Who may open the door?
A school has a staff room. Teachers have a key. Students do not. The office has a safe. Only the head teacher has that key.
Software needs the same. Not every user may do everything. And if a thief steals the data, the data should be unreadable to them.
These are the two jobs of this lesson: control who gets in, and hide the data.
Key words
| Word | What it means |
|---|---|
| Authentication | Checking who somebody is, for example with a password. |
| Authorisation | Deciding what a person may do after we know who they are. |
| Role | A named set of permissions, such as student or teacher. |
| Least privilege | Give each person only the access they need, and no more. |
| Encryption | Scrambling data with a key so that only the right people can read it. |
| Hashing | Turning data into a fixed code that cannot be turned back. |
| Salt | Extra random text added to a password before hashing. |
| Key | A secret value used to lock (encrypt) and unlock (decrypt) data. |
| Cipher | A rule for scrambling text, such as moving every letter forward by 3. |
| Plaintext | Data that anybody can read. It is not scrambled. |
The cells students fill in are left blank in this preview.
Control user access
Two questions come in order.
Authentication: who are you? A password, a code or a fingerprint answers it.
Authorisation: what may you do? A role answers it. A student may read. A teacher may read and write. An admin may also delete.
The rule of least privilege says: give the smallest access that does the job.
Try it: check a role
ROLES = {"student": {"read"}, "teacher": {"read", "write"}}
def has_access(role, action):
return action in ROLES.get(role, set())
print(has_access("student", "read"))
print(has_access("student", "write"))
print(has_access("visitor", "read"))
# Add an admin role that can also delete.
A role table
| Role | Read | Write | Delete |
|---|---|---|---|
| student | Yes | No | No |
| teacher | Yes | Yes | No |
| admin | Yes | Yes | Yes |
The cells students fill in are left blank in this preview.
Quick check: who and what
Have a go
Quick check: who and what
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Encrypt data
Encryption scrambles data with a key. Only somebody with the right key can read it.
Use it in two places. In transit: data moving over a network (computers joined together), which is what HTTPS does. At rest: data saved on a disk or in a database (an organised store of data).
Two kinds of key
| Kind | How many keys | Simple picture | Used for |
|---|---|---|---|
| Symmetric | One key locks and unlocks | One house key that both of you copy | Encrypting files and the data in a session |
| Asymmetric | A public key locks, a private key unlocks | A letter box: anybody posts a letter, only you have the key to open it | Starting a safe HTTPS connection |
The cells students fill in are left blank in this preview.
Try it: a toy cipher
def shift(text, n):
out = ""
for ch in text:
if "a" <= ch <= "z":
out += chr((ord(ch) - ord("a") + n) % 26 + ord("a"))
else:
out += ch
return out
secret = shift("hello", 3)
print(secret)
print(shift(secret, -3))
# This toy is NOT secure. Anybody can try all 25 shifts.