1、INTERNATIONAL TELECOMMUNICATION UNION ITU=T TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU DATA NETWORKS AND OPEN SYSTEM COMMUNICATIONS SECURITY X.833 (04/95) INFORMATION TECHNOLOGY - OPEN SYSTEMS INTERCONNECTION - GENERIC UPPER LAYERS SECURITY: PROTECTING TRANSFER SYNTAX SPECIFICATION ITU-T Recomm
2、endation X.833 (Previously “CCITT Recommendation”) FOREWORD ITU (International Telecommunication Union) is the United Nations Specialized Agency in the field of telecommunications. The ITU Telecommunication Standardization Sector (IT-T) is a permanent organ of the IT. Some 179 member countries, 84 t
3、elecom operating entities, 145 scientific and industrial organizations and 38 international organizations participate in IT-T which is the body which sets world telecommunications standards (Recommendations). The approval of Recommendations by the Members of ITU-T is covered by the procedure laid do
4、wn in WTSC Resolution No. 1 (Helsinki, 1993). In addition, the World Telecommunication Standardization Conference (WTSC), which meets every four years, approves Recommendations submitted to it and establishes the study programme for the following period. In some areas of information technology which
5、 fall within IT-Ts purview, the necessary standards are prepared on a collaborative basis with IS0 and IEC. The text of ITU-T Recommendation X.833 was approved on 10th of April 1995. The identical text is also published as ISO/IEC International Standard 11586-4. NOTE In this Recommendation, the expr
6、ession “Administration” is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. O ITU 1996 All rights reserved. No part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopyi
7、ng and microfilm, without permission in writing from the ITU. _ ITU-T RECMM*X=833 45 4hb25%L Ob08052 T73 Services and Facilities Interfaces ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS AND OPEN SYSTEM COMMUNICATIONS (February 1994) ORGANIZATION OF X-SERIES RECOMMENDATIONS x. 1-x. 19 X.20-X.49 I Subi
8、ect area I Recommendation Series I Network Aspects Maintenance I PUBLIC DATA NETWORKS I I X.90-X. 149 X.150-X.179 Administrative Arrangements OPEN SYSTEMS INTERCONNECTION I Transmission, Signalling and Switching I X.50-X.89 I X. 180-X. 199 Model and Notation x.200-x.209 Service Definitions Connectio
9、n-mode Protocol Specifications X.210-X.219 X.220-X.229 I Connectionless-mode Protocol Specifications I X.230-X.239 I PICS Proformas Protocol Identification X.240-X.259 X.260-X.269 Security Protocols Layer Managed Objects I X.290-X.299 I Conformance Testing I X.270-X.279 X.280-X.289 INTERWORKING BETW
10、EEN NETWORKS General I Mobile Data Transmission Systems I X.350-X.369 I X.300-X.349 Management MESSAGE HANDLING SYSTEMS X.370-X.399 X.400-X.499 DIRECTORY OS1 NETWORKING AND SYSTEM ASPECTS X.500-X.599 I OS1 MANAGEMENT I X.700-X.799 I Networking X.600-X.649 Naming, Addressing and Registration Abstract
11、 Syntax Notation One ASN.1) X.650-X.679 X.680-X.699 SECURITY OS1 APPLICATIONS X.800-X.849 Commitment, Concurrency and Recovery Transaction Processing X.850-X.859 X.860-X.879 Remote Operations OPEN DISTRIBUTED PROCESSING X.880-X.899 x.900-x.999 m . m CONTENTS Page Scope Normative references . 2.1 Ide
12、ntical Recommendations I International Standards Definitions Abbreviations . General overview . 5.1 Model of a protecting transfer syntax . 5.2 Initial encoding niles . 5.3 Security transformation . 5.4 Syntax structure Data structures for a protecting transfer syntax Incorporation into underlying p
13、rotocol Synchronization procedures . Object identifier assignment . Conformance 6 7 8 9 10 ITU-T RW . X.833 (1995 E) 1 1 1 2 2 2 3 3 4 4 4 5 6 6 6 i ITU-T RECMN*X*833 95 H 4862593 Ob08054 846 H Summary This Recommendation I International Standard belongs to a series of Recommendations which provide
14、a set of facilities to aid the construction of OS1 Upper Layer protocols which support the provision of security services. This Recommendation I International Standard defines the protecting transfer syntax, associated with Presentation Layer support for security services in the Application Layer. I
15、TU-T RW. X.833 (1995 E) 11 ITU-T RECflN*X.833 95 48b25L Ob08055 782 Introduction This Recommendation I International Standard forms part of a series of Recommendations I International Standards, which provide(s) a set of facilities to aid the construction of Upper Layers protocols which support the
16、provision of security services. The parts are as follows: - - - - - - Part 1 : Overview, Models and Notation; Part 2: Security Exchange Service Element Service Definition; Part 3: Security Exchange Service Element Protocol Specification; Part 4: Protecting Transfer Syntax Specification; Part 5: Secu
17、rity Exchange Service Element PICS Proforma; Part 6: Protecting Transfer Syntax PICS Proforma. This Recommendation I International Standard constitutes Part 3 of this series. . ITU-T Rec. X.833 (1995 E) 111 1TU-T RECMNLX.833 95 4862593 0608857 555 ISOAEC 11586-4 : 1995 (E) INTERNATIONAL STANDARD ITU
