1、BSI Standards PublicationBS ISO 16678:2014Guidelines for interoperableobject identification andrelated authentication systemsto deter counterfeiting andillicit tradeBS ISO 16678:2014 BRITISH STANDARDNational forewordThis British Standard is the UK implementation of ISO 16678:2014.The UK participatio
2、n in its preparation was entrusted to TechnicalCommittee SSM/1/2, Security Management.A list of organizations represented on this committee can beobtained on request to its secretary.This publication does not purport to include all the necessaryprovisions of a contract. Users are responsible for its
3、 correctapplication. The British Standards Institution 2014. Published by BSI StandardsLimited 2014ISBN 978 0 580 75436 4ICS 13.310Compliance with a British Standard cannot confer immunity fromlegal obligations.This British Standard was published under the authority of theStandards Policy and Strate
4、gy Committee on 31 July 2014.Amendments issued since publicationDate Text affectedBS ISO 16678:2014 ISO 2014Guidelines for interoperable object identification and related authentication systems to deter counterfeiting and illicit tradeLignes directrices pour lidentification interoprable dobjets et s
5、ystmes dauthentification associs destins dcourager la contrefaon et le commerce illiciteINTERNATIONAL STANDARDISO16678First edition2014-07-01Reference numberISO 16678:2014(E)BS ISO 16678:2014ISO 16678:2014(E)ii ISO 2014 All rights reservedCOPYRIGHT PROTECTED DOCUMENT ISO 2014All rights reserved. Unl
6、ess otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the
7、address below or ISOs member body in the country of the requester.ISO copyright officeCase postale 56 CH-1211 Geneva 20Tel. + 41 22 749 01 11Fax + 41 22 749 09 47E-mail copyrightiso.orgWeb www.iso.orgPublished in SwitzerlandBS ISO 16678:2014ISO 16678:2014(E) ISO 2014 All rights reserved iiiContents
8、PageForeword ivIntroduction v1 Scope . 12 Terms, definitions, abbreviations, and acronyms 12.1 Terms and definitions . 12.2 Abbreviations and acronyms 43 Overview . 43.1 General . 43.2 Object identification systems (in operation) 53.3 Object identification systems (setup) . 64 Key principals 84.1 Av
9、ailability and timely response . 84.2 One authoritative source 84.3 Data management 94.4 Need to know 94.5 Data protection . 94.6 Privacy 94.7 Regulatory compliance 94.8 Vetting . 94.9 Interoperability 94.10 UID generation . 105 Guidance .105.1 Introduction . 105.2 Determination of trusted services
10、105.3 Management of object identification data and attributes 115.4 Common frauds . 13Annex A (informative) Digital certificate (for inspectors) 16Annex B (informative) Master data management 18Annex C (informative) Illustrative implementation examples .19Bibliography .24BS ISO 16678:2014ISO 16678:2
11、014(E)ForewordISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for whic
12、h a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all ma
13、tters of electrotechnical standardization.The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of ISO documents should be noted. This d
14、ocument was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives). Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or al
15、l such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents). Any trade name used in this document is information given for the convenience of users an
16、d does not constitute an endorsement.For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplementary in
17、formationThe committee responsible for this document is ISO/TC 247, Fraud Countermeasures and Controls.iv ISO 2014 All rights reservedBS ISO 16678:2014ISO 16678:2014(E)IntroductionThis International Standard makes three foundational assumptions. First, detecting counterfeit objects is a complex and
18、often difficult task; second, accurate identity information about the object in question simplifies the counterfeit detection process; and third, accurate identity information is often difficult and hard to find.The main objective of this International Standard is to simplify access and delivery of
19、accurate identity information to trusted agents (inspectors) in the process of authenticating objects.To accomplish this objective, the document provides guidance intended to make object identity information easier to find and use. Identity data and information can be found in many places, including
20、 verification and authentication systems. Granting inspectors access to identity information helps them detect counterfeits. Helping inspectors find the identity information helps them detect counterfeits. This leads us to the conclusion that:Improving interoperability of object identification and r
21、elated authentication systems should make these systems easier for inspectors to use. Improving ease-of-use should increase inspector utilization of the multitude of systems containing accurate information, thus, increasing detection of counterfeits and reducing the losses caused by counterfeiting.T
22、his International Standard focuses attention on routing requests for object information to the appropriate authoritative service and then routing responses back to inspectors.Object identification systems commonly use Unique Identifiers (UID) to reference or access object information. UID can be ass
23、igned to a class of objects or can be assigned to distinct object. In either case, the UID can enhance detection of counterfeiting and fraud, although UIDs assigned to single instances can be more efficient. The International Standard is organized into six (6) major sections: Scope: Declares the lim
24、its of this International Standard as providing only guidance and advice. There are no requirements in this International Standard. Terms: Defines the contextual meaning of important terms as used in this International Standard such as “trusted agent”, “inspector”, and “semantic interoperability”. O
25、verview: An outline of how object information is used to detect counterfeits. Key Principals: The concepts and values that have influenced the guidance. Guidance: Recommendations that should improve interoperability of systems capable of providing object information to inspectors. Informative Annexe
26、s: Specific examples that illustrate some of the concepts presented in this International Standard.Desired OutcomesThe more validation or authentication solutions are used, the more effective they become at detecting and deterring frauds such as counterfeiting and illegal diversion. This Internation
27、al Standard intends to enable reliable and safe object identification to deter introduction of illegal objects to the market.One goal of this International Standard is to describe a framework in which disparate object identification solutions are interoperable and trust is increased, and therefore w
