1、 International Telecommunication Union ITU-T X.1528.4TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (09/2012) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Vulnerability/state exchange Common platform enumeration applicability language Recommend
2、ation ITU-T X.1528.4 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM
3、 ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECUR
4、E APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY C
5、ybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state
6、 exchange X.1520X.1539Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommendations. Rec.
7、 ITU-T X.1528.4 (09/2012) i Recommendation ITU-T X.1528.4 Common platform enumeration applicability language Summary Recommendation ITU-T X.1528.4 defines the specification for common platform enumeration (CPE) applicability language. The CPE applicability language specification is part of a stack o
8、f CPE specifications that support a variety of use cases relating to IT product description and naming. The CPE applicability language data model builds on top of other CPE specifications to provide the functionality required to allow CPE users to construct complex groupings of CPE names to describe
9、 IT platforms. These groupings are referred to as applicability statements because they are used to designate the platforms to which particular guidance, policies, etc. apply. This Recommendation defines the semantics of the CPE applicability language data model and the requirements that IT products
10、 and CPE applicability language documents must meet to claim compliance with this Recommendation. This is achieved by listing the relevant clauses of the NIST Interagency Report 7698: Common Platform Enumeration Applicability Language Specification version 2.3 and showing whether they are normative
11、or informative. History Edition Recommendation Approval Study Group 1.0 ITU-T X.1528.4 2012-09-07 17 ii Rec. ITU-T X.1528.4 (09/2012) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication te
12、chnologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Tel
13、ecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some
14、areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized
15、operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “
16、shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the
17、 practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation d
18、evelopment process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are th
19、erefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2012 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1528.4 (09/2012) iii Table of Contents Page 1 Sco
20、pe 1 2 References. 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 1 5 Conventions 2 6 Applicability language specification 2 6.1 Introduction 2 6.2 Definitions and abbreviations . 2 6.3 Relationship to existing specifications
21、 and standards 2 6.4 Conformance 2 6.5 Data model overview 2 6.6 Content design requirements and recommendations 2 6.7 Processing requirements and recommendations . 3 6.8 CPE applicability language pseudocode 3 iv Rec. ITU-T X.1528.4 (09/2012) Introduction Common platform enumeration (CPE) is a stru
22、ctured method of describing and identifying classes of applications, operating systems, and hardware devices present in an enterprises computing assets. CPE can be used as a source of information for enforcing and verifying IT management policies relating to these assets, such as vulnerability, conf
23、iguration, and remediation policies. IT management tools can collect information about installed products, identify products using their CPE names, and use this structured information to help make fully or partially automated decisions regarding the assets. CPE consists of several modular specificat
24、ions. Combinations of the specifications work together in layers to perform various functions. One of these specifications, CPE applicability language, defines a structured way to describe IT platforms by forming complex logical expressions out of individual CPE names and references to checks. For e
25、xample, CPE applicability language could combine the CPE name for an operating system, the CPE name for an application running on that operating system, and a reference to a check for a particular value of a certain configuration setting (such as the wireless network card being enabled in the operat
26、ing system). These logical expressions are called applicability statements, because they are used to designate to which platforms particular guidance, policies, etc. apply. Applicability statements can be used by tools to determine whether a target system is an instance of a particular platform. The
27、 CPE names used by the CPE applicability language specification are bound forms of well-formed CPE names (WFNs), which are the abstract logical constructions for CPE names CPE23-N:5.1. The basic building block of the CPE applicability language specification is referred to as the logical test. This i
28、s a logical conjunction (AND) or disjunction (OR) of one or more CPE names and/or references to checks. Individual logical tests can also be negated (inverted). Nested logical tests allow the user to express a platform as any logical combination of individual CPE names and/or references to checks. N
29、ote that previous NIST versions of CPE referred to the Applicability Language specification as simply the language specification. Rec. ITU-T X.1528.4 (09/2012) 1 Recommendation ITU-T X.1528.4 Common platform enumeration applicability language 1 Scope This Recommendation defines the specification for
