ISO 17090-1:2021 健康情報学—公開鍵インフラストラクチャ—パート1：デジタル証明書サービスの概要 | ページ 6

3.1.1

アプリケーション

秘密暗号化キーの所有者であるソフトウェア プロセスを実行している識別可能なコンピュータ

注記 1:この文脈では、アプリケーションは、治療や診断に直接的な役割を持たないものを含め、医療情報システムで使用される任意のソフトウェア プロセスである可能性があります。

注記 2:ソフトウェアを含む一部の法域では、プロセスが医療機器として規制される場合があります。

3.1.2

デバイス

秘密暗号鍵の所有者である、識別可能なコンピュータ制御の装置または機器

注記1：これには、上記の定義を満たす規制医療機器のクラスが含まれます。

注記 2:この文脈におけるデバイスとは、医療情報システムで使用される任意のデバイスであり、治療や診断に直接的な役割を持たないものも含まれます。

3.1.3

ヘルスケア俳優

俳優

規制対象の医療専門家、規制対象外の医療専門家、スポンサー付きの医療提供者、支援組織の従業員、患者/消費者、医療関連の通信で機能し、デジタル証明書対応のセキュリティ サービスの証明書を必要とする医療機関、デバイス、またはアプリケーション

3.1.4

医療機関

医療サービスまたは健康増進に関する主な活動を行う正式に登録された団体

注記 1:組織は、その活動に対して法的責任を負うと認識されているが、健康における特定の役割について登録する必要はない。

注記 2: X.501 のように、組織の内部部分をここでは組織単位と呼びます。

3.1.5

規制されていない医療専門家

規制された医療専門家ではない医療機関に雇用されている人

注記 1:被雇用者が雇用主から独立した団体によって専門的資格を与えられていないという事実は、もちろん、その被雇用者が自分のサービスを行う専門家ではないことを意味するものではありません。

3.1.6

組織の従業員

医療機関または支援組織に雇用されている人

3.1.7

忍耐強い

消費者

健康関連サービスの受信者であり、健康情報システムのアクターである人

3.1.8

プライバシー

個人に関するデータの不当または違法な収集および使用に起因する侵入が個人の私生活または業務に侵入することからの自由

[出典: ISO/IEC 2382:2015, 2126263]

3.1.9

規制医療専門家

特定の医療サービスを実施する資格があることを国家的に認められた機関によって認可された人

グレード 1 から入学:登録機関または認定機関の種類は、国や職業によって異なります。全国的に認められた団体には、地方または地域の政府機関、独立した専門家団体、およびその他の公式および全国的に認められた組織が含まれます。それらは、その領域内で排他的または非排他的である可能性があります。

注記2：この定義における全国的に認知された機関は、全国的に管理された専門家登録システムを意味するものではありませんが、国際的なコミュニケーションを促進するために、健康認定専門家登録機関の全国的なディレクトリが1つ存在することが望ましいでしょう.

3.1.10

スポンサーの医療提供者

医療サービス提供者は、その診療所の管轄区域では規制された専門家ではありませんが、医療コミュニティで活動しており、規制された医療機関によって後援されています。

3.1.11

後援団体

医療機関にサービスを提供しているが、医療サービスを提供していない正式に登録された組織

3.2.1

access control

means of ensuring that the resources of a data processing system can be accessed only by authorized entities in authorized ways

[SOURCE: ISO/IEC 2382:2015, 2126294, modified — Notes to entry removed.]

3.2.2

accountability

property that ensures that the actions of an entity may be traced uniquely to the entity

[SOURCE: ISO 7498‑2:1989, 3.3.3]

3.2.3

asymmetric cryptographic algorithm

algorithm for performing encipherment or the corresponding decipherment in which the keys used for encipherment and decipherment differ

[SOURCE: ISO/IEC 10181‑1:1996, 3.3.1, modified — Note to entry removed.]

