BS ISO IEC TR 14516-2002 Information technology - Security techniques - Guidelines for the use and management of trusted third party services《信息技术 安全技术 委托第三方服务的使用和管理指南》.pdf

1、BRITISH STANDARD BS ISO/IEC TR 14516:2002 Information technology Security techniques Guidelines for the use and management of Trusted Third Party services ICS 35.040 BS ISO/IEC TR 14516:2002 This British Standard, having been prepared under the direction of the DISC Board, was published under the au

2、thority of the Standards Policy and Strategy Committee on 5 August 2002 BSI 5 August 2002 ISBN 0 580 40180 4 National foreword This British Standard reproduces verbatim ISO/IEC TR 14516:2002 and implements it as the UK national standard. The UK participation in its preparation was entrusted to Techn

3、ical Committee IST/33, Security techniques, which has the responsibility to: A list of organizations represented on this committee can be obtained on request to its secretary. Cross-references The British Standards which implement international publications referred to in this document may be found

4、in the BSI Catalogue under the section entitled “International Standards Correspondence Index”, or by using the “Search” facility of the BSI Electronic Catalogue or of British Standards Online. This publication does not purport to include all the necessary provisions of a contract. Users are respons

5、ible for its correct application. Compliance with a British Standard does not of itself confer immunity from legal obligations. aid enquirers to understand the text; present to the responsible international/European committee any enquiries on the interpretation, or proposals for change, and keep the

6、 UK interests informed; monitor related international and European developments and promulgate them in the UK. Summary of pages This document comprises a front cover, an inside front cover, the ISO title page, pages ii to vi, pages 1 to 33, and a back cover. The BSI copyright date displayed in this

7、document indicates when the document was last issued. Amendments issued since publication Amd. No. Date Comments Reference number ISO/IEC TR 14516:2002(E)TECHNICAL REPORT ISO/IEC TR 14516 First edition 2002-06-15 Information technology Security techniques Guidelines for the use and management of Tru

8、sted Third Party services Technologies de linformation Techniques de scurit Lignes directrices pour lemploi et la gestion des services TTP BSISO/IECTR14516:2002 IS/OIET CR :615412002(E) lcsid FDParemi ihTs PDF file mac ytnoaie nmt deddebyfepca.se In ccaocnadrw eith Aebods licsneilop gnic,y this file

9、 mairp eb yntiv ro deewb detu slahl ton ide ebtlnu desse tt ehyfepacse whice era hml era deddebicsnede to i dnanstlaled t noeh comtupfrep reomrign tide ehti.gn In wodnlidaogn this file, trapies ccatpe tiereht nsnopser ehibility fo ton infriignA gnebods licnesilop gnic.y I ehTStneC Oarl Secrteiraat c

10、acepts l oniibality in this .aera Ai ebods a tredamafo kr Aebod SystemI sncotaropr.de teDails fo ts ehoftwaorp ercudts ust deo crtaet ehis PDF file ceb na fi dnuon tlareneG eh Info leratit evo tf ehile; tP ehD-Fcrtaeiarap nomtesre were tpoimizf deoirp rnti.gn Evyre casah er t neebakt neo snet eruhat

11、 tf ehile is suitlbaf eosu rI yb eSO memidob rebse. In the lnuikletneve y ttah a lborpem leratign to it is fnuo,d lpsaee inform ttneC ehlar Secrteiraat at tsserdda eh igleb nevwo. ISO/IE2002 C Athgir lls serevr.de selnUs towrehise specfi,dei trap on fo this ilbupctanoi may cudorper ebtu ro deziliyna

12、 ni de fomr yb ro nam y,snae lecetrinoc m roecinahcal, inclidutohp gnocpoiym dna gnicrfoilm, wittuoh repmissii non writif gnrom ietreh ISa Ot tserdda ehs lebwo I roSOs membre ydob in teh ctnuoo yrf ttseuqer ehe.r ISO cirypothg fofice saCe tsopale 65 eneG 1121-HC02 av leT. 14 + 10 947 22 11 xaF 90 94

13、7 22 14 + 74 E-mail cirypothgiso.ch Web ww.wiso.ch rPnietd ni wSztierland ii I SO/IE 2002 C All irhgts seredevrBSISO/IECTR14516:2002iiIS/OIET CR :615412002(E) I SO/IE 2002 C All irhgts seredevr iiiCONTENTS Page 1 Scope . 1 2 References 1 2.1 Identical Recommendations | International Standards 1 2.2

14、Paired Recommendations | International Standards equivalent in technical content 1 2.3 Additional References 1 3 Definitions 2 4 General Aspects 3 4.1 Basis of Security Assurance and Trust 3 4.2 Interaction between a TTP and Entities Using its Services 4 4.2.1 In-line TTP Services . 4 4.2.2 On-line

