Chapter 16: Application Layer Security Protocols

Team-Fly

Overview

In this chapter, we focus on security protocols that have been proposed, specified, implemented, and deployed for the application layer of the Internet model. Providing security at the application layer has in fact often turned out to be the most intrusive option. It is also the most flexible, because the scope and strength of the protection can be tailored to meet the security requirements of specific applications. Roughly speaking, there are two possibilities to provide security services at the application layer:

Take a given application protocol as it is and enhance it with security features. The result is a secure version of the given application protocol.
Follow a more generic approach to provide a security system that can be used by many application protocols to incorporate security features.

The first possibility leads to security-enhanced application protocols, whereas the second possibility leads to the development and use of authentication and key distribution systems that provide a standardized API. We overview and discuss security-enhanced application protocols in Section 16.1 and authentication and key distribution systems in Section 16.2. Finally, we draw some conclusions in Section 16.3.

Team-Fly