3.2.4

authentication

process of reliably identifying security subjects by securely associating an identifier and its authenticator

[SOURCE: ISO 7498‑2:1989]

Note 1 to entry: See also data origin authentication and peer entity authentication.

3.2.5

authorization

granting of rights, which includes the granting of access based on access rights

[SOURCE: ISO 7498‑2:1989, 3.3.10]

3.2.6

availability

property of being accessible and useable upon demand by an authorized entity

[SOURCE: ISO 7498‑2:1989, 3.3.11]

3.2.7

ciphertext

data produced through the use of encipherment, the semantic content of which is not available

[SOURCE: ISO 7498‑2:1989, 3.3.14, modified — Note to entry removed.]

3.2.8

confidentiality

property that information is not made available or disclosed to unauthorized individuals, entities, or processes

[SOURCE: ISO 7498‑2:1989, 3.3.16]

3.2.9

cryptography

discipline which embodies principles, means, and methods for the transformation of data in order to hide its information content, prevent its undetected modification, and/or prevent its unauthorized use

[SOURCE: ISO 7498‑2:1989, 3.3.20, modified — Note to entry removed.]

3.2.10

cryptographic algorithm

cipher

method for the transformation of data in order to hide its information content, prevent its undetected modification, and/or prevent its unauthorized use

[SOURCE: ISO 7498‑2:1989]

3.2.11

data integrity

property that data have not been altered or destroyed in an unauthorized manner

[SOURCE: ISO 7498‑2:1989, 3.3.21]

3.2.12

data origin authentication

corroboration that the source of data received is as claimed

[SOURCE: ISO 7498‑2:1989, 3.3.22]

3.2.13

decipherment

decryption

process of obtaining, from a ciphertext, the original corresponding data

[SOURCE: ISO/IEC 2382:2015, 2126281, modified — Notes 2 and 3 to entry removed.]

Note 1 to entry: A ciphertext may be enciphered a second time, in which case a single decipherment does not produce the original plaintext.

3.2.14

digital signature

data appended to, or a cryptographic transformation (see cryptography) of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery, e.g. by the recipient

[SOURCE: ISO 7498‑2:1989, 3.3.26]

3.2.15

encipherment

encryption

cryptographic transformation of data (see cryptography) to produce ciphertext

[SOURCE: ISO 7498‑2:1989, 3.3.27]

3.2.16

identifier

piece of information used to claim an identity, before a potential corroboration by a corresponding authenticator

[SOURCE: ENV 13608-1]

3.2.17

integrity

proof that the message content has not been altered, deliberately or accidentally, in any way during transmission

Note 1 to entry: Adapted from ISO 7498-2:1989.

3.2.18

key

sequence of symbols that controls the operations of encipherment and decipherment

[SOURCE: ISO 7498‑2:1989, 3.3.32]

3.2.19

key management

generation, storage, distribution, deletion, archiving, and application of keys in accordance with a security policy

[SOURCE: ISO 7498‑2:1989, 3.3.33]

3.2.20

non-repudiation

service providing proof of the integrity and origin of data (both in an unforgeable relationship), which can be verified by any party

Note 1 to entry: Adapted from Reference [18].

3.2.21

private key

key that is used with an asymmetric cryptographic algorithm and whose possession is restricted (usually to only one entity)

[SOURCE: ISO/IEC 10181‑1:1996, 3.3.10]

3.2.22

public key

key that is used with an asymmetric cryptographic algorithm and that can be made publicly available

[SOURCE: ISO/IEC 10181‑1:1996, 3.3.11]

3.2.23

role

set of behaviours that is associated with a task

3.2.24

security

combination of availability, confidentiality, integrity, and accountability

[SOURCE: ENV 13608-1]

3.2.25

security policy

plan or course of action adopted for providing computer security

[SOURCE: ISO/IEC 2382:2015, 2126246, modified — Notes to entry removed.]

