B030710154

Authentication is a process to identify something or someone to prove that claims by the subject is true.

Authentication principles:

- The claimant demonstrates knowledge of something,

e.g. password.

- The claimant demonstrates possession of something,

e.g. a physical key or card.

- The claimant exhibits some required immutable characteristics,

e.g. a finger print.

- Evidence is presented that the claimant is at some particular place or time.

- The verifier accepts that some other party, who is trusted, has already established authentication.

Cryptography is one of main tools for privacy which makes the information is unintelligible for unauthorized person. One of cryptography methods is encryption. Encryption not prevents access to the information or data, but it ensures unauthorized person cannot understand the content of the information. The original message is known as plain text and encrypted massage known as the chipper text. Encryption covers both encoding and enciphering, encoding is translating words into other words and enciphering is translating symbols or letters.

Factors in security of encryption:

1. The algorithm must be very hard to decrypt on the basis of cipher text alone.

2. Priority secrecy of the key, not secrecy of the algorithm.

There are two types of cryptography, symmetric and asymmetric. The difference between these two methods is only in number of key use to encrypt and decrypt. In symmetric method use same key to encrypt and decrypt data whereas asymmetric use for encrypt and decrypt is different.

Program Security

Secure program is preventing program from any vulnerability. There are two type of program error, no malicious and malicious.

Non malicious program error:

• Buffer over flows

o Array bound in the system is accidentally not checked.

• Incomplete mediation

o Data being exposed or uncontrolled.

Malicious code is unanticipated effect in programs generated on intent of damage. Malicious program has two types, need host program and independent. Need host program mean the code need a host before it does harm into the system. Independent means malicious program can harm the system directly and does not need a host.

Need host program:

• Trapdoor is writing undocumented entry point into code for debugging can allow unwanted user.
• Logic boom is malicious code that activates on a event.
• Trojan is a program that performs useful function but sometime it performs an unexpected function.
• Virus is a code that copy itself to executable program to runs it functions (modify files or OS).

Independent program:

• Worm is a code that can replicate itself through a network.
• Bacteria / rabbit is a code that will replicate itself until it exhausted the resource or until it fills all disk space.

Difference of virus and worm

Virus:

• Need host
• Activated by external action
• Replication limited to virtual system
• Only can attack single platform

Worm:

• Self contained
• Activated by creating process
• In network replication occurs across communication link.
• Can shut down entire network.

Virus has many types like listed below:

• Parasitic virus is a virus that attach itself into executable files and runs when host program run.
• Memory resident virus is virus that lodged in main memory as part of residual operating system.
• Boot sector virus is infects the boot sector and spread when the OS boots up.
• Stealth virus is a virus that designed to hide from virus scanning programs.
• Polymorphic virus mutates in new host to prevent from detection.

We can prevent our system from infected by the virus by using detection tools, identification tools or removal tools. Scanner and disinfector are the most popular tools to protect our system from virus. Do not open any attachment, downloaded files, and floppy disk unless they have been scanned. Other ways to prevent the system from virus are by using commercial software from established vendor and update the antivirus at least once a week. There is no real way to measure the amount of damage that malicious code can do, all one can do is estimate it.