1、BRITISH STANDARD BS ISO/IEC 11586-4:1996 Information technology Open Systems Interconnection Generic upper layers security: Protecting transfer syntax specification (ITU-T Rec. X.833 (1995)| ISO/IEC 11586-4:1996) ICS 35.100.70BS ISO/IEC 11586-4:1996 This British Standard, having been prepared under
2、the directionof the DISC Board, was published under the authority of the Standards Board and comes into effect on 15 November 1996 BSI 11-1998 ISBN 0 580 26555 2 National foreword This British Standard reproduces verbatim ISO/IEC 11586-4:1996, and implements it as the UK national standard. The UK pa
3、rticipation in its preparation was entrusted to Technical Committee IST/21, Open Systems Interconnection, Data Management and Open Distributed Processing, which has the responsibility to: aid enquirers to understand the text; present to the responsible international/European committee any enquiries
4、on the interpretation, or proposals for change, and keep the UK interests informed; monitor related international and European developments and promulgate them in the UK. A list of organizations represented on this committee is available on request. Cross-references The British Standards which imple
5、ment international or European publications referred to in this document may be found in the BSI Standards Catalogue under the section entitled “International Standards Correspondence Index”, or using the “Find” facility of the BSI Standards Electronic Catalogue. A British Standard does not purport
6、to include all the necessary provisions of a contract. Users of British Standards are responsible for their correct application. Compliance with a British Standard does not of itself confer immunity from legal obligations. Summary of pages This document comprises a front cover, an inside front cover
7、, the ISO/IEC title page, pages ii to iv, pages 1 to 6 and a back cover. This standard has been updated (see copyright date) and may have had amendments incorporated. This will be indicated in the amendment table on theinside front cover. Amendments issued since publication Amd. No. Date CommentsBS
8、ISO/IEC 11586-4:1996 ii BSI 11-1998 Contents Page Foreword iii Introduction 1 1 Scope 1 2 Normative references 1 2.1 Identical Recommendations|International Standards 1 3 Definitions 2 4 Abbreviations 2 5 General overview 2 5.1 Model of a protecting transfer syntax 2 5.2 Initial encoding rules 3 5.3
9、 Security transformation 3 5.4 Syntax structure 3 6 Data structures for a protecting transfer syntax 4 7 Incorporation into underlying protocol 6 8 Synchronization procedures 6 9 Object identifier assignment 6 10 Conformance 6 Figure 1 Protecting transfer syntax construction at encoding system 3BS I
10、SO/IEC 11586-4:1996 BSI 11-1998 iii Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of In
11、ternational Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liai
12、son with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an In
13、ternational Standard requires approval by at least 75 % of the national bodies casting a vote. International Standard ISO/IEC 11586-4 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 21, Open systems interconnection, data management and open distribute
14、d processing, in collaboration with ITU-T. The identical text is published as ITU-T Recommendation X.833. ISO/IEC 11586 consists of the following parts, under the general title Information technology Open Systems Interconnection Generic upper layers security: Part 1: Overview, models and notation Pa
15、rt 2: Security Exchange Service Element (SESE) service definition Part 3: Security Exchange Service Element (SESE) protocol specification Part 4: Protecting transfer syntax specification Part 5: Security Exchange Service Element Protocol Implementation Conformance Statement (PICS) proforma Part 6: P
16、rotecting transfer syntax Protocol Implementation Conformance Statement (PICS) proformaiv blankBS ISO/IEC 11586-4:1996 BSI 11-1998 1 Introduction This Recommendation| International Standard forms part of a series of Recommendations|International Standards, which provide(s) a set of facilities to aid
17、 the construction of Upper Layers protocols which support the provision of security services. The parts are as follows: Part 1: Overview, Models and Notation; Part 2: Security Exchange Service Element Service Definition; Part 3: Security Exchange Service Element Protocol Specification; Part 4: Prote
18、cting Transfer Syntax Specification; Part 5: Security Exchange Service Element PICS Proforma; Part 6: Protecting Transfer Syntax PICS Proforma. This Recommendation|International Standard constitutes Part 3 of this series. 1 Scope 1.1 This series of Recommendations|International Standards defines a s