15、TTP Services 4 4.2.3 Off-line TTP Services. 5 4.3 Interworking of TTP Services 5 5 Management and Operational Aspects of a TTP 5 5.1 Legal Issues. 6 5.2 Contractual Obligations 6 5.3 Responsibilities 7 5.4 Security Policy. 7 5.4.1 Security Policy Elements 8 5.4.2 Standards 8 5.4.3 Directives and Pro

16、cedures. 8 5.4.4 Risk Management. 8 5.4.5 Selection of Safeguards. 9 5.4.5.1 Physical and Environmental Measures . 9 5.4.5.2 Organisational and Personnel Measures . 9 5.4.5.3 IT Specific Measures. 9 5.4.6 Implementation Aspects of IT Security 10 5.4.6.1 Awareness and Training 10 5.4.6.2 Trustworthin

17、ess and Assurance 10 5.4.6.3 Accreditation of TTP Certification Bodies 11 5.4.7 Operational Aspects of IT Security 11 5.4.7.1 Audit/Assessment 11 5.4.7.2 Incident Handling 12 5.4.7.3 Contingency Planning 12 5.5 Quality of Service 12 5.6 Ethics 12 5.7 Fees. 12 6 Interworking. 12 6.1 TTP-Users . 13 6.

18、2 User-User 13 6.3 TTP-TTP. 13 6.4 TTP-Law Enforcement Agency 14 7 Major Categories of TTP Services. 14 7.1 Time Stamping Service 14 7.1.1 Time Stamping Authority 14 7.2 Non-repudiation Services. 15 7.3 Key Management Services. 16 7.3.1 Key Generation Service 16 7.3.2 Key Registration Service. 16 7.

19、3.3 Key Certification Service 16 7.3.4 Key Distribution Service. 17 7.3.5 Key Installation Service 17 7.3.6 Key Storage Service 17 7.3.7 Key Derivation Service. 17 7.3.8 Key Archiving Service 17 BSISO/IECTR14516:2002iiiIS/OIET CR :615412002(E) vi I SO/IE 2002 C All irhgts seredevrPage 7.3.9 Key Revo

20、cation Service 17 7.3.10 Key Destruction Service . 17 7.4 Certificate Management Services . 18 7.4.1 Public Key Certificate Service 18 7.4.2 Privilege Attribute Service 18 7.4.3 On-line Authentication Service Based on Certificates 19 7.4.4 Revocation of Certificates Service. 19 7.5 Electronic Notary

21、 Public Services 19 7.5.1 Evidence Generation Service 20 7.5.2 Evidence Storage Service 20 7.5.3 Arbitration Service 20 7.5.4 Notary Authority 20 7.6 Electronic Digital Archiving Service 21 7.7 Other Services . 22 7.7.1 Directory Service 22 7.7.2 Identification and Authentication Service 23 7.7.2.1

22、On-line Authentication Service 23 7.7.2.2 Off-line Authentication Service . 25 7.7.2.3 In-line Authentication Service 25 7.7.3 In-line Translation Service 25 7.7.4 Recovery Services 25 7.7.4.1 Key Recovery Services 25 7.7.4.2 Data Recovery Services . 26 7.7.5 Personalisation Service . 26 7.7.6 Acces

23、s Control Service. 26 7.7.7 Incident Reporting and Alert Management Service 26 Annex A Security Requirements for Management of TTPs 28 Annex B Aspects of CA management . 29 B.1 Example of Registration Process Procedures. 29 B.2 An example of requirements for Certification Authorities. 29 B.3 Certifi

24、cation Policy and Certification Practice Statement (CPS) 31 Annex C Bibliography 32 Table of Figures Figure 1 In-line TTP Service Between Entities 4 Figure 2 On-line TTP Service Between Entities 5 Figure 3 Off-line TTP Service Between Entities 5 Figure 4 Interworking of TTPs in Different Domains 13

25、Figure 5 Example of Non-repudiation Architecture . 16 Figure 6 Link Between an Attribute Certificate and a Public Key Certificate . 19 Figure 7 Directory Service Architecture 23 Figure 8 Example for On-line Authentication Services 24 Figure 9 Example for In-line TTP Authentication Service . 25 Figur

26、e 10 Example of Alert Management Service 27 BSISO/IECTR14516:2002ivIS/OIET CR :615412002(E) I SO/IE 2002 C All irhgts seredevr vForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standard

27、ization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mu

28、tual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accord

29、ance with the rules given in the ISO/IEC Directives, Part 3. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Stan

