|
|||
|
|
|
A Access: In computer context, entry granted to a software path that establishes the right to use a system and its resources. Access control : The security component that enforces or restricts access based on the level of authorization. Access control works in tandem with the authorization component to restrict user access. AIX : IBM's implementation of the UNIX operating system. Algorithm : A detailed sequence of actions which must be performed in order to accomplish some task. Named after an Iranian mathematician. Algorithm and Key Length: The combination of algorithm and its key length(s) often used to establish the strength of an encryption process. AP-REP : Application reply. AP-REQ : Application request. API : Application programming interface, the set of services an operating system makes available to programs that run under it. For example, the TrustBroker Security SDK gives programmers access to function calls that secure their applications for use with other TrustBroker products. AS : See authentication service. Assurance: Confidence that a system design meets its requirements, or that its implementation meets its specification, or that some specific property is satisfied. Asymmetric Cryptography (also public-key cryptography) : Cryptography based on algorithms that enable the use of one key to encrypt a message and a second, different, but mathematically related, key to decrypt a message. Asymmetric cryptography can also be used to perform digital signatures and key exchange. Attack signature : The pattern or method that signifies a user's action is a threat to an information asset. Audit log : A file stored on each computer that records user activity, file access, etc. Audit policy : The user-defined settings that determine what information is recorded into each computer's audit logs by its operating system (see "audit log"). Authenticate : To determine that something is genuine; to determine the identity of another principal reliably. Authentication : The act of verifying the identity of a principal. Authentication Service (AS) : A service of the Key Distribution Center (KDC) that verifies the identity of a principal. Once the identity is verified, the authentication service issues a set of credentials (including a ticket granting ticket) to the principal. Authenticator : Some known data that can be shown to have been recently generated using a session key known only by a client and server. In the TrustBroker Security Suite, an authenticator is sent with a ticket to an application server. It certifies a client's knowledge of a session key. Authorization : The process of determining whether a client may use a service. Permission to access a resource. Availability : The property that a given resource will be usable during a given time period, for example, that an encrypted file can be decrypted when necessary. B Back door : An aspect of a system's mechanism that can be exploited to circumvent the system's security. Binary digit : One of the two symbols (0 and 1) that are commonly tused to represent numerical entries in the number system. Bit : A contraction of the term "binary digit." Bit Stream (also digital stream) : The running stream of binary symbols representing digitzed infomration. Brute force attack : A type of attack where the intruder tries all possible combinations of characters in an attempt to match the user's password. This attack is usually run by another computer program. C Capstone Chip: An integrated circuit chip that imlplements the Skipjack algorithm and also includes the Digital Signature ALgorithm, the Secure Hash Standard, the classified Key Exchange Algorithm, circuitry for efficient exponentiation of large numbers and a random number generator using a pure noise source. Capstone/Fortezza Initiative : A government initiative to promote and support escrowed encryption for data storage and communications. Certificate authority (CA) : An entity that attests to the identity of a person or an organization. A CA might be an external company that offers certificate services or it might be an internal organization such as a corporate MIS department. The CA's chief function is to verify the identity of entities and issue digital certificates attesting to that identity. Certificate management : The overall process of issuing, storing, verifying and generally accepting responsibility for the accuracy of certifications and their secure delivery to appropriate consumers. Certificate revocation list : A list maintained by the CA of all certificates that are revoked but not expired. A certificate may be revoked because the user's private key is assumed to be compromised, the user is no longer certified by this CA, or the CA's private key is assumed to be compromised. Challenge : A token given to someone to be cryptographically processed; usually in a token device to generate a response. See also challenge-response cryptosystem. Challenge-response cryptosystem : A network security mechanism that asks for a piece of information that will be used to determine if access should be granted. The information is processed and a response is given. If the response is the expected result (e.g., the password given is the correct one), access is granted. Ciphertext : Literally, text material that has been encrypted. Cleartext : Refers to packets transferred across the network in a visible and non-encrypted form. Also known as plaintext. Client : The program that requests use of a network service on a user's behalf, such as the TrustBroker Client product. Client-server computing : A computing system with processes