ISO/IEC 15408-2:1999(E) - 信息技术安全评估标准第二部分：安全功能要求

需积分: 9 95 浏览量更新于2024-07-31 收藏 6.48MB PDF 举报

"ISO/IEC 15408-2是信息技术安全评估准则的第二部分，主要关注安全功能需求。这一国际标准定义了评估IT产品或系统安全性的具体要求，通常简称为‘CC’（Common Criteria）" 《信息技术安全评估准则》（ISO/IEC 15408）是一个全球认可的标准，旨在为评估信息技术产品的安全性提供一个统一的框架。该准则分为两个主要部分，其中第二部分（ISO/IEC 15408-2）详细阐述了安全功能需求，是确保IT系统和产品具备可靠安全性能的关键。 1. **范围**：这个标准适用于任何需要进行安全性评估的信息技术产品，包括硬件、软件以及相关的服务。它的目标是为所有参与安全评估的组织提供一套通用的评价标准，无论这些组织是制造商、用户还是第三方评估机构。 1.1 **扩展和维护功能需求**：标准的设计允许随着技术发展和安全威胁的变化而进行扩展和更新，确保始终能适应新的安全需求。 1.2 **ISO/IEC 15408-2的组织结构**：这部分内容可能包含对标准不同部分的逻辑划分，如核心概念、组件分类、评估等级等，以便于理解和应用。 1.3 **功能要求范式**：功能要求范式是描述安全功能组件如何组织和相互作用的方式。它可能包括一组基本的安全功能，以及这些功能如何在不同安全等级下被实现和组合。 2. **安全功能组件**：这部分是标准的核心，详细列出了为了达到不同级别的安全性所必需的各种功能组件。这些组件可以分为几个层次，包括类、家族和组件。 2.1 **概述**：这部分提供了整体的介绍，解释了组件结构是如何设计的，以及它们在评估过程中的作用。 2.1.1 **类结构**：类是对安全功能的一个高层次分类，比如数据完整性保护、访问控制等。每个类代表一类特定的安全问题或需求。 2.1.2 **家族结构**：在类之下，组件被进一步细分为家族，每个家族专注于特定类的某个子集或特定实现方式。 2.1.3 **组件结构**：家族内包含具体的组件，这些组件是可度量的安全功能，如“强制访问控制”或“用户身份验证”。组件是评估过程中最具体和可操作的部分。 ISO/IEC 15408-2提供了全面的框架来定义、评估和验证IT产品的安全功能。通过这个标准，开发者、评估者和用户都能明确知道产品应具备哪些安全特性，以满足不同场景下的安全要求。这对于保障信息技术系统的安全性、隐私保护和法规遵从性具有重要意义。

ISO/IEC 15408-2:1999(E) ©ISO/IEC

TOEs contain resources that may be used for the processing and storing of information. The

primary goal of the TSF is the complete and correct enforcement of the TSP over the resources and

information that the TOE controls.

TOE resources can be structured and utilised in many different ways. However, ISO/IEC 15408-2

makes a specific distinction that allows for the specification of desired security properties. All

entities that can be created from resources can be characterised in one of two ways. The entities

may be active, meaning that they are the cause of actions that occur internal to the TOE and cause

operations to be performed on information. Alternatively, the entities may be passive, meaning that

they are either the container from which information originates or to which information is stored.

Active entities are referred to as

subjects

. Several types of subjects may exist within a TOE:

a) those acting on behalf of an authorised user and which are subject to all the rules of the

TSP (e.g. UNIX processes);

b)those acting as a specific functional process that may in turn act on behalf of multiple

users (e.g. functions as might be found in client/server architectures); or

c) those acting as part of the TOE itself (e.g. trusted processes).

ISO/IEC 15408-2 addresses the enforcement of the TSP over types of subjects as those listed

above.

Passive entities (i.e. information containers) are referred to in the ISO/IEC 15408-2 security

functional requirements as

objects

. Objects are the targets of operations that may be performed by

subjects. In the case where a subject (an active entity) is the target of an operation (e.g. interprocess

communication), a subject may also be acted on as an object.

