Security Mechanisms
1. What Is a Security Mechanism? (X.800 View)
A security mechanism is the how — a process or device designed to detect, prevent, or recover from a security attack. X.800 (Stallings Ch.1) splits them into two groups:
Security Mechanisms (X.800)
├── Specific Security Mechanisms (built into a layer/service)
│ ├── Encipherment
│ ├── Digital Signatures
│ ├── Access Control
│ ├── Data Integrity
│ ├── Authentication Exchange
│ ├── Traffic Padding
│ ├── Routing Control
│ └── Notarization
└── Pervasive Security Mechanisms (not tied to one layer)
├── Trusted Functionality
├── Security Labels
├── Event Detection
├── Security Audit Trail
└── Security Recovery
Services = what protection; Mechanisms = how it is implemented; Attacks = what we defend against.
2. The 8 Specific Mechanisms in Detail
| # | Mechanism | What it does | Example |
|---|---|---|---|
| 1 | Encipherment | Transforms data so unauthorized parties cannot read or forge it; provides confidentiality and (with TTP) non-repudiation | AES encrypting email, TLS session encryption |
| 2 | Digital Signatures | Binds a message to its originator with a private-key operation; gives authentication + integrity + non-repudiation | RSA/ECDSA signature on a contract PDF |
| 3 | Access Control | Enforces rights of entities to resources after authentication | File ACLs, firewall rules, RBAC roles |
| 4 | Data Integrity | Appends check values so alteration is detectable | CRC + MAC, SHA-256 digest per block |
| 5 | Authentication Exchange | Protocol proving identity via message exchange (nonces, timestamps, passwords, challenge-response) | Kerberos ticket exchange, 802.1X EAP handshake |
| 6 | Traffic Padding | Inserts bogus traffic/units to hide real volume, timing, and endpoints | Military links sending dummy packets; TLS record padding |
| 7 | Routing Control | Routes data only over trusted/secure paths or networks | Policy routing avoiding hostile AS; VPN forcing corporate gateway |
| 8 | Notarization | A trusted third party vouches for properties (origin, time, integrity) of data exchanged | Timestamping authority, notary-signed key certificate |
3. The 5 Pervasive Mechanisms
| Mechanism | Purpose | Example |
|---|---|---|
| Trusted Functionality | Functions perceived as correct per some criteria (secure kernel, verified crypto module) | Common Criteria certified HSM |
| Security Labels | Marks bound to resources recording sensitivity/clearance | Bell-LaPadula "Top Secret" tags on files |
| Event Detection | Detects attack-relevant events (failed logins, anomalies) | IDS signatures + anomaly detectors |
| Security Audit Trail | Tamper-evident log enabling post-incident analysis and accountability | Syslog + SIEM with append-only storage |
| Security Recovery | Restores secure state and continues operation after attack/failure | Automated key revocation, backup restore, failover |
4. Services × Mechanisms Matrix (Exam Favourite)
Which mechanisms can provide which X.800 service (Y = can provide):
| Mechanism \ Service | Auth | Access Ctrl | Confd. | Integ. | Non-repud. |
|---|---|---|---|---|---|
| Encipherment | Y | – | Y | – | Y (with TTP) |
| Digital signature | Y | – | – | Y | Y |
| Access control | – | Y | – | – | – |
| Data integrity | – | – | – | Y | – |
| Authentication exchange | Y | – | – | – | – |
| Traffic padding | – | – | Y (flow) | – | – |
| Routing control | – | – | Y | – | – |
| Notarization | Y | – | – | Y | Y |
Key insight: one mechanism serves many services (signatures → authentication + integrity + non-repudiation); one service needs many mechanisms (confidentiality → encipherment + padding + routing control).
5. Worked Scenario: Corporate File Server
Engineer requests secret design file: authentication exchange (password + OTP challenge) verifies identity → access control (ACL says engineer may read) grants it → encipherment (AES-256 at rest + TLS in transit) keeps others from reading → data integrity (SHA-256 per chunk) detects tampering → notarization (timestamping server signs access log) gives non-repudiation → audit trail + event detection log the access and flag 3 AM anomaly → security labels ("Confidential") drive all of the above → security recovery (revoke session, restore file) on incident.
Exam Points
- X.800 definition: mechanism = how protection is implemented; list the 8 specific + 5 pervasive mechanisms — 5-mark list question.
- Services × mechanisms matrix — 5-mark table, asked almost every year.
- One-line example per mechanism (AES, RSA signature, ACL, MAC, Kerberos, dummy packets, policy routing, timestamping authority).
- Specific (layer-bound) vs pervasive (system-wide) distinction with 2 examples each.