distributed among clients on a network that request information from one or more servers on the network. Servers perform many functions, including storing information, helping clients share data and programs, and providing printing access. Clipper chip : An escrowed encryption chip that implements the Skipjack algorithm to encrypt communications conducted over the public switched network. Clipper initiative : A voluntary program to improve the telephone communications while meeting the legitimate needs of law enforcement. Clock skew : The time offset between two systems. In Kerberos, if the clock skew is too great between the client and the Key Distribution Center, authentication can fail. CoCom : Coordinating Committe for Multilateral Export Controls, began operations in 1950 to control export of strategic material and technology to communist countries. Collateral Cryptography : A collective term used in this report to include uses of encryption for other than cofidentiality. Competitive access providers : Telephone carriers that compete with local monopoly carriers. Confidentiality : The property of not being divulged to unauthorized parties. In the TrustBroker Security Suite, a message with confidentiality has been encrypted. Control characters : Characters transmitted that are not message or user data, but which cause certain control functions to be performed when encountered. Countermeasure : A mechanism that reduces vulnerability a threat. CRC : See cyclical redundancy check. Credentials : Presented and held by a principal as proof that it is what or who it claims to be. Credentials are used by a principal to show it has been authenticated by the Key Distribution Center. In Kerberos, credentials consist of a ticket and an associated session key. Credentials cache : A place where credentials are stored for a user. TrustBroker supports several cache types such as a file cache, a memory cache, and a persistent memory cache. Cryptography : The practice and study of encryption and decryption -- encoding data so that it can only be decoded by specific individuals. A system for encrypting and decrypting data is a cryptosystem. This usually involves an algorithm for combining the original data (plaintext) with one or more keys -- numbers or strings of characters known only to the sender and recipient. The resulting output is known as ciphertext. Cyclical redundancy check : (CRC) A method of detecting errors in a message by performing a mathematical calculation on the bits in the message (or file) and sending the results of the calculation with the message. The receiving program performs the same calculations on the message data it received and checks the results against those received at the end of the message. If the results do not match, the program knows something has changed in the message. See also checksum. D Daemons : A process that runs on a UNIX system with no associated user, typically the server side of a client-server application. Data confidentiality : See confidentiality and private messages. Data Encryption Standard : A standardized secret key cryptographic scheme. Data/Time stamp : The date and time a transaction or document is initiated or submitted to a computer system, or the time at which a transaction is logged or archived. DCE : See Distributed Computing Environment. Decompiling : A process through which object code consisting of ones and zeros can be converted into source in a high-level computer language. Decrypt : To undo an encryption process, generating cleartext. See also encrypt. Decryption : The process of converting cipher-text to cleartext. Denial of service : Reducing the availability of an object below the level needed to support critical processing or communication, as can happen for example, in a system crash. DES : See Data Encryption Standard. Digest : A much condensed version of a message produced by processing the message by a hash algorithm. Digital certificate (also called digital ID) : A data file which links an RSA public key with certain identifications of its owner, such as name and address. In order for trust to be established using a digital certificate, it must be signed by a trusted party. Digital signature : Extra data appended to a message which identifies and authenticates the sender and message data using public-key encryption. Digital telephony act of 1995 : A law requiring that the telephone industry madke such technical changes to its installed equipment as are needed to comply with court-authorized wiretap orders. Disassembly : A process through which object code consisting of ones and zeros can be converted into its low-level assembly language representation. Distributed Computing Environment (DCE) : A group of programs and protocols standardized by the Open Software Foundation and built on a cryptographically protected remote procedure call (RPC) protocol. DNS : See Domain Name System Domain : Systems, links, and all the associated resources that are within an administrative grouping. Domain Name System (DNS) : The naming standard defined in RFC 1033. DNS names are often referred to as Internet addresses or Internet names. See also Request for Comments. Dual-use system : a system with both military and civilian applications. E Encrypt : To scramble information so that only someone knowing the appropriate secret can obtain the original information (by decrypting it). See also decrypt. Encryption : A security mechanism. An application of a cipher to plaintext, resulting in cipher-text or crypto-text. See also decryption. Escrowed Encryption Standard : A voluntary U.S. government standard