试题解析：安全应用程序要依靠大家的力量去编制，并在一定许可条件下使用，才能确保安全，不是由信息安全管理员来编制。

信息安全管理员的职责包括对网络的总体安全布局进行规划，对信息系统安全事件进行处理，对安全设备进行优化配置等职责。为用户编写安全应用程序不属于信息安全管理员的职责范围。

试题解析：密钥协商算法使用ECDH密码算法。

无线局域网产品必须使用的系列密码算法是国内公布的第一个商用密码算法系列，其中ECDSA和ECDH密码算法必须采用国家密码管理局指定的椭圆曲线和参数。

国家密码管理局于2006年发布了“无线局域网产品须使用的系列密码算法”，包括对称密码算法：SMS4；签名算法：ECDSA；密钥协商算法：ECDH；杂凑算法：SHA-256；随机数生成算法等。

试题解析：木桶原则

（1）is the science of hiding information. Whereas the goal of cryptography is to make data unreadable by a third party. the goal of steganography is to hide the data from a third party. In this article, I will discuss what steganography is, what purposes it serves, and will provide an example using available software.

There are a large number of steganographic （2）that most of us are familiar with (especially if you watch a lot of spy movies), ranging from invisible ink and microdots to secreting a hidden message in the second letter of each word of a large body of text and spread spectrumradio communication. With computers and networks, there are many other ways of hiding informations, such as:Covert channels (c,g, Loki and some distributed denial-of-service toolsuse the Internet Control （3）Protocol, or ICMP, as the communicationchannel between the “bad guy”and a compromicyed system)

Hidden text within Web pages Hiding files in “plain sight”(c,g. what better place to “hide”a file than with an important sounding name in the c:\winnt system32 directory)

Null ciphers(c,g, using the first letter of each word to form a hidden message in an otherwise innocuous text)steganography today, however, is significantly more （4）than the example about suggest, allowing a user to hide large amounts of information within image and audio. These forms of steganography of tenare used in conjunction with cryptography so the information is double

protected; first it is encrypted and then hidden so that an advertisement first. find the information ( an often difficult task in and of itself) and the decrypted it.

The simplest approach to hiding data within an image file is called（5）signature insertion. In this method, we can take the binary representation of the hidden data and the bit of each byte within the covert image. If we are using 24-bit color the amount and will be minimum and indiscriminate to the human eye.

（1）A、Cryptography B、Geography C、Stenography D、Steganography

（2）A、methods B、software C、tools D、services

（3）A、Member B、Management C、Message D、Mail

（4）A、powerful B、sophistication C、advanced D、easy

（5）A、least B、most C、much D、less

正确答案：D、A、C、A、A

试题解析：

隐写术是一门隐藏信息的科学。而密码学的目标是让第三方无法读取数据。隐写术的目标是从第三方隐藏数据。在这篇文章中，我将讨论隐写术是什么，它的作用是什么，并将提供一个使用现有软件的例子。

有许多我们大多数人都熟悉的隐写术方法（特别是如果你看了很多间谍电影），从看不见的墨水和微粒到在第二个隐藏信息的隐藏。每个字的字母都是一个大正文，传播频谱和无线电通信。在计算机和网络中，隐藏信息的方法有很多，例如：隐藏通道（C、G、Loki和一些分布式拒绝服务工具，如Internet控制消息协议，或ICMP，作为“坏人”和复杂系统之间的通信通道）隐藏网页中的文本隐藏在“清晰可见”的文件中。“（c，g.在c:\winnt system32目录中有一个听起来很重要的名字，“隐藏”一个文件的最佳位置）空密码（c，g，使用每个单词的第一个字母在其他无害的文本中形成一个隐藏的信息），然而，今天的隐写术比建议的例子要强大得多，允许用户隐藏lar图像和音频中的GE信息量。泰纳的这些形式的隐写术与密码学结合使用，因此信息是双重保护的；首先它是加密的，然后是隐藏的，以便广告首先。找到信息（通常是很困难的任务）并对其进行解密。

