The security mechanisms defined in X.800 are categorized into those implemented in specific protocol layers, such as TCP or an application layer, and those that are not tied to any specific protocol layer or security service. These mechanisms will be detailed throughout the book. However, it's essential to note the distinction X.800 makes between reversible and irreversible encipherment mechanisms. A reversible encipherment mechanism is an encryption algorithm that enables data to be encrypted and later decrypted. Irreversible encipherment mechanisms include hash algorithms and message authentication codes used in digital signatures and message authentication applications.
Specific Security Mechanisms
These mechanisms may be incorporated into the appropriate protocol layer to provide some of the OSI security services:
- Encipherment: Uses mathematical algorithms to transform data into an unintelligible form. The data's transformation and recovery depend on an algorithm and encryption keys.
- Digital Signature: Data or a cryptographic transformation of a data unit that allows the recipient to verify the data unit's source and integrity, protecting against forgery.
- Access Control: Mechanisms enforcing access rights to resources.
- Data Integrity: Mechanisms ensuring the integrity of data units or data streams.
- Authentication Exchange: Verifies an entity's identity through information exchange.
- Traffic Padding: Inserts bits into data stream gaps to prevent traffic analysis.
- Routing Control: Selects secure routes for data and allows routing changes, especially when a security breach is suspected.
- Notarization: Uses a trusted third party to verify specific properties of a data exchange.
Pervasive Security Mechanisms
These mechanisms are not specific to any OSI security service or protocol layer: Trusted Functionality: Ensures operations are correct according to security policies. Security Label: Marks a resource with its security attributes. Event Detection: Detects security-relevant events.
Security Audit Trail: Collects data for security audits, which are independent reviews of system records and activities. Security Recovery: Manages event handling and takes recovery actions. Relationship Between Security Services and Mechanisms Table 1.4 from X.800 illustrates the relationship between security services and mechanisms, showing how services like peer entity authentication, data-origin authentication, confidentiality, and data integrity interact with mechanisms such as encipherment, digital signatures, access control, and more.
0 Comments