X-800
History
Recommendation X.800 was prepared by Study Group VII and was approved under the Resolution No. 2
procedure on the 22nd of March 1991. For connection-mode data transfer, protecting the integrity of a sequence of data units (i.e. protecting against
misordering, losing, replaying and inserting or modifying data) requires additionally some form of explicit ordering such
as sequence numbering, time stamping, or cryptographic chaining. Security audit trails provide a valuable security mechanism as potentially they permit detection and
investigation of breaches of security by permitting a subsequent security audit. A security audit is an independent review
and examination of system records and activities in order to test for adequacy of system controls, to ensure compliance
General description of security services and mechanisms
1. Overview
Security services that are included in the OSI security architecture and mechanisms which implement those
services are discussed in this section. The security services described below are basic security services. In practice they
will be invoked at appropriate layers and in appropriate combinations, usually with non-OSI services and mechanisms,
to satisfy security policy and/or user requirements. Particular security mechanisms can be used to implement
combinations of the basic security services.
2. Security services
The following are considered to be the security services which can be provided optionally within the
framework of the OSI Reference Model. The authentication services require authentication information comprising
locally stored information and data that is transferred (credentials) to facilitate the authentication.
3. Authentication
These services provide for the authentication of a communicating peer entity and the source of data as
described below.
4. Peer entity authentication
This service, when provided by the (N)-layer, provides corroboration to the (N + 1)-entity that the peer entity
is the claimed (N + 1)-entity.
This service is provided for use at the establishment of, or at times during, the data transfer phase of a
connection to confirm the identities of one or more of the entities connected to one or more of the other entities. This
service provides confidence, at the time of usage only, that an entity is not attempting a masquerade or an unauthorized
replay of a previous connection.
5. Data origin authentication
This service, when provided by the (N)-layer, provides corroboration to an (N + 1)-entity that the source of the
data is the claimed peer (N + 1)-entity.
The data origin authentication service provides the corroboration of the source of a data unit. The service does
not provide protection against duplication or modification of data units.
6. Access control
This service provides protection against unauthorized use of resources accessible via OSI. These may be OSI
or non-OSI resources accessed via OSI protocols. This protection service may be applied to various types of access to a
resource (e.g., the use of a communications resource; the reading, the writing, or the deletion of an information resource;
the execution of a processing resource) or to all accesses to a resource.
The control of access will be in accordance with various security policies (see § 6.2.1.1).
7. Data confidentiality
These services provide for the protection of data from unauthorized disclosure as described below.
Recommendation X.800 9
8. Connection confidentiality
This service provides for the confidentiality of all (N)-user-data on an (N)-connection.
Note – Depending on use and layer, it may not be appropriate to protect all data, e.g. expedited data or data in
a connection request.
9. Connectionless confidentiality
This service provides for the confidentiality of all (N)-user-data in a single connectionless (N)-SDU.
10. Selective field confidentiality
This service provides for the confidentiality of selected fields within the (N)-user-data on an (N)-connection or
in a single connectionless (N)-SDU.
11. Traffic flow confidentiality
This service provides for the protection of the information which might be derived from observation of traffic flows.
12. Data integrity
These services counter active threats and may take one of the forms described below.
Note – On a connection, the use of the peer entity authentication service at the start of the connection and the
data integrity service during the life of the connection can jointly provide for the corroboration of the source of all data
units transfered on the connection, the integrity of those data units, and may additionally provide for the detection of
duplication of data units, e.g. by the use of sequence numbers.
13. Connection integrity with recovery
This service provides for the integrity of all (N)-user-data on an (N)-connection and detects any modification,
insertion, deletion or replay of any data within an entire SDU sequence (with recovery attempted).
14. Connection integrity without recovery
As for Connection integrity with recovery but with no recovery attempted.
15 Selective field connection integrity
This service provides for the integrity of selected fields within the (N)-user data of an (N)-SDU transferred
over a connection and takes the form of determination of whether the selected fields have been modified, inserted,
deleted or replayed
RFC 2828
Introduction
This Glossary provides an internally consistent, complementary set of
abbreviations, definitions, explanations, and recommendations for use
of terminology related to information system security. The intent of
this Glossary is to improve the comprehensibility of Internet
Standards documents (ISDs)--i.e., RFCs, Internet-Drafts, and other
material produced as part of the Internet Standards Process [R2026]--
and of all other Internet material, too.
RFC 2828 Internet Security Glossary May 2000
This Glossary supports the goals of the Internet Standards Process:
o Clear, Concise, and Easily Understood Documentation
This Glossary seeks to improve comprehensibility of security-
related content of ISDs. That requires wording to be clear and
understandable, and requires the set of security-related terms and
definitions to be consistent and self-supporting. Also, the
terminology needs to be uniform across all ISDs; i.e., the same
term or definition needs to be used whenever and wherever the same
concept is mentioned.
Definitions
Note: Each acronym or other abbreviation (except items of common
English usage, such as "e.g.", "etc.", "i.e.", "vol.", "pp.", "U.S.")
that is used in this Glossary, either in a definition or as a subpart
of a defined term, is also defined in this Glossary.
$ 3DES
See: triple DES.
$ *-property
(N) (Pronounced "star property".) See: "confinement property"
under Bell-LaPadula Model.
o Paragraph Marking: Definitions and explanations are stated in
paragraphs that are marked as follows:
- "I" identifies a RECOMMENDED Internet definition.
