1、 International Telecommunication Union ITU-T X.1528.3TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (09/2012) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Vulnerability/state exchange Common platform enumeration dictionary Recommendation ITU-T
2、X.1528.3 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.6
3、00X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIO
4、NS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity
5、 X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.
6、1520X.1539Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.152
7、8.3 (09/2012) i Recommendation ITU-T X.1528.3 Common platform enumeration dictionary Summary Recommendation ITU-T X.1528.3 defines the common platform enumeration (CPE) dictionary specification. The CPE dictionary specification is a part of a stack of CPE specifications that support a variety of use
8、 cases relating to information technology (IT) product description and naming. An individual CPE dictionary is a repository of IT product names, with each name in the repository identifying a unique class of IT product in the world. This specification defines the semantics of the CPE Dictionary data
9、 model and the rules associated with CPE dictionary creation and management. This Recommendation also defines and explains the requirements that IT products and services, including CPE dictionaries, must meet to claim compliance with this Recommendation. This is achieved by listing the relevant clau
10、ses of the NIST Interagency Report 7697 Common Platform Enumeration: Name Matching Specification version 2.3 and showing whether they are normative or informative. History Edition Recommendation Approval Study Group 1.0 ITU-T X.1528.3 2012-09-07 17 ii Rec. ITU-T X.1528.3 (09/2012) FOREWORD The Inter
11、national Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, op
12、erating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn,
13、 produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE I
14、n this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g
15、., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not su
16、ggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the ev
17、idence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which
18、 may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2012 All rights reserved. No part of this publication may
19、 be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1528.3 (09/2012) iii Table of Contents Page 1 Scope 1 2 References. 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 1 5 Convent
20、ions 2 6 Dictionary specification 2 6.1 Introduction 2 6.2 Definitions and abbreviations . 2 6.3 Relationship to existing specifications and standards 2 6.4 Conformance 2 6.5 CPE dictionary data model . 2 6.6 Dictionary creation and maintenance . 3 6.7 Dictionary use . 3 6.8 CPE dictionary operation
21、s and pseudocode . 4 iv Rec. ITU-T X.1528.3 (09/2012) Introduction Common platform enumeration (CPE) is a structured method of describing and identifying classes of applications, operating systems, and hardware devices present in an enterprises computing assets. CPE can be used as a source of inform
22、ation for enforcing and verifying information technology (IT) management policies relating to these assets, such as vulnerability, configuration, and remediation policies. IT management tools can collect information about installed products, identify products using their CPE names, and use this stru
23、ctured information to help make fully or partially automated decisions regarding the assets. CPE consists of several modular specifications. Combinations of the specifications work together in layers to perform various functions. This specification, CPE Dictionary, defines a structured method for cr
24、eating and managing CPE dictionaries. A dictionary is a repository of CPE names and metadata associated with the names. Each CPE name in the dictionary identifies a single class of IT product in the world. The word “class“ here signifies that the object identified is not a physical instantiation of
25、a product on a system, but rather the abstract model of that product. Although organizations may use a CPE name to represent either a single product class or a set of multiple product classes, a CPE dictionary stores only bound forms of well-formed CPE names (WFNs) that identify a single product cla
26、ss, not a set of product classes. These single product-class WFNs in bound form are referred to as identifier names. An example of a WFN and its bound forms is shown below for a fictitious product. WFN: wfn:part=“o“,vendor=“xyz“,product=“visualizer_enterprise_suite“,version=“4.2.3“, update=“beta“,ed
27、ition=NA,language=NA,sw_edition=“demo_version“, target_sw=NA,target_hw=“x64“,other=NA WFN bound to a URI: cpe:/o:xyz:visualizer_enterprise_suite:4.2.3:beta:-demo_version-x64- WFN bound to a formatted string: cpe:2.3:o:xyz:vsiualizer_enterprise_suite:4.2.3:beta:-:-:demo_version:-:x64:- Rec. ITU-T X.1
28、528.3 (09/2012) 1 Recommendation ITU-T X.1528.3 Common platform enumeration dictionary 1 Scope This Recommendation defines the common platform enumeration (CPE) dictionary specification. This includes formally defining the concept of a CPE dictionary, the rules and policies relating to dictionary in
29、stantiation and management, and the data model that represents all dictionary concepts and relationships. This Recommendation also establishes the concept of an official CPE dictionary, as well as the process for how organizations can extend the official CPE dictionary using extended CPE dictionarie
30、s. As this Recommendation defines these specifications by listing the relevant clauses of the NIST Interagency Report 7697 Common Platform Enumeration: Dictionary Specification version 2.3 and showing whether they are normative or informative, all other versions are out of the scope of this Recommen
31、dation as are all CPE specifications other than CPE dictionary. Operational guidelines, such as suggested processes for submitting new entries to a dictionary, are also out of the scope of this Recommendation. 2 References The following ITU-T Recommendations and other references contain provisions w
32、hich, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of
33、 applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation.
