Internet Security Architectures and Protocols (BMEVIHI9367)
||14 weeks, 2 hours/week
||12:15 - 14:00, every Friday, from 10 Feb 2003 to 16 May 2003
||Dr. Levente Buttyán
Laboratory of Cryptography and Systems Security (CrySyS)
Department of Telecommunications
Budapest University of Technology and Economics
||14:00 - 15:00, every Thursday (until 20 June 2003), in I.E.419
The objective of the course is to introduce some of the
known security problems related to the protocols and applications
of the Internet, and to overview the contemporary solutions
to these problems. The focus of the course is on architectures
and protocols; cryptography will be introduced only to the extent
that is necessary to understand the security protocols. Legal
issues will be omitted.
Preamble [ppt slides]
- Introduction (vulnerabilities, examples for known attacks) [ppt slides]
- Brief introduction to cryptography [ppt slides]
- cryptographic primitives (symmetric and asymmetric
key ciphers, one-way hash functions, message
authentication codes, digital signatures)
- key establishment protocols, public-key certification structures
- E-mail security: PGP and S/MIME [ppt slides]
- Secure remote access: SSH [ppt slides]
- Web security: SSL/TLS [ppt slides]
- Network layer security: IPSec, ISAKMP/Oakley [ppt slides]
- E-commerce security: SET and other e-cash and micropayment schemes [ppt slides]
- Privacy protection and anonymity services (Onion routing and Crowds) [ppt slides]
- Java security [ppt slides]
- Firewalls and intrusion detection systems [ppt slides]
- Security in wireless ad hoc networks [intro, fc03, rex]
Evaluation of the students is based on their performance on
the oral exam.
Schedule of the exams is as follows:
May 16, 12:15 - 14:00, E.1.B, max 7 persons
May 23, 09:00 - 12:00, IE.218, max 10 persons
May 30, 09:00 - 12:00, IE.218, max 10 persons
June 6, 09:00 - 12:00, IE.218, max 10 persons
June 13, 09:00 - 12:00, IE.218, max 10 persons
June 20, 09:00 - 12:00, IE.218, max 10 persons
Important! If you intend to come for the exam of May 16, then
please notify me in e-mail and sign up for the exam of May 23 in the
Useful readings and background material
- W. Stallings, Cryptography and Network Security, third edition,
Prentice Hall, 2003.
- R. Oppliger, Internet and Intranet Security, second edition,
Artech House, 2002.
- A. Rubin, D. Geer and M. Ranum, Web Security Sourcebook,
- W. Cheswick and S. Bellovin, Firewalls and Internet Security,
- M. Pistoia et al., Java 2 Network Security, second edition,
Prentice Hall, 1999.
- S. Bellovin,
Security Problems in the TCP/IP Protocol Suite,
In Computer Communications Review, 19(2), 1989.
- R. Rivest and A. Shamir,
PayWord and MicroMint -- Two Simple Micropayment Schemes,
In Proceedings of 1996 International Workshop on Security Protocols, ed. Mark Lomas, Springer, 1997,
Lecture Notes in Computer Science No. 1189, pages 69--87.
- S. Micali and R. Rivest,
In Proceedings of the Cryptographer's Track at the RSA Conference 2002, Bart Preneel (ed.),
Springer Verlag CT-RSA 2002, LNCS 2271, pages 149--163.
- M. Reed, P. Syverson, and D. Goldschlag,
Anonymous Connections and Onion Routing,
In IEEE Journal on Selected Areas in Communication, Special Issue on Copyright and Privacy Protection, 1998.
- P. Syverson, G. Tsudik, M. Reed and C. Landwehr,
Towards an Analysis of Onion Routing Security,
Workshop on Design Issues in Anonymity and Unobservability, Berkeley, CA, July 2000.
- M. Reiter and A. Rubin,
Crowds: Anonymity for web transactions,
In ACM Transactions on Information and System Security, 1(1):66-92, November 1998.
- L. Buttyan and J.-P. Hubaux (eds.),
Report on a Working Session on Security in Wireless Ad Hoc Networks,
In ACM Mobile Computing and Communications Review, 7(1), March 2003.
- M. Jakobsson, J.-P. Hubaux, and L. Buttyan,
A Micropayment Scheme Encouraging Collaboration in Multi-Hop Cellular Networks,
In Proceedings of the 7th Financial Cryptography Conference, January 2003.
- L. Buttyan, J.-P. Hubaux, and S. Capkun,
A Formal Model of Rational Exchange and its Application to the Analysis of Syverson's Protocol,
to appear in Journal on Computer Security, special issue on selected papers from CSFW15, 2003.
For further information on the course, please, write
to buttyan (at) hit.bme.hu