ImageVerifierCode 换一换
格式:PDF , 页数:42 ,大小:731.67KB ,
资源ID:584783      下载积分:10000 积分
快捷下载
登录下载
邮箱/手机:
温馨提示:
如需开发票,请勿充值!快捷下载时,用户名和密码都是您填写的邮箱或者手机号,方便查询和重复下载(系统自动生成)。
如填写123,账号就是123,密码也是123。
特别说明:
请自助下载,系统不会自动发送文件的哦; 如果您已付费,想二次下载,请登录后访问:我的下载记录
支付方式: 支付宝扫码支付 微信扫码支付   
注意:如需开发票,请勿充值!
验证码:   换一换

加入VIP,免费下载
 

温馨提示:由于个人手机设置不同,如果发现不能下载,请复制以下地址【http://www.mydoc123.com/d-584783.html】到电脑端继续下载(重复下载不扣费)。

已注册用户请登录:
账号:
密码:
验证码:   换一换
  忘记密码?
三方登录: 微信登录  

下载须知

1: 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。
2: 试题试卷类文档,如果标题没有明确说明有答案则都视为没有答案,请知晓。
3: 文件的所有权益归上传用户所有。
4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
5. 本站仅提供交流平台,并不能对任何下载内容负责。
6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。

版权提示 | 免责声明

本文(BS ISO 15668-2000 Banking - Secure file transfer (retail)《银行业务 安全文件传输(零售)》.pdf)为本站会员(bonesoil321)主动上传,麦多课文库仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知麦多课文库(发送邮件至master@mydoc123.com或直接QQ联系客服),我们立即给予删除!

BS ISO 15668-2000 Banking - Secure file transfer (retail)《银行业务 安全文件传输(零售)》.pdf

1、| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BRITISH STANDARD BS ISO 15668:1999 ICS 35.

2、040: 35.240.40 NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW Banking Secure file transfer (retail)This British Standard, having been prepared under the direction of the DISC Board, was published under the authority of the Standards Committee and comes into effect on 15 April

3、 2000 BSI 04-2000 ISBN 0 580 34742 7 BS ISO 15668:1999 Amendments issued since publication Amd. No. Date Comments National foreword This British Standard reproduces verbatim ISO 15668:1999 and implements it as the UK national standard. The UK participation in its preparation was entrusted to Technic

4、al Committee IST/12, Banking, securities and other financial services, which has the responsibility to: aid enquirers to understand the text; present to the responsible international/European committee any enquiries on the interpretation, or proposals for change, and keep the UK interests informed;

5、monitor related international and European developments and promulgate them in the UK. A list of organizations represented on this committee can be obtained on request to its secretary. Cross-references The British Standards which implement international publications referred to in this document may

6、 be found in the BSI Standards Catalogue under the section entitled “International Standards Correspondence Index”, or by using the “Find” facility of the BSI Standards Electronic Catalogue. A British Standard does not purport to include all the necessary provisions of a contract. Users of British S

7、tandards are responsible for their correct application. Compliance with a British Standard does not of itself confer immunity from legal obligations. Summary of pages This document comprises a front cover, an inside front cover, the ISO title page, pages ii to v, a blank page, pages 1 to 33 and a ba

8、ck cover. The BSI copyright notice displayed in this document indicates when the document was last issued.Referencenumber ISO15668:1999(E) INTERNATIONAL STANDARD ISO 15668 Firstedition 1999-12-01 BankingSecurefiletransfer(retail) Banque Transfert de fichier de scurit (services aux particuliers)ISO15

9、668:1999(E) ii ISO15668:1999(E)iii Contents Page Foreword.iv Introduction.v 1 Scope1 2 Normativereferences3 3 Termsanddefinitions.4 4 Principles5 5 Application.6 6 Authenticationmechanisms.14 AnnexA(informative)Mechanismexamples.15 AnnexB(informative)Anexampleofimplementation23 AnnexC(informative)An

10、exampleforensuringfiletransferintegrityvalidation28 AnnexD(informative)Graphicsoverviewofsecurityserviceswithreferences33ISO15668:1999(E) iv Foreword ISO(theInternationalOrganizationforStandardization)isaworldwidefederationofnationalstandardsbodies(ISO memberbodies).TheworkofpreparingInternationalSt

11、andardsisnormallycarriedoutthroughISOtechnical committees.Eachmemberbodyinterestedinasubjectforwhichatechnicalcommitteehasbeenestablishedhas therighttoberepresentedonthatcommittee.Internationalorganizations,governmentalandnon-governmental,in liaisonwithISO,alsotakepartinthework.ISOcollaboratesclosel