在图像文件中隐藏数据的最简单方法称为最小签名插入。在这种方法中，我们可以取隐藏数据的二进制表示和隐藏图像中每个字节的位。如果我们使用的是24位颜色，那么对人眼来说，它的量是最小的，也是不加区别的。

试题解析：1985年美国国防部公布了《美国国防部可信计算机系统评估系统TCSEC》，分为四组七个等级：具体为D、C（C1、C2）、B（B1、B2、B3）和A（1），安全级别从左到右逐步提高，各级间向下兼容。

D级别是最低的安全级别，对系统提供最小的安全防护。系统的访问控制没有限制，无需登陆系统就可以访问数据，这个级别的系统包括DOS，WINDOWS98等。

C级别有两个子系统，C1级和C2。 C1级称为选择性保护级（Discrtionary Security Protection）可以实现自主安全防护，对用户和数据的分离，保护或限制用户权限的传播。 C2级具有访问控制环境的权力，比C1的访问控制划分的更为详细，能够实现受控安全保护、个人帐户管理、审计和资源隔离。这个级别的系统包括UNIX、LINUX和WindowsNT系统。C级别属于自由选择性安全保护，在设计上有自我保护和审计功能，可对主体行为进行审计与约束。

B级别包括B1、B2和B3三个级别，B级别能够提供强制性安全保护和多级安全。强制防护是指定义及保持标记的完整性，信息资源的拥有者不具有更改自身的权限，系统数据完全处于访问控制管理的监督下。B1级称为标识安全保护（Labeled Security Protection）。 B2级称为结构保护级别（Security Protection），要求访问控制的所有对象都有安全标签以实现低级别的用户不能访问敏感信息，对于设备、端口等也应标注安全级别。 B3级别称为安全域保护级别（Security Domain），这个级别使用安装硬件的方式来加强域的安全，比如用内存管理硬件来防止无授权访问。

A级别只有A1,这一级别，A级别称为验证设计级（Verity Design），是目前最高的安全级别，在A级别中，安全的设计必须给出形式化设计说明和验证，需要有严格的数学推导过程，同时应该包含秘密信道和可信分布的分析，也就是说要保证系统的部件来源有安全保证，例如对这些软件和硬件在生产、销售、运输中进行严密跟踪和严格的配置管理，以避免出现安全隐患。

There are different ways to perform IP based DoS Attacks. The most common IP based DoS attack is that an attacker sends an extensive amount of connection establishment （1）(e.g. TCP SYN requests) to establish hanging connections with the controller or a DPS. Such a way, the attacker can consume the network resources which should be available for legitimate users. In other （2）, the attacker inserts a large amount of （3）packets to the data plane by spoofing all or part of the header fields with random values. These incoming packets will trigger table-misses and send lots of packet-in flow request messages to the network controller to saturate the controller resources. In some cases, an （4）who gains access to DPS can artificially generate lots of random packet-in flow request messages to saturate the control channel and the controller resources. Moreover, the lack of diversity among DPSs fuels fuels the fast propagation of such attacks.Legacy mobile backhaul devices are inherently protected against the propagation of attacks due to complex and vendor specific equipment. Moreover, legacy backhaul devices do not require frequent communication with core control devices in a manner similar to DPSs communicating with the centralized controller. These features minimize both the impact and propagation of DoS attacks. Moreover, the legacy backhaul devices are controlled as a joint effort of multiple network element. For instance, a single Long Term Evilution（LTE）eNodeB  is connected up to 32 MMEs. Therefore, DoS/DDoS attack on a single core element will not terminate the entire operation of a backhaul device（5）the net work.

