ITU-T X.520 规范：目录信息与属性类型

x509

x520

需积分: 9 139 浏览量更新于2024-07-17 收藏 1.69MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

"X500规范系列是国际电信联盟(ITU-T)制定的一套标准，主要涉及目录服务中的属性类型和匹配规则。该标准适用于多种应用程序，并被目录系统本身理解和使用。X520是该系列标准的一部分，专注于定义开放系统互连(OSI)目录中的选定属性类型。" X500规范系列是信息技术领域的重要标准，它定义了在各种目录应用中可能需要用到的多种属性类型和匹配规则。这些规则分为三个类别：通用属性类型、特定应用属性类型和目录系统自身使用的属性类型和规则。通用属性类型被广泛应用于不同的应用场景，而目录系统则会理解和使用某些属性类型和匹配规则来实现其功能。 X.520推荐标准是X500系列中的一个，详细阐述了开放系统互连目录中所使用的特定属性类型。这些属性类型是构建目录服务的基础，它们允许目录存储和检索关于对象（如用户、组织、资源等）的各种信息，例如用户名、电子邮件地址、电话号码等。这些属性类型的设计使得不同系统之间的信息交换变得标准化和高效。 X500系列标准与X.509证书体系紧密相关。X.509是用于数字证书的标准，它规定了如何表示和验证公钥基础设施(PKI)中的证书。这些证书在网络安全、身份验证和数据加密等方面发挥着关键作用。X509证书包含了身份信息，如发行者、主体、有效期和公钥，这些信息通常与X520定义的属性类型相结合。此外，标签中的"sm2"指的是SM2密码算法，这是中国国家标准GM/T 0028-2014中定义的一种非对称加密算法。SM2算法在中国及其他采用中国加密标准的地区被广泛用于PKI系统，与X509证书一起确保数据的安全传输。 X500规范系列和其中的X.520标准为目录服务提供了标准化的框架，这些服务是许多现代网络和通信系统的核心部分。通过定义属性类型和匹配规则，它们促进了不同系统之间的互操作性和数据一致性，同时也为数字证书（如X.509证书）和安全协议（如SM2）的实施提供了基础。这些标准对于构建安全、可靠的网络环境至关重要。

资源详情

资源推荐

ISO/IEC 9594-6:2017 (E)

8 Rec. ITU-T X.520 (10/2016)

UUID in the pair represents the subject of the issuer/subject relationship. An example of such a relationship is a user

account.

uUIDPair ATTRIBUTE ::= {

WITH SYNTAX UUIDPair

EQUALITY MATCHING RULE uUIDPairMatch

ID id-at-uuidpair }

UUIDPair ::= SEQUENCE {

issuerUUID UUID,

subjectUUID UUID,

... }

UUID ::= OCTET STRING(SIZE (16)) -- UUID format only

6.2.12 uri

The uri attribute type is used for holding a Uniform Resource Identifier (URI) as defined in IETF RFC 3986.

uri ATTRIBUTE ::= {

WITH SYNTAX URI

EQUALITY MATCHING RULE uriMatch

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"uri"}

ID id-at-uri }

URI ::= UTF8String

6.2.13 URN

The URN attribute type is used for holding a Uniform Resource Name (URN) as defined in IETF RFC 3406.

urn ATTRIBUTE ::= {

SUBTYPE OF uri

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"urn"}

ID id-at-urn }

6.2.14 URL

The URL attribute type is used for holding a Uniform Resource Locator (URL).

url ATTRIBUTE ::= {

SUBTYPE OF uri

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"url"}

ID id-at-url }

6.2.15 Domain name

A value of attribute type dnsName is used for holding a DNS domain name, which may be an internationalized domain

name (IDN).

dnsName ATTRIBUTE ::= {

WITH SYNTAX DomainName

EQUALITY MATCHING RULE dnsNameMatch

LDAP-SYNTAX dnsString.&id

LDAP-NAME {"DNS name"}

ID id-at-dnsName }

DomainName ::= UTF8String (CONSTRAINED BY { -- Conforms to the format of a

(internationalized) domain name. -- })

A value of the DomainName data type shall be in the syntax, as specified by section 2.3.1 of IETF RFC 5890 meaning

that a domain name is a sequence of labels in the letters, digits, hyphen (LDH) format separated by dots.