28、ill be used more frequently. The framework shall also include solutions which simply detect some counterfeits without authenticating products. Likewise, the framework shall also include a solution which only evaluates an authentication element.Since we also anticipate that the object identification
29、systems themselves will also be counterfeited and copied, this International Standard establishes a method to formally prove that a remote description of an object can be trusted. Consideration is given to prevent interference between different independent ISO 2014 All rights reserved vBS ISO 16678:
30、2014ISO 16678:2014(E)implementations of such systems and to allow an unambiguous unique identification reference to service multiple uses and applications.The theory supporting the design of the system is that a lack of trust and lack of interoperability introduces friction for users. By reducing th
31、is friction, there will be greater awareness and usage, and therefore greater detection and deterrence of fraud.vi ISO 2014 All rights reservedBS ISO 16678:2014INTERNATIONAL STANDARD ISO 16678:2014(E)Guidelines for interoperable object identification and related authentication systems to deter count
32、erfeiting and illicit trade1 ScopeThis International Standard describes framework for identification and authentication systems. It provides recommendations and best practice guidance that include consequences and guidance of management and verification of identifiers, physical expression of identif
33、iers, and participants due diligence. vetting of all participants within the system, relationship between the unique identifier and possible authentication elements related to it, questions that deal with the identification of the inspector and any authorized access to privileged information about t
34、he object, and inspector access history (logs).Accordingly, this International Standard establishes a framework and outlines functional units used to achieve trustworthiness and interoperability of such systems.This International Standard does not specify any specific technical solutions, but instea
35、d describes processes, functions, and functional units using a generic model to illustrate what solutions have in common.Object identification systems can incorporate other functions and features such as supply chain traceability, quality traceability, marketing activities, and others, but these asp
36、ects are out of scope of this International Standard.NOTE This International Standard does not refer to industry specific requirements such as Global Trade Item Number.2 Terms, definitions, abbreviations, and acronymsFor the purposes of this document, the following terms and definitions apply.2.1 Te
37、rms and definitions2.1.1attribute data management systemADMSthe system that stores, manages, and controls access of data pertaining to objects2.1.2authenticationprocess of corroborating an entity or attributes with a specified or understood level of assuranceSOURCE: ISO/IEC 29115 ISO 2014 All rights
38、 reserved 1BS ISO 16678:2014ISO 16678:2014(E)2.1.3authentication functionthe function performing authentication2.1.4authoritative sourcethe official origination of an attribute which is also responsible for maintaining that attribute2.1.5custodian copya duplicate that is subordinate to the authorita
39、tive source2.1.6entitysomething that has separate and distinct existence and that can be identified within contextNote 1 to entry: An entity can be human, organization, a physical object, class of objects, or intangible object.SOURCE: ISO/IEC 291152.1.7identificationprocess of recognizing the attrib
40、utes that identify the objectSOURCE: ISO/IEC 291152.1.8identifiera specified set of attributes assigned to an entity for the purpose of identification2.1.9identityset of attributes that are related to an entityNote 1 to entry: An identity can have unique attributes that enable an object to be distin
41、guished from all others.Note 2 to entry: Identity can be viewed in terms of human, organization, and objects (physical and intangible).2.1.10inspectoranyone who uses the object examination function with the aim of evaluating an objectNote 1 to entry: Any participant within the system can act as an i
42、nspector.Note 2 to entry: Inspectors can have different levels of qualification and training.Note 3 to entry: The inspector could be an automated system.2.1.11inspector access historyaccess logs detailing when unique identifier codes (UID) were checked, optionally by which (privileged) inspector, an
43、d optionally from what specific locationNote 1 to entry: Time stamps are often used.2.1.12interoperabilityability of single entry point to route queries for objects carrying UIDs to the responsible authoritative source for trusted verification function (TVF)Note 1 to entry: Ability of multiple authe
44、ntication systems to deliver similar responses to user groups.2 ISO 2014 All rights reservedBS ISO 16678:2014ISO 16678:2014(E)2.1.13objectany single and distinct entity that can be identified2.1.14object examination functionOEFprocess of finding or determining the UID or other attributes intended to
45、 authenticateNote 1 to entry: In this process, other attributes can assist in the evaluation of the UID.2.1.15ownerentity that legally controls the licensing and user rights and distribution of the object associated with the UID2.1.16participantsolution providers for interoperable object identificat
46、ion and related authentication systems and its user groups including but not limited to rights holders, customs officers, distributors, and consumers2.1.17semantic interoperabilitythe ability of two or more systems or services to automatically interpret and use information that has been exchanged ac
47、curately2.1.18syntactic interoperabilitythe ability of two or more systems or services to exchange structured information2.1.19trusted query processing functionTQPFfunction which provides a gateway to trusted verification function (TVF) and attribute management data system (ADMS)Note 1 to entry: Thi
48、s includes software running locally on a hand-held device.2.1.20trusted verification functionTVFfunction which verifies whether a UID received is valid or not and, manages response according to rules and access privileges2.1.21unique IdentifierUIDa code that represents a single and specific set of a
49、ttributes that are related to an object or class of objects during its life within a particular domain and scope of an object identification system2.1.22verificationa check that a UID exists and is valid within an object identification systemNote 1 to entry: Verification can detect some types of fraud, but by itself does not prove an entity is authentic. ISO 2014 All rights reserved 3BS ISO 16678:2014ISO 16678:2014(E)2.2 Abbreviations and acronymsADMS Attribute Data Management SystemAI Application Identifier (see MH10.8.2)C