12、ywiththeInternationalElectrotechnical Commission(IEC)onallmattersofelectrotechnicalstandardization. InternationalStandardsaredraftedinaccordancewiththerulesgivenintheISO/IECDirectives,Part3. DraftInternationalStandardsadoptedbythetechnicalcommitteesarecirculatedtothememberbodiesforvoting. Publicatio

13、nasanInternationalStandardrequiresapprovalbyatleast75%ofthememberbodiescastingavote. AttentionisdrawntothepossibilitythatsomeoftheelementsofthisInternationalStandardmaybethesubjectof patentrights.ISOshallnotbeheldresponsibleforidentifyinganyorallsuchpatentrights. InternationalStandardISO15668wasprep

14、aredbyTechnicalCommitteeISO/TC68, Banking, securities and other financial services, Subcommittee SC 6, Retail financial services. AnnexesAtoDofthisInternationalStandardareforinformationonly.ISO15668:1999(E)v Introduction ThisInternationalStandarddescribeshowtosecurefiletransfersinaretailbankingenvir

15、onment.Typicaluseof suchfiletransfersarethosebetweenacardacceptingdeviceandanacquirer,orbetweenanacquirerandacard issuer.INTERNATIONALSTANDARD ISO15668:1999(E)1 BankingSecurefiletransfer(retail) 1 Scope Incontrasttofiletransfersinawholesalebankingenvironmentcharacterisedbyexchangesoflargevolume, bet

16、weenmainframes,inarelativelyhigh-securityenvironment(“bulkfiletransfers“);thoseinaretailbanking environmentarecharacterisedbylowvolumesandalowerdegreeofreliabilityofenvironmentinwhich downloadeddevicesareoperated.Suchdevicesmaybe,butnotlimitedto,anelectronicpointofsaleterminal (EPOS),anautomatedvend

17、ingmachine(AVM),anautomatedtellermachine(ATM),oramerchantserverin communicationwithpaymentgateways. Itisassumedthatapre-establishedrelationshipexistsbetweentheentitiesinvolvedinthesecurefiletransfer, especiallytocoverthelegalandcommercialaspectsrelatedtothefiletransferliabilities. ThisInternationalS

18、tandardappliestothedifferentkindsoffiletransferusedinretailbankingenvironment,butdoes notcovertransactionmessagesidentifiedinISO8583. Thetransfermayrequiretimeliness,andrequiresatleastoneofthefollowingsecurityservices: messageoriginauthentication; receiverauthentication; integrity; confidentiality;

19、nonrepudiationoforigin; nonrepudiationofdelivery; auditability. Itisassumedthatalldataforwardedbytheoriginatorshallhavebeenconfirmedaslegitimateandcorrectpriorto thetransfer. Thedifferenttypesoffilestobetransferredcouldcontain: software; theretailtransactionswhichhavebeenperformedandregistered,(uplo

20、ading); technicaldatarelatedtoanacquirer(accessparameters.),(downloading); applicationdatarelatedtoanacquirer(BINlist,hotlist,.),(downloading).ISO15668:1999(E) 2 Characteristicsofsuchfiletransfersarethefollowing: a)thetypeofdatatobetransferredcanbe non-secretdata(collectionofretailtransactions,techn

21、icaldataandapplicationdata);or secretdata. b) thenumberofentitiestoreceivethedatacanbe: one; morethanone(broadcastwitheventhousandsofreceivers). c) thecommunicationchannelscanconsistofoneorbothofthefollowingexamples: telecommunication:publicnetwork,privatenetwork; d) thenatureofthetransfercanbe: dir

22、ect-connect,real-timetransfer(alsoknownascircuitswitching);or store-and-forwardtransfer(alsoknownasmessageswitching). NOTE ThisInternationalStandardconsidersthesecurityserviceduringthetransfer.Requirementstoensurethat transferredfileshavenotbeenalteredaftertransferachievementareoutsidethescopeofthis

23、InternationalStandard. PermissibleformsofSecureFileTransfer TransferofSecuredFiles Thetransferfunctiondoesnotprovideanysecurityservicesbutincludesonlycommunicationservices.Inthiscase thefileshallbesecuredpriortothetransfer.Securityismanagedbytheoriginatorandthereceiverthemselves. Theyneednottrustthe

