algorithm

The encryption algorithms mentioned here are mainly divided into 2 classes, symmetric encryption algorithm and asymmetric encryption algorithm.

1, the first kind of symmetric encryption algorithm Ah, why is called symmetric encryption algorithm? Because the same key is used in the process of encrypting and decrypting, this key is private and only the receiver knows. But sometimes, the number of bits in this key is too short to be cracked by brute force attacks. The typical symmetric encryption algorithm is DES encryption algorithm.

2, the second class is the asymmetric encryption algorithm. A pair of keys is maintained in this algorithm for both the public and private keys. Public keys are public to the outside world, while private keys are owned by individuals. If anyone wants to send a message, use the public key to encrypt it, and if anyone wants to receive the message, use the private key to decrypt it.

3, block encryption and stream encryption. The above-mentioned algorithms are block encryption means, because the data is static text form, can be encrypted through the form of a block, but if it is in the process of liquidity, such as audio and video processes, the data is a steady flow, you can not use block encryption means, here the stream of the professional name is called stream Ciphers, the principle is really similar to block encryption, in stream encryption used to keystream, he is a fuzzy data content of a sequence bit, RC4 is a stream encryption algorithm.

4, in the symmetric encryption algorithm, is more typical DES, and later a more secure AES algorithm, and in the asymmetric encryption algorithm, the most famous, the most widely used is the RSA algorithm, he is the first letter of the name of 3 people constituted.

Iv. Digital Signature

A digital signature is a secure implementation that binds information to the identity of the owner of the information.

1, in the digital signature will be useful to the data content of the summary of the calculation, if the contents of the file changes, the value of the message digest will change, so you can make the data integrity check according to the Information Digest.

2, the message digest calculation algorithm has many, for example MD5 algorithm, also has the security hash function Sha algorithm.

Five, the development obstacle of the cryptology

The promotion and development of cryptography has encountered some obstacles in policy. For example, some algorithms in the open to the user, the number of bits is limited, the length of the password encryption can not be specified in accordance with the original algorithm, they may be afraid that they are in use, they can not crack.

Vi. Examples of learning: Needham-schroeder,kerberos,tls,802.11wifi

1, the authentication agreement was originally issued by Needhan and Schroeder.

2, Kerberos authentication was first used in the University of MIT Network. Inside the certification process can be roughly 1. The client wants as Authentication Service please license the ticket, 2. The client then requests the service ticket to the TGS Ticket authorization service, 3. After the group requests the service through the service ticket to the final server. During each session of this period, there will be the participation of a session key. Kerberos authentication is used in Hadoop.

3, Tls/ssl. The former is the most the latter version of the extension. These 2 protocols have been used in many operations involving e-commerce to build a secure channel. The protocol stack of TLS is divided into 2 layers, the first layer is called the TLS handshake Protocol, which is used to negotiate the encryption algorithm for the first time the information is communicated. The second layer is the TLS Record Protocol, and the second layer is the channel used for secure transmission. The purpose of TLS is to be able to negotiate different devices, different areas of the connection, and finally through a handshake to achieve a consistent encryption algorithm, so the subsequent encrypted communication. , in the process of negotiation, 2 sides will list the supported encryption algorithms AH.

4, 802.11WiFi represents the wireless LANS, wireless LAN. In the wireless LAN, there will be different from the wired network security issues, such as his user access problems, connect a wireless network, a user as long as through one of his key connection is OK, obviously this seems too easy. 2nd, users in the use of the wireless network process, often does not turn on WEP protection mode, because in the wireless network, they do not know that their data is completely exposed. So here comes a security protocol called WiFi Protected Access (WPA), which needs to be perfected in the future.

References: <<distributed sysytems Concepts and design>> original version fifth, Author:george Coulouris,jean Dollimore, Tim Kindberg,gordon Blair

Distributed Systems reading notes (11)-----Security