TDDE62 Information Security: Privacy, System and Network Security, 6 credits
Course Literature
The course literature consists of the lectures handouts and the reading material prepared by the lecturers on this page. The literature marked with Read for exam is mandatory for the exam, i.e. exam questions could cover any of the marked references. The un-marked literature is useful extra reading material.
The amount of mandatory reading material (number of pages) for each topic is approximately the same.
Note that all lecture slides are among the Read for exam material.
1) Network security
Note: Some of the Wikipedia articles may include sections that have been broken out into other articles (currently, for example, "Firewall" links to "Stateful firewall"). You can recognize these from the link labeled "main article" at the beginning of each such section. These main articles are also included in read-for-exam.
Wikipedia articles (Read for exam): Firewall (Computing), Application Layer Firewall, Proxy Server, Network Address Translation.
Network design
- D. Smith, "Improving Computer Security through Network Design". Read for exam
Mapping, attacks and vulnerabilities
- Matta Security Limited. "An Introduction to Internet Attack and Penetration". Read pages 5-8. Read for exam
- Fyodor, "Remote OS detection via TCP/IP stack fingerprinting". The section on nmap is beyond the scope of this topic; you don't have to read it at all.
- Joe Stuart. "DNS Cache Poisoning -- The Next Generation". Pages 1-10.
- Ptacek and Newsham. "Insertion
Evasion and Denial of Service: Eluding Network Intrusion Detection". Read for exam
Sections 1-2 are required reading. Include section 3-6 for in-depth reading.
Wireless security
- N. Cam-Winget, R. Housley, D. Wagner, and J. Walker, "Security Flaws in 802.11 Data Link Protocols". Read for exam
IPSec and SSL/TLS
- The main study material for IPSec and SSL/TLS is the slides for the Network Security part of the course, which are all Read for exam .
- The following material provides a more in-depth description of IPSec: An Illustrated Guide to IPsec. It may help in understanding the slides, but is not mandatory reading.
- For full details of the IPSec protocol, refer to: Kent, BBN Corp, Atkinson and @Home Network. "RFC
2401: Security Architecture for the Internet Protocol".
2) Privacy
- A. Pfitzmann, T. Dresden, and M. Hansen, "A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management,"
Read for exam: p.6 - p.10, p.12, p.14 - p.17 (check just the figures on the next page), p.21 - p.23, p.26. - Shen, Y., and Pearson, S. (2011). "Privacy enhancing technologies: A review." Hewlet Packard Development Company.
Read for exam: p.2 - p.11 (sections 1 to 2.6) gives examples of privacy enhancing technologies concerning communications, identity management and data analysis, including the ones discussed in the lectures.
Extra reading (for interested students)
- Chaum, D. L. (1981). "Untraceable electronic mail, return addresses, and digital pseudonyms. Communications of the ACM," 24(2), 84-90.
- J. Camenisch and E. Van Herreweghen, "Design and implementation of the idemix anonymous credential system," in Proceedings of the 9th ACM conference on Computer and communications security, New York, NY, USA, Nov. 2002, pp. 21-30. doi: 10.1145/586110.586114.
- Simple understanding of the Zero-knowledge proof protocol - https://blog.goodaudience.com/understanding-zero-knowledge-proofs-through-simple-examples-df673f796d99
3) System security
Trusted computing
- N. Asokan et al, Mobile Trusted Computing. Only chapters I and II are Read for exam, the rest of the paper is extra reading.
- A. Tomlinson, Introduction to the TPM Read for exam
- ARM Security Technology - Building a Secure System using TrustZone Technology gives a more technically in-depth description of ARM TrustZone.
OS security
- Make sure you understand the concepts of MAC and DAC from the basic secuirty course, as well as the Biba and Bell-LaPadula security models. Read for exam
- Role-based access control on Wikipedia. Read for exam
- Read about the 8 secure design principles by Saltzer and Schroeder. You only need to understand the design principles a-h in section I-A 3) "Design Principles". The rest of the paper is not mandatory reading. You should, however, be able to relate the design principles to real-life situations. (Note that the definition of the "Separation of privilege" principle here is different than the definition used by Robert during his lecture. We will use the definition in the article by Saltzer and Schroeder on the exam.) Read for exam
- You should also have a conceptual understanding of attacks mentioned in the slides. The following Wikipedia articles give some more details on two attack types:
- DMA attack Read for exam
- Cold boot attack Read for exam
Malware defense
The only mandatory reading material for the malware defense part of the course are the lecture slides.
As further reading for interested students, Joshua Saxe and Hillary Sanders: "Malware Data Science: Attack Detection and Attribution", 2018, No Starch Press provides a more in-depth introduction to machine learning for malware defense.
Page responsible: Ulf Kargén
Last updated: 2025-01-17