（1）A.message  B、information  C、requests  D、data

（2）A.methods  B、cases       C、hands    D、sections

（3）A.bad      B、real        C、fake      D、new

（4）A.user     B、administrator  C、editor   D、attacker

（5）A.or       B、of          C、in        D、to

Trustis typically interpreted as a subjective belief in the reliability， honesty and  security  of an entity on which we depend （71）our welfare .In online environments we depend on a wide spectrun of things , ranging from computer hardware,software and data to people and organizations. A security solution always assumescertain entities function according to specific policies.To trust is precisely to make this sort of assumptions , hence , a trusted entity is the same as anentity that is assumed to function according to policy . A consequence of this is that a trust component of a systemmust work correctly in order  for the security of that system to hold, meaning that when a trusted（72）fails , then the sytems and applications that depend on  it can（73）be considered secure . An often citedarticulation of this principle is:＂ a trusted system orcomponent is one that can break your security policy” ( which happens when thetrust system fails ). The same applies to a trusted party such as a serviceprovider ( SP for short )that is , it must operate according to the agreed orassumed  policy in order to ensure theexpected level of securty and quality of services . A paradoxical   conclusion to be drawn from this analysis isthat security assurance may decrease when increasing the number of trustedcomponents and parties that a service infrastructure depends on . This isbecause the security of an infrastructure consisting of many Trusted componentstypically follows the principle of the weakest link , that is ,in manysituations the the overall security can only be as strong as the least   reliable or least secure of all the trustedcomponents. We cannot avoid using trusted security  components,but the fewer the better. This isimportant to understand when designing the identity management architectures,that is, fewer the trusted parties inan identity management     model ,stronger the security that can be achieved by it .

Thetransfer of the social constructs of identity and trust into digital  and computational concepts helps in designingand implementing large scale online markets and communities,and also plays animportant role in the converging mobile and Internet environments .   Identity management (denoted Idm hereafter )is about recognizing and verifying the correctness of identitied in online environment .Trust management becomes a component of （74） whenever different parties rely on each other for identityprovision and authentication . IdM and Trust management therefore depend oneach other in complex ways because the correctness of the identity itself mustbe trusted for the quality and reliability of the corresponding entity tobe  trusted.IdM is also an essentialconcept when defining  authorisationpolicies in personalised services.

Establishing trust always has a cost , so thathaving  complex trust requirementtypically leads to high overhead in establishing the required trust . To reducecosts there will be  incentives forstakeholders to “cut corners”regarding trust requirements ,which could lead toinadequate security . The challenge is to design IdM systems with relativelysimple trust requirements. Cryptographic mechanisms are often a core componentof IdM solutions,for example,for entity and data authentication. Withcryptography,it is often possible to propagate trust from where it initiallyexists to where it is needed .The establishment of initial（75）usually takes place in the physicalworld,and the subsequent propagation of trust happens online,often in anautomated manner.

71、 A .with  B. on  C. of   D. for

72、A. entity   B. person C. component   D. thing

73、A. no longer   B. never   C. always  D. often

74、A. SP   B. IdM  C. Internet     D. entity

75、A. trust  B. cost C.  IdM    D. solution

2019年上半年上午真题

1、《中华人民共和国网络安全法》第五十八条明确规定，因维护国家安全和社会公共秩序，处置重大突发社会安全事件的需要，经（  ）决定或者批准，可以在特定区域对网络通信采取限制等临时措施。

A.国务院

B.国家网信部门

C.省级以上人民政府

D.网络服务提供商

3、 BS7799标准是英国标准协会制定的信息安全管理体系标准，它包括两个部分：《信息安全管理实施指南》和《信息安全管理体系规范和应用指南》。依据该标准可以组织建立、实施与保持信息安全管理体系，但不能实现（  ）。