for key-escrowed encryption of voice, fax, or computer data transmitted over circuit-switched and telephone systems. Exceptional access : access to encrypted data granted to a recipient other than the originally intended recipient. F Firewall : A type of gateway that protects private networks from eavesdropping, intrusion, and other attacks from the Internet by intercepting all traffic to and from the network. Firmware : The programmable information used to control the low-level operations of hardware. Fully qualified domain name (FQDN) : The official name including the domain component of a computer host. Functionality : The functional behavior of a system. G GSS-API : Generic Security Service Application Programming Interface, RFC 2078. Designed to allow application programmers to write applications that need security services without needing to commit to a particular security service implementation. H Hash function : An algorithm that converts data to numbers. Hash value : The output of a hash function. Hierarchy : The relationship among digital certificates issued by certification authorities to authenticate the identities of other certification authorities. At the top of the hierarchy is the self-authentication root CA. Host-based intrusion detection : The process of watching audit logs on each monitored machine to determine when misuse occurs and to respond accordingly. I Identification key : A key registered or issued to a specific user. Implementation : The mechanism that (supposedly) realizes the specified design. Integrated product : A product designed to provide the user a capability useful in its own right and integrated with encryption capabilities that a user may or may not employ. Integrity check : A security mechanism to detect message stream modification. Integrity check techniques include cyclic redundancy checks, checksums, and one-way hash functions. See also safe messages. Interceptor : A party eavesdropping on communications. Internet Activities Board (IAB) : A group of about a dozen researchers who provide direction and focus for the Internet project, including Internet operations and Internet administration. Internet Engineering Task Force (IETF) : A task force under the Internet Activities Board (IAB) whose main objective is to provide protocol standards for Internet operations. The IETF publishes Requests for Comments. Inter-realm authentication : The process by which a user in one realm is granted authenticated access to a server in another realm. In the TrustBroker suite, this is accomplished by walking a hierarchical tree of communicating realms. Two realms are said to be adjacent if they share an inter-realm key. Inter-realm key : In the TrustBroker suite, this key registers the ticket granting service of an adjacent realm as a principal in the other realm. Can have different keys used in each direction. Interrupt : A signal that suspends a program temporarily, transferring control to the operating system or underlying protocol. Intrusion detection : Software that watches networks and the computers within those networks for signs of misuse, such as unauthorized access, denial-of-service attacks, or inside espionage (also see "host-based intrusion detection" and "network intrusion detection"). ITAR : International Traffic in Arms Regulations. K KDC : See Key Distribution Center. Kerberos : In mythology, Cerberos (pronounced KERR-ber-roass) is the three-headed dog that guards the gates to Hades. In network security, Kerberos is a Data Encryption Standard-based authentication system developed at MIT as part of Project Athena. The TrustBroker Security Suite is an enhanced, commercial version of Kerberos. Key : An integer used to encrypt and decrypt messages. It controls the encryption transformation performed. Key distribution : Key distribution is the single largest outstanding security problem. There are three methods: (1) by hand, (2) with the Key Distribution Center, and (3) via the directory server. Key Distribution Center (KDC) : The trusted third-party authority that holds all the secret keys for all the principals in a realm or set of realms. The KDC provides two services: the authentication service (AS), and the ticket granting service (TGS). Key escrow : A secure location, separate from the Key Distribution Center, where passwords are stored (e.g., a safe deposit box). In the event of an emergency, the passwords can be retrieved by authorized personnel. Key Management : The overall process of generating and distributing cryptographic keys to authorized recipients in a secure manner. L Load balancing : A mechanism for distributing the traffic on a network to a number of services that handle those requests. M Masquerade : To pretend to be someone you are not, usually without that individual's permission. See also spoof. MD5 : Message Digest 5. When used on a message, it produces a unique hash function that can be used to detect modifications to the message. Message stream modification (MSM) : A network security threat in which all or parts of the message are intercepted, modified, and then passed back into the transmission stream. Monitioring : Recording of relevant information about each operation by a subject on an object, maintained in an audit trail for subsequent analysis. MSM : See message stream modification. Mutual authentication : An authentication exchange in which each side of the communication proves its identity to the other. N Network architecture : Defines the structure and topology of your network according to your organization's trust assumptions, policies and procedures, and business