ISO 22378:2022 セキュリティとレジリエンス — 製品と文書の真正性、完全性、および信頼 — 相互運用可能なオブジェクトの識別と関連する認証システムのガイドラインで、偽造と違法取引を判断します。 | ページ 2

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, 2 (see www.iso.org/directives ).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents ).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html .

This document was prepared by Technical Committee ISO/TC 292, Security and resilience.

This first edition cancels and replaces ISO 16678:2014, which has been technically revised.

The main changes are as follows:

• the title and number have been updated to follow the same structure as all other documents developed by ISO/TC 292.

Introduction

This document is based on three foundational assumptions:

• detecting counterfeit objects is a complex and often difficult task;
• accurate identity information about the object in question simplifies the counterfeit detection process;
• accurate identity information is often difficult and hard to find.

The main objective of this document is to simplify access and delivery of accurate identity information to inspectors when authenticating objects.

To accomplish this objective, the document provides guidance intended to make object identity information easier to find and use. Identity data and information can be found in many places, including verification and authentication systems. This document will make it easier for inspectors to access identity information and granting inspectors access to reliable identity information helps facilitate the detection of counterfeits.

This document focuses attention on routing requests for object information to the appropriate authoritative service and then routing responses back to inspectors.

Object identification systems commonly use unique identifiers (UID) to reference or access object information. UID can be assigned to a class of objects or can be assigned to distinct object. In either case, the UID can enhance detection of counterfeiting and fraud, although UIDs assigned to single instances can be more efficient.

This document contains:

• terms and definitions;
• an overview on how object information is used to detect counterfeits;
• principles, concepts and values;
• recommendations on how to improve interoperability of systems capable of providing object information to inspectors;
• specific examples that illustrate some of the concepts presented.

This document enables reliable and safe object identification to deter the introduction of illegal objects to the market.

It includes a framework with the objective to increase trust by making object identification solutions interoperable. For example, the framework describes method and solutions for how to:

• detect some counterfeits without authenticating products;
• evaluate an authentication element;
• formally prove that a remote description of an object can be trusted.

This is document is part of a family of standards which includes ISO 22380, ISO 22381, ISO 22382, ISO 22383, ISO 22384.

One goal of this document is to describe a framework in which disparate object identification solutions are interoperable and trust is increased, and therefore will be used more frequently. The framework should also include solutions which simply detect some counterfeits without authenticating products. Likewise, the framework should also include a solution which only evaluates an authentication element.

Assuming that the object identification systems themselves can also be counterfeited and copied, This document establishes a method to formally prove that a remote description of an object can be trusted. establishes a method to formally prove that a remote description of an object can be trusted. Consideration is given to prevent interference between different independent implementations of such systems and to allow an unambiguous unique identification reference to service multiple use-cases and applications.

The theory supporting the design of the system is that a lack of trust and lack of interoperability introduces “friction” for users. By reducing this friction, there will be greater awareness and usage, and therefore greater detection and deterrence of fraud.

This document is complemented by ISO 22381:2018, which guides the establishment and set-up of interoperability.

1 Scope

This document establishes a framework for identification and authentication systems. It provides recommendations and best practice that include:

• management and verification of identifiers;
• physical representation of identifiers;
• participants’ due diligence;
• vetting of all participants within the system;
• relationship between the unique identifier (UID) and possible authentication elements related to it;
• questions that deal with the identification of the inspector and any authorized access to privileged information about the object;
• inspector access history (logs).

The model described in this document is intended to determine the common functions of different systems.

This document describes processes, functions and functional units of a generic model. It does not specify any specific technical solutions.

Object identification systems can incorporate other functions and features such as supply chain traceability, quality traceability, marketing activities and others, but these aspects are out of scope of this document.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 22300 apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:

Bibliography