19、et of generic facilities to assist in the provision of security services in OSI applications. These include: a) a set of notational tools to support the specification of selective field protection requirements in an abstract syntax specification, and to support the specification of security exchange
20、s and security transformations; b) a service definition, protocol specification and PICS proforma for an application-service-element (ASE) to support the provision of security services within the Application Layer of OSI; c) a specification and PICS proforma for a security transfer syntax, associate
21、d with Presentation Layer support for security services in the Application Layer. 1.2 This Recommendation| International Standard defines the protecting transfer syntax, associated with Presentation Layer support for security services in the Application Layer. 2 Normative references The following Re
22、commendations and International Standards contain provisions which, through reference in this text, constitute provisions of this Recommendation|International Standard. At the time of publication, the editions indicated were valid. All Recommendations and Standards are subject to revision, and parti
23、es to agreements based on this Recommendation|International Standard are encouraged to investigate the possibility of applying the most recent edition of the Recommendations and Standards listed below. Members of IEC and ISO maintain registers of currently valid International Standards. The Telecomm
24、unication Standardization Bureau of the ITU maintains a list of currently valid ITU-T Recommendations. 2.1 Identical Recommendations|International Standards ITU-T Recommendation X.200 (1994)| ISO/IEC 7498-1:1994, Information technology Open Systems Interconnection Basic Reference Model: The Basic Mo
25、del. ITU-T Recommendation X.216 (1994)| ISO/IEC 8822:1994, Information technology Open Systems Interconnection Presentation service definition. ITU-T Recommendation X.226 (1994)| ISO/IEC 8823-1:1994, Information technology Open Systems Interconnection Connection-oriented presentation protocol: Proto
26、col specification. ITU-T Recommendation X.680 (1994)| ISO/IEC 8824-1:1995, Information technology Abstract Syntax Notation One (ASN.1): Specification of basic notation. ITU-T Recommendation X.681 (1994)| ISO/IEC 8824-2:1995, Information technology Abstract Syntax Notation One (ASN.1): Information ob
27、ject specification. ITU-T Recommendation X.682 (1994)| ISO/IEC 8824-3:1995, Information technology Abstract Syntax Notation One (ASN.1): Constraint specification. ITU-T Recommendation X.683 (1994)| ISO/IEC 8824-4:1995, Information technology Abstract Syntax Notation One (ASN.1): Parameterization of
28、ASN.1 specifications. ITU-T Recommendation X.690 (1994)| ISO/IEC 8825-1:1995, Information technology ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER).BS 2 BSI 11-1998 BS ISO/IEC 11586-4:1996 ITU-T Recommendation
29、X.803 (1994)| ISO/IEC 10/45:1995, Information technology Open Systems Interconnection Upper layers security model. ITU-T Recommendation X.830 (1995)| ISO/IEC 11586-1:1996, Information technology Open Systems Interconnection Generic upper layers security: Overview, models and notation. 3 Definitions
30、3.1 this Recommendation|International Standard makes use of the following terms defined in ITU-T Rec. X.200|ISO/IEC 7498-1: transfer syntax. 3.2 this Recommendation|International Standard makes use of the following terms defined in ITU-T Rec. X.216|ISO/IEC 8822: abstract syntax; presentation context
31、; presentation data value. 3.3 this Recommendation|International Standard makes use of the following terms defined in ITU-T Rec. X.803|ISO/IEC 10745: security association; security transformation. 3.4 this Recommendation|International Standard makes use of the following terms defined in ITU-T Rec. X
32、.830|ISO/IEC 11586-1: presentation-context-bound security association; single-item-bound security association; externally-established security association; initial encoding rules; protecting presentation context; protecting transfer syntax. 4 Abbreviations 5 General overview The concept of a protect
33、ing transfer syntax was introduced in ITU-T Rec. X.830|ISO/IEC 11586-1. This Specification defines a generic protecting transfer syntax. This Specification can be used, in conjunction with particular security transformation definitions, to generate particular protecting transfer syntaxes, tailored t
34、o satisfy particular application protection requirements. NOTEThe generic protecting transfer syntax may also prove useful in providing data compression for non-security-related purposes, however such use is outside the scope of this Specification. The generic protecting transfer syntax is based upo
