CAN CSA-ISO IEC 15816-2004 Information technology - Security techniques - Security information objects for access control.pdf

1、 Reference numberISO/IEC 15816:2002(E)ISO/IEC 2002Information technology Security techniques Security information objects for access control Technologies de linformation Techniques de scurit Objets dinformations de scurit pour le contrle daccs National Standard of CanadaCAN/CSA-ISO/IEC 15816:04(ISO/

2、IEC 15816:2002)International Standard ISO/IEC 15816:2002 (first edition, 2002-02-01) has been adopted without modification(IDT) as CSA Standard CAN/CSA-ISO/IEC 15816:04, which has been approved as a National Standard of Canadaby the Standards Council of Canada.ISBN 1-55397-316-X January 2004The Cana

3、dian Standards Association (CSA), The Standards Council of Canada is theunder whose auspices this National Standard has been coordinating body of the National Standards system, produced, was chartered in 1919 and accredited by a federation of independent, autonomousthe Standards Council of Canada to

4、 the National organizations working towards the furtherStandards system in 1973. It is a not-for-profit, development and improvement of voluntarynonstatutory, voluntary membership association standardization in the national interest.engaged in standards development and certification The principal ob

5、jects of the Council are to foster activities. and promote voluntary standardization as a means CSA standards reflect a national consensus of of advancing the national economy, benefiting theproducers and users including manufacturers, health, safety, and welfare of the public, assisting consumers,

6、retailers, unions and professional and protecting the consumer, facilitating domestic organizations, and governmental agencies. The and international trade, and furthering internationalstandards are used widely by industry and commerce cooperation in the field of standards.and often adopted by munic

7、ipal, provincial, and A National Standard of Canada is a standard whichfederal governments in their regulations, particularly in has been approved by the Standards Council ofthe fields of health, safety, building and construction, Canada and one which reflects a reasonableand the environment. agreem

8、ent among the views of a number of capableIndividuals, companies, and associations across individuals whose collective interests provide to theCanada indicate their support for CSAs standards greatest practicable extent a balance ofdevelopment by volunteering their time and skills to representation

9、of producers, users, consumers, andCSA Committee work and supporting the Associations others with relevant interests, as may be appropriateobjectives through sustaining memberships. The more to the subject in hand. It normally is a standardthan 7000 committee volunteers and the 2000 which is capable

10、 of making a significant and timelysustaining memberships together form CSAs total contribution to the national interest.membership from which its Directors are chosen. Approval of a standard as a National Standard ofSustaining memberships represent a major source of Canada indicates that a standard

11、 conforms to theincome for CSAs standards development activities. criteria and procedures established by the StandardsThe Association offers certification and testing Council of Canada. Approval does not refer to theservices in support of and as an extension to its technical content of the standard;

12、 this remains thestandards development activities. To ensure the continuing responsibility of the accreditedintegrity of its certification process, the Association standards-development organization.regularly and continually audits and inspects products Those who have a need to apply standards areth

13、at bear the CSA Mark. encouraged to use National Standards of CanadaIn addition to its head office and laboratory complex whenever practicable. These standards are subject in Toronto, CSA has regional branch offices in major to periodic review; therefore, users are cautioned centres across Canada an

14、d inspection and testing to obtain the latest edition from the organizationagencies in eight countries. Since 1919, the preparing the standard.Association has developed the necessary expertise to The responsibility for approving National Standards meet its corporate mission: CSA is an independent of

15、 Canada rests with theservice organization whose mission is to provide an Standards Council of Canadaopen and effective forum for activities facilitating the 270 Albert Street, Suite 200exchange of goods and services through the use of Ottawa, Ontario, K1P 6N7standards, certification and related ser

16、vices to meet Canadanational and international needs.For further information on CSA services, write toCanadian Standards Association5060 Spectrum Way, Suite 100Mississauga, Ontario, L4W 5N6CanadaCette Norme nationale du Canada est offerte en anglais et en franais.Although the intended primary applic

17、ation of this Standard is stated in its Scope, it is importantto note that it remains the responsibility of the users to judge its suitability for their particular purpose.Registered trade-mark of Canadian Standards AssociationCAN/CSA-ISO/IEC 15816:04 Security information objects for access controlI

18、nformation technology Security techniques January 2004 Canadian Standards Association CSA/1CAN/CSA-ISO/IEC 15816:04Information technology Securitytechniques Security informationobjects for access controlCSA PrefaceStandards development within the Information Technology sector is harmonized with inte

19、rnationalstandards development. Through the CSA Technical Committee on Information Technology (TCIT),Canadians serve as the Canadian Advisory Committee (CAC) on ISO/IEC Joint Technical Committee 1 onInformation Technology (ISO/IEC JTC1) for the Standards Council of Canada (SCC), the ISO memberbody f

20、or Canada and sponsor of the Canadian National Committee of the IEC. Also, as a member of theInternational Telecommunication Union (ITU), Canada participates in the International Telegraph andTelephone Consultative Committee (ITU-T).This International Standard was reviewed by the CSA TCIT under the

21、jurisdiction of the StrategicSteering Committee on Information Technology and deemed acceptable for use in Canada. (Acommittee membership list is available on request from the CSA Project Manager.) From time to time,ISO/IEC may publish addenda, corrigenda, etc. The CSA TCIT will review these documen

22、ts for approvaland publication. For a listing, refer to the CSA Information Products catalogue or CSA Info Update orcontact a CSA Sales representative. This Standard has been formally approved, without modification, bythe Technical Committee and has been approved as a National Standard of Canada by

