.NET Security and Cryptography
暫譯: .NET 安全性與加密技術

Peter Thorsteinson, G. Gnana Arun Ganesh

.NET Security and Cryptography
  • 出版商: Prentice Hall
  • 出版日期: 2003-08-28
  • 售價: $2,220
  • 貴賓價: 9.5 折 $2,109
  • 語言: 英文
  • 頁數: 496
  • 裝訂: Paperback
  • ISBN: 013100851X
  • ISBN-13: 9780131008519
  • 相關分類: .NET、資訊安全

    • 已過版

買這商品的人也買了...

相關主題

商品描述

Summary

Learn how to make your .NET applications secure!

Security and cryptography, while always an essential part of the computing industry, have seen their importance increase greatly in the last several years. Microsoft's .NET Framework provides developers with a powerful new set of tools to make their applications secure. NET Security and Cryptography is a practical and comprehensive guide to implementing both the security and the cryptography features found in the .NET platform. The authors provide numerous clear and focused examples in both C# and Visual Basic .NET, as well as detailed commentary on how the code works. They cover topics in a logical sequence and context, where they are most relevant and most easily understood. All of the sample code is available online at <www.objectinnovations.com/library/books/books_dotnet.html>.

This book will allow developers to:

  • Develop a solid basis in the theory of cryptography, so they can understand how the security tools in the .NET Framework function
  • Learn to use symmetric algorithms, asymmetric algorithms, and digital signatures
  • Master both traditional encryption programming as well as the new techniques of XML encryption and XML signatures
  • Learn how these tools apply to ASP.NET and Web Services security

Table of Contents

Preface.


Acknowledgments.


About This Series.


1. NET Cryptography and Security.

The Nature of This Book. Risks Are Everywhere. The Nature of Cryptography and Security. Why Cryptography and Security Are Important. What Cryptography and Security Can and Cannot Do. Windows Security Comes of Age. The .NET Framework and the CLR. How the .NET Framework Simplifies Security. Reliability and the .NET Platform. Managed Code and Type Safety. .NET Cryptography Programming. .NET Security Programming. Role-Based Security and Principals. CAS, Evidence, Policy, and Permissions. Summary.



2. Fundamentals of Cryptography.

Security and Keeping Secrets. Basic Cryptographic Terminology. Secret Keys Versus Secret Algorithms. Classical Techniques for Keeping Secrets. Brute-Force Attack Work Factor. Arbitrary Precision Arithmetic. Steganography. Modern Ciphers. Cryptography and the .NET Framework. Symmetric Cryptography. Asymmetric Cryptography. Cryptographic Algorithms. Cryptographic Protocols. Cryptanalytic Attacks. Issues in Human Interaction and Trust. Risk and Benefit. Other Important Concepts. Summary.



3. Symmetric Cryptography.

Symmetric Ciphers. DES. Modes of Operation. Triple DES. Rijndael. RC2. Programming with .NET Symmetric Cryptography. The Main Cryptography Classes. The SymmetricAlgorithm Class. SymmetricAlgorithm-Derived Classes. The SymmetricAlgorithms Example. Cryptographic Streams. Avoiding Weak Keys. Key Exchange Issues. Encrypted Hash Codes and Message Integrity. Keyed Hash Functions and Message Integrity. Summary.



4. Asymmetric Cryptography.

Problems with Symmetric Algorithms. The Key Exchange Problem. The Trust Problem. The Idea Behind Asymmetric Cryptography. Using Asymmetric Cryptography. The Combination Lock Analogy. Trapdoor One-Way Functions. Advantages of the Asymmetric Approach. Combining Asymmetric and Symmetric Algorithms. Existing Asymmetric Algorithms. RSA: The Most Used Asymmetric Algorithm. Underpinnings of RSA. A Miniature RSA Example. Caveat: Provability Issues. Programming with .NET Asymmetric Cryptography. An RSA Algorithm Example. Saving Keys as XML. Digital Certificates. Summary.



5. Digital Signatures.

Hash Algorithms. Good Hash Function Characteristics. Hash Algorithms Provided by .NET. The HashAlgorithm Class. The MD5 and SHA Classes. The KeyedHashAlgorithm Class. Object Identifiers. How Digital Signatures Work. RSA Used as a Digital Signature Algorithm. An RSA Signature Example Program. The Digital Signature Algorithm. Some Mathematical Background: Group Theory. The Discrete Logarithm Problem. How DSA Works. The Asymmetric AlgorithmHierarchy Class Hierarchy. The DSACryptoServiceProvider Class. A DSA Programming Example. Summary.



