System Architecture Design

pSHIELDSystem Architecture DesignPU4 SPD Considerations4.1 Fundamental Concepts4.1.1 Security and Privacy4.1.1.1 Concepts4.1.1.1.1 Cryptographic primitivesIn the context of systems and network security, the basic functional security primitives that have beenproposed and implemented are the various cryptographic algorithms that are to be used for data andcommunications encryption and decryption as well as data integrity. The three basic classes ofcryptographic primitives are symmetric ciphers, asymmetric ciphers and hashing algorithms.Symmetric ciphers perform the encryption and decryption operations using the same key that is to beshared among the sender and receiver of the message in hand. They are used mainly to ensure dataconfidentiality and are divided in two basic classes; block ciphers and stream ciphers. Block ciphers suchas AES, DES, 3DES, perform the cryptographic operations on similar sized blocks of data, while streamciphers such as RC4 operate on a bit by bit basis. On both cases, the cryptographic operations consist ofa sequence of mathematical computations such as permutations and substitutions performed on theoriginal or encrypted data.Asymmetric ciphers, or public-key algorithms, such as RSA, Diffie-Hellman, use different keys forencryption and decryption. Those keys are called public and private keys. They use computationallyintensive mathematical functions such as modular exponentiation and are used primarily for generatingand verifying digital signatures and certificates as well as exchanging the symmetric cipher keys. Due totheir computational complexity they are not usually used for encryption and decryption of the actualmessages, but as a means to providing a secure channel for symmetric key exchange.Hashing algorithms such as MD5 and SHA provide ways of mapping messages (with or without a key)into a fixed-length value, thereby providing “signatures” for messages. Thus, integrity checks can beperformed on communicated messages by (a) having the sender “securely sending” the actual hash valueof a message along with the message itself, (b) allowing the receiver to compute the hash value of thereceived message, and (c) comparing the two signatures to verify message integrity.4.1.1.1.2 Security MechanismsSecurity solutions to meet the various security requirements typically rely on the aforementionedcryptographic primitives or on security mechanisms that use a combination of these primitives in a specificmanner (e.g., security protocols). Various security technologies and mechanisms have been designedaround these cryptographic algorithms in order to provide specific security services.Security protocols provide ways of ensuring secure communication channels to and from the embeddedsystem. IPSec [IPSec] and SSL [SSL] are popular examples of security protocols, widely used for VirtualPrivate Networks (VPNs) and secure web transactions, respectively.Digital certificates provide ways of associating identity with an entity, while biometric technologies [Reid2003] such as fingerprint recognition and voice recognition aid in end-user authentication. Digitalsignatures, which function as the electronic equivalent of handwritten signatures, can be used toauthenticate the source of data as well as verify its identity.PUD2.3.2Issue 5 Page 48 of 122