ISO/IEC 29146:2016 情報技術—セキュリティ技術—アクセス管理のためのフレームワーク | ページ 6

3.1

access control

granting or denying an operation to be performed on a resource (3.14)

Note 1 to entry: A primary purpose of access control is to prevent unauthorized access to information or use of ICT resources based on the business and security requirements; that is, the application of authorization policies to particular access requests.

Note 2 to entry: When an authenticated subject (3.15) makes a request, the resource owner will authorize (or not) access in accordance with access policy and subject privileges.

3.2

access management

set of processes to manage access control (3.1) for a set of resources (3.14)

3.3

access token

trusted object encapsulating the authority for a subject (3.15) to access a resource (3.14)

Note 1 to entry: An access token is issued by the policy decision point (PDP) and consumed by the policy enforcement point (PEP) for the resource.

Note 2 to entry: An access token may contain access permission information for a subject to access the resource and identifying information for the authority of the authorization decision.

Note 3 to entry: An access token may contain information that enables its integrity to be validated.

Note 4 to entry: An access token may take a physical or a virtual form.

3.4

attribute

characteristic or property used to describe and to control access to a resource (3.14)

Note 1 to entry: The rules for accessing a resource are defined in an access control (3.1) policy which specifies the attributes required for the granting of access by a subject (3.15) to a resource for a specific operation.

Note 2 to entry: Attributes can include subject attributes, resource attributes, environmental attributes and other attributes used to control access as specified in the access control policy.

3.5

endpoint

location in an access management (3.2) system where an access control (3.1) function is performed

Note 2 to entry: Endpoint discovery services are commonly used in distributed and networked systems.

3.6

enterprise centric implementation

access management (3.2) conducted under the control of a policy decision point

3.7

need-to-know

security objective of keeping the subject’s (3.15) access to data resources (3.14) to the minimum necessary for a requesting user to perform their functions

Note 1 to entry: Need-to-know is authorized at the discretion of the resource owner.

Note 2 to entry: Need-to-have is the security objective of the requester for the fulfilment of specific tasks that may be limited at the resource owner’s discretion.

3.8

privilege

access right

permission

authorization to a subject (3.15) to access a resource (3.14)

Note 1 to entry: Privilege is a necessary but not sufficient condition for access. Access occurs when the access request is granted according to its access control policy. The access control policy is based on privileges and may include other environmental factors (e.g. time-of-day, location, etc.)

Note 2 to entry: Privileges take the form of data presented by a subject or obtained for a subject that is used by a Policy Decision Point in order to grant or deny an operation that a subject is willing to perform on a resource.

Note 3 to entry: A resource may have multiple distinct privileges associated with it which correspond to various defined levels of access. For example, a data resource could have read, write, execute and delete privileges available for assignment to subjects. A request by a subject for access to the resource might be allowed for some levels of access request but disallowed for other levels depending on the level of access requested and the resource privileges that have been assigned to the subject.

3.9

role

name given to a defined set of system functions that may be performed by multiple entities

Note 1 to entry: The name is usually descriptive of the functionality.

Note 2 to entry: Entities can be but are not necessarily human subjects.

Note 3 to entry: Roles are implemented by a set of privilege (3.8) attributes to provide the necessary access to data resources or objects.

Note 4 to entry: Subjects assigned to a role inherit the access privileges associated with the role. In operational use, subjects will need to be authenticated as members of the role group before being allowed to perform the functions of the role.

3.10

policy decision point

PDP

service that implements an access control policy to adjudicate requests from entities to access resources (3.14) and provide authorization decisions for use by a policy enforcement point (3.11)

Note 1 to entry: Authorization decisions are used by a policy enforcement point to control access to a resource. An authorization decision may be communicated through the use of an access token (3.3) .

Note 2 to entry: PDP also audits the decisions in an audit trail and is able to trigger alarms.

Note 3 to entry: The term corresponds to Access Decision Function (ADF) in ISO 10181-3. It is presumed that this function is located over a network from the subject (3.15) , and may be located over a network from the corresponding PEP (3.11) .

3.11

policy enforcement point

PEP

service that enforces the access decision by the policy decision point (3.10)

Note 1 to entry: The PEP receives authorization decisions made by the PDP and implements them in order to control access by entities to resources (3.14) . An authorization decision may be received in the form of an access token (3.3) presented by a subject (3.15) when an access request is made.

Note 2 to entry: The term corresponds to Access Enforcement Function (AEF) in ISO 10181-3. It is presumed that this function is located over a network from the subject and may be located over a network from the corresponding PDP (3.10) .

3.12

policy administration point

PAP

service that administers access authorization policy

3.13

policy information point

PIP

service that acts as the source of attributes (3.4) that are used by a policy decision point (3.10) to make authorization decisions

Note 1 to entry: Attributes can include resource (3.14) , subject (3.15) and environment privileges (3.8) /permissions.

3.14

resource

object

physical, network, or any information asset that can be accessed for use by a subject (3.15)

3.15

subject

entity requesting access to a resource (3.14) controlled by an access control (3.1) system

3.16

security token service

STS

service that builds, signs, exchanges and issues access tokens (3.3) based on decision made by a policy decision point (3.10)

Note 1 to entry: This service may be split into separate components.

3.17

subject centric implementation

access management (3.2) implemented as component services that are called by a subject (3.15) to acquire the means recognized by the policy enforcement point (3.11) for accessing a resource (3.14)

Note 1 to entry: Component services may include policy decision point service, policy enforcement point service and associated discovery services that enable the subject to locate and contact the access control (3.1) services.