3.2.26

security service

service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers

[SOURCE: ISO 7498‑2:1989, 3.3.51]

3.3.1

attribute authority

aa

authority which assigns privileges by issuing attribute certificates

[SOURCE: RFC 5280]

3.3.2

attribute certificate

data structure, digitally signed by an attribute authority, that binds some attribute values with identification about its holder

[SOURCE: RFC 5280]

3.3.3

authority certificate

certificate issued to a certification authority or to an attribute authority

Note 1 to entry: Adapted from RFC 5280.

3.3.4

certificate

public key certificate

3.3.5

certificate distribution

act of publishing certificates and transferring certificates to security subjects

3.3.6

certificate extension

extension fields (known as extensions) in X.509 certificates that provide methods for associating additional attributes with users or public keys and for managing the certification hierarchy

Note 1 to entry: Certificate extensions may be either critical (i.e. a certificate-using system has to reject the certificate if it encounters a critical extension it does not recognize) or non-critical (i.e. it may be ignored if the extension is not recognized).

3.3.7

certificate generation

act of creating certificates

3.3.8

certificate profile

specification of the structure and permissible content of a certificate type

3.3.9

certificate revocation

act of removing any reliable link between a certificate and its related owner (or security subject owner) because the certificate is not trusted any more, even though it is unexpired

3.3.10

certificate holder

entity that is named as the subject of a valid certificate

3.3.11

certification

procedure by which a third party gives assurance that all or part of a data processing system conforms to security requirements

[SOURCE: ISO/IEC 2382:2015, 2126258, modified — Notes to entry removed.]

3.3.12

certification authority

ca

certificate issuer

authority trusted by one or more relying parties to create and assign certificates and which may, optionally, create the relying parties' keys

Note 1 to entry: Adapted from ISO/IEC 9594-8:2021.

Note 2 to entry: Authority in the CA term does not imply any government authorization but only denotes that it is trusted.

Note 3 to entry: Certificate issuer may be a better term, but CA is very widely used.

3.3.13

certificate policy

CP

named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements

[SOURCE: IETF/RFC 3647]

3.3.14

certification practices statement

CPS

statement of the practices which a certification authority employs in issuing certificates

[SOURCE: IETF/RFC 3647]

3.3.15

public key certificate

PKC

X.509 public key certificates (PKCs) which bind an identity and a public key

Note 1 to entry: The identity may be used to support identity-based access control decisions after the client proves that it has access to the private key that corresponds to the public key contained in the PKC.

Note 2 to entry: Adapted from IETF/RFC 3280.

3.3.16

public key infrastructure

PKI

infrastructure used in the relation between a key holder and a relying party that allows a relying party to use a certificate relating to the key holder for at least one application using a public key dependent security service and that includes a certification authority, a certificate data structure, means for the relying party to obtain current information on the revocation status of the certificate, a certification policy, and methods to validate the certification practice

3.3.17

qualified certificate

certificate whose primary purpose is identifying a person with a high level of assurance in public non-repudiation services

Note 1 to entry: The actual mechanisms that will decide whether a certificate should or should not be considered to be a “qualified certificate” in regard to any legislation are outside the scope of this document.

3.3.18

registration authority

RA

entity that is responsible for identification and authentication of certificate subjects, but that does not sign or issue certificates (i.e. an RA is delegated certain tasks on behalf of a CA)

[SOURCE: IETF/RFC 3647]

3.3.19

relying party

recipient of a certificate who acts in reliance on that certificate and/or digital signature verified using that certificate

[SOURCE: IETF/RFC 3647]

3.3.20

third party

party, other than data originator or data recipient, required to perform a security function as part of a communication protocol

3.3.21

trusted third party

TTP

third party which is considered trusted for purposes of a security protocol

[SOURCE: ENV 13608-1]

Note 1 to entry: This term is used in many ISO/IEC International Standards and other documents describing mainly the services of a CA. The concept is, however, broader and includes services such as time-stamping and possibly escrowing.