24、lowerlevels.Thereisnosecurityaddedbythecommunicationlevel(senderandreceiver). SFT=SecureFileTransfer Securedtransferoffiles Inthiscase,thesecurityistakenintoaccountonlyfromthesendertothereceiverandtheoriginatorfullytruststhe sender.Oneexampleiswheretheoriginatoristhesenderandthesecurityisdelegatedto

25、thetransferlevel.Thisis notendtoendsecurityasthereisnosecurityaddedbytheoriginator.Inthiscase,thetransferfunctionfully includesthesecurityservices.Thefileneednotbesecuredpriortothesecuredtransfertakingplace.ISO15668:1999(E)3 Securedtransferofsecuredfiles Thesecurityfunctionscanbesplitupbetweenthesec

26、urityfunctionandthetransferfunction.Oneexampleis wheretheoriginatorcreatesafile,signsitwiththeprivatesignaturekey,andenciphersthefilewithakeyknown onlybytheenduser(thereceiver). Theconcerninthisexampleistopreventanyonewithinthesendersorganisationfromseeingthecontentofthe originatorsfile.However,theo

27、riginatortrustsitsagent(s)toprocessthetransferandtotakeintoaccountthe authentication,integrity,betweenthesenderandthereceiver. 2 Normativereferences Thefollowingnormativedocumentscontainprovisionswhich,throughreferenceinthistext,constituteprovisionsof thisInternationalStandard.Fordatedreferences,sub

28、sequentamendmentsto,orrevisionsof,anyofthese publicationsdonotapply.However,partiestoagreementsbasedonthisInternationalStandardareencouragedto investigatethepossibilityofapplyingthemostrecenteditionsofthenormativedocumentsindicatedbelow.For undatedreferences,thelatesteditionofthenormativedocumentref

29、erredtoapplies.MembersofISOandIEC maintainregistersofcurrentlyvalidInternationalStandards. ISO8372:1987, Information processing Modes of operation for a 64-bit block cipher algorithm. ISO8583:1993, Financial transaction card originated messages Interchange message specifications. ISO8731-1:1987, Ban

30、king Approved algorithms for message authentication Part 1: DEA. ISO9564-1:1991, Banking Personal Identification Number management and security Part 1: PIN protection principles and techniques. ISO/IEC9796:1991, Information technology Security techniques Digital signature scheme giving message recov

31、ery. ISO/IEC9796-2:1997, Information technology Security techniques Digital signature schemes giving message recovery Part 2: Mechanisms using a hash-function. ISO/IEC9797:1994, Information technology Security techniques Data integrity mechanism using a cryptographic check function employing a block

32、 cipher algorithm. ISO/IEC9798-1:1991, Information technology Security techniques Entity authentication mechanisms Part 1: General model. ISO/IEC9798-2:1994, Information technology Security techniques Entity authentication Part 2: Mechanisms using symmetric encipherment algorithms. ISO/IEC9798-3:199

33、3, Information technology Security techniques Entity authentication mechanisms Part 3: Entity authentication using a public key algorithm. ISO/IEC9798-4:1995, Information technology Security techniques Entity authentication Part 4: Mechanisms using a cryptographic check function. ISO9807:1991, Banki

34、ng and related financial services Requirements for message authentication (retail). ISO/IEC10116:1993, Information technology Modes of operation for an n-bit block cipher algorithm. ISO/IEC10118-1:1994, Information technology Security techniques Hash-functions Part 1: General.ISO15668:1999(E) 4 ISO/

35、IEC10118-2:1994, Information technology Security techniques Hash-functions Part 2: Hash-functions using an n-bit block cipher algorithm. ISO11568(allparts), Banking Key management (retail). ISO/IEC13888-2:1998, Information technology Security techniques Non-repudiation Part 2: Mechanisms using symme

36、tric techniques. ISO/IEC13888-3:1997, Information technology Security techniques Non-repudiation Part 3: Mechanisms using asymmetric techniques. NISTFIPSPUB180-1, Secure Hash Standard (Secure Hash Algorithm SHA-1). 3 Termsanddefinitions ForthepurposesofthisInternationalStandard,thefollowingtermsandd

37、efinitionsapply. 3.1 hotlist alistofPrimaryAccountNumbers(PAN)whicharearrangedaccordingtothecardissueroritsagent,notvalidfor transactionuse 3.2 digitalsignature dataappendedto,oracryptographicformationof,adataunitthatallowsarecipientofthedataunittoprovethe sourceandintegrityofthedataunitandprotectag

