{"pinia":{"ui":{"prefs":{"theme":"system","textScale":"md","fontFamily":"sans","reducedMotion":false,"highContrast":false}},"academy":{"universities":[],"universitySummaries":[{"slug":"rtu","name":"RTU","fullName":"Rajasthan Technical University","branches":[{"slug":"first-year-common","name":"First Year (Common)"},{"slug":"computer-science","name":"Computer Science"},{"slug":"mechanical","name":"Mechanical"},{"slug":"civil","name":"Civil"},{"slug":"ai-data-science","name":"AI & Data Science"},{"slug":"ee-ec-eee","name":"EE / EC / EEE"}]},{"slug":"aktu","name":"AKTU","fullName":"Dr. A. P. J. Abdul Kalam Technical University","branches":[{"slug":"first-year-common","name":"First Year (Common)"},{"slug":"computer-science","name":"Computer Science"}]}],"activePapers":[{"id":"information-security-systems-2023","title":"Information Security Systems (2023)","subjectSlug":"information-security-systems","subjectName":"Information Security Systems","universitySlug":"rtu","branchSlug":"computer-science","year":3,"semester":6,"examYear":2023,"paperCode":"6E7103","questions":[{"id":"v2-information-security-systems-2023-pA-q1","number":1,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Define the C.I.A. triad in information security."}],"answer":{"summary":"The C.I.A. triad represents Confidentiality, Integrity, and Availability.","explanation":[{"type":"paragraph","content":"Confidentiality ensures that information is accessible only to authorized entities. Integrity safeguards the accuracy and completeness of data against unauthorized alteration. Availability guarantees that data and systems are accessible to authorized users when needed."}]}},{"id":"v2-information-security-systems-2023-pA-q2","number":2,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is a Man-in-the-Middle (MitM) attack?"}],"answer":{"summary":"An attack where an adversary intercepts and relays communication between two parties.","explanation":[{"type":"paragraph","content":"In a Man-in-the-Middle (MitM) attack, the attacker secretly eavesdrops on or alters the communication between two entities who mistakenly believe they are communicating directly with each other. This severely compromises data confidentiality and integrity."}]}},{"id":"v2-information-security-systems-2023-pA-q3","number":3,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Differentiate between symmetric and asymmetric key cryptography."}],"answer":{"summary":"Symmetric uses one shared key, while asymmetric uses a public-private key pair.","explanation":[{"type":"paragraph","content":"Symmetric cryptography utilizes a single shared key for both encryption and decryption, requiring secure key distribution. Asymmetric cryptography uses a mathematically linked key pair: a public key for encryption and a private key for decryption, eliminating the shared key distribution problem."}]}},{"id":"v2-information-security-systems-2023-pA-q4","number":4,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is the role of a Message Authentication Code (MAC)?"}],"answer":{"summary":"A MAC ensures the integrity and authenticity of a message.","explanation":[{"type":"paragraph","content":"A Message Authentication Code (MAC) is a short piece of information used to authenticate a message and confirm its integrity. It requires the sender and receiver to share a secret cryptographic key, ensuring that the message was not altered in transit."}]}},{"id":"v2-information-security-systems-2023-pA-q5","number":5,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Define non-repudiation in the context of digital security."}],"answer":{"summary":"Non-repudiation prevents a party from denying their actions.","explanation":[{"type":"paragraph","content":"Non-repudiation ensures that a sender cannot falsely deny having sent a message and the recipient cannot falsely deny having received it. Digital signatures are commonly used to provide non-repudiation."}]}},{"id":"v2-information-security-systems-2023-pA-q6","number":6,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is a digital certificate?"}],"answer":{"summary":"An electronic document used to prove the ownership of a public key.","explanation":[{"type":"paragraph","content":"A digital certificate binds a public key to an entity's identity, verified and signed by a trusted third party known as a Certificate Authority (CA). It is foundational to the Public Key Infrastructure (PKI)."}]}},{"id":"v2-information-security-systems-2023-pA-q7","number":7,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Briefly explain Steganography."}],"answer":{"summary":"Steganography is the practice of hiding a secret message within an ordinary message.","explanation":[{"type":"paragraph","content":"Unlike cryptography which scrambles the message, steganography hides the very existence of the communication. For example, embedding secret text data within the least significant bits of an image file."}]}},{"id":"v2-information-security-systems-2023-pA-q8","number":8,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is the difference between a block cipher and a stream cipher?"}],"answer":{"summary":"Block ciphers encrypt chunks of data, stream ciphers encrypt bit-by-bit.","explanation":[{"type":"paragraph","content":"A block cipher operates on fixed-length groups of bits (blocks) applying an unvarying transformation, such as AES. A stream cipher encrypts individual characters or bits of a plaintext message one at a time continuously, often using a pseudorandom keystream."}]}},{"id":"v2-information-security-systems-2023-pA-q9","number":9,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"State the purpose of an Intrusion Detection System (IDS)."}],"answer":{"summary":"An IDS monitors network or system activities for malicious activities.","explanation":[{"type":"paragraph","content":"An Intrusion Detection System is designed to monitor networks or systems and generate alerts when suspicious activity or policy violations are detected. Unlike an IPS, an IDS typically only detects and alerts, rather than actively blocking the attack."}]}},{"id":"v2-information-security-systems-2023-pA-q10","number":10,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is a trapdoor one-way function?"}],"answer":{"summary":"A function that is easy to compute in one direction but hard to reverse without a special secret.","explanation":[{"type":"paragraph","content":"A trapdoor one-way function is a fundamental concept in asymmetric cryptography. It is mathematically easy to compute the forward function, computationally infeasible to compute the inverse, unless a piece of 'trapdoor' information (the private key) is known."}]}},{"id":"v2-information-security-systems-2023-pB-q11","number":11,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Explain the operational steps of the RSA algorithm with a simple outline."}],"answer":{"summary":"RSA algorithm relies on the mathematical difficulty of factoring large prime numbers.","explanation":[{"type":"paragraph","content":"The RSA algorithm involves three main steps: Key Generation, Encryption, and Decryption. In Key Generation, two large primes (p, q) are chosen to compute n = p*q and the totient phi(n). A public exponent 'e' and a private exponent 'd' are calculated such that (e*d) mod phi(n) = 1. The public key is (e, n) and the private key is (d, n). For Encryption, ciphertext C = P^e mod n. For Decryption, plaintext P = C^d mod n. RSA's security stems from the computational difficulty of factoring 'n' back into 'p' and 'q'."}]}},{"id":"v2-information-security-systems-2023-pB-q12","number":12,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Describe the different types of firewalls and their specific use cases."}],"answer":{"summary":"Firewalls filter network traffic based on predefined security rules.","explanation":[{"type":"paragraph","content":"Firewalls establish a barrier between trusted internal networks and untrusted external networks. Packet-filtering firewalls operate at the network layer, checking IPs and ports against a ruleset. Stateful inspection firewalls track the active state of connections, providing deeper security. Proxy (Application-level) firewalls act as intermediaries, inspecting application layer payloads to filter out advanced threats. Next-Generation Firewalls (NGFW) combine these features with deep packet inspection and intrusion prevention capabilities."