6. XML Cryptography.

XML Encryption. XML Encryption Versus SSL/TLS. The XML Encryption Specification. What XML Encryption Provides. XML Encryption Syntax. How XML Encryption Works. Classes Used in XML Encryption. Communicating Asymmetric Key Information. The XmlEncryption Example. XML Signatures. The XML Signature Specification. What XML Signatures Provide. XML Signature Syntax. Classes Used in XML Signatures. The EnvelopingXmlSignature Example. Combining XML Signing and XML Encryption. Summary.



7. NET User-Based Security.

Authentication and Authorization. .NET Security Model. Administrating Windows Security. Defining Users and Roles on Windows. Defining Shared Folder Permissions on Windows. Defining NTFS Security on Windows. Administrating .NET Security. Permissions. The IPermission Interface. The IPermission Inheritance Hierarchy. The PrincipalPermission Class. User-Based Security. Principal and Identity Objects. The IIdentity Interface. IIdentity Implementation Classes. The GenericIdentity Class. The WindowsIdentity Class. Principal Objects. The IPrincipal Interface. The GenericPrincipal Class. The WindowsPrincipal Class. Two Approaches to User-Based Security. Imperative User-Based Security. Declarative User-Based Security. Credentials. Network Credentials. Security Discipline. Principle of Least Privilege. Establish Security Policy Early. Summary.



8. NET Code Access Security.

The Need for Code Access Security. Cost Versus Risk. The Range of Risks. Assembly Trustworthiness. Risks of Calling into Unmanaged Code. Security, Managed Code, and the CLR. Microsoft Intermediate Language. Verifiably Type-Safe Code. Denying and Demanding Permissions. How CAS Is Used. Flexible Security. The Luring Attack and Walking the Stack. Managing Security Policy with Code Groups. The Basic Concepts of Security Policy Management. Using the .NET Framework Configuration Tool. Using the Caspol.exe Utility. Imperative Versus Declarative CAS. Evidence-Based Security. The Evidence Class. Obtaining the Current Application Domain Evidence. Enumerating Evidence. The WalkingThruEvidence Example. Accessing the WalkingThruEvidence Example Via IIS. Imperative CAS. Code Access Permissions. CodeAccessPermission Derived Classes. The CodeAccessPermission Class. The UrlIdentityPermission Class. Working with Code Access Permissions. Declarative Code Access Permissions. Square Bracket Attribute Declaration Syntax. The URL Identity Permission Attribute. The SecurityAction Class. Permission Requests. The PermissionRequest Example. Permission Sets. The PermissionSet Class. Defining a Permission Set in a Configuration File. Summary.



9. ASP.NET Security.

Fundamental Security Mechanisms. Authentication: Who Are You? Authorization: Are You Allowed to Access This Resource? Impersonation: Application Assumes Client's Identity. Implementing ASP.NET Authentication. ASP.NET Configuration. Facts and Benefits of the ASP.NET Configuration System. Configuration Hierarchy. Description. Forms Authentication. Method 1: Storing Credentials in the Web.config File. Method 2: Storing Credentials in the XML File. The Users.xml File. The login.aspx File. Method 3: Storing Credentials in a Database. Forms Authentication Classes. Passport Authentication. Windows Authentication. Implementing ASP.NET Authorization. File Authorization. URL Authorization. Implementing ASP.NET Impersonation. Summary.



10. Web Services Security.

Basic Techniques in Securing Web Services. Secure Connection. Authentication and Authorization. Authentication Mechanisms for HTTP. Authenticate Web Service Using SOAPHEADER. The SOAP Message Architecture. Creating a Proxy with Visual Studio .NET. XML Security Technologies. Integrity. XML Signature. Data Protection and Privacy. XML Encryption. XML Key Management Specification (XKMS). Security Assertion Markup Lanquage (SAML). Global XML Web Services Architecture (GXA). WS-Security. WS Initial Specifications. Next Steps of Specifications. Why WS-Security? Security Token Propagation. Message Integrity. Message Confidentiality. Organizations Involved. Summary.



A. A Security Attack Example: The Stack Overrun.


B. How the RSA Cipher Works.

Modular Arithmetic. The BigRSA Example Program. The CrackRSAWorkFactorDemo Example Program.



C. Using the GNU GMP Library.

Installing Cygwin. Testing Your Cygwin Installation. Installing GMP. Uninstalling Cygwin.



D. Cryptography and Security Resources.

Background Knowledge and Conceptual Books. Cryptographic Mathematics Books. Implementing Security Guide Books. Human Interest Books on Cryptography. Cryptography News Groups. Useful Cryptographic and Security Web Sites.



