the password to the internal subpage sent over Edukacja
RBAC test on 5.11.2019, follow up solution deadline: 13.11.2019 (printout or pdf by email)
GDPR assignment due on January 19 (sunset), for assignment details see below
exam:
the date and place for the exam is the following:
4.02.2020, 10-12, room 312b/D-1
the 2nd chance:
10.02.2019, 10-12, room 312b/D-1
on the internal page there is some preparatory material for
the exam. Please solve these problems!
Topics finished:
access control
Common Criteria
FIPS 140-3
DRNG according to NIST, the story of Dual EC
RFC
eIDAS
PKI systems
hardware Trojans
quantum cryptography
SSL and TLS attacks
forging certificate
cache attacks
Assignments:
GDPR:
Consider the following business case. The company PWR-ID offers services concerning
confirmation of identity of students for third parties. The target process is the
following one:
a client (a student) requests the service from PWR-ID and provides
his necessary identification data,
PWR-ID performs a check that the client is indeed a student at PWr,
the procedure involves three tests: clients's access to the mailbox at PWr, client's access
to Edukacja (e.g. via a message sent over Edukacja), validity of the client's student ID
(based on the certificate verification)
PWR-ID issues a digitally signed certificate stating that the client is a student
the client pays a fee and gets the certificate
While organizing such a business a web service is trivial from the technical point of view,
you have to find out how to satisfy the requirements of the GDPR regulation.
The answer should be a list of relevant requirements and for each requirements a chosen concrete
solution demonstrating that the requirement will be satisfied.
Please start with a concise description of the technical architecture applied by PWR-ID.
The solution will be accepted iff ALL requirements are properly addressed.