}]}},{"id":"v2-information-security-systems-2023-pB-q13","number":13,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Explain the Diffie-Hellman key exchange algorithm and its vulnerability."}],"answer":{"summary":"Diffie-Hellman securely exchanges cryptographic keys over a public channel.","explanation":[{"type":"paragraph","content":"The Diffie-Hellman algorithm allows two parties to mutually agree on a shared secret key without ever transmitting the key itself. It relies on the discrete logarithm problem. Both parties agree on a large prime 'p' and a generator 'g'. They generate private values and exchange calculated public values. By combining their private value with the received public value, both arrive at the same shared secret. However, standard Diffie-Hellman is vulnerable to Man-in-the-Middle (MitM) attacks because it inherently lacks authentication."}]}},{"id":"v2-information-security-systems-2023-pB-q14","number":14,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"What is a Buffer Overflow attack, and how can it be mitigated?"}],"answer":{"summary":"Buffer overflow occurs when more data is written to a buffer than it can hold.","explanation":[{"type":"paragraph","content":"A buffer overflow anomaly happens when a program writes data beyond the boundaries of pre-allocated fixed-length memory buffers. Attackers exploit this to overwrite adjacent memory, which can corrupt data, crash the application, or execute malicious injected code. It can be mitigated by using safe programming languages, implementing bounds checking (like strncpy instead of strcpy in C), using Address Space Layout Randomization (ASLR), and enabling Data Execution Prevention (DEP)."}]}},{"id":"v2-information-security-systems-2023-pB-q15","number":15,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Outline the principles and requirements of Digital Signatures."}],"answer":{"summary":"Digital signatures provide authentication, data integrity, and non-repudiation.","explanation":[{"type":"paragraph","content":"A digital signature is generated by applying a cryptographic hash function to a message and encrypting the resulting hash value with the sender's private key. The receiver decrypts the signature using the sender's public key to retrieve the hash and compares it with their own locally computed hash of the message. If they match, it proves the message originated from the sender (Authentication), was not altered (Integrity), and the sender cannot deny sending it (Non-repudiation)."}]}},{"id":"v2-information-security-systems-2023-pB-q16","number":16,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Discuss the architecture of IPSec, including its AH and ESP protocols."}],"answer":{"summary":"IPSec secures IP communications via Authentication Header (AH) and Encapsulating Security Payload (ESP).","explanation":[{"type":"paragraph","content":"Internet Protocol Security (IPSec) is a suite of protocols for securing network layer communications. The Authentication Header (AH) protocol provides data origin authentication, data integrity, and anti-replay protection, but no confidentiality. The Encapsulating Security Payload (ESP) provides confidentiality (encryption) along with optional authentication and integrity. IPSec operates in two modes: Transport mode (encrypts payload only) and Tunnel mode (encrypts entire IP packet, used in VPNs)."}]}},{"id":"v2-information-security-systems-2023-pB-q17","number":17,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Explain the properties of a secure cryptographic hash function."}],"answer":{"summary":"Cryptographic hash functions must be deterministic, quick, and collision-resistant.","explanation":[{"type":"paragraph","content":"A secure cryptographic hash function takes an input of arbitrary size and outputs a fixed-size string (hash value). Key properties include Pre-image resistance (computationally infeasible to find the input from the hash), Second pre-image resistance (infeasible to find a different input that hashes to the same value as a given input), and Collision resistance (infeasible to find any two distinct inputs that produce the same hash). Minor changes in input must drastically change the output (Avalanche effect)."}]}},{"id":"v2-information-security-systems-2023-pC-q18","number":18,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Provide a detailed structure and working mechanism of the Advanced Encryption Standard (AES) algorithm. Discuss the various transformations involved in a single round."}],"answer":{"summary":"AES is a symmetric block cipher using substitution-permutation networks over multiple rounds.","explanation":[{"type":"paragraph","content":"The Advanced Encryption Standard (AES) is a symmetric block cipher chosen by NIST to replace DES. It operates on fixed blocks of 128 bits and uses key sizes of 128, 192, or 256 bits, requiring 10, 12, or 14 rounds respectively. AES relies on a substitution-permutation network structure, organizing data into a 4x4 state matrix of bytes."},{"type":"paragraph","content":"Each full round of AES (except the final round) consists of four distinct transformation stages:"},{"type":"paragraph","content":"1. SubBytes: A non-linear substitution step where each byte in the state is replaced with another byte using a predefined substitution box (S-box), providing confusion."},{"type":"paragraph","content":"2. ShiftRows: A transposition step where the last three rows of the state matrix are shifted cyclically to the left by specific offsets, providing diffusion."},{"type":"paragraph","content":"3. MixColumns: A mixing operation which operates on the columns of the state, combining the four bytes in each column mathematically. This provides substantial diffusion."},{"type":"paragraph","content":"4. AddRoundKey: Each byte of the state is combined with a block of the round key using bitwise XOR. The round keys are derived from the master key via a key schedule."},{"type":"paragraph","content":"The final round omits the MixColumns stage. The symmetric nature means the decryption process applies inverse transformations in reverse order."},{"type":"svg","src":"/assets/diagrams/rtu/cs/3/information-security-systems/diagram-18.svg","alt":"AES Algorithm Round Structure","caption":"Detailed Block Diagram of Advanced Encryption Standard (AES) Transformations per Round"}]}},{"id":"v2-information-security-systems-2023-pC-q19","number":19,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Explain the X.509 digital certificate format. Detail the components of Public Key Infrastructure (PKI) and their interactions."}],"answer":{"summary":"X.509 defines the format for digital certificates within a Public Key Infrastructure (PKI).","explanation":[{"type":"paragraph","content":"The X.509 standard dictates the structure and contents of a digital certificate, which is used to bind an entity's identity to their public key. An X.509 certificate includes fields such as Version, Serial Number, Signature Algorithm ID, Issuer Name, Validity Period, Subject Name, Subject Public Key Info, and standard extensions. It is digitally signed by a trusted third party."},{"type":"paragraph","content":"Public Key Infrastructure (PKI) is the overarching framework managing these certificates. Key components of PKI include:"},{"type":"paragraph","content":"1. Certificate Authority (CA): The highly trusted entity that issues, signs, and manages digital certificates. It vouches for the identity of the certificate holder."},{"type":"paragraph","content":"2. Registration Authority (RA): A subordinate entity that verifies user identities and approves certificate requests before passing them to the CA."},{"type":"paragraph","content":"3. Certificate Repository: A centralized directory where certificates and Public Keys are stored and accessible to users."},{"type":"paragraph","content":"4. Certificate Revocation List (CRL): A list maintained by the CA detailing certificates that have been revoked prior to their expiration date."},{"type":"svg","src":"/assets/diagrams/rtu/cs/3/information-security-systems/diagram-19.svg","alt":"PKI and X.509 Architecture","caption":"Components of Public Key Infrastructure (PKI) and X.509 Certificate Hierarchy"}]}},{"id":"v2-information-security-systems-2023-pC-q20","number":20,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Describe the Kerberos authentication protocol in detail. Explain the roles of the Authentication Server (AS) and Ticket Granting Server (TGS)."}],"answer":{"summary":"Kerberos is a secure, ticket-based authentication protocol for untrusted networks.","explanation":[{"type":"paragraph","content":"Kerberos is a widely utilized network authentication protocol designed to provide strong authentication for client/server applications using secret-key cryptography. It assumes network communication is inherently insecure. The architecture centers on a trusted third party known as the Key Distribution Center (KDC)."},{"type":"paragraph","content":"The KDC consists of two primary logical components: the Authentication Server (AS) and the Ticket Granting Server (TGS). The workflow proceeds as follows:"},{"type":"paragraph","content":"1. Initial Authentication: The client requests a Ticket Granting Ticket (TGT) from the AS. The AS authenticates the client using their password hash and returns an encrypted TGT and a session key."},{"type":"paragraph","content":"2. Requesting a Service Ticket: The client wishes to access a specific network service. The client presents the TGT and an authenticator to the TGS. Since the TGT is encrypted with the TGS's secret key, it proves the client's initial authentication."},{"type":"paragraph","content":"3. Service Access: The TGS validates the TGT and issues a Service Ticket valid for the requested service. The client then sends this Service Ticket to the target Application Server to gain access."},{"type":"paragraph","content":"Kerberos effectively mitigates replay attacks using timestamps and avoids transmitting plain text passwords over the network."},{"type":"svg","src":"/assets/diagrams/rtu/cs/3/information-security-systems/diagram-20.svg","alt":"Kerberos Protocol Workflow","caption":"Message Exchange and Workflow in the Kerberos Authentication Protocol"}]}},{"id":"v2-information-security-systems-2023-pC-q21","number":21,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Discuss the SSL/TLS protocol architecture. Detail the steps involved in the SSL Handshake Protocol."}],"answer":{"summary":"SSL/TLS secures network communication via encrypted, authenticated transport tunnels.","explanation":[{"type":"paragraph","content":"Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), are cryptographic protocols designed to provide communications security over a computer network. The SSL/TLS architecture operates above the TCP layer and below the application layer, encapsulating application data."},{"type":"paragraph","content":"The protocol is divided into two layers: the SSL Record Protocol (which handles data fragmentation, compression, MAC application, and encryption) and higher-level protocols including the SSL Handshake Protocol, Change Cipher Spec Protocol, and Alert Protocol."},{"type":"paragraph","content":"The SSL Handshake Protocol involves:"},{"type":"paragraph","content":"1. Hello Phase: Client sends a 'ClientHello' (supported ciphers, random number). Server responds with 'ServerHello' (chosen cipher, random number)."},{"type":"paragraph","content":"2. Certificate Exchange: The server sends its digital certificate to prove its identity. The client verifies this certificate."},{"type":"paragraph","content":"3. Key Exchange: The client generates a 'Pre-Master Secret', encrypts it with the server's public key, and sends it. Both compute the symmetric 'Master Secret' from the pre-master secret and exchanged random numbers."},{"type":"paragraph","content":"4. Finished: Both parties send a 'Finished' message encrypted with the new symmetric keys. All subsequent data is encrypted."},{"type":"svg","src":"/assets/diagrams/rtu/cs/3/information-security-systems/diagram-21.svg","alt":"SSL/TLS Handshake Process","caption":"Step-by-step SSL/TLS Handshake Protocol Execution"}]}},{"id":"v2-information-security-systems-2023-pC-q22","number":22,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Differentiate between Viruses, Worms, and Trojans. Describe the typical lifecycle of malware and suggest comprehensive countermeasures."}],"answer":{"summary":"Viruses infect files, worms self-propagate, and Trojans masquerade as legitimate software.","explanation":[{"type":"paragraph","content":"Malicious software (Malware) categorizes into several distinct types based on propagation and execution behavior. A Virus attaches itself to clean files and infects other clean files, requiring human interaction to spread. A Worm is a standalone malware program that replicates itself automatically across a network to infect other computers without user intervention. A Trojan Horse disguises itself as legitimate or desirable software to deceive users into installing it, often creating backdoors for attackers."},{"type":"paragraph","content":"The typical malware lifecycle consists of:"},{"type":"paragraph","content":"1. Infection/Delivery: The malware is introduced into the target system via phishing, drive-by downloads, or infected media."},{"type":"paragraph","content":"2. Execution: The payload activates. 3. Propagation (Optional): The malware attempts to spread across the network. 4. Payload Activation: The primary malicious intent is carried out (data theft, encryption for ransom, botnet joining)."},{"type":"paragraph","content":"Countermeasures include robust Next-Generation Antivirus (NGAV), strict email filtering and web proxies, regular patching and vulnerability management, User Awareness Training, and enforcing Principle of Least Privilege."},{"type":"svg","src":"/assets/diagrams/rtu/cs/3/information-security-systems/diagram-22.svg","alt":"Malware Lifecycle and Types","caption":"Distinctions between Malware Types and the Typical Malware Lifecycle"}]}}]},{"id":"information-security-systems-2024","title":"Information Security Systems (2024)","subjectSlug":"information-security-systems","subjectName":"Information Security Systems","universitySlug":"rtu","branchSlug":"computer-science","year":3,"semester":6,"examYear":2024,"paperCode":"6E7103","questions":[{"id":"v2-information-security-systems-2024-pA-q1","number":1,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Distinguish between Authentication and Authorization."}],"answer":{"summary":"Authentication mathematically verifies the absolute identity of a user (who you are), while Authorization dictates the strict access permissions granted to that verified identity (what you can do).","explanation":[{"type":"paragraph","content":"Authentication is the cryptographic or biometric process of proving an entity's identity (e.g., verifying a password or fingerprint). Authorization mathematically occurs immediately after; it is the strict architectural enforcement of Access Control Lists (ACLs) to determine if that authenticated identity possesses the mathematical privilege to read or write specific files."}]}},{"id":"v2-information-security-systems-2024-pA-q2","number":2,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Define cryptanalysis."}],"answer":{"summary":"Cryptanalysis is the highly aggressive mathematical science of violently breaking cryptographic architectures to decrypt ciphertext without possessing the legitimate decryption key.","explanation":[{"type":"paragraph","content":"Cryptanalysis (codebreaking) is the absolute counterpart to Cryptography. It involves deploying massive mathematical algorithms, statistical frequency analysis, and brute-force computational power to maliciously deduce the secret key or plaintext from ciphertext, effectively destroying the security of the encryption protocol."}]}},{"id":"v2-information-security-systems-2024-pA-q3","number":3,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is a Denial of Service (DoS) attack?"