WG6: OSI Session, Presentation and Common Application Services

This working group has already produced an IS addendum (Association Control Service Element, Authentication) to ISO 8649. Presently it is working on the OSI Upper Layer Security Model (ULSM), a Committee Draft and on a Generic Upper Layer Security Service Element (GULS).

ULSM will specify:

• the security aspects of communication in the Upper Layers of OSI ;
• the support in the Upper Layers of the security services defined in ISO 7498-2 (the OSI Security Architecture) and in the Security Frameworks for Open Systems;
• the positioning of, and relationships among security services and mechanisms in the Upper Layers, according to the guidelines of ISO 7498-2 and ISO/IEC 9545 (ISO 9545 is the Application Layer Structure and is also known as CCITT X.207);
• the interactions among the Upper Layers and interactions between the Upper Layers and the Lower Layers, in providing and using security services;
• the requirements for management of security in the Upper Layers, including audit, as guided by the Audit Trail Framework.

An off-shoot of this work is the proposed GULS standard (ISO DIS 11586). GULS, a five part standard, provides security-exchange functions that allow the exchange of security information and security-transformation functions that support the integrity and confidentiality of application data. The latter are supported through ASN.1 extensions.

This work has been the cause of considerable controversy in the past since cryptographic transformations in layer 7 all but replace the functionality of layer 6. But, the appropriate vague statements have been included (i.e., the transformations may be performed in either layer) and the work is now much less controversial. Last minute challenges to this work (including UK proposals for a generic security ESO-OSI abstract interface standard) have not slowed down its progress and it is expected that this work will be incorporated in several applications in the near future.

Most interestingly, the work in GULS is already reflected in the IEEE work on key management. The United States has been interested in having this work accepted as an OSI standard for two reasons:

• Starting with the SDNS series, the United States has always maintained that key management should be done in layer seven, and
• A key management standard in layer seven would greatly simplify the design of the lower layer standards.

A New Work Item (Authentication, Access Control, and key management service elements) has passed ballot in WG6 and the United States intends to port the IEEE work to ISO.