E. Exploring Web Services.

Motivation for Web Services. Web Services Definition. Backbones of Web Services. Next Generation of Distributed Computing: Web Services. Benefits of Web Services. ASP.NET Web Services. Web Services Architecture. Code Model for Web Services. Developing a Simple Concatenate Web Service. Concatenate.asmx and Concatenate.asmx.cs. @ WebService Directive. System.Web.Services Namespace. WebServiceAttribute. WebService Class. WebMethod Attribute. Session Management. Protocols. Accessing a Web Service. Generating a Proxy. Creating a Proxy Using Wsdl.exe. Creating a Windows Form Client. Asynchronous Programming in Web Services. Two Asynchronous Methods (Begin and End). Creating an ASP.NET Calculator Web Service. Web Services Are Still Evolving. Summary.



Index.

商品描述(中文翻譯)

**摘要**

學習如何使您的 .NET 應用程式安全！

安全性和密碼學雖然一直是計算機行業的重要組成部分，但在過去幾年中其重要性大幅增加。微軟的 .NET Framework 為開發人員提供了一套強大的新工具，以確保其應用程式的安全性。《NET 安全性與密碼學》是一本實用且全面的指南，旨在實現 .NET 平台中的安全性和密碼學功能。作者提供了許多清晰且專注的範例，使用 C# 和 Visual Basic .NET，並詳細解釋了代碼的運作方式。他們以邏輯順序和上下文涵蓋主題，使其最相關且最易於理解。所有範例代碼均可在線獲得，網址為 。

本書將使開發人員能夠：

- 建立密碼學理論的堅實基礎，以便理解 .NET Framework 中安全工具的運作
- 學習使用對稱算法、非對稱算法和數位簽章
- 精通傳統加密編程以及 XML 加密和 XML 簽章的新技術
- 學習這些工具如何應用於 ASP.NET 和 Web 服務的安全性

**目錄**

**前言。**

**致謝。**

**關於本系列。**

**1. .NET 密碼學與安全性。**

本書的性質。風險無處不在。密碼學與安全性的本質。為什麼密碼學和安全性很重要。密碼學和安全性能做什麼，不能做什麼。Windows 安全性成熟了。.NET Framework 和 CLR。.NET Framework 如何簡化安全性。可靠性與 .NET 平台。受管理的代碼與類型安全。.NET 密碼學編程。.NET 安全性編程。基於角色的安全性與原則。CAS、證據、政策與權限。總結。

**2. 密碼學基礎。**

安全性與保密。基本密碼學術語。秘密金鑰與秘密算法。保持秘密的經典技術。暴力攻擊工作量。任意精度算術。隱寫術。現代密碼。密碼學與 .NET Framework。對稱密碼學。非對稱密碼學。密碼算法。密碼協議。密碼分析攻擊。人際互動與信任問題。風險與收益。其他重要概念。總結。

**3. 對稱密碼學。**

對稱密碼。DES。運作模式。三重 DES。Rijndael。RC2。使用 .NET 對稱密碼學編程。主要的密碼學類別。SymmetricAlgorithm 類。SymmetricAlgorithm 派生類。SymmetricAlgorithms 範例。密碼流。避免弱金鑰。金鑰交換問題。加密哈希碼與訊息完整性。金鑰哈希函數與訊息完整性。總結。

**4. 非對稱密碼學。**

對稱算法的問題。金鑰交換問題。信任問題。非對稱密碼學的理念。使用非對稱密碼學。組合鎖類比。陷門單向函數。非對稱方法的優勢。結合非對稱和對稱算法。現有的非對稱算法。RSA：最常用的非對稱算法。RSA 的基礎。迷你 RSA 範例。警告：可證明性問題。使用 .NET 非對稱密碼學編程。一個 RSA 算法範例。將金鑰儲存為 XML。數位證書。總結。

**5. 數位簽章。**

哈希算法。良好的哈希函數特徵.NET 提供的哈希算法。HashAlgorithm 類。MD5 和 SHA 類。KeyedHashAlgorithm 類。物件識別碼。數位簽章的運作方式。RSA 作為數位簽章算法。RSA 簽章範例程式。數位簽章算法。一些數學背景：群論。離散對數問題。DSA 的運作方式。非對稱算法層次結構。DSACryptoServiceProvider 類。一個 DSA 編程範例。總結。

**6. XML 密碼學。**

XML 加密。XML 加密與 SSL/TLS。XML 加密規範。XML 加密提供的內容。XML 加密語法。XML 加密的運作方式。XML 加密中使用的類別。傳遞非對稱金鑰資訊。XmlEncryption 範例。XML 簽章。XML 簽章規範。XML 簽章提供的內容。XML 簽章語法。XML 簽章中使用的類別。EnvelopingXmlSignature 範例。結合 XML 簽署和 XML 加密。總結。