needs. A network architecture includes things such as naming conventions, system location, and system grouping. Network entity : A user, program, or server on a network. Network Information Service (NIS+) : Formerly known as YP. It is Sun Microsystem's mechanism for distributing administrative information such as passwords and group information. Network intrusion detection : The process of watching network traffic (packets) to determine when misuse occurs and to respond accordingly. Network scanner : A type of vulnerability assessment tool that tests machines on a network for network-based holes or misconfigurations that might be used to gain unauthorized access. Network service : A resource provided by one or more servers to network clients, such as an rlogin service. NIS+ : See Network Information Service. Node : A computer system that is connected to a communications network and participates in the routing of messages within the network. Nonrepudiation (of a signed digital message, data or software) : The status achieved by emloying a digital-signature procedure to affirm the identity of the signer of the digital message with extremely high confidence and, hence, to protect against a subsequent attempt to deny authenticity, whether or not there had been an initial authentication. O Object code : The "executable" code of ones and zeros that provides a computer with instructions on what steps to peform. Contrasts with source code. Object linking and embedding(OLE) : Microsoft's object oriented software technology. One-to-one mapping : A function that assigns an output value to each input value in such a way that each input maps to exactly one output, and no two inputs map to the same output. One-way hash function : A function that produces a message digest that cannot be reversed to obtain the original. P Password versus secret key : The password is used to derive the secret key using a one-way transformation algorithm. The secret key is then used to authenticate the user. The secret key is stored in the principal database, but the actual password is never stored. Pen register : A device that records nunbers dialed from a telephone. PIN : A personal identification number. It is a sequence of digits found on token cards, along with a password, when using hardware authentication devices. Plaintext : See cleartext. Principal : Any user, client, network service, application, or host system that has stored a secret with the TrustBroker Security Server (usually a secret key). Principals have a unique name within a realm and an associated key. Principal names use the following form: name/instance@REALM, where the /instance and @REALM parts are optional. If the /instance is omitted, an empty instance is assumed. If @REALM is omitted, the default realm is assumed. Multiple instances are allowed, each separated by a /. Principal database : Located with the TrustBroker Security Server; holds the shared secrets used in authentication. Each user has a principal in the database providing access to secured network services. Privacy : Protection from the unauthorized disclosure of data. Private key : In public key encryption, the key that must be kept private. Only you use your private key, to encrypt messages you send, and to decrypt the messages you receive from others signed with your public key. A private key is the inverse of the complementary public key. Private messages : A level of security that encrypts every message between the client and server so messages are not visible to network eavesdroppers. This security level also uses safe message checking, via cryptographic checksums, ensuring that messages are not tampered with during transit. See also safe messages and encryption. Protocol : A formal set of rules governing the format, timing, sequencing, and error control of messages exchanged on a data network. A protocol may also include facilities to manage a communications link. Public key : In public key encryption, the key that you give to others to use when sending messages to you. They encrypt the message with the public key, and the message can only be decrypted with the private key. A public key is the inverse of its complementary private key. Public key certificate : A statement, possibly on paper but more often transmitted electronically over an information network, that establishes the relationship between a named individual (or organization) and a specified public key. Q QOP : Quality of protection. The strength of the cryptographic algorithm applied to a piece of data. R Random key : A randomly generated secret key; it is commonly used for service principals. It is more secure, since no one knows the password or needs to remember it. RC2/RC4 Algorithms : Two variable-key length cryptographic algorightms designed by ROnald Rivest of the Massachusetts Institute of Technology. Both are symmetric algorithms. Realm : A name for a collection of principals in a network served by a Key Distribution Center. All principal names within a realm must be unique. Within a realm, the administration policy is the same for all principals. Redundancy : The ability of an important service to rely on a backup in the event the primary service fails. Replay attack : A network security threat in which messages are stored and later re-sent by the intruder. Request For Comments : RFCs are a series of notes, started in 1969, about the Internet. There are many types of RFCs like Internet Drafts (IDs), Informational (FYIs) and Technical Reports (RTRs). Response : The result of the calculation performed on the challenge information. RFC : See Request for Comments