ISO_IEC 9594-8-2005 信息技术.开放系统互连.目录_公共键和属性认证框架.pdf

标准号：ISO/IEC 9594-8-2005
实施状态：作废
中文名称：信息技术.开放系统互连.目录:公共键和属性认证框架
英文名称：Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks
发布日期：2005-12
被替代标准：ISO/IEC 9594-8-2008
代替标准：ISO/IEC 9594-8-2001;ISO/IEC FDIS 9594-8-2006
采用标准：ANSI/INCITS/ISO/IEC 9594-8-2008,IDT;ITU-T X.509-2005,IDT
起草单位：ISO/IEC JTC 1/SC 6
标准简介：This Recommendation | International Standard addresses some of the security requirements in the areas of
authentication and other security services through the provision of a set of frameworks upon which full services can be
based. Specifically, this Recommendation | International Standard defines frameworks for:
– Public-key certificates;
– Attribute certificates;
– Authentication services.
The public-key certificate framework defined in this Recommendation | International Standard includes definition of the
information objects for Public Key Infrastructure (PKI), including public-key certificates, and Certificate Revocation
List (CRL). The attribute certificate framework includes definition of the information objects for Privilege Management
Infrastructure (PMI), including attribute certificates, and Attribute Certificate Revocation List (ACRL). This
Specification also provides the framework for issuing, managing, using and revoking certificates. An extensibility
mechanism is included in the defined formats for both certificate types and for all revocation list schemes. This
Recommendation | International Standard also includes a set of standard extensions for each, which is expected to be
generally useful across a number of applications of PKI and PMI. The schema components, including object classes,
attribute types and matching rules for storing PKI and PMI objects in the Directory, are included in this
Recommendation | International Standard. Other elements of PKI and PMI, beyond these frameworks, such as key and
certificate management protocols, operational protocols, additional certificate and CRL extensions are expected to be
defined by other standards bodies (e.g., ISO TC 68, IETF, etc.).
The authentication scheme defined in this Recommendation | International Standard is generic and may be applied to a
variety of applications and environments.
The Directory makes use of public-key certificates and attribute certificates, and the framework for the Directory's use
of these facilities is also defined in this Recommendation | International Standard. Public-key technology, including
certificates, is used by the Directory to enable strong authentication, signed and/or encrypted operations, and for storage
of signed and/or encrypted data in the Directory. Attribute certificates can be used by the Directory to enable rule-based
access control. Although the framework for these is provided in this Specification, the full definition of the Directory's
use of these frameworks, and the associated services provided by the Directory and its components is supplied in the
complete set of Directory Specifications.
This Recommendation | International Standard, in the Authentication services framework, also:
– specifies the form of authentication information held by the Directory;
– describes how authentication information may be obtained from the Directory;
– states the assumptions made about how authentication information is formed and placed in the Directory;
– defines three ways in which applications may use this authentication information to perform
authentication and describes how other security services may be supported by authentication.
This Recommendation | International Standard describes two levels of authentication: simple authentication, using a
password as a verification of claimed identity; and strong authentication, involving credentials formed using
cryptographic techniques. While simple authentication offers some limited protection against unauthorized access, only
strong authentication should be used as the basis for providing secure services. It is not intended to establish this as a
general framework for authentication, but it can be of general use for applications which consider these techniques
adequate.
文件格式：PDF
文件大小：1.27MB
文件页数：174
（以上信息更新时间为：2019-11-22）



文档语言及版本参照下方封面截图：