Aims
This assignment aims to establish a basic familiarity with network security topics via analysing,
designing, and implementing solutions.
Questions
1. Network Security
A bank system, including the internal and external sub-systems, is used by different users.
Based on the security requirements, these accesses should be protected in different ways
depending on access methods. We will focus on network security for internal and external
access to the bank system in this task.
• There are two types of users: bank customers and bank employees.
• The bank system provides a range of services, such as personal savings, bank
statements, money transfer, internal message management, and account
management.
• As a customer, it is allowed to use web browsers to access the bank website and make
transactions.
• A customer can also use the mobile app to access the services. In this case, the
customer is likely to use a mobile network or WiFi connection.
• As a bank employee, it is allowed to access the bank system via the website or desktop
application.
• When an employee is travelling for business, it may need to connect the bank servers
via a secure connection.
Your task.
a. Consider the security of the above system, discuss two potential security issues and
provide countermeasures.
For each of the issues, specify the related security service(s), attack(s) and
mechanism(s). The demonstrated issues must not relate to the same security
service(s). (2 marks)
b. Consider that a bank employee requests to modify a bank customer’s daily cash
transfer limit. Briefly describe the essential security-related step(s) that demonstrate
the security checks for the operation. For each step, specify the aimed security
service(s). (2 marks)
c. An employee accesses the internal system with proper authentication and
authorisation. Consider Kerberos, SAML, and OAuth, which one is better for internal
system authentication and authorisation? Justify your answer. (3 marks)
d. To provide secure connection services for the travelling employees, which of IPSec,
SSL/TLS, and SSH, would be a better option? Justify your answer. (3 marks)
2. Programming Task
A client and a server are planning to do data exchange. They decide to use a simplified SSL
handshake (see Figure 1) to establish a secure channel (session key) then exchange data. The
simplified SSL handshake removes the messages for alert, change cipher spec, certificate, etc.

FAQ
1. What is about the “Setup_Request: Hello” message?
It is just the text “Hello” that initiates the setup phase.
2. Can I use modpow() (or some function like that from the library) for modular
exponentiation computation?
No. You need to implement the function based on the pseudocode in Lab 2.
3. What are the identities like IDs?
They are random character/number string of your choice.
4. Which is the shared session key for (CTR-AES256) encryption and HMAC?
It is k ′.
5. Can I use the “CTR” encryption mode from the library?
No. You need to implement CTR encryption and decryption processes.
6. What should I send for the data exchange demonstration?
Anything, as long as 64 bytes of each message.
7. Can I use the external cryptography library?
Yes, but you have to implement the required components.
8. Can I reuse the code from the labs?
Yes