ISO IEC 27551:2021 pdf download – Information security, cybersecurity and privacy protection — Requirements for attribute-based unlinkable entity authentication.
There is no such preliminary procedure between U and RP, meaning that U and RP are a priori strangers to one another. An attribute-based entity authentication protocol is a sequence of computations and communications among U, RP and AP which, when conducted successfully throughout, results in a state at RP where RP is convinced that a statement made by U about its attributes is correct or not. The purpose of the protocol is to reach that state. The authentication phase is the protocol stage where U and RP interact, which can involve the participation of AP or not. The description of a particular attribute-based entity authentication protocol requires a specification of the attributes, of the statements that can be made on them, as well as of all computations and communications between the three parties. It includes a description of the authentication phase, the setup phase if any, and the user registration phase if any. NOTE Attribute-based entity authentication can also be achieved in communication models that extend beyond the minimal U-RP-AP model either by involving additional specific-purpose entities or by limiting the use of communication channels at determined stages of the protocol. Annex B describes some examples of attribute- based entity authentication protocols and their underlying model. Attributes are defined in ISO/IEC 24760-1. As properties, they can have: — a type, a Boolean, or a character string of alphabetical characters, or an integer in a certain range, or a compound type built on these basic types (such as a fixed length vector of integers or a dynamic list of mixed strings and integers, and so forth); — a name, which is a string in a prescribed alphabet; — a value selected within the range of admissible values for the considered type. Other properties of attributes such as their origin or level of assurance, or more generally classes or categories of sorts, can exist and be involved in the attribute-based authentication protocol. However, they are usually encoded as additional attributes. Therefore, it is enough to rely on the notions of type, name and value when describing an attribute. A policy decision function is a function that takes a policy and other information for the purpose of returning a boolean value. It is defined as a logic predicate combining basic relational expressions using logic operators such as OR, AND or possibly more complex ones such as threshold gates (t-out-of-n). A relational expression can express: — equality of an attribute value to a particular value; — non-equality of an attribute value to a particular value; — inequality of an attribute value towards a particular value (less than, greater than). This requires that the attribute type support an ordering over its set of admissible values. It is usual to rely on a structured language to express policies when some level of genericity is desired. OASIS eXtensible Access Control Markup Language (XACML) is one such example. In other applications, the policy may be fixed and hard-coded into the attribute-based entity authentication protocol itself. It should also be noted that some attribute-based entity authentication protocols may only support restricted policies, where: — attribute values can only be compared to constants and not to other attribute values; — the nature or the number of logic operators is limited; or — some other restriction applies.
ISO IEC 27551:2021 pdf download – Information security, cybersecurity and privacy protection — Requirements for attribute-based unlinkable entity authentication