34、NISTIR 7697 NIST Interagency Report 7697, Common Platform Enumeration: Dictionary Specification Version 2.3, August 2011. 3 Definitions 3.1 Terms defined elsewhere None. 3.2 Terms defined in this Recommendation None. 4 Abbreviations and acronyms CPE Common Platform Enumeration NIST National Institut
35、e of Standards and Technology NISTIR NIST Interagency Report URI Uniform Resource Identifier WFN Well-formed CPE Name 2 Rec. ITU-T X.1528.3 (09/2012) 5 Conventions The following terms are considered equivalent: In ITU use of the word shall and must and their negatives are considered equivalent. In I
36、TU use of the word shall is equivalent to the NISTIR use of the word MUST. In ITU use of the phrase shall not is equivalent to the NISTIR use of the term MUST NOT. NOTE In the NISTIR use of the words shall and must (in lower case) are used for informative text. 6 Dictionary specification This clause
37、 defines the specification for common platform enumeration (CPE) name matching. It provides direct references to NIST Interagency Report 7697 Common Platform Enumeration: Dictionary Specification version 2.3 through alignment of the clauses with the section numbers such that clause 6.x aligns with N
38、ISTIR 7697 section x with matching titles. 6.1 Introduction b-NISTIR 7697 section 1 is informative. 6.2 Definitions and abbreviations b-NISTIR 76967 section 2 is informative. 6.3 Relationship to existing specifications and standards b-NISTIR 7697 section 3 is informative. 6.4 Conformance b-NISTIR 76
39、97 section 4 is informative. 6.5 CPE dictionary data model NISTIR 7697 section 5 is normative. 6.5.1 The element NISTIR 7697 section 5.1 is normative. 6.5.2 The element NISTIR 7697 section 5.2 is normative. 6.5.3 The element NISTIR 7697 section 5.3 is normative. 6.5.4 The element NISTIR 7697 section
40、 5.4 is normative. 6.5.5 The element NISTIR 7697 section 5.5 is normative. Rec. ITU-T X.1528.3 (09/2012) 3 6.5.6 The element NISTIR 7697 section 5.6 is normative. 6.5.7 Extension points NISTIR 7697 section 5.7 is normative. 6.6 Dictionary creation and maintenance NISTIR 7697 section 6 is normative.
41、6.6.1 Acceptance criteria NISTIR 7697 section 6.1 is normative. 6.6.1.1 Logical values and special characters NISTIR 7697 section 6.1.1 is normative. 6.6.1.2 CPE name completeness NISTIR 7697 section 6.1.2 is normative. 6.6.1.3 CPE name uniqueness NISTIR 7697 section 6.1.3 is normative. 6.6.2 CPE di
42、ctionary deprecation process NISTIR 7697 section 6.2 is normative. 6.6.3 CPE dictionary provenance data NISTIR 7697 section 6.3 is normative. 6.6.4 CPE dictionary management documents NISTIR 7697 section 6.4 is normative. 6.6.4.1 Dictionary content management and decisions document NISTIR 7697 secti
43、on 6.4.1 is normative. 6.6.4.2 Dictionary process management document NISTIR 7697 section 6.4.2 is normative. 6.7 Dictionary use NISTIR 7697 section 7 is normative. 6.7.1 Identifier lookup NISTIR 7697 section 7.1 is normative. 6.7.2 Dictionary searching NISTIR 7697 section 7.2 is normative. 6.7.3 Us
44、e of deprecated identifier names NISTIR 7697 section 7.3 is normative. 4 Rec. ITU-T X.1528.3 (09/2012) 6.8 CPE dictionary operations and pseudocode NISTIR 7697 section 8 is normative. 6.8.1 Operations on a CPE dictionary NISTIR 7697 section 8.1 is normative. 6.8.1.1 Function get_cpe_items(d) NISTIR
45、7697 section 8.1.1 is normative. 6.8.1.2 Function get_cpe_item_wfn(item) NISTIR 7697 section 8.1.2 is normative. 6.8.1.3 Function get(w,a) NISTIR 7697 section 8.1.3 is normative. 6.8.1.4 Function is_deprecated(item) NISTIR 7697 section 8.1.4 is normative. 6.8.1.5 Function getitem(list, index) NISTIR
46、 7697 section 8.1.5 is normative. 6.8.1.6 Function strlen(s) NISTIR 7697 section 8.1.6 is normative. 6.8.1.7 Function substr(s,b,e) NISTIR 7697 section 8.1.7 is normative. 6.8.2 Acceptance criteria pseudocode NISTIR 7697 section 8.2 is normative. 6.8.3 Dictionary use pseudocode NISTIR 7697 section 8
47、.3 is normative. Printed in Switzerland Geneva, 2012 SERIES OF ITU-T RECOMMENDATIONS Series A Organization of the work of ITU-T Series D General tariff principles Series E Overall network operation, telephone service, service operation and human factors Series F Non-telephone telecommunication servi
48、ces Series G Transmission systems and media, digital systems and networks Series H Audiovisual and multimedia systems Series I Integrated services digital network Series J Cable networks and transmission of television, sound programme and other multimedia signals Series K Protection against interfer
49、ence Series L Construction, installation and protection of cables and other elements of outside plant Series M Telecommunication management, including TMN and network maintenance Series N Maintenance: international sound programme and television transmission circuits Series O Specifications of measuring equipment Series P Terminals and subjective and objective assessment methods Series Q Switching and signalling Series R Telegraph tran
