January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
382
｜
第
12
章
API
，以及终端节点进行交互。客户系统上的处理将会很频繁，通常用标准的
格式（如
HTML
、
XML
和
JSON
）并利用
HTTP
协议进行数据传送。
以下是表示层使用的两类协议：
• TLS
：通过
HTTPS
为传输层提供安全。
• HTTP
：包含了支持流和状态跟踪特征。
图
12-4
描述了一个本机
Apple iOS
应用，使用传输层安全协议
TLS
与
Web
服务器和后端应用逻辑安全地交互。本例中，
JSON
数据利用
HTTP
协议在对
等点之间进行传输。
服务器
可靠的
TLS
通道
图 12-4：一个 iOS 应用中使用的协议和数据格式
传输层安全协议
TLS
如第
11
章中所描述的，
TLS
提供以下优势：
•
通过非对称加密认证和数字证书实现认证。
•
通过非对称加密实现保密性。
•
通过
HMAC
和认证密码实现完整性。
安全性依赖于客户端和服务器的配置（例如数学基础是合理的，但实施的过
程有瑕疵）。这里有一个实例，由于
Apple OS X
和
iOS
的瑕疵，使得系统遭
受了
MITM
攻击。
注
2
注 2： Adam Langley, “Apple’s SSL/TLS Bug”, Imperial Violet Blog, February 22, 2014.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.