23、the StandardsCouncil of Canada.January 2004 Canadian Standards Association 2004All rights reserved. No part of this publication may be reproduced in any form whatsoever without the prior permission ofthe publisher. ISO/IEC material is reprinted with permission. Where the words “this International St

24、andard” appear in thetext, they should be interpreted as “this National Standard of Canada”. Inquiries regarding this National Standard of Canada should be addressed to Canadian Standards Association 5060 Spectrum Way, Suite 100, Mississauga, Ontario, Canada L4W 5N6 1-800-463-6727 416-747-4044www.cs

25、a.caReference numberISO/IEC 15816:2002(E)ISO/IEC 2002INTERNATIONAL STANDARD ISO/IEC15816First edition2002-02-01Information technology Security techniques Security information objects for access control Technologies de linformation Techniques de scurit Objets dinformations de scurit pour le contrle d

26、accs ISO/IEC 15816:2002(E) PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing.

27、 In downloading this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be foun

28、d in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the

29、address given below. ISO/IEC 2002 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below

30、 or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.ch Web www.iso.ch ii ISO/IEC 2002 All rights reservedISO/IEC 15816:2002(E) ISO/IEC 2002 All rights reserved iiiCONTENTS Page 1

31、 Scope 1 2 Normative references 1 2.1 Identical Recommendations | International Standards. 1 2.2 Paired Recommendations | International Standards equivalent in technical content. 2 3 Definitions 2 4 Abbreviations 2 5 Conventions 3 5.1 Security Information Object Class Description. 3 5.2 Generic Secu

32、rity Information Object Class Correspondence 3 5.3 Security Information Object Composition. 3 6 Specification of Security Information Objects 3 6.1 Confidentiality Label. 3 6.1.1 Introduction . 3 6.1.2 ASN.1 Specification of the Label 4 6.1.3 Binding Methods for Confidentiality Labels. 5 6.2 Securit

33、y Policy Information File . 5 6.2.1 Introduction . 5 6.2.2 ASN.1 Specification of the Security Policy Information File . 6 6.3 Clearance Attribute 9 6.3.1 Introduction . 9 6.3.2 Definition of clearance attribute 10 7 Security Information Object Interaction . 10 7.1 SIO Class Structure Comparison. 10

34、 7.2 Security Information Object Interaction for Access Control. 10 Annex A Security Information Objects for Access Control in ASN.1. 13 Annex B Expansion of the SECURITY-CATEGORY Syntax 19 ISO/IEC 15816:2002(E) iv ISO/IEC 2002 All rights reservedForeword ISO (the International Organization for Stan

35、dardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organiza

36、tion to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology,

37、 ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adop

38、ted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this International Standard may be

39、the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 15816 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques, in collaboration with ITU-T. The identical

40、 text is published as ITU-T Rec. X.841. Annex A forms a normative part of of this International Standard. Annex B is for information only. ISO/IEC 15816:2002(E) ISO/IEC 2002 All rights reserved vIntroduction This Recommendation | International Standard on Security Information Objects (SIOs) for Acce

41、ss Control provides object definitions that are commonly needed in more than one security standard such that multiple and different definitions of the same functionality may be avoided. Precision in these definitions is achieved by use of the Abstract Syntax Notation One (ASN.1) defined in ITU-T Rec

42、. X.680 (1997) | ISO/IEC 8824-1:1998, and ITU-T Rec. X.681 (1997) | ISO/IEC 8824-2:1998. The aim of security management is to ensure that assets, including information, are protected appropriately and cost effectively. In order to protect proprietary interests and Intellectual Property Rights, organ

43、izations need to control the handling of their information. Severe damage or embarrassment can be caused to either the originator or holder of sensitive information, for example, if it is released to those not authorized to receive it (a breach of confidentiality), or if it is modified in any way (a

44、 breach of integrity). Each organization needs to ensure that it protects its own information and assets adequately in all forms during its storage, processing and transmission between and within organizations over both private and public networks. Organizations must be satisfied that their assets w

45、ill be protected properly when they are held or processed by others if business is to be conducted more widely. The motivation for development of SIOs for Access Control is the achievement of the flexibility and interoperability in security management that accrues from the use of common structures f

46、or similar functions. Standardization of security labels and alternative methods for access control have been pursued in this Recommendation | International Standard. ISO/IEC 15816 : 2002 (E) ITU-T X.841 (10/2000 E) 1 INTERNATIONAL STANDARD ISO/IEC 15816 : 2001 (E) ITU-T RECOMMENDATION INFORMATION T

47、ECHNOLOGY SECURITY TECHNIQUES SECURITY INFORMATION OBJECTS FOR ACCESS CONTROL 1 Scope The scope of this Recommendation | International Standard is: a) the definition of guidelines for specifying the abstract syntax of generic and specific Security Information Objects (SIOs) for Access Control; b) th

48、e specification of generic SIOs for Access Control; c) the specification of specific SIOs for Access Control. The scope of this Recommendation | International Standard covers only the “statics“ of SIOs through syntactic definitions in terms of ASN.1 descriptions and additional semantic explanations.

49、 It does not cover the “dynamics“ of SIOs, for example rules relating to their creation and deletion. The dynamics of SIOs are a local implementation issue. 2 Normative references The following Recommendations and International Standards contain provisions which, through reference in this text, constitute provisions of this Recommendation | International Standard. At the time of publication, the editions indicated were valid. All Recommendations and Standards are subject to revision, and parties to ag