}],"answer":{"summary":"A DoS attack is a malicious, aggressive network assault designed to violently overwhelm a target server's hardware resources, mathematically rendering it unavailable to legitimate users.","explanation":[{"type":"paragraph","content":"A Denial of Service (DoS) attack is an asymmetric assault where a single attacker violently blasts a target server (like a web server) with millions of malformed TCP/IP packets (e.g., SYN Floods) to exhaust its RAM or CPU, causing the architecture to crash and drop legitimate client connections."}]}},{"id":"v2-information-security-systems-2024-pA-q4","number":4,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Briefly explain the concept of Public Key Infrastructure (PKI)."}],"answer":{"summary":"PKI is the massive, hierarchical trust architecture that mathematically manages, issues, and validates Digital Certificates using public-key cryptography across global networks.","explanation":[{"type":"paragraph","content":"Public Key Infrastructure (PKI) is the absolute foundation of internet trust. It utilizes a supreme Certificate Authority (CA) to mathematically bind a public key to a specific human or corporate entity via a cryptographically signed Digital Certificate, guaranteeing the authenticity of servers during HTTPS/TLS handshakes."}]}},{"id":"v2-information-security-systems-2024-pA-q5","number":5,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is Pretty Good Privacy (PGP) primarily used for?"}],"answer":{"summary":"PGP is a highly secure cryptographic architecture utilized primarily for mathematically encrypting, decrypting, and digitally signing email communications to guarantee privacy and non-repudiation.","explanation":[{"type":"paragraph","content":"Pretty Good Privacy (PGP) is the absolute gold standard for secure email. It violently combines the speed of Symmetric cryptography (for the message payload) with the security of Asymmetric cryptography (to encrypt the symmetric key), and uses a decentralized \"Web of Trust\" instead of a rigid central CA."}]}},{"id":"v2-information-security-systems-2024-pA-q6","number":6,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Describe a Cross-Site Scripting (XSS) attack."}],"answer":{"summary":"XSS is a catastrophic web vulnerability where an attacker violently injects malicious client-side JavaScript into a trusted website, which is then unknowingly executed by victim browsers.","explanation":[{"type":"paragraph","content":"In a Cross-Site Scripting (XSS) attack, the hacker bypasses backend security by injecting raw JavaScript into a comment forum. When a legitimate user visits the forum, their browser downloads and violently executes the script, allowing the attacker to steal their secure session cookies and mathematically hijack their account."}]}},{"id":"v2-information-security-systems-2024-pA-q7","number":7,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is a botnet?"}],"answer":{"summary":"A botnet is a massive, coordinated network of globally compromised computers (zombies) controlled mathematically by a single malicious hacker (the botmaster) via a Command and Control server.","explanation":[{"type":"paragraph","content":"A Botnet is an aggressive cyber-weapon architecture. Hackers infect 100,000 random IoT devices or PCs with Trojan malware. The attacker then uses a centralized Command and Control (C&C) server to violently command all 100,000 nodes to simultaneously launch a catastrophic DDoS attack or blast spam emails globally."}]}},{"id":"v2-information-security-systems-2024-pA-q8","number":8,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"List two advantages of biometric authentication."}],"answer":{"summary":"Biometric authentication provides absolute physical non-repudiation and completely eradicates the severe human vulnerabilities associated with weak or forgotten alphanumeric passwords.","explanation":[{"type":"paragraph","content":"Biometric architecture (fingerprints, retina scans) mathematically maps unique biological features. It provides massive security advantages: First, the credential cannot be forgotten or easily shared (unlike a password). Second, it provides absolute non-repudiation because the physical presence of the human is mathematically proven at the time of authentication."}]}},{"id":"v2-information-security-systems-2024-pA-q9","number":9,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"What is a logic bomb in malware?"}],"answer":{"summary":"A logic bomb is a highly insidious, dormant piece of malicious code that violently executes a catastrophic payload only when a strict mathematical condition is met.","explanation":[{"type":"paragraph","content":"Unlike a virus that attacks instantly, a Logic Bomb is stealth architecture. A disgruntled employee might implant code that says: \"If my payroll ID is deleted from the HR database, violently format the entire central server.\" The malware sleeps undetected until the exact mathematical trigger condition is fulfilled."}]}},{"id":"v2-information-security-systems-2024-pA-q10","number":10,"marks":2,"tags":["Part A"],"text":[{"type":"paragraph","content":"Define a Key Distribution Center (KDC)."}],"answer":{"summary":"A KDC is a highly secure, centralized server architecture in symmetric cryptography (like Kerberos) that mathematically generates and securely distributes temporary session keys between communicating parties.","explanation":[{"type":"paragraph","content":"In a massive network using symmetric encryption, every pair of users needs a unique key. The Key Distribution Center (KDC) completely solves this mathematical nightmare. It shares a unique master key with every user. When Alice wants to talk to Bob, the KDC generates a temporary session key and securely transmits it to both, eradicating the key distribution crisis."}]}},{"id":"v2-information-security-systems-2024-pB-q11","number":11,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Explain the round structure in the Data Encryption Standard (DES)."}],"answer":{"summary":"A rigorous architectural breakdown of the DES Feistel Round Structure. Violently details the Expansion Permutation, the catastrophic non-linear S-Box substitution, and the final P-Box permutation executed over 16 iterations.","explanation":[{"type":"heading","content":"The Round Structure of the Data Encryption Standard (DES)"},{"type":"paragraph","content":"DES is a symmetric-key block cipher based entirely on Horst Feistel's architectural network. It violently shatters a 64-bit plaintext block into two 32-bit halves (Left $L_0$ and Right $R_0$) and subjects them to 16 identical, mathematically aggressive iterations (Rounds) of confusion and diffusion."},{"type":"subheading","content":"The Mathematical Mechanics of a Single Round ($i$)"},{"type":"paragraph","content":"Inside Round $i$, the Left half simply copies the previous Right half: $L_i = R_{i-1}$. The absolute cryptographic violence occurs in calculating the new Right half: $R_i = L_{i-1} \\oplus F(R_{i-1}, K_i)$, where $F$ is the highly complex Feistel function."},{"type":"subheading","content":"The Execution of the $F$-Function"},{"type":"list","items":["**1. Expansion Permutation (E-Box):** The 32-bit $R_{i-1}$ is mathematically expanded to 48 bits by duplicating specific bits. This allows it to physically match the size of the 48-bit subkey ($K_i$).","**2. Key Mixing (XOR):** The 48-bit expanded block is violently XORed with the 48-bit subkey generated by the Key Schedule.","**3. Substitution Boxes (S-Boxes):** The absolute core of DES security. The 48-bit result is chopped into eight 6-bit chunks. Each chunk is fed into a specific non-linear S-Box. The S-Box mathematically crushes the 6 bits down to 4 bits using rigid look-up tables. **This is the ONLY non-linear step in DES**, providing absolute resistance against catastrophic differential cryptanalysis.","**4. Permutation (P-Box):** The resulting 32 bits from the S-Boxes are wildly rearranged (diffused) using a strict wire permutation to ensure the output violently affects completely different S-Boxes in the next round."]}]}},{"id":"v2-information-security-systems-2024-pB-q12","number":12,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Discuss the working principles of the SHA-1 algorithm."}],"answer":{"summary":"A deep theoretical exposition on the SHA-1 Hashing Algorithm. Explains how it mathematically processes 512-bit message blocks through 80 aggressive compression iterations to generate an irreversible 160-bit cryptographic digest.","explanation":[{"type":"heading","content":"Working Principles of the SHA-1 Algorithm"},{"type":"paragraph","content":"The Secure Hash Algorithm 1 (SHA-1) is a cryptographic hash function architecture. Its absolute mathematical goal is to take a message of any arbitrary length (up to $2^{64}-1$ bits) and violently compress it into a rigid, irreversible 160-bit message digest. It guarantees the Avalanche Effect: flipping a single bit in a 1-Gigabyte file will mathematically cascade and completely alter the final 160-bit hash."},{"type":"subheading","content":"The Architectural Pipeline"},{"type":"list","items":["**1. Message Padding:** The input message must be mathematically forced to be a multiple of 512 bits. SHA-1 appends a single `1` bit, followed by enough `0` bits, and finally appends the exact 64-bit original length of the message at the very end.","**2. Buffer Initialization:** The architecture initializes five 32-bit hardware registers ($A, B, C, D, E$) with rigid, predefined hexadecimal mathematical constants.","**3. The Compression Engine (The 80 Rounds):** The padded message is violently chopped into 512-bit blocks. Each block is further shattered into sixteen 32-bit words. The compression function executes exactly 80 mathematically aggressive iterations (Rounds) on each block.","**4. Round Operations:** During each of the 80 rounds, the algorithm executes catastrophic bitwise logical operations (AND, OR, XOR, NOT) and highly non-linear Circular Left Shifts on the $A, B, C, D, E$ registers, aggressively mixing the message bits with the register states.","**5. The Output:** After all 512-bit blocks have been sequentially violently digested by the compression engine, the final state of the five 32-bit registers is concatenated together, yielding the absolute final 160-bit mathematical hash."]}]}},{"id":"v2-information-security-systems-2024-pB-q13","number":13,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Explain the concept of a Virtual Private Network (VPN) and its tunneling protocols."}],"answer":{"summary":"An architectural review of Virtual Private Networks (VPNs). Details how tunneling protocols like IPsec and OpenVPN mathematically encapsulate and violently encrypt private IP packets inside public internet packets to create impenetrable digital tunnels.","explanation":[{"type":"heading","content":"Virtual Private Network (VPN) and Tunneling Architecture"},{"type":"paragraph","content":"A VPN is a highly advanced network security architecture designed to mathematically simulate a secure, private, physical fiber-optic cable over the completely chaotic, insecure public internet. It allows remote employees to access corporate databases as if they were physically sitting in the office building."},{"type":"subheading","content":"The Mathematics of Tunneling"},{"type":"paragraph","content":"Standard TCP/IP packets are violently exposed to packet sniffers. VPNs utilize \"Tunneling\"—a mathematical process of absolute encapsulation."},{"type":"list","items":["**1. Encapsulation:** The VPN software takes the user's original private IP packet (containing confidential data destined for the internal corporate server).","**2. Cryptographic Violence:** It aggressively encrypts the ENTIRE packet (both the payload and the private IP header) using AES-256.","**3. The Wrapper:** It then wraps this encrypted blob inside a brand-new, completely standard public IP packet. The outer packet's destination is strictly the corporate VPN Gateway router, not the final server.","**4. Traversal:** The packet travels across the public internet. Hackers intercepting it see only mathematically unbreakable AES-256 gibberish traveling between the user and a firewall.","**5. Decapsulation:** The VPN Gateway receives the packet, violently strips away the public wrapper, decrypts the payload, and routes the pristine, original private packet into the corporate intranet."]},{"type":"subheading","content":"Dominant Tunneling Protocols"},{"type":"paragraph","content":"The architecture is powered by rigid protocols. **IPsec** operates at the Network Layer (Layer 3), providing mandatory military-grade encryption for entire network-to-network tunnels. **OpenVPN** operates higher up, utilizing standard TLS/SSL mathematics for extreme flexibility and firewall traversal."}]}},{"id":"v2-information-security-systems-2024-pB-q14","number":14,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Describe the Bell-LaPadula security model and its primary properties."}],"answer":{"summary":"A critical analysis of the Bell-LaPadula model. Explains the strict military architecture of \"No Read Up\" and \"No Write Down\" that mathematically guarantees absolute data confidentiality across highly classified clearance levels.","explanation":[{"type":"heading","content":"The Bell-LaPadula Security Model"},{"type":"paragraph","content":"Engineered for the US Department of Defense, the Bell-LaPadula (BLP) model is an absolute, mathematically rigid State Machine architecture designed strictly to enforce Access Control and guarantee one single property: **Confidentiality**. It mathematically prevents highly classified information from leaking to lower-cleared entities."},{"type":"subheading","content":"The Architectural Matrix"},{"type":"paragraph","content":"The system is divided into Subjects (users) and Objects (files). Every entity is mathematically assigned a strict Security Clearance Level (e.g., Unclassified, Secret, Top Secret). BLP enforces two absolute, unbreakable mathematical rules:"},{"type":"list","items":["**1. The Simple Security Property (No Read Up):** A Subject at a given clearance level mathematically CANNOT read an Object at a higher classification level. (A \"Secret\" user cannot read a \"Top Secret\" file). This is standard and obvious.","**2. The Star Property (*-Property / No Write Down):** The absolute genius of the model. A Subject at a given clearance level mathematically CANNOT write information into an Object at a LOWER classification level. (A \"Top Secret\" user cannot copy-paste data into an \"Unclassified\" email)."]},{"type":"subheading","content":"The Prevention of Trojan Horses"},{"type":"paragraph","content":"The Star Property seems counter-intuitive (why can't a General write an unclassified memo?). However, it mathematically eradicates the Trojan Horse vulnerability. If a General's computer is infected with a Trojan, the malware has \"Top Secret\" access. Without the Star Property, the malware could silently read top-secret war plans and violently write them to an unclassified, publicly accessible file, destroying the nation's security. The Star Property makes this data leak mathematically impossible."}]}},{"id":"v2-information-security-systems-2024-pB-q15","number":15,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Compare and contrast DoS and DDoS attacks with examples."}],"answer":{"summary":"A definitive comparison between DoS and DDoS attacks. Contrasts the limited mathematical power of a single-source TCP flood against the catastrophic, globally distributed bandwidth exhaustion executed by massive botnet architectures.","explanation":[{"type":"heading","content":"DoS vs. DDoS Attacks: Architectural Comparison"},{"type":"paragraph","content":"Both Denial of Service (DoS) and Distributed Denial of Service (DDoS) are highly aggressive cyber-assaults designed to mathematically exhaust a target server's hardware (RAM, CPU, or Network Bandwidth) to violently deny access to legitimate users. The absolute difference lies in the architectural scale of the attack vectors."},{"type":"subheading","content":"1. Denial of Service (DoS)"},{"type":"list","items":["**Architecture:** A 1-to-1 mathematical assault. Exactly ONE malicious computer aggressively attacks the target server.","**Mechanism:** The attacker might utilize a \"Ping of Death\" or a SYN Flood, rapidly firing malformed packets to crash the server's TCP/IP stack.","**Defense:** Highly trivial to stop. The target's Firewall simply detects the massive spike in traffic coming from a single IP address and violently blocks that specific IP, instantly neutralizing the attack."]