35、n the security transformation model described in ITU-T Rec. X.830|ISO/IEC 11586-1. The purpose of a protecting transfer syntax is to provide a standard means for representing, for transfer purposes, the following information items: the transformed item resulting from applying the encoding process of
36、 a security transformation to a representation of an unprotected item which is to be protected; protected static and dynamic parameters of a security transformation, which achieve protection by being processed in the encoding process of a security transformation (along with the representation of the
37、 unprotected item); unprotected static and dynamic parameters of a security transformation; on the first PDV of a protecting presentation context, or a protected PDV sent outside a presentation context, either: a) in the case of a presentation-context-bound or single-item-bound security association,
38、 an identifier of the security transformation; b) in the case of an externally-established security association, an identifier of that security association. Use of a protecting transfer syntax is negotiated by the presentation protocol or announced in an ASN.1 EXTERNAL or EMBEDDED PDV construct. It
39、can be applied to any abstract syntax, which may be specified using ASN.1 or by other means. Object identifiers for negotiating or announcing protecting transfer syntaxes are addressed in clause 9. A protecting transfer syntax is a context-sensitive transfer syntax, i.e. state is retained within enc
40、oders and decoders. 5.1 Model of a protecting transfer syntax Figure 1 illustrates, in finer detail than in ITU-T Rec. X.830|ISO/IEC 11586-1, the operations associated with a protecting transfer syntax at an encoding system (the corresponding operations at a decoding system follow naturally). GULS G
41、eneric Upper Layers Security OSI Open Systems Interconnection PDU Protocol-data-unit PDV Presentation data value PICS Protocol implementation conformance statementBS ISO/IEC 11586-4:1996 BSI 11-1998 3 5.2 Initial encoding rules The initial encoding process (in the encoding system) and corresponding
42、decoding process (in the decoding system) map between an abstract syntax and an unprotected syntax. The rules applied to this process are known as the initial encoding rules. NOTEFor an ASN.1-based abstract syntax, this mapping will typically employ some variant of the ASN.1 encoding rules. Single-v
43、alued encoding rules (e.g. the ASN.1 Canonical Encoding Rules or Distinguished Encoding Rules) should be applied where the transformation is a function of data which may also be sent separately, particularly when used via a relay system. The initial encoding rules for use in a protecting transfer sy
44、ntax are established as follows: a) if the security transformation in use provides for conveying an identifier of a specific set of encoding rules as a static (protected or unprotected) parameter, and if this parameter is present in the applicable first-PDV field, then these encoding rules are used;
45、 otherwise b) the encoding rules indicated by the b) when the PDV transfer relates to an externally established security association, the security transformation identifier is an attribute of that security association. The rules of a security transformation indicate how a bit string of user data and
46、 a set of protected parameter values are to map to an ASN.1 value for transfer purposes. 5.4 Syntax structure A protecting transfer syntax defines the data structure used to convey the output of the encoding process of a security transformation, plus unprotected parameters and identifiers of the sec
47、urity transformation or security association (as applicable). The data structure transferred has a different variant for each of the cases: Figure 1 Protecting transfer syntax construction at encoding systemBS 4 BSI 11-1998 BS ISO/IEC 11586-4:1996 a) the first PDV of a protecting presentation contex
48、t in a presentation-context-bound security association, or the one PDV in a single-item-bound security association; b) the first PDV of a protecting presentation context, or a protected PDV sent outside a presentation context, in the case of an externally established security association; c) a subse
49、quent PDV in a protecting presentation context. 6 Data structures for a protecting transfer syntax The set of data structures used by a protecting transfer syntax is defined by the ASN.1 type SyntaxStructure in the following ASN.1 module. The SyntaxStructure type is parameterized by the object set ValidSTs, which is a set of SECURITY-TRANSFORMATION objects. When a value for ValidSTs is supplied, together with the corresponding security transformation speci