18、-T RECOMMENDATION INFORMATION TECHNOLOGY - OPEN SYSTEMS INTERCONNECTION - GENERIC UPPER LAYERS SECURITY: PROTECTING TRANSFER SYNTAX SPECIFICATION 1 Scope 1.1 provision of security services in OS1 applications. These include: This series of Recommendations I Internationai Standards defines a set of g
19、eneric facilities to assist in the a) a set of notational tools to support the specification of selective field protection requirements in an abstract syntax specification, and to support the specification of security exchanges and security transformations; a service definition, protocol specificati
20、on and PICS proforma for an application-service-element (ASE) to support the provision of security services within the Application Layer of OSI; a specification and PICS proforma for a security transfer syntax, associated with Presentation Layer support for security services in the Application Layer
21、. This Recommendation I International Standard defines the protecting transfer syntax, associated with b) c) 1.2 Presentation Layer support for security services in the Application Layer. 2 Normative references The following Recommendations and International Standards contain provisions which, throu
22、gh reference in this text, constitute provisions of this Recommendation I International Standard. At the time of publication, the editions indicated were valid. All Recommendations and Standards are subject to revision, and parties to agreements based on this Recommendation I International Standard
23、are encouraged to investigate the possibility of applying the most recent edition of the Recommendations and Standards listed below. Members of IEC and IS0 maintain registers of currently valid International Standards. The Telecommunication Standardization Bureau of the ITLJ maintains a list of curr
24、ently valid ITU-T Recommendations. 2.1 Identical Recommendations I International Standards - ITU-T Recommendation X.200 (1994) I ISO/iEC 7498-1: 1994, Information technology - Open Systems Interconnection - Basic Reference Model: The Basic Model. ITU-T Recommendation X.216 (1994) I ISO/IEC 8822:1994
25、, Information technology - Open Systems Interconnection - Presentation service definition. ITU-T Recommendation X.226 (1994) I ISO/IEC 8823-1: 1994, Information technology - Open Systems Interconnection - Connection-oriented presentation protocol: Protocol specification. ITU-T Recommendation X.680 (
26、1994) I ISO/IEC 8824-1:1995, Information technology -Abstract Syntax Notation One (ASN. I): Specification of basic notation. ITU-T Recommendation X.681 (1994) I ISO/IEC 8824-2:1995, Information technology -Abstract Syntax Notation One (ASN. I): Infomtion object specification. IT-T Recommendation X.6
27、82 (1994) I ISO/IEC 8824-3: 1995, Information technology - Abstract Syntax Notation One (ASN. I): Constraint specification. ITU-T Recommendation X.683 (1994) I ISO/IEC 8824-4:1995, Information technology -Abstract Syntax Notation One (ASN. 1): Parameterization of ASN. I specifications. ITU-T Recomme
28、ndation X.690 (1994) I ISO/IEC 8825- 1 : 1995, Infomation technology - ASN. I encoding rules: Specjcation of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER). - - - - - - - ITU-T Rec. X.833 (1995 E) 1 - ITU-T Recommendation X.803 (1994) I ISO/IEC 1074
29、5:1995, Infomution technobgy - Open Systems Interconnection - Upper layers security model. ITU-T Recommendation X.830 (1995) I ISO/IEC 11586-1:1995, Information technology - Open Systems Interconnection - Generic upper layers security: Overview, models and notation. - 3 Definitions 3.1 This Recommen
30、dation I International Standard makes use of the following terms defined in ITU-T Rec. X.200 I ISO/IEC 7498-1 : - transfer syntax. 3.2 This Recommendation I International Standard makes use of the following terms defined in ITU-T Rec. X.216 I ISO/IEC 8822: - abstract syntax; - presentation context;
31、- presentation data value. 3.3 This Recommendation I International Standard makes use of the following terms defined in ITU-T Rec. X.803 I ISO/IEC 10745: - security association; - security transformation. 3.4 This Recommendation I International Standard makes use of the following terms defined in IT
32、U-T RW. X.830 I ISOAEC 11586-1: - presentation-context-bound security association; - single-item-bound security association; - externally-established security association; - initiai encoding rules; - protecting presentation context; - protecting transfer syntax. 4 Abbreviations GULS Generic Upper La
33、yers Security OS1 Open Systems Interconnection PDU Protocol-data-unit PDV Presentation data value PICS Protocol implementation conformance statement 5 General overview The concept of a protecting transfer syntax was introduced in ITU-T Rec. X.830 I ISO/IEC 11586-1. This Specification defines a gener
34、ic protecting transfer syntax. This Specification can be used, in conjunction with particular security transformation definitions, to generate particular protecting transfer syntaxes, tailored to satisfy particular application protection requirements. NOTE - The generic protecting transfer syntax ma
35、y also prove useful in providing data compression for non-security- related purposes, however such use is outside the scope of this Specification. The generic protecting transfer syntax is based upon the security transformation model described in ITU-T Rec. X.830 I ISOAEC 11586-1. The purpose of a p
36、rotecting transfer syntax is to provide a standard means for representing, for transfer purposes, the following information items: the transformed item resulting from applying the encoding process of a security transformation to a representation of an unprotected item which is to be protected; - 2 I
37、TU-T Rec. X.833 (1995 E) ITU-T RECMNrX.833 75 m 4862571 0608059 328 m ISOfiEC 11586-4 : 1995 (E) - protected static and dynamic parameters of a security transformation, which achieve protection by being processed in the encoding process of a security transformation (along with the representation of
38、the unprotected item); unprotected static and dynamic parameters of a security transformation; on the first PDV of a protecting presentation context, or a protected PDV sent outside a presentation context, either: a) in the case of a presentation-context-bound or single-item-bound security associati
39、on, an identifier of the security transformation; b) in the case of an externally-established security association. an identifier of that security association. - - Use of a protecting transfer syntax is negotiated by the presentation protocol or announced in an ASN. 1 EXTERNAL or EMBEDDED PDV constr
40、uct. It can be applied to any abstract syntax, which may be specified using ASN.l or by other means. Object identifiers for negotiating or announcing protecting transfer syntaxes are addressed in clause 9. A protecting transfer syntax is a context-sensitive transfer syntax, i.e. state is retained wi
41、thin encoders and decoders. 5.1 Figure 1 illustrates, in finer detail than in IT-T Rec. X.830 I ISO/IEC 11586-1, the operations associated with a protecting transfer syntax at an encoding system (the corresponding operations at a decoding system follow naturally). Model of a protecting transfer synt
42、ax Unprotected item (ASN.l value) 1 Initiai encoding rsal 4 I 1 processa) 1 prccess a) (on unprotected item) transformation encodina Drocecs I -. Unprotected I parameters a), . . transformation id ), security association id b, ASN.l data value Construct and encode protecting transfer Bit string for
43、transmission a) if applicable. b, These two encoding processes may be combined. Figure 1 - Protecting transfer syntax construction at encoding system 5.2 Initial encoding rules The initiai encoding process (in the encoding system) and corresponding decoding process (in the decoding system) map betwe
44、en an abstract syntax and an unprotected syntax. The rules applied to this process are known as the initial encoding rules. N0.E - For an ASN.l-based abstract syntax, this mapping will typically employ some variant of the ASN.1 encoding rules. Single-valued encoding rules (e.g. the ASN. 1 Canonical
45、Encoding Rules or Distinguished Encoding Rules) should be applied where the transformation is a function of data which may also be sent separately, particularly when used via a relay system. ITU-T Rec. X.833 (1995 E) 3 ITU-T RECMNxX.833 95 Li86259l.1 ObO8ObQ Q4T H ISOIIEC 11586-4 : 1995 (E) The init
46、ial encoding rules for use in a protecting transfer syntax are established as follows: a) if the security transformation in use provides for conveying an identifier of a specific set of encoding rules as a static (protected or unprotected) parameter, and if this parameter is present in the applicabl
47、e first-PDV field, then these encoding rules are used; otherwise the encoding rules indicated by the b) when the PDV transfer relates to an externally established security association, the security transformation identifier is an attribute of that security association. The rules of a security transf
48、ormation indicate how a bit string of user data and a set of protected parameter values are to map to an ASN. 1 value for transfer purposes. 5.4 Syntax structure A protecting transfer syntax defines the data structure used to convey the output of the encoding process of a security transformation, pl
49、us unprotected parameters and identifiers of the security transformation or security association (as applicable). The data structure transferred has a different variant for each of the cases: the first PDV of a protecting presentation context in a presentation-context-bound security association, or the one PDV in a single-item-bound security association; the first PDV of a protecting presentation context, or a protected PDV sent outside a presentation context, in the case of an externally established security association;