},{"type":"subheading","content":"2. Distributed Denial of Service (DDoS)"},{"type":"list","items":["**Architecture:** A Many-to-1 catastrophic assault. The attacker utilizes a massive Botnet—100,000 infected IoT devices (fridges, cameras) geographically scattered across the globe.","**Mechanism:** The attacker commands all 100,000 devices to simultaneously blast HTTP requests at the target server. The server is hit with 500 Gigabits per second of raw traffic, completely annihilating the data center's physical internet pipe.","**Defense:** Mathematically horrific to defend against. The firewall cannot simply block one IP; the attack is coming from 100,000 legitimate residential IP addresses. Defeating it requires massive Cloud Scrubbing Centers (like Cloudflare) to mathematically filter the global traffic before it ever reaches the physical server."]}]}},{"id":"v2-information-security-systems-2024-pB-q16","number":16,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Outline the Secure Electronic Transaction (SET) protocol for e-commerce."}],"answer":{"summary":"A concise outline of the SET Protocol architecture. Explains how Dual Signatures and public-key cryptography are mathematically executed to shield credit card data from merchants while authenticating all parties involved.","explanation":[{"type":"heading","content":"The Secure Electronic Transaction (SET) Protocol"},{"type":"paragraph","content":"Engineered in the 1990s by a massive consortium (Visa, Mastercard, IBM), SET is a highly complex, mathematically rigorous cryptographic architecture designed specifically to secure E-commerce credit card transactions."},{"type":"subheading","content":"Architectural Objectives"},{"type":"paragraph","content":"Standard SSL/TLS only protects data in transit. SET was engineered to provide absolute mathematical authentication of all parties (Customer, Merchant, and Bank) using X.509 Digital Certificates, and crucially, to guarantee that the Merchant NEVER physically possesses the customer's credit card number."},{"type":"subheading","content":"The Dual Signature Mathematics"},{"type":"paragraph","content":"The core engine of SET is the Dual Signature. The customer software generates two distinct data packets:"},{"type":"list","items":["1. **Order Information (OI):** The items being purchased. Encrypted strictly for the Merchant.","2. **Payment Information (PI):** The raw credit card data. Violently encrypted using the **Bank's Public Key**.","3. Both packets are mathematically hashed together and signed with the Customer's Private Key (The Dual Signature)."]},{"type":"paragraph","content":"The Merchant receives the entire bundle. They can decrypt the OI to ship the product, but they are mathematically incapable of decrypting the PI. They forward the PI to the Bank. The Bank decrypts the PI, verifies the Dual Signature, and authorizes the payment, completely isolating the Merchant from catastrophic credit card data breaches."}]}},{"id":"v2-information-security-systems-2024-pB-q17","number":17,"marks":4,"tags":["Part B"],"text":[{"type":"paragraph","content":"Discuss role-based access control (RBAC) and its benefits."}],"answer":{"summary":"A detailed review of Role-Based Access Control (RBAC). Explains how mathematically decoupling user accounts from file permissions via intermediate \"Roles\" drastically reduces administrative chaos in massive enterprise architectures.","explanation":[{"type":"heading","content":"Role-Based Access Control (RBAC) Architecture"},{"type":"paragraph","content":"In early security architectures (Discretionary Access Control), administrators manually assigned permissions (Read/Write) for every single file to every single user ID. In a mega-corporation with 10,000 employees, this mathematical $Users \\times Files$ matrix becomes catastrophically chaotic and impossible to audit. RBAC solves this by mathematically injecting an abstraction layer: the **Role**."},{"type":"subheading","content":"The Mathematical Mechanics"},{"type":"list","items":["**Role Creation:** The system administrator defines rigid architectural Roles based strictly on corporate job functions (e.g., `Cardiology_Nurse`, `Senior_Auditor`).","**Permission Assignment:** The system violently binds file permissions strictly to the ROLE, never to the human user. (The `Cardiology_Nurse` role is mathematically granted Read/Write access to the `Patient_Records` database).","**User Assignment:** When John is hired as a nurse, his User ID is simply assigned to the `Cardiology_Nurse` role. He instantly inherits all mathematical permissions of that role."]},{"type":"subheading","content":"Architectural Benefits"},{"type":"paragraph","content":"RBAC enforces the Principle of Least Privilege automatically. Its absolute greatest advantage is in catastrophic HR events (termination or promotion). If John is promoted to Doctor, the admin simply mathematically detaches his ID from the Nurse role and attaches it to the Doctor role. Tens of thousands of underlying file permissions shift instantly and flawlessly without a single manual database entry."}]}},{"id":"v2-information-security-systems-2024-pC-q18","number":18,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Analyze the RSA cryptographic algorithm in detail. Provide a mathematical example of key generation, encryption, and decryption, followed by a security analysis."}],"answer":{"summary":"A massive mathematical exposition on the RSA Cryptographic Algorithm. Violently executes prime number generation, modulus calculation, and Euler's Totient to derive Public/Private keys, followed by a rigorous analysis of the Integer Factorization problem that secures it.","explanation":[{"type":"heading","content":"The Architecture of the RSA Cryptographic Algorithm"},{"type":"paragraph","content":"Invented by Rivest, Shamir, and Adleman in 1977, RSA is the absolute foundation of global Asymmetric (Public Key) Cryptography. It completely eradicates the key-distribution nightmare of symmetric systems. Its security is mathematically anchored in the catastrophic computational difficulty of factoring massive semi-prime numbers."},{"type":"heading","content":"1. Mathematical Key Generation (The Setup)"},{"type":"paragraph","content":"The server executes a rigid mathematical sequence to generate the Key Pair:"},{"type":"list","items":["**Step 1 (Prime Selection):** Violently generate two massive, distinct prime numbers, $p$ and $q$ (in reality, these are 2048 bits long). \n *Example: Let $p = 11$ and $q = 3$.*","**Step 2 (The Modulus):** Mathematically calculate $n = p \\times q$. This $n$ will be released to the public. \n *Example: $n = 11 \\times 3 = 33$.*","**Step 3 (Euler's Totient):** Calculate $\\phi(n) = (p-1) \\times (q-1)$. \n *Example: $\\phi(33) = 10 \\times 2 = 20$.*","**Step 4 (Public Exponent $e$):** Select an integer $e$ such that $1 < e < \\phi(n)$, and $e$ is strictly coprime to $\\phi(n)$ (they share no common factors except 1). \n *Example: Let $e = 3$. (3 and 20 are coprime).*","**Step 5 (Private Exponent $d$):** Mathematically calculate the modular multiplicative inverse of $e$ modulo $\\phi(n)$. Meaning, $(d \\times e) \\equiv 1 \\pmod{\\phi(n)}$. \n *Example: $(d \\times 3) \\equiv 1 \\pmod{20}$. By trial or Extended Euclidean algorithm, $d = 7$, because $(7 \\times 3) = 21$, and $21 \\pmod{20} = 1$.*"]},{"type":"paragraph","content":"The keys are now violently locked. \n- **Public Key:** $(e, n) \\Rightarrow (3, 33)$. \n- **Private Key:** $(d, n) \\Rightarrow (7, 33)$."},{"type":"heading","content":"2. Encryption and Decryption (The Execution)"},{"type":"subheading","content":"Encryption (By the Sender using Public Key)"},{"type":"paragraph","content":"Let the plaintext message $M = 4$. The mathematical encryption formula is: \n $$ C = M^e \\pmod{n} $$"},{"type":"paragraph","content":"*Execution:* $C = 4^3 \\pmod{33} = 64 \\pmod{33} = 31$. \nThe Ciphertext $C = 31$ is blasted across the public internet."