GB/T 18794.2-2002 in English

《GB/T 18794.2-2002信息技术 开放系统互连 开放系统安全框架 第2部分:鉴别框架》由TC28（全国信息技术标准化技术委员会）归口，TC28SC6（全国信息技术标准化技术委员会数据通信分会）执行，主管部门为国家标准化管理委员会。
关于开放系统安全框架的本标准系列涉及在开放系统环境中的安全服务应用，术语“开放系统”系指包括诸如数据库、分布式应用、开放分布式处理和OSI一类的领域。安全框架主要用来提供在系统内和系统间交互时对系统和客体的保护方法。安全框架不考虑用于构造系统或者机制的方法学。安全框架涉及用于获取具体安全服务所使用的数据素和操作序列(但不是协议素)。这些安全服务可适用于系统的通信实体，也可以用于系统间交换的数据和由系统管理的数据。本标准:――定义鉴别的基本概念；――确定可能的鉴别机制类；――定义用于这些鉴别机制类的服务；――确定为支持这些鉴别机制类的协议的功能需求；――确定鉴别的通用管理需求。能够使用本框架的标准类型包括:1)符合鉴别概念的标准；2)提供鉴别服务的标准；3)使用鉴别服务的标准；4)规定在开放系统体系结构内提供鉴别手段的标准；5)规定鉴别机制的标准。上述标准能以下列方式使用本框架:――标准类型1)、2)、3)、4)和5)能够使用这个框架的术语；――标准类型2)、3)、4)和5)能够使用本框架第7章定义的服务；――标准类型5)能够基于本框架第8章定义的机制。正如其他安全服务一样，鉴别只能够在为特定应用所定义的安全政策的上下文中被提供。安全政策的定义不属于本标准的范围。本标准的范围不包括为取得鉴别所需执行的协议交换细节的规范。本标准不规定用于支持这些鉴别服务的特定机制。其他标准(如GB/T 15843)更详细地制定了具体的鉴别方法。此外，这类方法的例子被收编在其他标准中(如GB/T 16264.8)以便涉及具体的鉴别需求。本框架中所描述的某些规程通过应用密码学技术来达到安全性。尽管某些鉴别机制类可以依赖于特定的算法特性，例如非对称特性，但本框架的使用不依赖于特定密码或者其他算法。

Scope

This standard series on open systems security frameworks deals with the application of security services in an open systems environment. The term "open systems" is meant to include areas such as databases, distributed applications, open distributed processing and OSI. The security framework is mainly used to provide protection methods for systems and objects when interacting within and between systems. Security frameworks do not take into account the methodology used to construct systems or mechanisms. The security framework refers to the data elements and sequences of operations (but not the protocol elements) used to obtain specific security services. These security services are applicable to the communicating entities of the system, as well as to data exchanged between systems and data managed by the system. This standard: - defines the basic concepts of authentication; - identifies possible classes of authentication mechanisms; - defines services for these classes of authentication mechanisms; - identifies the functional requirements of protocols supporting these classes of authentication mechanisms; Identify common management needs. The types of standards that can use this framework include: 1) Standards that conform to the concept of authentication; 2) Standards that provide authentication services; 3) Standards that use authentication services; 4) Standards that specify means to provide authentication within an open system architecture; 5) Specifies the criteria for the authentication mechanism. NOTE: The services in 2), 3) and 4) may include authentication, but may have different intents. The above-mentioned standards can use this framework in the following ways: - standard types 1), 2), 3), 4) and 5) can use the terms of this framework; - standard types 2), 3), 4) and 5) Can use the services defined in Clause 7 of this framework; – standard type j) can be based on the mechanisms defined in Clause 8 of this framework. As with other security services, authentication can only be provided in the context of security policies defined for a particular application. The definition of a security policy is outside the scope of this standard. The scope of this standard does not include the specification of the details of the protocol exchanges that need to be performed to achieve authentication. This International Standard does not specify specific mechanisms for supporting these authentication services. Other standards (such as GB/T 15843) have formulated specific identification methods in more detail. In addition, examples of such methods are incorporated in other standards (such as GB/T 16264.8) in order to address specific identification requirements.