**7. .NET 基於使用者的安全性。**

身份驗證與授權。.NET 安全模型。管理 Windows 安全性。在 Windows 上定義使用者和角色。在 Windows 上定義共享資料夾權限。在 Windows 上定義 NTFS 安全性。管理 .NET 安全性。權限。IPermission 介面。IPermission 繼承層次結構。PrincipalPermission 類。基於使用者的安全性。Principal 和 Identity 物件。IIdentity 介面。IIdentity 實作類別。GenericIdentity 類。WindowsIdentity 類。Principal 物件。IPrincipal 介面。GenericPrincipal 類。WindowsPrincipal 類。基於使用者的安全性有兩種方法。命令式基於使用者的安全性。宣告式基於使用者的安全性。憑證。網路憑證。安全性紀律。最小特權原則。及早建立安全政策。總結。

**8. .NET 代碼存取安全性。**

代碼存取安全性的必要性。成本與風險。風險範圍。組件的可信度。調用非管理代碼的風險。安全性、受管理的代碼與 CLR。微軟中間語言。可驗證的類型安全代碼。拒絕和要求權限。CAS 的使用方式。靈活的安全性。誘騙攻擊與堆疊遍歷。使用代碼組管理安全政策。安全政策管理的基本概念。使用 .NET Framework 配置工具。使用 Caspol.exe 工具。命令式與宣告式 CAS。基於證據的安全性。Evidence 類。獲取當前應用程式域的證據。列舉證據。WalkingThruEvidence 範例。通過 IIS 訪問 WalkingThruEvidence 範例。命令式 CAS。代碼存取權限。CodeAccessPermission 派生類別。CodeAccessPermission 類。UrlIdentityPermission 類。處理代碼存取權限。宣告式代碼存取權限。方括號屬性聲明語法。URL 身份權限屬性。SecurityAction 類。權限請求。PermissionRequest 範例。權限集。PermissionSet 類。在配置文件中定義權限集。總結。

**9. ASP.NET 安全性。**

基本安全機制。身份驗證：你是誰？授權：您是否被允許訪問此資源？模擬：應用程式假設客戶端的身份。實現 ASP.NET 身份驗證。ASP.NET 配置。ASP.NET 配置系統的事實與好處。配置層次結構。描述。表單身份驗證。方法 1：將憑證儲存在 Web.config 文件中。方法 2：將憑證儲存在 XML 文件中。Users.xml 文件。login.aspx 文件。方法 3：將憑證儲存在資料庫中。表單身份驗證類別。Passport 身份驗證。Windows 身份驗證。實現 ASP.NET 授權。檔案授權。URL 授權。實現 ASP.NET 模擬。總結。

**10. Web 服務安全性。**

保護 Web 服務的基本技術。安全連接。身份驗證與授權。HTTP 的身份驗證機制。使用 SOAPHEADER 驗證 Web 服務。SOAP 訊息架構。使用 Visual Studio .NET 創建代理。XML 安全技術。完整性。XML 簽章。數據保護與隱私。XML 加密。XML 金鑰管理規範 (XKMS)。安全聲明標記語言 (SAML)。全球 XML Web 服務架構 (GXA)。WS-Security。WS 初始規範。規範的下一步。為什麼選擇 WS-Security？安全令牌傳播。訊息完整性。訊息機密性。參與的組織。總結。

**A. 安全攻擊範例：堆疊溢位。**

**B. RSA 密碼的運作方式。**

模組算術。BigRSA 範例程式。CrackRSAWorkFactorDemo 範例程式。

**C. 使用 GNU GMP 函式庫。**

安裝 Cygwin。測試您的 Cygwin 安裝。安裝 GMP。卸載 Cygwin。

**D. 密碼學與安全性資源。**

背景知識與概念書籍。密碼學數學書籍。實施安全指南書籍。與密碼學相關的人文書籍。密碼學新聞組。實用的密碼學與安全性網站。

**E. 探索 Web 服務。**

Web 服務的動機。Web 服務定義。Web 服務的骨幹。下一代分散式計算：Web 服務。Web 服務的好處。ASP.NET Web 服務。Web 服務架構。Web 服務的代碼模型。開發簡單的串接 Web 服務。Concatenate.asmx 和 Concatenate.asmx.cs。@ WebService 指令。System.Web.Services 命名空間。WebServiceAttribute。WebService 類。WebMethod 屬性。會話管理。協議。訪問 Web 服務。生成代理。使用 Wsdl.exe 創建代理。創建 Windows 表單客戶端。Web 服務中的非同步編程。兩個非同步方法（Begin 和 End）。創建 ASP.NET 計算器 Web 服務。Web 服務仍在演變中。總結。

**索引。**

類似商品

最後瀏覽商品 (18)