Network Encryption and Security Services

Network Encryption and Security Services

The primary objectives include:

1. Protect data so they cannot be read by unauthorized people.
2. Prevent unauthorized modification by stopping persons from inserting or deleting messages.
3. Verify the sender of each message (authentication).
4. Enable electronic signatures so users can transmit electronically signed documents; encryption (keying) can be used for all these objectives.

Encryption Locations in the OSI Model

The location of encryption in the OSI model has been so controversial that any mention of this matter was omitted from the original rule. Theoretically, keying can be performed on any layer, but in practice three of them seem more appropriate: the physical layer, the transport layer, and the presentation layer.

Link Encryption at the Physical Layer

When encryption is done at the physical layer, a key-commissioning unit is inserted between each computer and the physical medium. Each bit that leaves the computer is processed, and every bit that enters the computer undergoes the reverse process. This is known as link encryption. It is very simple, but relatively inflexible.

Network Security Challenges

In the early days, when companies and universities had a single central computer, it was relatively simple to achieve a good degree of safety. All one had to do was place a guard at the gateway to the computer room; the guard's role was to ensure that no tape, disk, or card left the room unless there was explicit permission to do so.

With the advent of networks, the situation changed drastically. Nobody can manually monitor the millions of bits of data that move daily between computers on a network. In addition, organizations have no way of ensuring that their data will not be copied secretly by interception of telephone lines or other means along the path to its destination. This type of interception is more common than people might imagine (Kahn, 1980; Selfridge and Schwartz, 1980). The worst case is when a satellite link is used in the transmission path, since data are available to whoever takes the trouble to erect an antenna to listen. Clearly, there is a need for some form of keying (also known as encryption) to make data unintelligible to everyone except the intended recipients.

Data protection against curious users is not the only aspect of security in network connections. One might think of at least four security services:

Essential Network Security Services

1. Confidentiality — protect data so they cannot be read by unauthorized people.
2. Integrity — prevent unauthorized persons from inserting or deleting messages.
3. Authentication — verify the sender of each message.
4. Non-repudiation — enable users to transmit electronically signed documents.