9.1 Internet Security
Anyone responsible for the security of a trusted network will be concerned when connecting it to a distrusted network. In the case of connections to the Internet this concern may be based largely on anecdotal evidence gleaned from widespread media coverage of security breaches. A closer inspection of the facts and statistics behind some of the media coverage will， however， only serve to deepen that concern. For example， the US National Computer Security Agency （NCSA） asserts that most attacks to computer systems go undetected and unreported， citing attacks made against 9000 Department of Defense computers by the US Defense Information Systems Agency （DISA）. These attacks had an 88 percent success rate and went undetected by more than 95 percent of the target organizations. Only 5 percent of the 5 percent that detected an attack， a mere 22 sites， reacted to it.
Despite fears about security， organizations are increasingly coming to regard a presence on the Internet as an important part of their strategic planning. Security concerns will not be allowed to prevent organizations from exploiting the commercial opportunities the Internet is perceived to offer. As a result organizations have to find ways to manage tile security issue. This ties growth in the Internet security market directly to growth in the Internet. The compound annual growth rate （CAGR） of the Internet firewall market between 1995 and 2000 is projected to be 174% driven by rapid growth of both the Internet and Intranets. The most significant trend driving this growth is the rapid and aggressive deployment of World Wide Web servers for both Internet and Intranet use. Unit shipments of web server software are expected to grow from 127，000 units in 1995 to just more than 5 million units in 2000. Although the IT industry has traditionally enjoyed rapid development this level of growth is unprecedented.
Encryption Techniques
Encryption is tile way to solve tile data security problem. There are two kinds of encryption techniques-symmetric key encryption and asymmetric key encryption.
For symmetric key encryption， both parties should have a consensus about a secret encryption key. When A wants to send a message to B， A uses the secret key to encrypt tile message. After receiving the encrypted message， B uses the same （or derived） secret key to decrypt the message. The advantage of using symmetric key encryption lies in its fast encryption and decryption processes （when compared with asymmetric key encryption at the same security level）. The disadvantages are， first， the encryption key must be exchanged between two parties in a secure way before sending secret messages. Secondly， we must use different keys with different parties. For example， if A communicates with B， C， D and E， A should use 4 different keys. Otherwise， B will know what A and C as well as A and D has been talking about. The drawbacks of symmetric key encryption make it unsuitable to be used in the Internet， because it’s difficult to find a secure way to exchange the encryption key.
For asymmetric key encryption， there is a pair of keys for each party: a public key and a private key. The public key is freely available to the public， but only the key owner gets hold of the private key. Messages encrypted by a public key can only be decrypted by its corresponding private key， and vice versa. When A sends message to B， A first gets B’s public key to encrypt the message and sends it to B. After receiving the message， B uses his private key to decrypt the message. The advantage comes in the public key freely available to the public， hence free from any key exchange problem.
The disadvantage is the slow encryption and decryption process. Almost all encryption schemes used in the Internet uses asymmetric key encryption for exchanging the symmetric encryption key， and symmetric encryption for better performance. Asymmetric key cryptography seems to attain secrecy in data transmission， but the authentication problem still exists. Consider the following scenario: when A sends a message to B， A gets B’s public key from the internet--but how can A know the public key obtained actually belongs to B？ Digital certificate emerges to solve this problem.
Authentication
Digital certificate is an identity card counterpart in the computer society. When a person wants to get a digital certificate， he generates his own key pair， gives the public key as well as some proof of his identification to the Certificate Authority （CA）. CA will check the person’s identification to assure the identity of the applicant. If the applicant is really the one “who claims to be”， CA will issue a digital certificate， with the applicant’s name， e-mail address and the applicant’s public key， which is also signed digitally with the CA’s private key. When A wants to send B a message， instead of getting B’s public key， A now has to get B’s digital certificate. A first checks the certificate authority’s signature with the CA’s public key to make sure it’s a trustworthy certificate. Then A obtains B’s public key from the certificate， and uses it to encrypt message and sends to B.
Authentication is an important part of everyday life. The lack of strong authentication has inhibited the development of electronic commerce. It is still necessary for contracts， legal documents and official letters to be produced on paper Strong authentication is then， a key requirement if the Internet is to be used for electronic commerce. Strong authentication is generally based on modem equivalents of the one time pad. For example， tokens are used in place of one time pads and are stored on smart cards or disks.
Firewall