30、 CPE applicability language. The Recommendation also defines and explains the requirements that producers of CPE applicability language-supporting implementations, such as software and services, and CPE applicability language content must meet to claim compliance with this Recommendation. As this Re
31、commendation defines these specifications by listing the relevant clauses of the NIST Interagency Report 7698 Common Platform Enumeration: Applicability Language specification version 2.3 and showing whether they are normative or informative, all other versions are out of the scope of this Recommend
32、ation as are all CPE specifications other than CPE applicability language. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated
33、were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recomme
34、ndations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. NISTIR 7698 NIST Interagency Report 7698, Common Platform Enumeration: Applicability Language Specification Version 2.3, August 2011. 3
35、 Definitions 3.1 Terms defined elsewhere None. 3.2 Terms defined in this Recommendation None. 4 Abbreviations and acronyms CPE Common Platform Enumeration NIST National Institute of Standards and Technology NISTIR NIST Interagency Report WFN Well-formed CPE Name 2 Rec. ITU-T X.1528.4 (09/2012) 5 Con
36、ventions The following terms are considered equivalent: In ITU use of the word shall and must and their negatives are considered equivalent. In ITU use of the word shall is equivalent to the NISTIR use of the word MUST. In ITU use of the phrase shall not is equivalent to the NISTIR use of the term M
37、UST NOT. NOTE In the NISTIR use of the words shall and must (in lower case) are used for informative text. 6 Applicability language specification This clause defines the specification for common platform enumeration (CPE) applicability language. It provides direct references to NIST Interagency Repo
38、rt 7698 Common Platform Enumeration: Applicability Language Specification version 2.3 through alignment of the clauses with the section numbers such that clause 6.x aligns with NISTIR 7698 section x with matching titles. 6.1 Introduction b-NISTIR 7698 section 1 is informative. 6.2 Definitions and ab
39、breviations b-NISTIR 7698 section 2 is informative. 6.3 Relationship to existing specifications and standards b-NISTIR 7698 section 3 is informative. 6.4 Conformance b-NISTIR 7698 section 4 is informative. 6.5 Data model overview NISTIR 7698 section 5 is normative. 6.5.1 The element NISTIR 7698 sect
40、ion 5.1 is normative. 6.5.2 The element NISTIR 7698 section 5.2 is normative. 6.5.3 The element NISTIR 7698 section 5.3 is normative. 6.5.4 The element NISTIR 7698 section 5.4 is normative. 6.6 Content design requirements and recommendations NISTIR 7698 section 6 is normative. Rec. ITU-T X.1528.4 (0
41、9/2012) 3 6.6.1 CPE applicability language document contents NISTIR 7698 section 6.1 is normative. 6.6.2 The platform element NISTIR 7698 section 6.2 is normative. 6.6.3 The logical-test element NISTIR 7698 section 6.3 is normative. 6.6.4 The fact-ref element NISTIR 7698 section 6.4 is normative. 6.
42、6.5 The check-fact-ref element NISTIR 7698 section 6.5 is normative. 6.7 Processing requirements and recommendations NISTIR 7698 section 7 is normative. 6.7.1 CPE bound name conversions NISTIR 7698 section 7.1 is normative. 6.7.2 Graceful error handling NISTIR 7698 section 7.2 is normative. 6.7.3 Ev
43、aluating elements NISTIR 7698 section 7.3 is normative. 6.7.3.1 Evaluating a logical-test element NISTIR 7698 section 7.3.1 is normative. 6.7.3.2 Evaluating a fact-ref element NISTIR 7698 section 7.3.2 is normative. 6.7.3.3 Evaluating a check-fact-ref element NISTIR 7698 section 7.3.3 is normative.
44、6.8 CPE applicability language pseudocode NISTIR 7698 section 8 is normative. 6.8.1 Core function NISTIR 7698 section 8.1 is normative. 6.8.2 Support functions NISTIR 7698 section 8.2 is normative. Printed in Switzerland Geneva, 2012 SERIES OF ITU-T RECOMMENDATIONS Series A Organization of the work
45、of ITU-T Series D General tariff principles Series E Overall network operation, telephone service, service operation and human factors Series F Non-telephone telecommunication services Series G Transmission systems and media, digital systems and networks Series H Audiovisual and multimedia systems S
46、eries I Integrated services digital network Series J Cable networks and transmission of television, sound programme and other multimedia signals Series K Protection against interference Series L Construction, installation and protection of cables and other elements of outside plant Series M Telecomm
47、unication management, including TMN and network maintenance Series N Maintenance: international sound programme and television transmission circuits Series O Specifications of measuring equipment Series P Terminals and subjective and objective assessment methods Series Q Switching and signalling Ser
48、ies R Telegraph transmission Series S Telegraph services terminal equipment Series T Terminals for telematic services Series U Telegraph switching Series V Data communication over the telephone network Series X Data networks, open system communications and security Series Y Global information infrastructure, Internet protocol aspects and next-generation networks Series Z Languages and general software aspects for telecommunication systems
