IEEE 1888 3-2013 en Ubiquitous Green Community Control Network Security《无处不在的绿色社区控制网络用IEEE标准 安全》.pdf

1、5HIHUHQFHQXPEHU,62,( fitness for a particular purpose; non-infringement; and quality, accuracy, effectiveness, currency, or completeness of material. In addition, IEEE disclaims any and all conditions relating to: results; and workmanlike effort. IEEE standards documents are supplied “AS IS” and “WI

2、TH ALL FAULTS.” Use of an IEEE standard is wholly voluntary. The existence of an IEEE standard does not imply that there are no other ways to produce, test, measure, purchase, market, or provide other goods and services related to the scope of the IEEE standard. Furthermore, the viewpoint expressed

3、at the time a standard is approved and issued is subject to change brought about through developments in the state of the art and comments received from users of the standard. In publishing and making its standards available, IEEE is not suggesting or rendering professional or other services for, or

4、 on behalf of, any person or entity nor is IEEE undertaking to perform any duty owed by any other person or entity to another. Any person utilizing any IEEE Standards document, should rely upon his or her own independent judgment in the exercise of reasonable care in any given circumstances or, as a

5、ppropriate, seek the advice of a competent professional in determining the appropriateness of a given IEEE standard. IN NO EVENT SHALL IEEE BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO: PROCUREMENT OF SUBSTITUTE GOODS OR

6、SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE PUBLICATION, USE OF, OR RELIANCE UPON ANY STANDARD, EVEN IF ADVISED OF TH

7、E POSSIBILITY OF SUCH DAMAGE AND REGARDLESS OF WHETHER SUCH DAMAGE WAS FORESEEABLE. Translations The IEEE consensus development process involves the review of documents in English only. In the event that an IEEE standard is translated, only the English version published by IEEE should be considered

8、the approved IEEE standard. ISO/IEC/IEEE 18883:2016(E) IEEE Std 1888.3-2 013 IEEE 2013 All rights reservedOfficial statements A statement, written or oral, that is not processed in accordance with the IEEE-SA Standards Board Operations Manual shall not be considered or inferred to be the official po

9、sition of IEEE or any of its committees and shall not be considered to be, or be relied upon as, a formal position of IEEE. At lectures, symposia, seminars, or educational courses, an individual presenting information on IEEE standards shall make it clear that his or her views should be considered t

10、he personal views of that individual rather than the formal position of IEEE. Comments on standards Comments for revision of IEEE Standards documents are welcome from any interested party, regardless of membership affiliation with IEEE. However, IEEE does not provide consulting information or advice

11、 pertaining to IEEE Standards documents. Suggestions for changes in documents should be in the form of a proposed change of text, together with appropriate supporting comments. Since IEEE standards represent a consensus of concerned interests, it is important that any responses to comments and quest

12、ions also receive the concurrence of a balance of interests. For this reason, IEEE and the members of its societies and Standards Coordinating Committees are not able to provide an instant response to comments or questions except in those cases where the matter has previously been addressed. For the

13、 same reason, IEEE does not respond to interpretation requests. Any person who would like to participate in revisions to an IEEE standard is welcome to join the relevant IEEE working group. Comments on standards should be submitted to the following address: Secretary, IEEE-SA Standards Board 445 Hoe

14、s Lane Piscataway, NJ 08854 USA Laws and regulations Users of IEEE Standards documents should consult all applicable laws and regulations. Compliance with the provisions of any IEEE Standards document does not imply compliance to any applicable regulatory requirements. Implementers of the standard a

15、re responsible for observing or referring to the applicable regulatory requirements. IEEE does not, by the publication of its standards, intend to urge action that is not in compliance with applicable laws, and these documents may not be construed as doing so. Copyrights IEEE draft and approved stan

16、dards are copyrighted by IEEE under U.S. and international copyright laws. They are made available by IEEE and are adopted for a wide variety of both public and private uses. These include both use, by reference, in laws and regulations, and use in private self-regulation, standardization, and the p

17、romotion of engineering practices and methods. By making these documents available for use and adoption by public authorities and private users, IEEE does not waive any rights in copyright to the documents. Photocopies Subject to payment of the appropriate fee, IEEE will grant users a limited, non-e