},{"type":"subheading","content":"Decryption (By the Receiver using Private Key)"},{"type":"paragraph","content":"The receiver mathematically unlocks $C$ using their highly guarded Private Key ($d=7$). The formula is: \n $$ M = C^d \\pmod{n} $$"},{"type":"paragraph","content":"*Execution:* $M = 31^7 \\pmod{33}$. \n $31^7 = 27512614111$. \n $27512614111 \\pmod{33} = 4$. \nThe absolute original plaintext $M = 4$ is flawlessly recovered."},{"type":"heading","content":"3. Security Analysis (The Factorization Crisis)"},{"type":"paragraph","content":"A hacker intercepts $C = 31$, and knows the Public Key $(e=3, n=33)$. To decrypt the message, the hacker MUST mathematically calculate the Private Key $d$. To calculate $d$, the hacker MUST know $\\phi(n)$. To know $\\phi(n)$, the hacker MUST know the original prime numbers $p$ and $q$."},{"type":"paragraph","content":"Therefore, the hacker must mathematically factor $n$ back into $p \\times q$. For $n=33$, a human can instantly see $11 \\times 3$. However, if $n$ is a 4096-bit number (a number with 1200 digits), no supercomputer on Earth possesses the physical time or mathematical algorithms to execute the factorization before the universe ends. The security of RSA relies entirely on the catastrophic asymmetry of multiplication (easy) versus factorization (impossible)."}]}},{"id":"v2-information-security-systems-2024-pC-q19","number":19,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Detail the architecture and modes (Transport and Tunnel) of IPSec. Discuss how it provides security at the network layer."}],"answer":{"summary":"A comprehensive architectural dissection of IPSec. Explains how Authentication Headers (AH) and Encapsulating Security Payloads (ESP) operate within Transport and Tunnel modes to brutally secure the IP layer of the OSI model.","explanation":[{"type":"heading","content":"The Architecture of IP Security (IPSec)"},{"type":"paragraph","content":"SSL/TLS operates at the Application/Transport layer (securing only a specific browser session). **IPSec** is a massive suite of protocols operating at the absolute Network Layer (Layer 3) of the OSI model. Its mathematical goal is to violently encrypt and authenticate EVERY SINGLE IP PACKET leaving a computer or router, providing invisible, mandatory security to all higher-level applications."},{"type":"heading","content":"1. The Core Protocols (AH and ESP)"},{"type":"paragraph","content":"IPSec executes its security using two highly distinct mathematical architectures:"},{"type":"list","items":["**Authentication Header (AH):** Focuses strictly on Integrity and Authentication. It mathematically hashes the entire IP packet (including the IP headers) and attaches a cryptographic signature. It absolutely prevents spoofing and tampering, but provides ZERO confidentiality. The data payload is sent in plain text.","**Encapsulating Security Payload (ESP):** The workhorse of IPSec. It violently encrypts the data payload using AES-256 (Confidentiality) and mathematically hashes it (Integrity). However, standard ESP does not authenticate the outermost IP headers."]},{"type":"heading","content":"2. The Execution Modes: Transport vs. Tunnel"},{"type":"paragraph","content":"IPSec can execute its cryptographic protocols in two distinct architectural modes:"},{"type":"subheading","content":"Transport Mode (End-to-End Security)"},{"type":"paragraph","content":"Utilized for securing a direct connection between two specific computers (Host-to-Host)."},{"type":"list","items":["**Mechanism:** The ESP header is aggressively injected directly *between* the original IP Header and the TCP payload. Only the TCP payload is mathematically encrypted.","**Execution:** The original IP Header remains completely intact and visible. The internet routers can read the source and destination IPs to route the packet normally.","**Demerit:** Hackers can execute Traffic Analysis. They cannot read the data, but they can see that the CEO's IP address is constantly talking to the Swiss Bank's IP address."]},{"type":"subheading","content":"Tunnel Mode (Site-to-Site VPN Security)"},{"type":"paragraph","content":"The absolute foundation of corporate VPNs, linking a Branch Office router to the HQ router over the public internet."},{"type":"list","items":["**Mechanism:** The absolute entire original IP packet (Payload + Original IP Header) is violently encrypted by the branch router.","**Execution:** The router then generates a brand NEW, completely distinct public IP Header and wraps it around the encrypted blob. The new IP header simply lists the branch router as the source and the HQ router as the destination.","**Merit:** Absolute catastrophic defeat of Traffic Analysis. Hackers see massive encrypted traffic flowing between two routers, but they have absolutely zero mathematical ability to see the internal IPs of the actual computers communicating inside the tunnel."]},{"type":"svg","content":""}]}},{"id":"v2-information-security-systems-2024-pC-q20","number":20,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Elaborate on the working of Intrusion Detection Systems (IDS). Compare Network-based IDS (NIDS) and Host-based IDS (HIDS)."}],"answer":{"summary":"A deep dive into Intrusion Detection Systems (IDS). Explains the mathematical anomaly detection engines, and violently contrasts the global network surveillance of NIDS against the deep OS-level kernel inspection executed by HIDS.","explanation":[{"type":"heading","content":"Intrusion Detection Systems (IDS) Architecture"},{"type":"paragraph","content":"A Firewall is a dumb security door; it blindly blocks or allows traffic based on rigid port rules. If port 80 is open, it lets all web traffic through. An **Intrusion Detection System (IDS)** is the intelligent, aggressive security camera. It mathematically analyzes the actual payloads flowing through the open ports, violently tearing packets apart to hunt for malicious signatures (like SQL injection strings) or catastrophic behavioral anomalies that bypass the firewall."},{"type":"heading","content":"The Mathematical Detection Engines"},{"type":"list","items":["**Signature-Based Detection:** The IDS maintains a massive database of known malware bit-patterns (signatures). It aggressively compares every incoming packet against this database. Fast, but mathematically blind to Zero-Day (unknown) attacks.","**Anomaly-Based Detection:** The IDS utilizes complex Machine Learning algorithms to establish a mathematical baseline of \"normal\" network traffic. If traffic violently deviates from this baseline (e.g., a server suddenly attempting to upload 10GB of data at 3 AM), the IDS triggers a massive alarm, successfully detecting Zero-Day threats."]},{"type":"heading","content":"Architectural Deployment: NIDS vs. HIDS"},{"type":"subheading","content":"1. Network-Based IDS (NIDS)"},{"type":"paragraph","content":"Deployed as a dedicated hardware appliance physically attached to a central network switch (via a SPAN/Mirror port)."},{"type":"list","items":["**Mechanism:** It operates in \"Promiscuous Mode,\" violently copying and analyzing every single packet traversing the entire corporate network.","**Merits:** Global visibility. A single NIDS can protect thousands of computers. It is mathematically invisible to hackers since it sits off the main traffic line.","**Demerits:** Catastrophic failure against Encryption. If a hacker attacks a server using HTTPS, the NIDS only sees unbreakable AES ciphertext; it cannot analyze the payload. It also struggles to process traffic on massive 100 Gbps fiber links."]},{"type":"subheading","content":"2. Host-Based IDS (HIDS)"},{"type":"paragraph","content":"Deployed as an aggressive software agent physically installed directly onto the operating system of a critical server (e.g., the master database)."},{"type":"list","items":["**Mechanism:** It ignores network packets. Instead, it violently hooks into the OS Kernel. It mathematically analyzes system calls, file integrity, CPU spikes, and Windows Registry modifications.","**Merits:** Absolute precision. HIDS operates *after* the server has decrypted the HTTPS traffic, allowing it to easily see the raw malicious SQL injection. It can detect if a hacker mathematically modified a critical system binary (`/bin/login`).","**Demerits:** Horrific administrative overhead; you must install and update the software on every single server. Furthermore, if the OS is violently compromised (Rootkit), the hacker can simply turn the HIDS software off."]