A label may be in three formats:

a) All characters in the label are from the Basic Latin collection as defined by ISO/IEC 10646 (i.e., having

code points in the ranges 002D, 0030-0039, 0041-005A and 0061-007A) and it does not start with "xn--".

The maximum length is 63 octets.

ISO/IEC 9594-6:2017 (E)

Rec. ITU-T X.520 (10/2016) 9

b) It is an A-label as defined in IETF RFC 5890, i.e., it starts with the "xn--" and is a U-label converted to

valid ASCII characters as in item a) using the Punycode algorithm defined by IETF RFC 3492. The

converted string shall be maximum 59 octets. To be valid, it shall be possible for an A-label to be converted

to a valid U-label.

NOTE 1 – An A-label is normally not human readable.

c) It is a U-label as defined in IETF RFC 5890, i.e., it contains characters outside the Basic Latin collection.

A valid U-label shall not include any characters that are not included in the restricted Unicode repertoire

as defined by IETF RFC 5892 and it shall be convertible to a valid A-label as defined in item b). A valid

U-label may be more than 63 octets.

NOTE 2 – In a constraint environment, it is recommended to use a domain name whenever possible, according to item a).

NOTE 3 – When used as a naming attribute, a unique distinguished name may be constructed using only this attribute type.

An attribute of type dnsName to be used as a distinguished name in a public-key certificate or in an attribute certificate

shall be a fully-qualified domain name (FQDN), i.e., it shall identify a particular entity. An FQDN may have an asterisk

('*') as an additional leftmost label, which is a substitute (wildcard) for all labels at the next levels of subdomains of the

domain identified by the FQDN without the asterisk. An attribute of type dnsName holding an FQDN with a wildcard

label may in some cases be used in the subject component of an end-entity public-key certificate.

6.3 Geographical attribute types

These attribute types are concerned with geographical positions or regions with which objects are associated.

6.3.1 Country Name

A value of the countryName attribute type specifies a country. When used as a component of a directory name, it

identifies the country in which the named object is physically located or with which it is associated in some other important

way.

An attribute value for country name is a string chosen from ISO 3166-1 alpha-2.

countryName ATTRIBUTE ::= {

SUBTYPE OF name

WITH SYNTAX CountryName

SINGLE VALUE TRUE

LDAP-SYNTAX countryString.&id

LDAP-NAME {"c"}

ID id-at-countryName }

CountryName ::= PrintableString(SIZE (2)) (CONSTRAINED BY { -- ISO 3166 alpha-2 codes

only -- })

6.3.2 Three-character country code

A value of countryCode3a attribute type specifies a country. When used as a component of a directory name, it identifies

the country in which the named object is physically located or with which it is associated in some other important way.

An attribute value for countryCode3a is a string chosen from ISO 3166-1 alpha-3.

countryCode3c ATTRIBUTE ::= {

SUBTYPE OF name

WITH SYNTAX CountryCode3c

SINGLE VALUE TRUE

LDAP-SYNTAX countryString3c.&id

LDAP-NAME {"c3"}

ID id-at-countryCode3c }

CountryCode3c ::= PrintableString(SIZE (3)) (CONSTRAINED BY { -- ISO 3166 alpha-3 codes

only -- })

6.3.3 Numeric character country code

A value of countryCode3n attribute type specifies a country. When used as a component of a directory name, it identifies

the country in which the named object is physically located or with which it is associated in some other important way.

An attribute value for countryCode3n is a string chosen from ISO 3166-1 numeric-3.

countryCode3n ATTRIBUTE ::= {

SUBTYPE OF name

ISO/IEC 9594-6:2017 (E)

10 Rec. ITU-T X.520 (10/2016)

WITH SYNTAX CountryCode3n

SINGLE VALUE TRUE

LDAP-SYNTAX countryString3n.&id

LDAP-NAME {"n3"}

ID id-at-countryCode3n }

CountryCode3n ::= NumericString(SIZE (3)) (CONSTRAINED BY { -- ISO 3166 numeric-3 codes

only -- })

6.3.4 Locality Name

The Locality Name attribute type specifies a locality. When used as a component of a directory name, it identifies a

geographical area or locality in which the named object is physically located or with which it is associated in some other

important way.