18、xclusive license to photocopy portions of any individual standard for company or organizational internal use or individual, non-commercial use only. To arrange for payment of licensing fees, please contact Copyright Clearance Center, Customer Service, 222 Rosewood Drive, Danvers, MA 01923 USA; +1 97

19、8 750 8400. Permission to photocopy portions of any individual standard for educational classroom use can also be obtained through the Copyright Clearance Center. ISO/IEC/IEEE 18883:2016(E) IEEE 2013 All rights reserved Updating of IEEE Standards documents Users of IEEE Standards documents should be

20、 aware that these documents may be superseded at any time by the issuance of new editions or may be amended from time to time through the issuance of amendments, corrigenda, or errata. An official IEEE document at any point in time consists of the current edition of the document together with any am

21、endments, corrigenda, or errata then in effect. Every IEEE standard is subjected to review at least every ten years. When a document is more than ten years old and has not undergone a revision process, it is reasonable to conclude that its contents, although still of some value, do not wholly reflec

22、t the present state of the art. Users are cautioned to check to determine that they have the latest edition of any IEEE standard. In order to determine whether a given document is the current edition and whether it has been amended through the issuance of amendments, corrigenda, or errata, visit the

23、 IEEE-SA Website at http:/ieeexplore.ieee.org/xpl/standards.jsp or contact IEEE at the address listed previously. For more information about the IEEE SA or IEEEs standards development process, visit the IEEE-SA Website at http:/standards.ieee.org. Errata Errata, if any, for all IEEE standards can be

24、 accessed on the IEEE-SA Website at the following URL: http:/standards.ieee.org/findstds/errata/index.html. Users are encouraged to check this URL for errata periodically. Patents Attention is called to the possibility that implementation of this standard may require use of subject matter covered by

25、 patent rights. By publication of this standard, no position is taken by the IEEE with respect to the existence or validity of any patent rights in connection therewith. If a patent holder or patent applicant has filed a statement of assurance via an Accepted Letter of Assurance, then the statement

26、is listed on the IEEE-SA Website at http:/standards.ieee.org/about/sasb/patcom/patents.html. Letters of Assurance may indicate whether the Submitter is willing or unwilling to grant licenses under patent rights without compensation or under reasonable rates, with reasonable terms and conditions that

27、 are demonstrably free of any unfair discrimination to applicants desiring to obtain such licenses. Essential Patent Claims may exist for which a Letter of Assurance has not been received. The IEEE is not responsible for identifying Essential Patent Claims for which a license may be required, for co

28、nducting inquiries into the legal validity or scope of Patents Claims, or determining whether any licensing terms or conditions provided in connection with submission of a Letter of Assurance, if any, or in any licensing agreements are reasonable or non-discriminatory. Users of this standard are exp

29、ressly advised that determination of the validity of any patent rights, and the risk of infringement of such rights, is entirely their own responsibility. Further information may be obtained from the IEEE Standards Association. ISO/IEC/IEEE 18883:2016(E) IEEE Std 1888.3-2 013 IEEE 2013 All rights re

30、servedCopyright 2013 IEEE. All rights reserved. vi Participants At the time this IEEE standard was completed, the UGCCNet-SEC Working Group had the following membership: Dong Liu, Chair Wenjie Li, Vice Chair Beijing Jiaotong University BII Group Holdings Ltd. China Telecommunications Corporation Cis

31、co Systems Inc. Intel Corporation Qingdao Gaoxiao Information Industry Co., Ltd. Raisecom Technology Co., Ltd The University of Tokyo The P1888.3 Working Group gratefully acknowledges the contributions of the following participants. Without their assistance and dedication, this standard would not ha

32、ve been completed. Changhe Du Chen Gu Dong Liu Guoquan Tan Hideya Ochiai Hiroshi Esaki Hongke Zhang Huiling Zhao Lianshan Jiang Masahiro Ishiyama Ming Feng Ming Qiu Ning Zou Shoichi Sakane Shuai Gao Tsuyoshi Momose Wenjie Li Wenjie Ma Xiaochuan Gu Yan He The following members of the entity balloting