}]}},{"id":"v2-information-security-systems-2024-pC-q21","number":21,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Discuss major Web Security threats including SQL Injection and Cross-Site Request Forgery (CSRF). Provide detailed countermeasures for each."}],"answer":{"summary":"A critical review of Web Application Security. Violently analyzes the catastrophic database destruction caused by SQL Injection and the psychological hijacking of CSRF, detailing the rigid mathematical countermeasures (Parameterized Queries and Anti-CSRF Tokens) required to defeat them.","explanation":[{"type":"heading","content":"Major Web Security Threats and Countermeasures"},{"type":"paragraph","content":"Web applications are the most aggressively attacked architectures on the planet. Traditional firewalls provide zero protection because the attacks utilize standard HTTP traffic over open port 443. The vulnerabilities exist entirely within the mathematical logic of the application's source code."},{"type":"heading","content":"1. SQL Injection (SQLi)"},{"type":"paragraph","content":"The absolute most catastrophic vulnerability in web history. It occurs when a web application takes raw user input and blindly concatenates it directly into a backend database SQL query without sanitization."},{"type":"subheading","content":"The Attack Mechanism"},{"type":"paragraph","content":"Assume a login script executes: `SELECT * FROM users WHERE user = '$username' AND pass = '$password'`"},{"type":"paragraph","content":"The attacker violently types the following into the username field: `' OR '1'='1`"},{"type":"paragraph","content":"The resulting executed query becomes: \n`SELECT * FROM users WHERE user = '' OR '1'='1' AND pass = ''`"},{"type":"paragraph","content":"Because the mathematical statement `1=1` is absolutely True, the database completely ignores the password check and violently dumps every single user record, granting the hacker supreme administrative access."},{"type":"subheading","content":"The Absolute Countermeasure: Parameterized Queries"},{"type":"paragraph","content":"Escaping quotes is mathematically insufficient. Engineers MUST utilize Prepared Statements (Parameterized Queries). The SQL query structure is sent to the database *first*, locked, and pre-compiled. The user input is sent *later* strictly as raw data variables. The database violently refuses to execute the input as code, rendering SQL injection mathematically impossible."},{"type":"heading","content":"2. Cross-Site Request Forgery (CSRF)"},{"type":"paragraph","content":"A highly insidious psychological and architectural attack. CSRF tricks a victim's browser into executing a malicious, unwanted action on a trusted site where the victim is currently logged in."},{"type":"subheading","content":"The Attack Mechanism"},{"type":"list","items":["1. The victim logs into `bank.com`. The bank mathematically drops a highly secure authentication Cookie into the victim's browser.","2. The victim opens a new tab and visits `evil-hacker.com`.","3. The hacker's site contains a hidden HTML image tag: `

`","4. The victim's browser sees the `` tag and attempts to fetch it. It automatically and blindly attaches the `bank.com` authentication Cookie to the HTTP request.","5. The Bank receives the valid request with a valid Cookie and violently transfers $10,000, completely destroying the victim's finances."]},{"type":"subheading","content":"The Absolute Countermeasure: Anti-CSRF Tokens"},{"type":"paragraph","content":"Cookies are architecturally flawed because they are sent automatically. The solution is the **Anti-CSRF Token** (Synchronizer Token Pattern). When the user logs in, the server generates a massive, cryptographically random, temporary mathematical string (the token) and embeds it inside a hidden field in the HTML form. When the form is submitted, the server absolutely demands the token. Because the hacker on `evil-hacker.com` cannot mathematically read the token from `bank.com` (due to the Same-Origin Policy), the forged request lacks the token, and the bank violently rejects the transaction."}]}},{"id":"v2-information-security-systems-2024-pC-q22","number":22,"marks":10,"tags":["Part C"],"text":[{"type":"paragraph","content":"Explain the Digital Signature Standard (DSS) approach. Detail the algorithm used for generating and verifying digital signatures."}],"answer":{"summary":"A massive mathematical exposition on the Digital Signature Standard (DSS). Details how the architecture utilizes the Secure Hash Algorithm and the ElGamal-based DSA to generate and verify signatures, providing absolute proof of origin and data integrity.","explanation":[{"type":"heading","content":"The Digital Signature Standard (DSS) Architecture"},{"type":"paragraph","content":"Proposed by NIST in 1991, the Digital Signature Standard (DSS) is a federal cryptographic architecture designed strictly for authenticating digital documents. Unlike RSA, which can be used for both encryption and signing, the algorithm mathematically mandated by DSS—the Digital Signature Algorithm (DSA)—is engineered *exclusively* for generating digital signatures. It is mathematically based on the extreme computational difficulty of calculating Discrete Logarithms."},{"type":"heading","content":"The Mathematical Architecture of DSA"},{"type":"paragraph","content":"The protocol requires a highly secure hash function (strictly SHA-1 or SHA-2). The signing process does NOT encrypt the message; it generates two massive 160-bit integers, $r$ and $s$, which act as the signature."},{"type":"subheading","content":"1. Global Public Key Components (System Setup)"},{"type":"list","items":["$p$: A massive prime number (1024 to 3072 bits).","$q$: A 160-bit prime divisor of $(p - 1)$.","$g$: A mathematical generator function: $g = h^{(p-1)/q} \\pmod{p}$.","These three parameters $(p, q, g)$ are public and can be shared across the entire network."]},{"type":"subheading","content":"2. User Key Generation"},{"type":"list","items":["**Private Key ($x$):** The user violently selects a random integer $x$ such that $0 < x < q$. This is kept in absolute secrecy.","**Public Key ($y$):** The user mathematically calculates $y = g^x \\pmod{p}$. The key $y$ is published."]},{"type":"heading","content":"The Execution Algorithms"},{"type":"subheading","content":"Algorithm 1: Signature Generation (Executed by the Sender)"},{"type":"paragraph","content":"To sign a message $M$:"},{"type":"list","items":["1. The sender generates a new, highly secure, one-time random integer $k$ ($0 < k < q$) for this specific message.","2. Mathematically calculate $r$: \n $$ r = (g^k \\pmod{p}) \\pmod{q} $$","3. Violently hash the message using SHA: $H(M)$.","4. Mathematically calculate $s$: \n $$ s = [k^{-1} (H(M) + x \\cdot r)] \\pmod{q} $$","5. The absolute signature is the pair of integers: **$(r, s)$**. The sender blasts the plaintext message $M$ and the signature $(r, s)$ across the network."]},{"type":"subheading","content":"Algorithm 2: Signature Verification (Executed by the Receiver)"},{"type":"paragraph","content":"The receiver has $M, r, s$ and the sender's Public Key $y$."},{"type":"list","items":["1. The receiver verifies that $r$ and $s$ are mathematically valid ($0 < r < q$ and $0 < s < q$).","2. Hash the received message: $w = s^{-1} \\pmod{q}$.","3. Calculate $u_1 = [H(M) \\cdot w] \\pmod{q}$.","4. Calculate $u_2 = (r \\cdot w) \\pmod{q}$.","5. The absolute mathematical verification step—calculate $v$:\n $$ v = [(g^{u_1} \\cdot y^{u_2}) \\pmod{p}] \\pmod{q} $$","6. **The Final Test:** If, and only if, the calculated $v$ is exactly mathematically equal to the received $r$ ($v == r$), the signature is violently validated as authentic. It proves the sender possessed the private key $x$, and that the message $M$ was not altered by a single bit during transit."]}]}}]}],"loading":false,"error":null}}}

Q7Information Security Systems

Question

Answer