Overview
ISO/IEC 10181-2:1996 - "Information technology - Open Systems Interconnection - Security frameworks for open systems: Authentication framework" defines a general, vendor‑neutral framework for authentication in Open Systems (including Database systems, Distributed Applications, Open Distributed Processing and OSI). The standard explains authentication concepts, classes of authentication mechanisms, services to be provided, functional protocol requirements and general management needs. It is cryptography‑agnostic (it does not mandate specific algorithms or protocol exchanges) and is intended to be used together with more detailed method standards (for example ISO/IEC 9798 for specific authentication methods and ITU‑T X.509 for certificates).
Key topics
- Basic concepts and definitions: authenticated identity, authentication information, authentication exchange, claimant/verifier roles.
- Classes of authentication mechanisms: symmetric vs asymmetric methods; cryptographic and non‑cryptographic techniques; classification by vulnerability and configuration.
- Authentication services and phases: services required to support authentication, phases of authentication and mutual authentication considerations.
- Authentication information & facilities: claim authentication information, authentication certificates, tokens and challenges (time‑variant parameters).
- Attacks and countermeasures: common attack types (e.g., replay, masquerade) plus guidance on countering replay and other threats.
- Interactions with other security services: access control, data integrity, confidentiality, non‑repudiation and audit.
- Management requirements and trusted third parties: roles of authentication authorities, security domains and trusted third‑party involvement.
- Informative annexes: examples such as human user authentication, OSI model mapping, counter-replay techniques, and sample mechanisms.
Applications
ISO/IEC 10181-2 is practical for:
- Security architects and system designers defining authentication requirements for OSI or open distributed systems.
- Standards developers who need a common terminology and service model for authentication.
- Protocol and application designers selecting or specifying authentication services (e.g., mutual authentication, certificate use).
- Operations and security teams planning authentication management, trusted third‑party services, audit and access‑control integration.
- Implementers who must ensure their products conform to established authentication service expectations without being constrained to specific cryptographic algorithms.
Related standards
Keywords: ISO/IEC 10181-2, authentication framework, Open Systems Interconnection, OSI, authentication services, authentication mechanisms, authentication certificate, mutual authentication, replay attack, trusted third party.
Open preview (PDF)Information technology — Open Systems Interconnection — Security frameworks for open systems: Authentication framework