33、 committee voted on this standard. Balloters may have voted for approval, disapproval, or abstention. Beijing Jiaotong University BII Group Holdings Ltd. China Datang Corporation China Telecommunications Corporation Cisco Systems, Inc. Intel Corporation Marvell Semiconductor, Inc. Nippon Telegraph a

34、nd Telephone Corporation (NTT) NXP Semiconductors Qingdao Gaoxiao Information Industry Co. Ltd. Raisecom Technology Co., Ltd. The University of Tokyo When the IEEE-SA Standards Board approved this standard on 31 October 2013, it had the following membership: John Kulick, Chair David J. Law, Vice Cha

35、ir Richard H. Hulett, Past Chair Konstantinos Karachalios, Secretary Masayuki Ariyoshi Peter Balma Farooq Bari Ted Burse Wael William Diab Stephen Dukes Jean-Philippe Faure Alexander Gelman Mark Halpin Gary Hoffman Paul Houz Jim Hughes Michael Janezic Joseph L. Koepfinger* Oleg Logvinov Ron Petersen

36、 Gary Robinson Jon Walter Rosdahl Adrian Stephens Peter Sutherland Yatin Trivedi Phil Winston Yu Yuan *Member EmeritusISO/IEC/IEEE 18883:2016(E) IEEE 2013 All rights reserved vii Copyright 2013 IEEE. All rights reserved. Also included are the following nonvoting IEEE-SA Standards Board liaisons: Ric

37、hard DeBlasio, DOE Representative Michael Janezic, NIST Representative Patrick Gibbons IEEE Standards Program Manager, Document Development Krista Gluchoski IEEE Project Specialist, Professional Services Joan Woolery IEEE Standards Program Manager, Technical Program Development ISO/IEC/IEEE 18883:20

38、16(E) IEEE Std 1888.3-2 013 IEEE 2013 All rights reservedviii Copyright 2013 IEEE. All rights reserved. Introduction This introduction is not part of IEEE Std 1888.3-2013, IEEE Standard for Ubiquitous Green Community Control Network: Security. This standard describes the enhanced security management

39、 function for the protocol defined in IEEE Std 1888, IEEE Standard for Ubiquitous Green Community Control Network Protocol, specifies security requirements, defines system security architecture, gives a standardized description of authentication and authorization, along with security procedures and

40、protocols. This standard can help avoid unintended data disclosure to the public and unauthorized access to resources, while providing enhanced integrity and confidentiality of transmitted data in the ubiquitous green community control network. The purpose of this standard is to define a security ma

41、nagement function in the ubiquitous green community control network that provides an interoperable, high-quality, and secure applications operation platform. As an open system, a ubiquitous green community control network assumes multi-domain operation and public access from other system components.

42、 In this context, security considerations are needed for operation of the IEEE 1888 protocol. This specification defines the architecture and framework that provides security for IEEE 1888 systems. As an interactive monitoring and control system based on sensor-actuator networks, IEEE 1888 systems w

43、ithout security suffer from some potential security threats. For example, unintended users or systems may capture sensor readings and control HVAC or lights easily, or information exchanged and data stored may be overwritten by unauthorized users or components. This standard specifies a security fra

44、mework to protect the message exchange path of both the data plane and the control plane of an IEEE 1888 system from such security threats, providing mutual authentication, access control, message integrity, data confidentiality, and so on. The IEEE 1888 protocol is bound to simple object access pro

45、tocol (SOAP) and normally takes hypertext transfer protocol (HTTP) for the transportation of its SOAP messages. To meet the security requirements and protect from security threats, HTTP over TLS (HTTPS) shall be adopted. This is because HTTPS has been widely used and can satisfy the security require

46、ments with small implementation cost. This document distinguishes system reliability issues from security issues. For example, service tolerance against heavy requests from clients and communication tolerance against temporal physical link failure are out of the scope of this document. This document

47、 is organized as follows: Clause 4 specifies security requirements and design principles. Clause 5 describes security system architecture. Clause 6 defines security protocols, including communication sequence, software interface, and identifier (ID) system. ISO/IEC/IEEE 18883:2016(E) IEEE 2013 All rights reserved