30、dard requires approval by at least 75 % of the national bodies casting a vote. In exceptional circumstances, the joint technical committee may propose the publication of a Technical Report of one of the following types: type 1, when the required support cannot be obtained for the publication of an I

31、nternational Standard, despite repeated efforts; type 2, when the subject is still under technical development or where for any other reason there is the future but not immediate possibility of an agreement on an International Standard; type 3, when the joint technical committee has collected data o

32、f a different kind from that which is normally published as an International Standard (“state of the art”, for example). Technical Reports of types 1 and 2 are subject to review within three years of publication, to decide whether they can be transformed into International Standards. Technical Repor

33、ts of type 3 do not necessarily have to be reviewed until the data they provide are considered to be no longer valid or useful. Attention is drawn to the possibility that some of the elements of this Technical Report may be the subject of patent rights. ISO and IEC shall not be held responsible for

34、identifying any or all such patent rights. ISO/IEC TR 14516, which is a Technical Report of type 3, was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques, in collaboration with ITU-T. The identical text is published as ITU-T Rec.

35、X.842. BSISO/IECTR14516:2002vIS/OIET CR :615412002(E) iv I SO/IE 2002 C All irhgts seredevrIntroduction Achievement of adequate levels of business confidence in the operation of IT systems is underpinned by the provision of practical and appropriate legal and technical controls. Business must have c

36、onfidence that IT systems will offer positive advantages and that such systems can be relied upon to sustain business obligations and create business opportunities. An exchange of information between two entities implies an element of trust, e.g. with the recipient assuming that the identity of the

37、sender is in fact the sender, and in turn, the sender assuming that the identity of the recipient is in fact the recipient for whom the information is intended. This “implied element of trust“ may not be enough and may require the use of a Trusted Third Party (TTP) to facilitate the trusted exchange

38、 of information. The role of TTPs includes providing assurance that business and other trustworthy (e.g. governmental activities) messages and transactions are being transferred to the intended recipient, at the correct location, that messages are received in a timely and accurate manner, and that f

39、or any business dispute that may arise, there exist appropriate methods for the creation and delivery of the required evidence for proof of what happened. Services provided by TTPs may include those necessary for key management, certificate management, identification and authentication support, priv

40、ilege attribute service, non-repudiation, time stamping services, electronic public notary services, and directory services. TTPs may provide some or all of these services. A TTP has to be designed, implemented and operated to provide assurance in the security services it provides, and to satisfy ap

41、plicable legal and regulatory requirements. The types and levels of protection adopted or required will vary according to the type of service provided and the context within which the business application is operating. The objectives of this Recommendation | Technical Report are to provide: a) Guide

42、lines to TTP managers, developers and operations personnel and to assist them in the use and management of TTPs; and b) Guidance to entities regarding the services performed by TTPs, and the respective roles and responsibilities of TTPs and entities using their services. Additional aspects covered b

43、y this Recommendation | Technical Report are to provide: a) An overview of the description of services provided; b) An understanding of the role of TTPs and their functional features; c) To provide a basis for the mutual recognition of services provided by different TTPs; and d) Guidance of interwor

44、king between entities and TTPs. BSISO/IECTR14516:2002vi ISO/ICERT 541 002:61E( 2) ITU-R Tec.X .248/01( )0002)E( 1 TECHNICAL REPORT ISO/IEC TR 14516 ITU-T RECOMMENDATION X.842 INFORMATION TECHNOLOGY SECURITY TECHNIQUES GUIDELINES FOR THE USE AND MANAGEMENT OF TRUSTED THIRD PARTY SERVICES 1 Scope Asso

45、ciated with the provision and operation of a Trusted Third Party (TTP) are a number of security-related issues for which general guidance is necessary to assist business entities, developers and providers of systems and services, etc. This includes guidance on issues regarding the roles, positions a

46、nd relationships of TTPs and the entities using TTP services, the generic security requirements, who should provide what type of security, what the possible security solutions are, and the operational use and management of TTP service security. This Recommendation | Technical Report provides guidanc

47、e for the use and management of TTPs, a clear definition of the basic duties and services provided, their description and their purpose, and the roles and liabilities of TTPs and entities using their services. It is intended primarily for system managers, developers, TTP operators and enterprise use

48、rs to select those TTP services needed for particular requirements, their subsequent management, use and operational deployment, and the establishment of a Security Policy within a TTP. It is not intended to be used as a basis for a formal assessment of a TTP or a comparison of TTPs. This Recommenda

49、tion | Technical Report identifies different major categories of TTP services including: time stamping, non-repudiation, key management, certificate management, and electronic notary public. Each of these major categories consists of several services which logically belong together. 2 References 2.1 Identical Recommendations | International Standards IT U-T Recommendation X.509 (2001) | ISO/IEC 9594-8:2001, Information techn