密码学和网络安全_安全目标，安全攻击和安全原则| 密码学

密码学和网络安全

安全目标 (Security Goals)

The security goals include different measures to secure the data, like confidentiality, integrity, authentication, etc. However, the main goal of keeping the data secure is to prevent the data from various types of security attacks.

安全目标包括保护数据安全的不同措施，例如机密性，完整性，身份验证等。但是，保持数据安全的主要目标是防止数据受到各种类型的安全攻击。

安全攻击 (Security Attacks)

The security attacks can be defined as an attempt by an outsider who is not an authenticate person to receive the data, but tries to get it by breaking into the system and applying different techniques and methods to get the valid information. The security attacks can be further classified as follows.

可以将安全攻击定义为不是经过身份验证的人的外部人尝试接收数据，而是通过闯入系统并应用不同的技术和方法来获取有效信息，从而尝试获取数据。 安全攻击可以进一步分类如下。

Classification of Security attacks:

安全攻击的分类：

The security attacks are classified into 2 types,

安全攻击分为两种类型，

1) Active attacks:

1)主动攻击：

In an active attack, the attacker tries to modify the information. Due, to the modification, this attack can be easily detected because of visibility.

在主动攻击中，攻击者尝试修改信息。 由于修改，由于可见性，可以容易地检测到这种攻击。

Examples:

例子：

1. Masquerade: One entity pretends to be a different entity.

   假面舞会 ：一个实体冒充另一个实体。

2. Replay: Before going to the receiver, the attacker receives the message and transmits some other information over the network.

   重播 ：攻击者在转到接收者之前，会接收该消息并通过网络传输其他一些信息。

3. Denial of service: Breakdown of communication system or the entire network system.

   拒绝服务 ：通信系统或整个网络系统的故障。

4. Modification of message: The message is modified before it is received by the user at the receiver end.

   消息的修改 ：它是由在接收端用户接收之前修改该消息。

2) Passive attacks

2)被动攻击

In the passive attacks, the attacker tries to obtain the information and not to modify it. Due to this, these types of attacks are difficult to attack because no sign of intervention is seen in the data.

在被动攻击中，攻击者尝试获取信息而不修改信息。 因此，这些类型的攻击很难进行攻击，因为在数据中看不到任何干预迹象。

Examples:

例子：

1. Release of message content: The sensitive content in the messages is released among the unauthorized people.

   消息内容的发布：消息中的敏感内容在未经授权的人员之间释放。

2. Traffic analysis: In this, the attacker monitors and observes the transmission in order to understand the pattern of transmission.

   流量分析 ：在这种情况下，攻击者会监视并观察传输以了解传输模式。

If our encryption technique is strong enough that no outsider or attacker can break the code or algorithm used for encryption under any of the above-mentioned attacks, then this means that we are successful in meeting the data security goals.

如果我们的加密技术足够强大，以至于没有任何外部者或攻击者可以在上述任何攻击下破坏用于加密的代码或算法，那么这意味着我们已成功实现了数据安全目标。

To ensure that the security goals are met, certain principles were proposed which must be met to ensure the complete security of data.

为了确保达到安全目标，提出了必须满足的某些原则以确保数据的完全安全。

The following five principles of data security are known to ensure the security,

为了确保安全性，已知以下五项数据安全性原则：

安全原则 (Principles of Security)

1. Data confidentiality: This means the privacy of data. Only the person who is the sole bearer of the data can access and read it.

   数据机密性 ：这意味着数据的私密性。 只有数据的唯一持有者才能访问和读取数据。

2. Data Integrity: This means that no insertion, deletion or modification has been done in the information. The data is present in its original form as it was sent by the sender.

   数据完整性 ：这意味着未在信息中进行任何插入，删除或修改。 数据以发送方发送时的原始格式显示。

3. Data availability: This means that the data is always available for access whenever required.

   数据可用性 ：这意味着只要需要，数据始终可供访问。

4. Authentication: This ensures that the communication is being held among the right individuals.

   身份验证 ：这可以确保正确的个人之间进行通信。

5. Non-repudiation: According to this, the sender or the receiver cannot deny being responsible for the data being transmitted.

   不可否认性 ：据此，发送者或接收者不能否认对正在传输的数据负责。

翻译自: https://www.includehelp.com/cryptography/security-goals-security-attacks-and-principles-of-security.aspx

密码学和网络安全