Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    From $11.99/month after trial. Cancel anytime.

    New Frontiers in Cryptography: Quantum, Blockchain, Lightweight, Chaotic and DNA
    New Frontiers in Cryptography: Quantum, Blockchain, Lightweight, Chaotic and DNA
    New Frontiers in Cryptography: Quantum, Blockchain, Lightweight, Chaotic and DNA
    Ebook214 pages1 hour

    New Frontiers in Cryptography: Quantum, Blockchain, Lightweight, Chaotic and DNA

    By Khaled Salah Mohamed

    ()

    Read preview

    About this ebook

    This book provides comprehensive coverage of various Cryptography topics, while highlighting the most recent trends such as quantum, blockchain, lightweight, Chaotic and DNA cryptography. Moreover, this book covers cryptography primitives and its usage and applications and focuses on the fundamental principles of modern cryptography such as Stream Ciphers, block ciphers, public key algorithms and digital signatures. Readers will gain a solid foundation in cryptography and security. This book presents the fundamental mathematical concepts of cryptography. Moreover, this book presents hiding data techniques such as steganography and watermarking. The author also provides a comparative study of the different cryptographic methods, which can be used to solve security problems.

    LanguageEnglish
    PublisherSpringer
    Release dateOct 16, 2020
    ISBN9783030589967
    New Frontiers in Cryptography: Quantum, Blockchain, Lightweight, Chaotic and DNA

    Related to New Frontiers in Cryptography

    Related ebooks

    Security For You

    View More
    View More

    Related podcast episodes

    Related categories

    Reviews for New Frontiers in Cryptography

    0 ratings

    0 ratings0 reviews

    What did you think?

    Tap to rate

    Review must be at least 10 words

      Book preview

      New Frontiers in Cryptography - Khaled Salah Mohamed

      © The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland AG 2020

      K. S. MohamedNew Frontiers in Cryptographyhttps://doi.org/10.1007/978-3-030-58996-7_1

      1. Introduction to Cyber Security

      Khaled Salah Mohamed¹ 

      (1)

      A Siemens Business, Fremont, CA, USA

      Keywords

      ConfidentialityIntegrityAvailabilityVulnerabilityThreatCybersecurityAttacksCryptographicSSLIPSec

      Today, cryptography plays a vital role in every electronic and communication system. Everyday many users generate and interchange large amount of information in various fields through the Internet, telephone conversations, and e-commerce transactions. In modern system-on-chips (SoCs), cybersecurity plays an integral role in protecting the confidentiality and integrity of information. Cybersecurity is protecting computers, servers, mobiles, networks, electronic devices, and data from malicious attacks [1]. Recent years have seen an unfortunate and disruptive growth in the number of cyber-attacks. There are mainly three threats to data security [2, 3]:

      Theft them (confidentiality/privacy).

      Modify them (Integrity).

      You are prevented to get them (access/availability).

      The aim of any secure system is to ban these threats. There are many techniques for achieving this such as encryption and data hiding. We will cover them in this book.

      1.1 Security Terms

      Confidentiality refers to the protection of information, such as computer files or database elements, so that only authorized persons may access it in a controlled way [4].

      Integrity refers to not being able to modify information unless proper authorization is used. Availability refers to the presence of information when it is needed by authorized personnel and accessed using proper security measures.

      Vulnerability means weakness in the secure system.

      Threat is set of circumstances that have the potential to cause loss or harm.

      Attack is the act of a human exploiting the vulnerability in the system [5].

      Trojan horse is software that appears to perform legitimately but has malicious side effect.

      Virus is a self-propagating Trojan horse; infects other software.

      Worm is a Virus which propagates over network.

      1.2 Security Threats/Attacks

      Security means freedom from risk or danger. Generally, nothing is ever 100% secured. Given enough time, resources, and motivation, an attacker can break any system. There are many threats to data security (Fig. 1.1):

      Interception: Theft them (confidentiality/privacy attack), i.e., eavesdrop (nondestructive).

      Modification: Modify them (Integrity attack), i.e., insert messages into connection (destructive). Hijacking by taking over ongoing connection by removing sender or receiver, inserting himself as an attacker in place. It is also called fabrication of data or counterfeit data [6, 7].

      Interruption: You are prevented to get them (access/availability attack), i.e., denial of service (DoS) as attacker can prevent service from being used by others (e.g., by overloading resources).

      ../images/501530_1_En_1_Chapter/501530_1_En_1_Fig1_HTML.png

      Fig. 1.1

      Security attacks and threats

      Cybercrimes are criminal offenses committed via the Internet or otherwise aided by various forms of computer technology. There are many privacy concerns surrounding cybercrime when confidential information is intercepted or disclosed, lawfully or otherwise [8].

