General

ISO/IEC 10609 is applicable to End Systems concerned with operating in the Open Systems Interconnection (OSI) environment. It specifies a combination of OSI standards which collectively provide the connection-mode Transport Service using the connection-mode Network Service.

This part of ISO/IEC 10609 specifies the profile requirements for the provision of security services using cryptographic techniques with Network Layer Security Protocol connection-mode and SDT-PDU based protection.

Position within the Taxonomy

The taxonomy of profiles is specified in ISO/IEC TR 10000-2. This part of ISO/IEC ISP 10609 supports security services for any TB, TC, TD or TE profile specified in ISO/IEC ISP 10609 (Connection-mode transport over connection-mode Network Service).

Scenario

End System

Security Services

The following security services are within the scope of this part of ISO/IEC ISP 10609:

• Peer entity authentication
• Connection integrity without recovery (including replay protection)
• Access control using security labels
• Connection confidentiality (optional)
• Traffic flow confidentiality (optional)

Security Mechanisms

This part of ISP 10609 provides no assurance as to the strength of the security mechanisms employed.

This part of ISO/IEC ISP 10609 does not specify the cryptographic algorithms to be employed.