Objects can contain

information

. This concept is required to specify information flow control

policies as addressed in the FDP class.

Users, subjects, information and objects possess certain

attributes

that contain information that

allows the TOE to behave correctly. Some attributes, such as file names, may be intended to be

informational (i.e. to increase the user-friendliness of the TOE) while others, such as access control

information, may exist specifically for the enforcement of the TSP. These latter attributes are

generally referred to as

‘security attributes’

. The word attribute will be used as a shorthand in this

part of ISO/IEC 15408 for the word ‘security attribute’, unless otherwise indicated. However, no

matter what the intended purpose of the attribute information, it may be necessary to have controls

on attributes as dictated by the TSP.

Data in a TOE is categorised as either user data or TSF data. Figure 1.3 depicts this relationship.

User Data

is information stored in TOE resources that can be operated upon by users in accordance

with the TSP and upon which the TSF places no special meaning. For example, the contents of an

electronic mail message is user data.

TSF Data

is information used by the TSF in making TSP

decisions. TSF Data may be influenced by users if allowed by the TSP. Security attributes,

authentication data and access control list entries are examples of TSF data.

There are several SFPs that apply to data protection such as

access control SFPs

and

information

flow control SFPs

. The mechanisms that implement access control SFPs base their policy

decisions on attributes of the subjects, objects and operations within the scope of control. These

attributes are used in the set of rules that govern operations that subjects may perform on objects.

©ISO/IEC ISO/IEC 15408-2:1999(E)

The mechanisms that implement information flow control SFPs base their policy decisions on the

attributes of the subjects and information within the scope of control and the set of rules that govern

the operations by subjects on information. The attributes of the information, which may be

associated with the attributes of the container (or may not, as in the case of a multi-level database)

stay with the information as it moves.

Figure 1.3 - Relationship between user data and TSF data

Two specific types of TSF data addressed by ISO/IEC 15408-2 can be, but are not necessarily, the

same. These are

authentication data

and

secrets

Authentication data is used to verify the claimed identity of a user requesting services from a TOE.

The most common form of authentication data is the password, which depends on being kept secret

in order to be an effective security mechanism. However, not all forms of authentication data need

to be kept secret. Biometric authentication devices (e.g. fingerprint readers, retinal scanners) do not

rely on the fact that the data is kept secret, but rather that the data is something that only one user

possesses and that cannot be forged.

The term secrets, as used in ISO/IEC 15408-2 functional requirements, while applicable to

authentication data, is intended to also be applicable to other types of data that must be kept secret

in order to enforce a specific SFP. For example, a trusted channel mechanism that relies on

cryptography to preserve the confidentiality of information being transmitted via the channel can

only be as strong as the method used to keep the cryptographic keys secret from unauthorised

disclosure.

Therefore, some, but not all, authentication data needs to be kept secret and some, but not all,

secrets are used as authentication data. Figure 1.4 shows this relationship between secrets and

authentication data. In the Figure the types of data typically encountered in the authentication data

and the secrets sections are indicated.

USER DATA

TSF DATA

Authentication

Security Attributes

User Attributes

Object Attributes

TOE DATA

Data

Subject Attributes

Information Attributes

剩余353页未读，继续阅读

xiaotajd

粉丝: 0
资源: 2

ISO/IEC 15408-2:1999(E) - 信息技术安全评估标准第二部分：安全功能要求

GB/T 18336系列标准解读：信息技术安全评估准则

GB/T18336-3：信息安全技术，IT安全评估准则的第三部分：安全保障组件详解

GB-T18336.3-2001 信息技术安全性评估准则解析

信息技术安全评估准则.zip

CC标准信息技术安全评估准则

信息技术安全评估准则发展过程.pptx

信息技术安全评估通用准则

GB18336信息技术安全技术评估准则

GBT 18336 信息技术 安全技术 信息技术安全性评估准则 第3部分 安全保证要求

信息技术安全技术信息技术安全性评估准则-第二部分-word版.7z

最新资源

GBT 18336 信息技术安全技术信息技术安全性评估准则第3部分安全保证要求