Because the network protection specifications in the military domain are as yet unconsolidated, we will discuss the ISO standard for network protection instead. The International Standards Organization's (ISO) Open Systems Interconnect (OSI) standard specifies a set of standards for network operation between computer systems. As a result of concerns regarding protection in these networks, a security addendum was added to specify security aspects of these networks. The OSI standard specifies a layered protocol in which there are 7 layers, each requesting services from lower levels (level 1 requesting services of the transmission media), and granting services to higher levels (level 7 to the user). The levels and their functions are:
1 - Physical - transmission of bits over the network 2 - Link - error detection and correction 3 - Network - examining and affecting network services and controls 4 - Transport - multi network inter operation and routing 5 - Session - inter process communication 6 - Presentation - formatting of data 7 - Application - User or application specific
In order to discuss the model further, we define a few terms. An 'entity' is a physical or logical end point participating in a data exchange. Entities are typically associated with layers in the protocol, with equivalent layers in other systems called 'peers'. User data is defined as data transferred between peer entities at a given protocol layer on behalf of entities at the next higher layer. A 'protocol data unit', more commonly known as a 'packet', consists of a combination of user data and protocol information. Each layer of the protocol either; constructs packets out of user data and protocol information, and passes these packets as user data to the next lower protocol layer; or unpacks packets into user data and protocol information for passage to the next higher protocol layer. The protection services specified in the security addenda include:
Identification Peer entity authentication Access control rules Access control labels Data confidentiality Communications integrity Service availability Accountability Non-repudiation
The selection, implementation, and placement of these facilities are at the discretion of the network architect, and the above list is considered a minimum specification. This puts the burden of encryption, digital signatures, access control, integrity, identification, authentication, and other mechanisms on the shoulders of the network architect.
This standard has several major problems. As we have previously discussed, protection depends on proper design, and to implement the 'security' standard as an 'add-on' to the previous standard is a potentially fatal fundamental flaw in design. The OSI policies are not designed as a philosophy of protecting information in the network, but rather as a set of network services that may be performed. The concept that providing protection services yields protection is fundamentally flawed. We must begin at the beginning, with a policy, and work from there. Finally, everything in the OSI standard is left to the designer, and there is no guidance as to how to implement it. This makes it weak from a standards point of view in that it doesn't lead to compatible designs.