Security - Telenor

More documents

Recommendations

Info

Telektronikk Volume 96 No. 3 – 2000 ISSN 0085-7130 Editor: Ola Espvik Tel: (+47) 63 84 88 83 e-mail: ola.espvik@telenor.com Status section editor: Per Hjalmar Lehne Tel: (+47) 63 84 88 26 e-mail: per-hjalmar.lehne@telenor.com Editorial assistant: Gunhild Luke Tel: (+47) 63 84 86 52 e-mail: gunhild.luke@telenor.com Editorial office: Telenor AS, Telenor R&D PO Box 83 N-2027 Kjeller Norway Tel: (+47) 63 84 84 00 Fax: (+47) 63 81 00 76 e-mail: telektronikk@telenor.com Editorial board: Ole P. Håkonsen, Senior Executive Vice President. Oddvar Hesjedal, Vice President, R&D. Bjørn Løken, Director. Graphic design: Design Consult AS, Oslo Layout and illustrations: Gunhild Luke, Britt Kjus, Åse Aardal (Telenor R&D) Prepress: ReclameService as, Oslo Printing: Optimal as, Oslo Circulation: 4,000 Contents Feature: Security 1 Guest Editorial; Øyvind Eilertsen 2 An Introduction to Cryptography; Øyvind Eilertsen 10 Advanced Encryption Standard (AES). Encryption for our Grandchildren; Lars R. Knudsen 13 Development of Cryptographic Standards for Telecommunications; Leif Nilsen 21 Show Me Your Public Key and I will Tell Who You Are; Lise Arneberg 26 Security in a Future Mobile Internet; Henning Wright Hansen and Dole Tandberg 34 Mobile Agents and (In-)security; Tønnes Brekne 47 An Overview of Firewall Technologies; Habtamu Abie 53 CORBA Firewall Security: Increasing the Security of CORBA Applications; Habtamu Abie 65 Telenor’s Risk Management Model; Erik Wisløff 69 Risk Analysis in Telenor; Erik Wisløff
Telektronikk 3.2000 Guest Editorial To a certain extent, security has been regarded as a matter that should be left to military and national security interests. With the advent of worldwide electronic networks, such misconceptions can be dangerous. Luckily, it is now standard procedure to carry out a risk analysis of all new products and systems before they are put into service. A problem is that security considerations are often ignored until the product is almost finished, when someone remembers: “Oh, and we need some security”. Security features are among the first to be removed from projects suffering from exceeded budgets. It is an important issue to make sure that security is built into applications from the very beginning. Last-minute introduction of security features will generally lead to both higher expenses and poorer security. Apart from the actual physical damage resulting from a security breach, the loss of goodwill after a blearing front page in the tabloid press or a prime-time news story must not be overlooked. The latter may actually represent a much more serious and long-lasting loss potential. This feature section addresses communication security comprising both the security of the users (security services and security as a value added service) and the security of e.g. a telephone operator (security against malicious intruders, competitors, etc.). Physical security (e.g. barbed wire, locks and fences, but also personnel questions) will generally be left out. Although most users are still not concerned with the security of services, the awareness is certainly growing rapidly, and the ability to offer security-enhanced services will become an ever more important issue for service providers. Even if the “paper-less office” is still far from becoming a reality, more and more information that previously only existed on paper is now stored on electronic media. While this development makes it easier to share information among those who need it in their daily work, it also increases the potential for outsiders (malicious or not) to intrude. Industrial espionage is a threat that all competitive companies must consider. In the real world, the so-called “Bribe the secretary attack” is probably the attack with the lowest complexity of them all, whereas cryptographic protection often is the strongest link in the chain. Cryptographic security can be quantified (relatively) easily compared to other aspects that are much less tangible. Thus, we are in the somewhat paradoxical situation that purely academic weaknesses in otherwise secure cryptographic algorithms get a disproportionate interest compared to other security risks. Nevertheless, with the number of available strong algorithms, there is simply no excuse for using weak cryptography. 1
Page 4 and 5: Øyvind Eilertsen (34) is Research
Page 6 and 7: 4 E(P) = a ⋅ P + b (mod 26) D(C)
Page 8 and 9: 6 In 1997, NIST initiated the proce
Page 10 and 11: 8 decrypt the signed hash value, re
Page 12 and 13: Lars R. Knudsen (38) is Professor a
Page 14 and 15: Table 1 Timetable for AES Table 2 T
Page 16 and 17: 14 K m i Stream cipher algorithm Fi
Page 18 and 19: 16 6 Use of Encryption in Telecommu
Page 20 and 21: 18 mode, integrity mode, key divers
Page 22 and 23: 20 7 Beaver, D. Computing with DNA.
Page 24 and 25: 22 In both cases, my trust depends
Page 26 and 27: 24 A number of standard PC applicat
Page 28 and 29: Henning Wright Hansen (28) is Resea
Page 30 and 31: 28 Securing Locally Stored Informat
Page 32 and 33: Figure 3 A simple Public Key Infras
Page 34 and 35: 32 The Policy Control Center An imp
Page 36 and 37: Tønnes Brekne (31) is on leave fro
Page 38 and 39: 36 Sets definable by such predicate
Page 40 and 41: 38 A failure is caused by some type
Page 42 and 43: Figure 1 This figure illustrates th
Page 44 and 45: 42 ating system(s) and/or platform
Page 46 and 47: Message Sender Recipient Message pa
Page 48 and 49: 46 Assume some agent a carries with
Page 50 and 51: 48 gateway from attack, while the i
Page 52 and 53:
50 transfer at the expense of secur
Page 54 and 55:
52 7 FORE Systems. Firewall Switchi
Page 56 and 57:
Figure 2-1 Object invocations throu
Page 58 and 59:
Figure 4-1 3 Levels of different fi
Page 60 and 61:
58 phase two, in which the client r
Page 62 and 63:
60 5 CORBA Firewall Traversal 5.1 F
Page 64 and 65:
62 7.2 Visibroker Gatekeeper of Inp
Page 66 and 67:
64 References 1 Abie, H. An Overvie
Page 68 and 69:
Cost Figure 1 Minimising total cost
Page 70 and 71:
68 In the coming years it is likely
Page 72 and 73:
70 financial, social, environmental
Page 74 and 75:
Consequence 72 Insignificant Substa
Page 76 and 77:
74 in a one week time-frame, using
show all

Security - Telenor

Create successful ePaper yourself

Delete template?

Save as template?