Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Archi > Security and Privacy in the IoT > Flashcards

Security and Privacy in the IoT Flashcards

1
Q

Privacy vs. Security

What is security? What is privacy? (or its goal)

A

Security - protect the data
Privacy - protect the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Issues with the IoT systems (4)

A

Hardware heterogeneity
Limited resources
Big data generation
Need for complex data protection and access measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Hierarchical IoT System (and give the 3 layers)

A
  • Application layer - Applications/Services, Operation and Management
  • Transportation later - Access Network
  • Perception layer - WSN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

“The quality or state of being secure- to be free from danger”

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A successful organization should have multiple layers of security in place: (6)

A

Physical security
Personal security
Operations security
Communications security
Network security
Information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The protection of information and its critical elements, including systems and hardware that use, store, and transmit information.

Give its necessary tools (5)

A

Information security

Necessary tools:
- policy
- awareness
- training
- education
- technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security Concepts

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CIA TRIAD

________ - To ensure protection against unauthorized access to or use of confidential information

________ - To ensure that information and vital services are accessible for use when required

________- To ensure the accuracy and completeness of information to protect business processes

A

Confidentiality-Integrity-Availability (CIA)

  1. Confidentiality
  2. Availability
  3. Integrity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which should weigh more security or usability?

A

usability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why learn IoT security from payment industry?

IoT systems face the same problems as ___________ faced before
- Initial design was for private point to point network the moved to _______ and later on the ______
- Started with basic security then found the security flaws and attached more complex security requirements later
- Low security devices from early design are still out there and used in compatible _________

A

card payment systems
IP network; internet
fall-back mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

model of payment ecosystem and who are involved

A

Four-Party Model

  • consumer
  • merchant
  • issuing bank
  • acquiring bank
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Simplified Authorization Flow for Card Payment

  1. The customer make a payment. Enter cardholder data into the__________ (POS, e-commerce website).
  2. The merchant sends card data to an ________ who will route data to through the payments system for processing. For e-commerce, a _______ may redirect website to the acquirer.
  3. The __________ sends the data to Payment brand.
  4. __________ forwards the data to the issuer. The _______ verifies and make approval. For e-commerce, a payment gateway may redirect website to the issuer (ex. Verified by ______)
  5. If the issuer agrees to fund the purchase, it will generate __________ and routes back to the card brand.
  6. Payment brand forwards the authorization code back to acquirer/processor.
  7. The acquirer/processor sends the authorization code back to the merchant.
  8. The _______ concludes the sale with the customer.
A
  1. merchant payment system
  2. acquirer/payment processor, payment gateway
  3. acquirer/processor
  4. Payment brand; issuer; VISA
  5. authorization number
  6. merchant
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

________ standard size (normally ID-1) card that has embedded integrated circuit with microprocessor

A

ISO/IEC 7810

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What can a smart card provide? (4)

A

personal identification
authentication
data storage
application processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

There are different designs or types of smart cards such as: (3)

A
  • Contact smart card - ISO/IEC 7816
  • Contactless smart card - ISO/IEC 14443
  • Hybrid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Inside a smart card (7)

A

CPU
Security logic
Serial I/O Interface
Test Logic
ROM
RAM
EEPROM

17
Q
  • microprocessor
  • cryptographic co-processors
  • random number generator
A

CPU

18
Q

Detects abnormal condition (e.g. low voltage)

A

security logic

19
Q

contacts the outside world

A

serial I/O interface

20
Q

Self-test procedure

A

test logic

21
Q

Basic Security Feature

Hardware (5)
Software (5)

A

Hardware
- closed package
- memory encapsulation
- fuses
- security logic (sensors)
- cryptographic co-processors and random generator

Software
- decoupling applications and operating system
- application separation (Java card)
- restricted file access
- life cycle control
- various cryptographic algorithms and protocols

22
Q

The two primary types of smart card operating systems are: (2)

A

Fixed File Structure
Dynamic Application

23
Q

What Card OS?

  • files and permissions are set in advances by the issuer
  • seldom used for payment cards
A

Fixed File Structure

24
Q

What Card OS?

  • enables developers to build, test, and deploy different card application securely
  • updates and security are able to be downloaded and dynamically changed
  • ________ and _______ are the two main OS standards
A

Dynamic Application
- MULTOS and JavaCard

25
Q
  • A standard, flexible tool box
  • a known language and an easy tool for applet developers in cards
  • requires the addition of Global Platform (or similar) to manage the card and its applets
A

JavaCard

26
Q
  • a turn key system
  • comes as a complete package for cards issuers, with its certification authority, language, tools and personalization process
  • global platform is possible
A

MULTOS

27
Q
  • also known as a point of sale terminal, credit card terminal, EFTPOS terminal, Electronics Data Capture (EDC)
A

Payment terminal

28
Q

a device which interfaces with payment cards to make electronic fund transfers

A

Payment terminal

29
Q
  • A technical standard for smart payment cards and for payment terminals and automated teller machines (ATM)
A

EMV

30
Q

The initiative for EMV was taken by _________, __________ and ______ in the 1990s (now managed by EMVCe)

A

Europay, Mastercard and Visa

31
Q

support both ISO/IEC 7816 for contact cards, and standards based on ISO/IEC 14443 for contactless cards (MasterCard Contactless, Paywave, Expresspay)

A

EMV

32
Q

EMV current version

A

4.3

33
Q

EMV consist of four books

________ - application and independent ICC to Terminal Interface Requirements
_______ - security and key management
_______ - application specification
_______ - cardholder, attendant, and acquirer interface requirements

A

Book 1
Book 2
Book 3
Book 4

34
Q
A

Archi (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions