BS ISO/IEC 9594-8:1995 Information technology. Open systems interconnection - The directory. Authentication framework
Withdrawn
Printed version of this standard is available at Library. To request, please e-mail to referencepk@usm.my and include a copy of this record in your e-mail.
This Recommendation I International Standard:
- specifies the form of authentication information held by the Directory,
- describes how authentication information may be obtained from the Directory:
- states the assumptions made about how authentication information is formed and placed in the
Directory;
- defines three ways in which applications may use this authentication information to perform
authentication and describes how other security services may be supported by authentication.
This Recommendation I International Standard describes two levels of authentication: simple authentication, using a password as a verification of claimed identity; and strong authentication, involving credentials formed using cryptographic techniques. While simple authentication offers some limited protection against unauthorized access, only strong authentication should be used as the basis for providing secure services. It is not intended to establish this as a general framework for authentication, but it can be of general use for applications which consider these techniques adequate.
Authentication (and other security services) can only be provided within the context of a defined security policy. It is a matter for users of an application to define their own security policy which may be constrained by the services provided by a standard.
It is a matter for standards defining applications which use the authentication framework to specify the protocol exchanges which need to be performed in order to achieve authentication based upon the authentication information obtained from the Directory. The protocol used by applications to obtain credentials from the Directory is the Directory Access Protocol (DAP), specified in ITU-T Recommendation X.519 | ISO/IEC 9594-5.
The strong authentication method specified in this Recommendation | International Standard is based upon public-key cryptosystems. It is a major advantage of such systems that user certificates may be held within the Directory as attributes, and may be freely communicated within the Directory System and obtained by users of the Directory in the same manner as other Directory information. The user certificates are assumed to be formed by "off-line" means, and placed in the Directory by their creator. The generation of user certificates is performed by some off-line Certification Authority which is completely separate from the DSAs in the Directory. In particular, no special requirements are placed mupon Directory providers to store or communicate user certificates in a secure manner.
Application layer (OSI); Information exchange; Information systems; Directories; Data processing; Verification; Data storage protection; Open systems interconnection; Identification methods; Data transmission; Computer networks; Data transfer