      1.3 Security Requirements/Services/Objectives/Goals

      Below we describe the main security requirements to overcome the security threats (Fig. 1.2):

      ../images/501530_1_En_1_Chapter/501530_1_En_1_Fig2_HTML.png

      Fig. 1.2

      Security goals intersections

      1.3.1 Confidentiality

      Refers to the protection of information, such as computer files or database elements, so that only authorized persons may access it in a controlled way. Confidentiality ensures that the message is encoded in order to conceal it, so the sender encrypts the message (plaintext) to create a ciphertext that is transmitted. The receiver, who possesses the cryptographic key, decrypts the ciphertext into the original plaintext.

      1.3.2 Authentication

      Authentication answers the following question how does a receiver know that remote communicating entity is who it is claimed to be?. It is also called identification. Nowadays, most cryptographic algorithms support authenticated encryption (AE) or authenticated encryption with associated data (AEAD). This basically means that both confidentiality and authenticity of the data is achieved. When referring to the AEAD scheme, it is assumed that the recipient is able to verify the integrity of both the encrypted and the decrypted message. To clarify this even more, the associated data (AD) are used to bind a ciphertext to the context that it is supposed to be. So, any attempt to place a valid ciphertext along with a different context is detectable and can be rejected.

      1.3.3 Integrity

      Refers to not being able to modify information unless proper authorization is used. The information and data sent can’t be modified in storage or during the transmission between the source and destination in a way that the alteration is not detectable. Data integrity assures that the message received is exactly the same as the one sent by the sender. This may be accomplished, e.g., with the use of hash functions like SHA256 that create a unique digest from the original message, which is sent along with the message.

      1.3.4 Access Control/Authorization

      Who is allowed to do what. Access control is the process of controlling who does what and ranges from managing physical access to equipment to dictating who has access to a resource, such as a file, and what they can do with it, such as read or change the file. Many security vulnerabilities are created by the improper use of access controls.

      1.3.5 Availability

      Refers to the presence of information when it is needed by authorized personnel and accessed using proper security measures.

      1.3.6 Non-repudiation

      The ability to ensure that a party to a contract or a communication cannot deny the authenticity of their signature on a document or the sending of a message that they originated. You can’t deny doing something you did. Generally, it is the assurance that the sender can’t repudiate the validity of the message transmitted. This is accomplished with the use of digital signatures (especially used in online transactions) and message authentication codes, which are basically hash functions containing a key. It should be noted that such cryptographic primitives also ensure the integrity of the information, in a more robust manner than a simple hash function.

      System is secured when all these goals are achieved (Fig. 1.2).

      1.4 Security Mechanisms/Tools/Defenses

      Security tools are summarized as below (Fig. 1.3):

      Cryptographic algorithms (Table 1.1): can be symmetric (one shared key) or asymmetric algorithms (we have two keys: one is secret, other is public) [9, 10].

      Authentication: who the user actually is. It is achieved by digital signature.

      Public/private keys: give out public key. Encrypt with this. Decrypt with private key.

      Hashes: create a unique, fixed length signature (hash) of a data set.

      Digital signatures: encrypt hash with private key. Decrypt with public key. Encryption does not ensure integrity.

      Passwords: something you know. It should be hard enough.

      Firewalls: a firewall is like a castle with a drawbridge. Only one point of access into the network.

      Trusted third party: a trusted third party can issue declarations such as the holder of this key is a person who is legally known.

      ../images/501530_1_En_1_Chapter/501530_1_En_1_Fig3_HTML.png

      Fig. 1.3

      Security services and tools

      Table 1.1

      Classifications of cryptographic algorithms

      1.5 Security Hierarchy/Levels

      A computing system is a collection of hardware (HW), software (SW), storage media, data, networks, and human interacting with them. We need to secure SW, data, and communication, and HW (Fig. 1.4).

      ../images/501530_1_En_1_Chapter/501530_1_En_1_Fig4_HTML.png

      Fig. 1.4

      An example for security hierarchy

      Another prospective for the security hierarchy is shown in Fig. 1.5. Vulnerabilities can happen on the level of hardware, software, and data [11, 12].

      ../images/501530_1_En_1_Chapter/501530_1_En_1_Fig5_HTML.png

      Fig. 1.5

      Security hierarchy. Another prospective

      Hardware Vulnerabilities: Adding devices, changing them, removing them, intercepting the traffic to them, or flooding them with traffic until they can no longer function. Hardware vulnerabilities are often introduced by hardware design flaws. RAM memory, for example, is essentially capacitors installed very close to one another. It was discovered that, due to proximity, constant changes applied to one of these capacitors could influence neighbor capacitors. Based on that design flaw, an exploit called Rowhammer was created. By repeatedly rewriting memory in the same addresses, the Rowhammer exploit allows data to be retrieved from nearby address memory cells, even if the cells are protected.

      Software Vulnerabilities:Software can be replaced, changed, or destroyed maliciously, or it can be modified, deleted, or misplaced accidentally. Whether intentional or not, these attacks exploit the software’s vulnerabilities. Malware is any code that can be used to steal data, bypass access controls, or cause harm to, or compromise a system such as spyware and Ransomware. Software vulnerabilities are usually introduced by errors

      Enjoying the preview?
      Page 1 of 1