OSI Security Architecture
1. What Is the OSI Security Architecture?
ITU-T X.800 defines the OSI Security Architecture — the systematic framework Stallings uses for the whole subject. It organizes security into three pillars:
OSI SECURITY ARCHITURE (X.800)
├── 1. Security SERVICES (the WHAT) — Topic 1
├── 2. Security MECHANISMS (the HOW) — Topic 2
└── 3. Security ATTACKS (the THREAT) — Topic 3
X.800 says: an attack threatens data, a service counters the attack, a mechanism implements the service. Every later module is just filling in mechanisms under this roof — encryption (Modules 1–5), hashes/MACs/signatures (Module 6), key management (Module 3), authentication protocols (Module 6).
2. The Three Pillars Together
| Pillar | Question answered | X.800 contents |
|---|---|---|
| Security attacks | What threatens us? | Passive (release of content, traffic analysis) + Active (masquerade, replay, modification, DoS) |
| Security services | What protection is offered? | 5 families: authentication, access control, confidentiality, integrity, non-repudiation |
| Security mechanisms | How is it provided? | 8 specific + 5 pervasive mechanisms (see Topic 2) |
Key X.800 insight: a single service can use several mechanisms, and one mechanism can serve several services. Example: encryption gives confidentiality AND (with chaining/MAC) integrity; digital signatures give authentication + integrity + non-repudiation.
3. Where Services Live in the OSI Layers
X.800 maps services to protocol layers — BEU loves asking "which service at which layer":
| Layer | Typical services placed there |
|---|---|
| 3 Network (IP) | Confidentiality + integrity per-packet — IPsec (tunnel/transport) |
| 4 Transport (TCP) | End-to-end connection confidentiality, integrity, peer authentication — TLS/SSL |
| 5–7 Session/Presentation/Application | Authentication (login, Kerberos), access control (firewalls, RBAC), non-repudiation (signed mail), selective-field confidentiality (PGP, S/MIME) |
| 2 Data link | Link-by-link encryption (WPA2, PPP encryption) — protects one hop only |
Rule: end-to-end security belongs at transport or above; link encryption leaves data plaintext inside intermediate nodes.
4. Why X.800 Still Matters
- Gives the vocabulary of every exam answer: always name attack → service → mechanism in that order and score structure marks.
- RFC 2828 and NIST standards reuse X.800 definitions verbatim — writing "per X.800" signals textbook alignment.
- Design principle: identify threats first, then choose services, then pick mechanisms — never deploy a mechanism (e.g. AES) without stating which service (confidentiality) counters which attack (eavesdropping).
Worked exam framing: Q: "Bank website login over HTTPS." Answer: threat = masquerade + eavesdropping; services = peer authentication (server cert) + connection confidentiality + integrity; mechanisms = TLS handshake (certificates, symmetric encryption, MAC), placed at layer 4.
Exam Points
- Draw the 3-pillar triangle (attacks–services–mechanisms) with X.800 name — 2-mark opener.
- One mechanism → many services and vice versa, with encryption + signature examples — favourite 2–3 marker.
- Layer-placement table (IPsec L3, TLS L4, Kerberos/PGP L7) — 5-mark question core.
- Always structure long answers as threat → service → mechanism.