Security Services

1. What Is a Security Service?

Per ITU-T X.800 (the OSI security standard, followed by Stallings Ch. 1), a security service is a processing or communication service that enhances the security of data processing systems and information transfers. It is the "what" — what protection is provided — as opposed to a security mechanism (the "how", e.g. encryption, next topic).

A service is implemented by one or more mechanisms, and is invoked at a protocol layer to counter specific attacks.

2. The Five Main Service Categories (X.800)

Stallings groups them into 5 families, subdivided further:

Service	Protects Against	Sub-types	One-line meaning
1. Authentication	Masquerade, replay	Peer-entity authentication; Data-origin authentication	Prove who you are / where data came from
2. Access Control	Unauthorized use	—	Only authorized users get resources
3. Confidentiality	Disclosure, eavesdropping	Connection, connectionless, selective-field, traffic-flow confidentiality	Keep data secret
4. Integrity	Modification, replay	Connection / connectionless, with/without recovery; selective-field	Detect/prevent alteration
5. Non-repudiation	Denial of sending/receiving	Origin non-repudiation; Destination (delivery) non-repudiation	Sender/receiver cannot later deny

3. Service-by-Service Detail

1. Authentication — "Are you really who you claim?"

Peer entity authentication: verifies identity of both parties when a connection is established (e.g. TLS handshake, SSH login, Wi-Fi WPA2-Enterprise). Provides confidence the peer is not an impostor at that moment.
Data origin authentication: verifies the source of a single message (no prior session), e.g. a digitally signed email — does NOT prove receipt or freshness by itself.
Typical mechanisms: passwords, challenge-response, biometrics, digital certificates, Kerberos tickets.

2. Access Control — "Are you allowed to do this?"

Enforces authorization policy: file permissions (read/write/execute), firewall rules, database GRANTs, RBAC/ABAC in operating systems.
Must run after authentication — you cannot authorize an unauthenticated stranger.
Example: Linux chmod 600 private.key; university portal allowing only CSE-Sem-6 students to download the CNS paper.

3. Confidentiality — "Nobody else can read it"

Connection confidentiality: all data on a session hidden (e.g. HTTPS stream).
Connectionless confidentiality: a single datagram hidden (e.g. encrypted email).
Selective-field confidentiality: only chosen fields hidden (e.g. credit-card number in a form, while name stays plain).
Traffic-flow confidentiality: hides even the existence, source, destination, length and frequency of traffic — via padding, dummy packets, onion routing (Tor). Needed because metadata alone ("General called HQ 10 times tonight") leaks intelligence.
Main mechanism: encryption (symmetric/asymmetric), covered in Topics 6–8 and Modules 2–5.

4. Integrity — "Nobody changed it in transit"

Connection integrity with recovery: detects any modification/replay/reorder on a stream and recovers (retransmit) — e.g. TCP over TLS.
Without recovery: only detects and reports (e.g. checksum alarm, abort session).
Connectionless integrity: per-datagram checksum/MAC, with optional replay detection via sequence numbers.
Selective-field integrity: protects chosen fields only (e.g. money-amount field in a banking message).
Mechanisms: hash functions, MACs, digital signatures (Module 6).

5. Non-repudiation — "You cannot deny it later"

Origin: proof the sender sent it — sender cannot falsely deny (digitally signed contract).
Destination/delivery: proof the receiver got it — receiver cannot deny receipt (signed delivery receipt, registered email).
Needs a trusted third party / notary or public-key signatures plus timestamps; symmetric MACs alone are insufficient because both parties share the key and either could have forged the tag.

4. Services vs Mechanisms vs Attacks (Exam Trap)

ATTACK (threat)        SERVICE (what)              MECHANISM (how)
eavesdropping      →   Confidentiality         →   Encryption, traffic padding
tampering          →   Integrity               →   Hash, MAC, digital signature
impersonation      →   Authentication          →   Passwords, certificates, Kerberos
unauthorized login →   Access Control          →   ACLs, firewall, RBAC
denial ("I never   →   Non-repudiation         →   Digital signature + timestamp
 sent it")

BEU frequently asks: "Define security services. Explain any four with examples." Draw the table above and expand two lines per service with one example each.

Exam Points

X.800 definition line + "service = WHAT, mechanism = HOW" — 2-mark opener.
List all 5 services with sub-types (connection vs connectionless, origin vs destination) — 5-mark theory core.
Traffic-flow confidentiality and selective-field variants are favourite 2-mark short notes.
Non-repudiation needs asymmetric signatures + TTP; MAC alone fails — classic justification question.

Security Services