- "N" identifies a RECOMMENDED non-Internet definition.
- "O" identifies a definition that is not recommended as the first
choice for Internet documents but is something that authors of
Internet documents need to know.
- "D" identifies a term or definition that SHOULD NOT be used in
Internet documents.
- "C" identifies commentary or additional usage guidance.
The rest of Section 2 further explains these five markings.
1. Recommended Terms with an Internet Basis ("I")
The paragraph marking "I" (as opposed to "O") indicates a definition
that SHOULD be the first choice for use in ISDs. Most terms and
definitions of this type MAY be used in ISDs; however, some "I"
definitions are accompanied by a "D" paragraph that recommends
against using the term.
An "I" (as opposed to an "N") also indicates that the definition has
an Internet basis. That is, either the Internet Standards Process is
authoritative for the term, or the term is sufficiently generic that
this Glossary can freely state a definition without contradicting a
non-Internet authority (e.g., see: attack).
An "I" (as opposed to an "N") also indicates that the definition has
an Internet basis. That is, either the Internet Standards Process is
authoritative for the term, or the term is sufficiently generic that
this Glossary can freely state a definition without contradicting a
non-Internet authority (e.g., see: attack).
2. Other Definitions ("O")
The paragraph marking "O" indicates a definition that has a non-
Internet basis, but indicates that the definition SHOULD NOT be used
in ISDs *except* in cases where the term is specifically identified
as non-Internet.
3. Deprecated Terms, Definitions, and Uses ("D")
If this Glossary recommends that a term or definition SHOULD NOT be
used in ISDs, then either the definition has the paragraph marking
"D", or the restriction is stated in a "D" paragraph that immediately
follows the term or definition.
4. Commentary and Additional Guidance ("C")
The paragraph marking "C" identifies text that is advisory or
tutorial. This text MAY be reused in other Internet documents. This
text is not intended to be authoritative, but is provided to clarify
the definitions and to enhance this Glossary so that Internet
security novices can use it as a tutorial.
Introduction
This Glossary provides an internally consistent, complementary set of
abbreviations, definitions, explanations, and recommendations for use
of terminology related to information system security. The intent of
this Glossary is to improve the comprehensibility of Internet
Standards documents (ISDs)--i.e., RFCs, Internet-Drafts, and other
material produced as part of the Internet Standards Process [R2026]--
and of all other Internet material, too.
RFC 2828 Internet Security Glossary May 2000
This Glossary supports the goals of the Internet Standards Process:
o Clear, Concise, and Easily Understood Documentation
This Glossary seeks to improve comprehensibility of security-
related content of ISDs. That requires wording to be clear and
understandable, and requires the set of security-related terms and
definitions to be consistent and self-supporting. Also, the
terminology needs to be uniform across all ISDs; i.e., the same
term or definition needs to be used whenever and wherever the same
concept is mentioned.
Definitions
Note: Each acronym or other abbreviation (except items of common
English usage, such as "e.g.", "etc.", "i.e.", "vol.", "pp.", "U.S.")
that is used in this Glossary, either in a definition or as a subpart
of a defined term, is also defined in this Glossary.
$ 3DES
See: triple DES.
$ *-property
(N) (Pronounced "star property".) See: "confinement property"
under Bell-LaPadula Model.
o Paragraph Marking: Definitions and explanations are stated in
paragraphs that are marked as follows:
- "I" identifies a RECOMMENDED Internet definition.
- "N" identifies a RECOMMENDED non-Internet definition.
- "O" identifies a definition that is not recommended as the first
choice for Internet documents but is something that authors of
Internet documents need to know.
- "D" identifies a term or definition that SHOULD NOT be used in
Internet documents.
- "C" identifies commentary or additional usage guidance.
The rest of Section 2 further explains these five markings.
1. Recommended Terms with an Internet Basis ("I")
The paragraph marking "I" (as opposed to "O") indicates a definition
that SHOULD be the first choice for use in ISDs. Most terms and
definitions of this type MAY be used in ISDs; however, some "I"
definitions are accompanied by a "D" paragraph that recommends
against using the term.
An "I" (as opposed to an "N") also indicates that the definition has
an Internet basis. That is, either the Internet Standards Process is
authoritative for the term, or the term is sufficiently generic that
this Glossary can freely state a definition without contradicting a
non-Internet authority (e.g., see: attack).
An "I" (as opposed to an "N") also indicates that the definition has
an Internet basis. That is, either the Internet Standards Process is
authoritative for the term, or the term is sufficiently generic that
this Glossary can freely state a definition without contradicting a
non-Internet authority (e.g., see: attack).
2. Other Definitions ("O")
The paragraph marking "O" indicates a definition that has a non-
Internet basis, but indicates that the definition SHOULD NOT be used
in ISDs *except* in cases where the term is specifically identified
as non-Internet.
3. Deprecated Terms, Definitions, and Uses ("D")
If this Glossary recommends that a term or definition SHOULD NOT be
used in ISDs, then either the definition has the paragraph marking
"D", or the restriction is stated in a "D" paragraph that immediately
follows the term or definition.
4. Commentary and Additional Guidance ("C")
The paragraph marking "C" identifies text that is advisory or
tutorial. This text MAY be reused in other Internet documents. This
text is not intended to be authoritative, but is provided to clarify
the definitions and to enhance this Glossary so that Internet
security novices can use it as a tutorial.
