The idea
The previous topic listed what attackers do. A security service is the promise you want in return, stated as something a user can check: nobody read it, nobody changed it, it really came from her, and she cannot say it did not.
A security mechanism is the technique that delivers a service. The two lists are separate on purpose, because one mechanism often serves more than one service. This topic is the map. The next four topics each take a mechanism apart.
How it works
The four services
The lecture names four services and gives each its sub-kinds and the mechanism that implements it.
Confidentiality service
- Data confidentiality: confidentiality of data is maintained between the sender and the receiver.
- Traffic flow confidentiality: confidentiality of the identities of the source and destination of the data traffic.
- Mechanism implemented: encryption.
Integrity service
- Ensures that data modification is possible for authorized parties only.
- Data integrity: ensures the data received is not modified.
- Data sequence integrity: the sequence of data blocks is not altered, repeated or missing.
- Mechanism implemented: hash functions and cryptographic checksums.
Authentication service
- Ensures the data is genuine, unaltered, complete and not an unlawful replay.
- Data origin authentication: checks that the message originates from the claimed source.
- Peer-entity authentication: provides an entity with confidence in the authenticity of a peer entity.
- Mechanism implemented: private-key and public-key based techniques, challenge-response mechanisms and timestamps.
Nonrepudiation service
- A sender must not be able to deny sending a message that he or she did send.
- Mechanism implemented: digital signatures.
How it works
The mechanisms the lecture covers
The lecture says different mechanisms cater to different services and that it will focus on a short list.
| Service | Mechanisms covered |
|---|---|
| Confidentiality | Symmetric (secret key) encryption and asymmetric (public key) encryption |
| Integrity | Hash functions and message digests |
| Authentication | Keyed hash functions and digital signatures |
Topics 3 and 4 cover the confidentiality mechanisms, topic 5 covers hashes and keyed hashes, and topic 6 covers digital signatures and entity authentication.
Where marks get lost
Authentication is wider than a login
The lecture’s authentication service covers a message (data origin) and an entity (peer-entity). Marks go to naming which one a scenario describes. Checking that a message came from the claimed source is data origin authentication. Gaining confidence that the party at the other end is who it says is peer-entity authentication.
In the exam
- Know all four services, their two sub-kinds where the lecture gives them, and the one-line definition of each.
- Pair each service with its mechanism: encryption, hash functions and cryptographic checksums, key-based techniques with challenge-response and timestamps, digital signatures.
- Integrity has the lecture’s extra phrase “not altered, repeated or missing” for sequence integrity. That wording maps directly onto modification and replaying from the attacks list.
Check yourself
- Four services: confidentiality, integrity, authentication, nonrepudiation.
- Confidentiality splits into data and traffic flow. Integrity splits into data and data sequence. Authentication splits into data origin and peer-entity.
- Encryption, hashing, key-based authentication techniques and digital signatures are the matching mechanisms.