A.强化员工的信息安全意识，规范组织信息安全行为

B.对组织内关键信息资产的安全态势进行动态监测

C.促使管理层坚持贯彻信息安全保障体系

D.通过体系认证就表明体系符合标准，证明组织有能力保障重要信息

5、等级保护制度已经被列入国务院《关于加强信息安全保障工作的意见》之中。以下关于我国信息安全等级保护内容描述不正确的是（  ）。

A.对国家秘密信息、法人和其他组织及公民的专有信息以及公开信息和存储、传输和处理这些信息的信息系统分等级实行安全保护

B.对信息系统中使用的信息安全产品实行按等级管理

C.对信息系统中发生的信息安全事件按照等级进行响应和处置

D.对信息安全从业人员实行按等级管理，对信息安全违法行为实行按等级惩处

8、对于提高人员安全意识和安全操作技能来说，以下所列的安全管理方法最有效的是 （  ）。

A.安全检查

B.安全教育和安全培训

C.安全责任追究

D.安全制度约束

10、下面对国家秘密定级和范围的描述中，不符合《中华人民共和国保守国家秘密法》要求的是（  ）。

A.对是否属于国家和属于何种密级不明确的事项，可由各单位自行参考国家要求确定和定级，然后报国家保密工作部门备案

B.各级国家机关、单位对所产生的秘密事项，应当按照国家秘密及其密级的具 体范围的规定确定密级，同时确定保密期限和知悉范围

C.国家秘密及其密级的具体范围，由国家行政管理部门分别会同外交、公安、 国家安全和其他中央有关机关规定

D.对是否属于国家和属于何种密级不明确的事项，由国家保密行政管理部门， 或省、自治区、直辖市的保密行政管理部门确定

58、在我国，依据《中华人民共和国标准化法》可以将标准划分为：国家标准、行业 标准、地方标准和企业标准4个层次。《信息安全技术信息系统安全等级保护基本要求》 （GB/T 22239-2008）属于(  )。

A.国家标准

B.行业标准

C.地方标准

D.企业标准

68如果对一个密码体制的破译依赖于对某一个经过深入研究的数学难题的解决，就认为相应的密码体制是（  ）的。

A.计算安全

B.可证明安全

C.无条件安全

D.绝对安全

71-75、The modern study of symmetric-key ciphers relates mainly to the study of block ciphers and stream ciphers and to their applications. A block cipher is, in a sense, a modern embodiment of Alberti’s polyalphabetic cipher: block ciphers take as input a block of （71 ）and a key, and output a block of ciphertext of the same size. Since messages are almost always longer than a single block, some method of knitting together successive blocks is required. Several have been developed, some with better security in one aspect or another than others. They are the mode of operations and must be carefully considered when using a block cipher in a cryptosystem.

The Data Encryption Standard (DES) and the Advanced Encryption Standard (AES) are( 72 )designs which have been designated cryptography standards by the US government (though DES’s designation was finally withdrawn after the AES was adopted). Despite its deprecation as an official standard, DES (especially its still-approved and much more secure triple-DES variant) remains quite popular; it is used across a wide range of applications, from ATM encryption to e-mail privacy and secure remote access. Many other block ciphers have been designed and released, with considerable variation in quality. Many have been thoroughly broken. See Category: Block ciphers.

Stream ciphers, in contrast to the ‘block’type, create an arbitrarily long stream of key material, which is combined ( 73 )the plaintext bit-by-bit or character-by-character, somewhat like the one-time pad. In a stream cipher, the output( 74 )is created based on an internal state which changes as the cipher operates. That state change is controlled by the key, and, in some stream ciphers, by the plaintext stream as well. RC4 is an example of a well-known, and widely used, stream cipher; see Category: Stream ciphers.

Cryptographic hash functions (often called message digest functions) do not necessarily use keys, but are a related and important class of cryptographic algorithms. They take input data (often an entire message), and output a short fixed length hash, and do so as a one-way function. For good ones, ( 75 ) (two plaintexts which produce the same hash) are extremely difficult to find.

Message authentication codes (MACs) are much like cryptographic hash functions, except that a secret key is used to authenticate the hash value on receipt. These block an attack against plain hash functions.

（71）A.plaintext

B.ciphertext

C.data

D.hash

（72）A.stream cipher

B.hash function

C.Message authentication code

D.Block cipher

（73）A.of

B.for

C.with

D.in

（74）A.hash

B.stream

C.ciphertext

D.plaintext

（75）A.collisons

B.image

C.preimage

D.solution