An attribute value for Locality Name is a string, e.g., L = "Edinburgh".

localityName ATTRIBUTE ::= {

SUBTYPE OF name

WITH SYNTAX UnboundedDirectoryString

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"l"}

ID id-at-localityName }

The Collective Locality Name attribute type specifies a locality name for a collection of entries.

collectiveLocalityName ATTRIBUTE ::= {

SUBTYPE OF localityName

COLLECTIVE TRUE

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"c-l"}

ID id-at-collectiveLocalityName }

6.3.5 State or Province Name

The State or Province Name attribute type specifies a state or province. When used as a component of a directory name,

it identifies a geographical subdivision in which the named object is physically located or with which it is associated in

some other important way.

An attribute value for State or Province Name is a string, e.g., S = "Ohio".

stateOrProvinceName ATTRIBUTE ::= {

SUBTYPE OF name

WITH SYNTAX UnboundedDirectoryString

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"st"}

ID id-at-stateOrProvinceName }

The Collective State or Province Name attribute type specifies a state or province name for a collection of entries.

collectiveStateOrProvinceName ATTRIBUTE ::= {

SUBTYPE OF stateOrProvinceName

COLLECTIVE TRUE

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"c-st"}

ID id-at-collectiveStateOrProvinceName }

6.3.6 Street Address

The Street Address attribute type specifies a site for the local distribution and physical delivery in a postal address, i.e., the

street name, place, avenue and house number. When used as a component of a directory name, it identifies the street

address at which the named object is located or with which it is associated in some other important way.

An attribute value for Street Address is a string, e.g., "Arnulfstraße 60".

streetAddress ATTRIBUTE ::= {

WITH SYNTAX UnboundedDirectoryString

EQUALITY MATCHING RULE caseIgnoreMatch

SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"street"}

ID id-at-streetAddress }

ISO/IEC 9594-6:2017 (E)

Rec. ITU-T X.520 (10/2016) 11

The Collective Street Address attribute type specifies a street address for a collection of entries.

collectiveStreetAddress ATTRIBUTE ::= {

SUBTYPE OF streetAddress

COLLECTIVE TRUE

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"c-street"}

ID id-at-collectiveStreetAddress }

6.3.7 House Identifier

The House Identifier attribute type specifies a linguistic construct used to identify a particular building, for example a

house number or house name relative to a street, avenue, town or city etc.

An attribute value for House Identifier is a string, e.g., "14".

houseIdentifier ATTRIBUTE ::= {

WITH SYNTAX UnboundedDirectoryString

EQUALITY MATCHING RULE caseIgnoreMatch

SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"houseIdentifier"}

ID id-at-houseIdentifier }

6.3.8 UTM Coordinates attribute type

An attribute of type utmCoordinates gives the coordinates in the Universal Transverse Mercator (UTM) coordinate

system.

utmCoordinates ATTRIBUTE ::= {

WITH SYNTAX UtmCoordinates

SINGLE VALUE TRUE

ID id-at-utmCoordinates }

UtmCoordinates ::= SEQUENCE {

zone PrintableString,

easting NumericString,

northing NumericString }

The zone component gives the value of the UTM zone. It consists of a single letter followed by up to two numeric

characters.

The easting component gives the easting values in metres.

The northing component gives the northing value in metres.

6.4 Organizational attribute types

These attribute types are concerned with organizations and can be used to describe objects in terms of organizations with

which they are associated.

6.4.1 Organization Name

The Organization Name attribute type specifies an organization. When used as a component of a directory name, it

identifies an organization with which the named object is affiliated.