38、ainstforgerye.g.bytherecipient 3.3 FileValidationValue(FVV) aderivedvalueusedforfilevalidationpurposes 3.4 hashcode theresultofapplyinghash-functiontodatabits 3.5 hash-function a(mathematical)functionwhichmapsvaluesfroma(possiblyvery)largesetofvaluesintosmallerrangeofvalues, satisfyingthefollowingtw

39、opropertieswithinthisInternationalStandard: itiscomputationallyinfeasibletofindforagivenoutputaninputwhichmapstothisoutput; itiscomputationallyinfeasibletofindforagiveninputasecondinputwhichmapstothesameoutput. 3.6 applicationmanager thepartofthesoftwareofaterminalwhichisinchargeofverifyingthesecure

40、downloadingoftheintended executableobject 3.7 MessageAuthenticationCode(MAC) acodeinamessagebetweentheoriginatorandthereceiverusedtovalidatethesourceandpartorallofthetext ofthemessage NOTE Thecodeistheresultofanagreedcalculation.ISO15668:1999(E)5 3.8 originator theentitythatcreatesthefilethathastobe

41、transferredtothereceiverandisresponsibleforitssecurity 3.9 receiver theentitythatreceivesthefile 3.10 sender theentitythatsendsthefile 3.11 sponsor theentitythatevaluatestheriskofthefiletransfer 4Principles 4.1 MessageOriginAuthentication Thepurposeofmessageoriginauthenticationistoprovideassuranceto

42、thereceiverthattheallegedoriginatoris thelegitimateoriginator.Itmayalsoprovideassurancetothereceiverthattheallegedfileistheactualfile,inthe eventthatthereceiverisauthorisedtoreceivecertainfilesfromonlyasubsetofitsauthorisedoriginators. Messageoriginauthenticationmayoccurconcurrentwiththefiletransfer

43、,thoughitmayalsooccurbeforethe transferinaconnectionmode.Ifastoreandforwardtransferisused,themessageoriginauthenticationshalloccur afterthetransfer,whenthefileisretrievedbythereceiver.(Note:transferofsecuredfilesinthemodel). Techniquesthatprovidecontentauthenticationmayprovidemessageoriginauthentica

44、tion,butthesetechniques requirethetransferoftheentirefilebeforetheauthenticationcanbeverified.Theremaybesituationsinwhichitis desirabletoperformmessageoriginauthenticationpriortoinitiatingtheactualtransfer.Asanexample,itmaybe desirabletopreventanimpostorfrommasqueradingasalegitimatefile-providerandt

45、yingupacommunications channelforanextendedtimeintransferringalongfile,eventhoughtheillegitimacyoftheoriginatorwould eventuallybedetectedandthetransferredfilerejected. 4.2 Receiverauthentication Thissecurityserviceauthenticatestheidentityofthereceiverpriortoinitiatingthetransfer,sothatthetransferwill

46、 notoccurunlessthereceiversidentityhasbeenverified. Somereceivers(POSterminals)areallowedtoreceiveonlysometypesoffiles.Partoftheauthenticationprocess isthecontrolbytheoriginatoroftherightsforthereceivertoreceivesomefile-type. Anotherpossiblereasonforusing“receiverauthentication”istopreventanunauthor

47、isedpartyfromimpersonating alegitimatereceiverandtyinguptheoriginatorscommunicationscapabilitieswhiletheoriginatortransfersa perhaps-lengthyfiletotheimpersonator. Receiverauthenticationdoesnotpreventanunauthorisedpartyfromascertainingthefilecontents(by“listening in”).Withoutthissecurityservice,andwi

48、thoutthesecurityserviceofconfidentiality,anyonecouldeasily impersonatethelegitimatereceiverandthusobtainthefile.Ifitisessentialthatonlytheauthorisedreceiver(s)ofa fileactuallyreceivethefile,thenthesecurityserviceofconfidentialitymustbeused.Onlyinthiswaycanitbe ensuredthatanunauthorisedpartyhasnot“li

49、stenedin”onthecommunicationschannelandthusobtainedacopy ofthefile. Notethatthereisarelatedsecurityservice,nonrepudiationofdelivery,thatconfirms,afterthecompletionofthe transfer,thattheauthorisedpartyhassuccessfullyreceivedthefile.ISO15668:1999(E) 6 4.3 Integrity Accidentalorunauthorisedalterationofthetransferredfile,or,ataminimum,selectedportionsofthetransferred file,shallbedetectedduringandafterthetransferprocess.Integrityservicesmaycontroltheentirefileinas

copyright@ 2008-2019 麦多课文库(www.mydoc123.com)网站版权所有
备案/许可证编号:苏ICP备17064731号-1