1

Scope

This Recommendation / International Standard on Security Frameworks for Open Systems addresses the application of se curity services in an Open Systems environment, where the term ""Open System"" is taken to include areas such as Database, Distributed Applications, Open Distributed Processing and OSI. The Security Frameworks are concerned with defining the means of providing protection for systems and objects within systems, and with the interactions between systems. The Security Frameworks are not concerned with the methodology for constructing systems or mechanisms.

The Security Frameworks address both data elements and sequences of operations (but not protocol elements) which may be used to obtain specific security services. These security services may apply to the communicating entities of systems as well as to data exchanged between systems, and to data managed by systems.

This Recommendation / International Standard addresses the integrity of data in information retrieval, transfer, and management: (1) defines the basic concept of data integrity; (2) identifies possible classes of integrity mechanism; (3) identifies facilities for each class of integrity mechanisms; (4) identifies management required to support the class of integrity mechanism; (5) addresses the interaction of integrity mechanism and the supporting services with other security services and mechanisms.

A number of different types of standard can use this framework, including: (1) standards that incorporate the concept of integrity; (2) standards that specify abstract services that include integrity; (3) standards that specify uses of an integrity service; (4) standards that specify means of providing integrity within an open system architecture; and (5) standards that specify integrity mechanisms.

Such standards can use this framework as follows: - standards of type (1), (2), (3), (4) and (5) can use the terminology of this framework; - standards of type (2), (3), (4) and (5) can use the facilities identified in clause 7; - standards of type (5) can be based upon the classes of mechanisms identified in clause 8.

Some of the procedures described in this security framework achieve integrity by the application of cryptographic techniques. This framework is not dependent on the use of particular cryptographic or other algorithms, although certain classes of integrity mechanisms may depend on particular algorithm properties.

NOTE - Although ISO does not standardize cryptographic algorithms, it does standardize the procedures used to register them in ISO/IEC 9979.

The integrity addressed by this Recommendation / International Standard is that defined by the constancy of a data value. This notion (constancy of a data value) encompasses all instances in which different representations of a data value are deemed equivalent (such as different ASN.1 encodings of the same value). Othe r forms of invariance are excluded.

The usage of the term data in this Recommendation / International Standard includes all types of data structures ( such as sets or collections of data, sequences of data, file- systems and databases).

This framework addresses the provision of integrity to data that are deemed to be write-accessible to potential attackers. Therefore, it focuses on the provision of integrity through mechanisms, both cryptographic and non-cryptographic that do not rely exclusively on regulating access.