An attribute value for OrganizationName is a string chosen by the organization (e.g., O = "Scottish

Telecommunications plc"). Any variants should be associated with the named Organization as separate and alternative

attribute values.

organizationName ATTRIBUTE ::= {

SUBTYPE OF name

WITH SYNTAX UnboundedDirectoryString

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"o"}

ID id-at-organizationName }

The Collective Organization Name attribute type specifies an organization name for a collection of entries.

collectiveOrganizationName ATTRIBUTE ::= {

SUBTYPE OF organizationName

ISO/IEC 9594-6:2017 (E)

12 Rec. ITU-T X.520 (10/2016)

COLLECTIVE TRUE

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"c-o"}

ID id-at-collectiveOrganizationName }

6.4.2 Organizational Unit Name

The Organizational Unit Name attribute type specifies an organizational unit. When used as a component of a directory

name, it identifies an organizational unit with which the named object is affiliated.

The designated organizational unit is understood to be part of an organization designated by an organizationName

attribute. It follows that if an Organizational Unit Name attribute is used in a directory name, it shall be associated with

an organizationName attribute.

An attribute value for Organizational Unit Name is a string chosen by the organization of which it is part (e.g., OU =

"Technology Division"). Note that the commonly used abbreviation "TD" would be a separate and alternative attribute

value.

Example

O = "Scottel", OU = "TD"

organizationalUnitName ATTRIBUTE ::= {

SUBTYPE OF name

WITH SYNTAX UnboundedDirectoryString

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"ou"}

ID id-at-organizationalUnitName }

The Collective Organizational Unit Name attribute type specifies an organizational unit name for a collection of entries.

collectiveOrganizationalUnitName ATTRIBUTE ::= {

SUBTYPE OF organizationalUnitName

COLLECTIVE TRUE

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"c-ou"}

ID id-at-collectiveOrganizationalUnitName }

6.4.3 Title

The Title attribute type specifies the designated position or function of the object within an organization.

An attribute value for Title is a string.

Example

T = "Manager, Distributed Applications"

title ATTRIBUTE ::= {

SUBTYPE OF name

WITH SYNTAX UnboundedDirectoryString

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"title"}

ID id-at-title }

6.4.4 Organization Identifier

An attribute of type organizationIdentifier holds an identification of an organization different from the

organization name.

organizationIdentifier ATTRIBUTE ::= {

WITH SYNTAX UnboundedDirectoryString

EQUALITY MATCHING RULE caseIgnoreMatch

SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch

SINGLE VALUE TRUE

LDAP-SYNTAX directoryString.&id

LDAP-NAME {"organizationIdentifier"}

ID id-at-organizationIdentifier }

6.5 Explanatory attribute types

These attribute types are concerned with explanations (e.g., in a natural language) of something about an object.

剩余125页未读，继续阅读

魔琴师

粉丝: 14
资源: 32

ITU-T X.520 规范：目录信息与属性类型

地贝X500说明书.pdf

9个500x500盒子图标

exchange服务器x500地址添加csdn

qfn50p500x500x80-33am

can't resolve symbol x500name

自己编写函数，用MATLAB计算两个500x500的矩阵qr6和b之间的均方误差（MSE）

第一个，​​1x1卷积是如何给神经网络增加非线性 第二个，一张500x500且厚度depth为100 （500x500x100）的图片在20个filter上做1x1的卷积，那么结果的大小为什么变成了500x500x20

使用matlab在500X500的直角坐标系生成随机点

用MATLAB计算两个500x500的矩阵qr6和b之间的均方误差（MSE）

RuntimeError: mat1 and mat2 shapes cannot be multiplied (2x42050 and 51200x500)

RuntimeError: mat1 and mat2 shapes cannot be multiplied (1x90000 and 1x500)这种错误要怎么改

用c语言写一个500x500的坐标系随机取点要求两个点间距至少为5且离边界距离至少2.5

'NoneType' object is not subscriptable

x1(t) =[1+sin(2πx500t)]× cos(2πxft)信号用matlab对其进行采样，其中采样频率为fs，信号的采样周期为 Ts，低通滤波器截止频率为fc

华为坤灵交换机命名规则

如何调整python运行窗口的大小

用Python设置窗口大小

python调整资源管理器窗口大小

插入新闻图片长宽一般为多少

最新资源

第一个，1x1卷积是如何给神经网络增加非线性第二个，一张500x500且厚度depth为100 （500x500x100）的图片在20个filter上做1x1的卷积，那么结果的大小为什么变成了500x500x20