Computer Networks · 免费预览
安全系统实践
前几课的原语与协议已在若干可运行的系统中落地：PGP 以信任网包裹电子邮件；SSH 用强认证、会话加密和端口转发取代明文密码的远程登录；TLS 在应用与 TCP 之间插入一层，通过握手协商密码套件、用证书认证服务器并派生会话密钥，这正是网页地址旁出现锁形图标的原因；IPsec 将安全下沉到 IP 层，使用认证头，并以传输模式或隧道模式封装安全载荷；防火墙则守护边界，按策略在内部与外部之间过滤分组，是密码学的补充而非替代。
1. Securing the Applications We Had
Securing the Applications We Had
2. The Handshake the Web Runs On
The Handshake the Web Runs On
3. Security at the IP Layer
Security at the IP Layer
4. The Perimeter and Its Limits
The Perimeter and Its Limits
5. The borrowed tunnel
What does SSH port forwarding provide, and why does it matter?
6. What the handshake buys
Which of these does the TLS handshake accomplish?
7. Why the server needs a certificate
Why does TLS authenticate the server with a certificate rather than a shared secret?
8. Headers and payloads
How do IPsec's two security protocols, the authentication header and the encapsulating security payload, differ in what they protect?
9. Tunnel mode's purpose
What does IPsec tunnel mode enable that transport mode does not?
10. The bypass problem
What is a firewall's structural weakness?
11. The web's layer
TLS inserts its security between the application and which transport protocol?
12. The remembered key
SSH clients authenticate servers by remembering what from the first connection?
13. The screened zone
What is the name of the screened network zone where a site places its exposed services between the outside and the soft interior?
14. The per-direction state
What does IPsec call the agreed keys, algorithms, and parameters protecting one direction of a conversation?