ITU-T X 1528-2012 Common platform enumeration (Study Group 17)《通用平台枚举 17号研究组》.pdf

1、 International Telecommunication Union ITU-T X.1528TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (09/2012) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Vulnerability/state exchange Common platform enumeration Recommendation ITU-T X.1528 ITU-T

2、X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MAN

3、AGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES

4、 Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 C

5、ountering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539Event

6、/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1528 (09/2012) i R

7、ecommendation ITU-T X.1528 Common platform enumeration Summary Recommendation ITU-T X.1528 provides a structured method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprises computing assets. Common platform enumeration (CPE) is d

8、efined through a set of specifications in a stack-based model, where capabilities are based on simpler, more narrowly defined elements that are specified lower in the stack. The stack consists of a dictionary specification and an applicability language specification that rely on a name matching spec

9、ification which relies on a naming specification. History Edition Recommendation Approval Study Group 1.0 ITU-T X.1528 2012-09-07 17 ii Rec. ITU-T X.1528 (09/2012) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, in

10、formation and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a

11、worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down

12、in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication ad

13、ministration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory p

14、rovisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attenti

15、on to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others o

16、utside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the

17、 latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2012 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1528 (09/2012) iii

18、Table of Contents Page 1 Scope 1 2 References. 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 1 5 Conventions 1 6 High-level requirements . 1 6.1 CPE stack 2 iv Rec. ITU-T X.1528 (09/2012) Introduction This Recommendation on

19、common platform enumeration (CPE) provides a structured method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprises computing assets. CPE does not identify unique instantiations of products on systems, such as the installation of

20、 XYZ Visualizer Enterprise Suite 4.2.3 with serial number Q472B987P113. Rather, CPE identifies abstract classes of products, such as XYZ Visualizer Enterprise Suite 4.2.3, XYZ Visualizer Enterprise Suite (all versions), or XYZ Visualizer (all variations). IT management tools can collect information

21、about installed products, identifying these products using their CPE names, and then use this structured information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability manage

22、ment tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organizations policies. This example illustrates how CPE names can be used as a structured source of inf

23、ormation for enforcing and verifying IT management policies across tools. This Recommendation is intended to be technically compatible with CPE Specification 2.3, 3 June 2011. Rec. ITU-T X.1528 (09/2012) 1 Recommendation ITU-T X.1528 Common platform enumeration 1 Scope Common platform enumeration (C

24、PE) describes and identifies classes of applications, operating systems, and hardware devices present among an enterprises computing assets. CPE does not identify unique instantiations of products on systems, but only abstract classes of products. 2 References None. 3 Definitions 3.1 Terms defined e

25、lsewhere None. 3.2 Terms defined in this Recommendation None. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: CPE Common Platform Enumeration NIST National Institute of Standards and Technology NISTIR NIST Interagency Report URI Uniform Resource Identi

26、fier WFN Well-Formed Name 5 Conventions The following terms are considered equivalent: In ITU use of the word “shall“ and “must“ and their negatives are considered equivalent. In ITU use of the word “shall“ is equivalent to the NISTIR use of the word “MUST“. In ITU use of the phrase “shall not“ is e

27、quivalent to the NISTIR use of the term “MUST NOT“. NOTE In the NISTIR use of the words “shall“ and “must“ (in lower case) are used for informative text. The ITU-T term “CPE stack“ and the NISTIR term “CPE 2.3 stack“ are considered equivalent. 6 High-level requirements Figure 1 below shows the curre

28、nt CPE stack, with the most fundamental layer (Naming) at the bottom. Each higher layer builds on top of the layers below it. 2 Rec. ITU-T X.1528 (09/2012) X.1528(12)_F01Applicability language DictionaryName matchingNamingFigure 1 Common platform component relationships As the use of CPE continues t

29、o grow, it is anticipated that additional specifications will be added to the CPE stack. 6.1 CPE stack Naming The naming specification defines the logical structure of well-formed names (WFNs), URI bindings, and formatted string bindings, and the procedures for converting WFNs to and from the bindin

30、gs. Name matching The name matching specification defines the procedures for comparing WFNs to each other so as to determine whether they refer to some or all of the same products. Dictionary The dictionary specification defines the concept of a CPE dictionary, which is a repository of CPE names and

31、 metadata, with each name identifying a single class of IT product. The dictionary specification defines processes for using the dictionary, such as how to search for a particular CPE name or look for dictionary entries that belong to a broader product class. Also, the dictionary specification outli

32、nes all the rules that dictionary maintainers must follow when creating new dictionary entries and updating existing entries. Applicability language The applicability language specification defines a structured method for forming complex logical expressions out of WFNs. These expressions, also known

33、 as applicability statements, are used to tag checklists, policies, guidance, and other documents with information about the product(s) to which the documents apply. For example, a security checklist for a specific numbered version of a web browser running on a specific version of an operating syste

34、m could be tagged with a single applicability statement that ensures only systems with both that particular numbered version of that web browser and that specific version of that operating system will have the security checklist applied. Printed in Switzerland Geneva, 2012 SERIES OF ITU-T RECOMMENDA

35、TIONS Series A Organization of the work of ITU-T Series D General tariff principles Series E Overall network operation, telephone service, service operation and human factors Series F Non-telephone telecommunication services Series G Transmission systems and media, digital systems and networks Serie

36、s H Audiovisual and multimedia systems Series I Integrated services digital network Series J Cable networks and transmission of television, sound programme and other multimedia signals Series K Protection against interference Series L Construction, installation and protection of cables and other ele

37、ments of outside plant Series M Telecommunication management, including TMN and network maintenance Series N Maintenance: international sound programme and television transmission circuits Series O Specifications of measuring equipment Series P Terminals and subjective and objective assessment metho

38、ds Series Q Switching and signalling Series R Telegraph transmission Series S Telegraph services terminal equipment Series T Terminals for telematic services Series U Telegraph switching Series V Data communication over the telephone network Series X Data networks, open system communications and security Series Y Global information infrastructure, Internet protocol aspects and next-generation networks Series Z Languages and general software aspects for telecommunication systems