ISO/IEC 29115:2013 情報技術—セキュリティ技術—エンティティ認証保証フレームワーク | ページ 6

3.1

assertion

statement made by an entity without accompanying evidence of its validity

[SOURCE: ITU-T X.1252]

Note 1 to entry: The meaning of the terms claim and assertion are generally agreed to be somewhat similar but with slightly different meanings. For the purposes of this International Standard, an assertion is considered to be a stronger statement than a claim.

3.2

authentication

provision of assurance in the identity of an entity

[SOURCE: ISO/IEC 18014-2]

3.3

authentication factor

piece of information and/or process used to authenticate or verify the identity of an entity

[SOURCE: ISO/IEC 19790]

3.4

authentication protocol

defined sequence of messages between an entity and a verifier that enables the verifier to perform authentication of an entity

3.5

authoritative source

repository which is recognized as being an accurate and up-to-date source of information

3.6

claim

statement that something is the case, without being able to give proof

[SOURCE: ITU-T X.1252]

Note 1 to entry: The meaning of the terms claim and assertion are generally agreed to be somewhat similar but with slightly different meanings. For the purposes of this International Standard, an assertion is considered to be a stronger statement than a claim.

3.7

context

environment with defined boundary conditions in which entities exist and interact

[SOURCE: ITU-T X.1252]

3.8

credential

set of data presented as evidence of a claimed or asserted identity and/or entitlements

Note 1 to entry: See Annex B for additional characteristics of a credential.

3.9

credential service provider

trusted actor that issues and/or manages credentials

3.10

entity

something that has separate and distinct existence and that can be identified in a context

[SOURCE: ITU-T X.1252]

Note 1 to entry: For the purposes of this International Standard, entity is also used in the specific case for something that is claiming an identity.

3.11

entity authentication assurance

degree of confidence reached in the authentication process that the entity is what it is, or is expected to be

[SOURCE: ITU-T X.1252]

Note 1 to entry: The confidence is based on the degree of confidence in the binding between the entity and the identity that is presented.

3.12

identifier

one or more attributes that uniquely characterize an entity in a specific context

3.13

identity

set of attributes related to an entity

[SOURCE: ISO/IEC 24760]

Note 1 to entry: Within a particular context, an identity can have one or more identifiers to allow an entity to be uniquely recognized within that context.

3.14

identity information verification

process of checking identity information and credentials against issuers, data sources, or other internal or external resources with respect to authenticity, validity, correctness, and binding to the entity

3.15

identity proofing

process by which the Registration Authority (RA) captures and verifies sufficient information to identify an entity to a specified or understood level of assurance

3.16

man-in-the-middle attack

attack in which an attacker is able to read, insert, and modify messages between two parties without their knowledge

3.17

multifactor authentication

authentication with at least two independent authentication factors

[SOURCE: ISO/IEC 19790]

3.18

mutual authentication

authentication of identities of entities which provides both entities with assurance of each other's identity

3.19

non-repudiation

ability to protect against denial by one of the entities involved in an action of having participated in all or part of the action

[SOURCE: ITU-T X.1252]

3.20

phishing

scam by which an email user is duped into revealing personal or confidential information which the scammer can then use illicitly

3.21

registration authority

trusted actor that establishes and/or vouches for the identity of an entity to a CSP

3.22

relying party

actor that relies on an identity assertion or claim

3.23

repudiation

denial in having participated in all or part of an action by one of the entities involved

[SOURCE: ITU-T X.1252]

3.24

salt

non-secret, often random, value that is used in a hashing process

Note 1 to entry: It is also referred to as sand.

3.25

shared secret

secret used in authentication that is known only to the entity and the verifier

3.26

time stamp

reliable time variant parameter which denotes a point in time with respect to a common reference

3.27

transaction

discrete event between an entity and service provider that supports a business or programmatic purpose

3.28

trust framework

set of requirements and enforcement mechanisms for parties exchanging identity information

3.29

trusted third party

authority or its agent, trusted by other actors with respect to specified activities (e.g., security-related activities)

Note 1 to entry: A trusted third party is trusted by an entity and/or a verifier for the purposes of authentication.

3.30

validity period

time period during which an identity or credential may be used in one or more transactions

3.31

verification

process of checking information by comparing the provided information with previously corroborated information

3.32

verifier

actor that corroborates identity information

Note 1 to entry: The verifier can participate in multiple phases of the EAAF and can perform credential verification and/or identity information verification.