Risk : The likelihood that a vulnerability may be exploited, or that a threat may become harmful. Rlogin : A program that provides remote access to systems running the rlogin protocol. RSA : Can refer to the public key encryption algorithm authored by Rivest, Shamir, and Adleman at MIT, or the company they started. Rsh : A program that runs a command on a remote system; a permanent login is not established. S Safe messages : A level of security provided by performing a cryptographic checksum on a message and sending the result along with the message. The checksum is then performed at the destination and compared with the original result to ensure the message was not modified during transit. However, these messages are sent across the network in cleartext, making them visible to eavesdroppers. See also private messages. Salt : A value combined with a user's password before it generates a key. The salt limits the possibilities of principals having the same key. Seal : To encrypt a message. See also private messages. Secret key : The shared secret used to authenticate a principal stored by the Key Distribution Center. Secret key cryptosystem : A scheme that relies on shared secrets. Secured : An application that has been enhanced to authenticate users using the TrustBroker Security Solution or Defensor product line; also offers data and session encryption. Secure hash function: A one-way hash functino for which the likelihood that two messages will yield the same digest is satisfactorily small. Sequence number : Used to detect message replays. Server : A daemon that provides one or more services. A server can also be a system (e.g., a file server). Service : Something that is offered by a server to the network for use by clients. Sign : To use your private key to generate a digital signature, proving you generated a message. See also seal. Signature : A quantity associated with a message which only someone with knowledge of your private key could have generated, but which can be verified through knowledge of your public key. Single sign-on : The ability to sign on to the network using a single password and to be authenticated to all services you are authorized to use. Skew : See clock skew. Skipjack : A classified symmetric key encryption algorithm that uses 80-bit keys. Spoof : To convince someone that you are some entity X when you are not X, usually without X's permission. See also masquerade. Stolen ticket : A ticket that is copied by an unauthorized user from the legitimate user's credentials cache, for the purpose of gaining illegal access to the network. Source code : The textual form in which a program is entered into a computer. Spoofing : Illicitly masquearding as a legitimate company, party or individual. T TCP/IP : Transmission Control Protocol/Internet Protocol. A layered set of communications protocols that is used by telnet terminal emulation, ftp file transfer, and other services for communications across a wide variety of systems. Further development of TCP/IP is a responsibility of the Internet Engineering Task Force (IETF). Telnet : A program that provides virtual terminal service, letting a user log in to another system and access it as if the user were logged in to that system's console. Provides remote access to systems running the telnet protocol. TGS : See ticket granting service. TGT : See ticket granting ticket. Ticket : The portion of a credential which contains the session key encrypted under the service's key that authenticates one principal to another. Only a Key Distribution Center can issue a ticket. See also ticket granting ticket and service ticket. Ticket addresses : In Kerberos, a list of network addresses from which a ticket may be used. If the list is empty, a ticket can be used from anywhere and services may refuse to honor it. Used to complicate use of stolen tickets. Ticket attribute flags : In Kerberos, define the type and usage of the ticket. Ticket granting service (TGS) : The part of the Key Distribution Center that provides tickets when a client wants to access a server. The client provides its valid set of credentials, and a session key and service ticket are generated. Ticket granting ticket (TGT) : As part of the authentication process with the AS, a principal is granted a TGT and a session key which obtains service tickets. Token : An opaque data item returned by GSS-API routines that an application needs to communicate with its peer. Transited realms list : In Kerberos, used by the target of an inter-realm authentication attempt to help decide whether to honor a request. It's the list of all realms that were visited to obtain the credentials. Trusted third party : A third party, such as a Key Distribution Center that is implicitly trusted by two parties who are trying to authenticate with each other. U Unseal : Decrypt a message. See seal. V Verify a signature : To cryptographically prove, using the signer's public key, that a message was signed with the signer's private key. Virtual Private Network : A collection of hosts that have implemented protocols to exchange information securely, generally over the Internet or other public network. Vulnerability assessment/analysis : The process of analyzing computers for security holes or misconfigurations that might be used to gain unauthorized access. W Work Factor : A measure of the difficulty of undertaking a brute force test of all possible keys against a given ciphertext and known algorithm. X X.509 Certificates : The commonly used form of digital certificates, named for CCITT Recommendation X.509. |
©2001 APMsafe.com, Inc. All rights reserved.