CSC 5255: Cryptography
and Network Security
|
RESPONSIBLE FACULTY: Babak Forouraghi |
DATE OF PREPARATION: 2006/3/28 DATE OF REVISION 1: 2006/3/31 |
|
TEXTBOOKS/REQUIRED MATERIAL: Introduction to Computer Security, Matt Bishop, Addision Wesley, 2005. Malicious Cryptography-- Exposing Cryptovirology, Young & Yung, Wiley, 2004. |
PREREQUISITES: CSC 4005 Object Oriented Design and Data Structures |
|
SYLLABUS: |
|
|
CATALOG DESCRIPTION: Topics include classical cryptosystems, public and symmetric cryptography, key management, digital signatures, cipher techniques, authentication and federated identity management. Course also covers concepts relating to cryptovirology, malware, viruses, Trojan horses, worms and other types of infectors as they relate to network security. Course includes programming projects. |
COURSE TOPICS: -- Core -- 1. Access control matrix and security policies 2. Confidentiality and integrity policies 3. Hybrid policy models 4. Basic cryptography 5. Java JCA/JCE (RSA+AES), Hashing and SHA-X 6. Key management, Kerberos and X.509 7. Cipher techniques 8. Authentication 9. Malicious logic-- viruses, rabbits,
bombs, Trojan horses, etc. -- Advanced -- 10. Federated Identity Management (FIM) 11. XML signatures, WS-Security and SAML 12. Web services security 13. Etiology of digital crime 14. Digital forensics |
|
COURSE OBJECTIVES |
1. Explain the basic components of security: confidentiality, integrity and availability 2. Distinguish between security policies and models 3. Explain confidentiality policies and the Bell-LaPadula Model (and its limitations) 4. Explain integrity policies and the Biba Model (and its limitations) 5. Explain the role of access control matrix model and protections state transitions 6. Discuss basic cryptography, transition vs. substitution ciphers, Vigenère cipher, classical ciphers 7. Discuss differences between public and classical cryptosystems 8. Describe DES, AES, RSA, MAC, SHA, MDx 9. Explain the need for two-phase key exchange techniques based on classical and PKE methods 10. Discuss X.509 certificate signature chains and Kerberos key exchange model 11. Understand the basic idea behind the rounds of transposition and substitution (as in DES and AES) 12. Explain capabilities of various cryptosystems in thwarting active and passive network attacks 13. Discuss authentication mechanisms most widely used in networked environments such as challenge-response algorithms, biometrics, and means to protect against dictionary attacks 14. Explain malicious logic and the anatomy of viruses, Trojan horses, worms, and understand defense mechanisms against them |
|
COURSE OUTCOMES |
(Numbers shown in brackets are links to course
objectives listed above) 1. Ability to identify and analyze real-world applications of security and integrity models (1, 2, 3, 4) 2. Ability to critically examine security issues regarding primitive operations of a software system such as an operating system (5) 3. Ability to design and implement a crypto system using Java JCA/JCE (6, 7, 8) 4. Ability to design authenticated two-phase key exchange client/server model (8, 9, 10) 5. Ability to assess strengths and weaknesses of a cryptosystem (11, 12, 13) 6. Ability to describe consequences of allowing backdoors in software systems (14) |