GB/T 31501-2015 English PDF

US$1179.00 · In stock
Delivery: <= 8 days. True-PDF full-copy in English will be manually translated and delivered via email.
GB/T 31501-2015: Information security technology -- Authentication and authorization -- Specification for authorization application programming decision interface
Status: Valid

Standard ID	USD	BUY PDF	Lead-Days	Standard Title (Description)	Status
GB/T 31501-2015	1179	Add to Cart	8 days	Information security technology -- Authentication and authorization -- Specification for authorization application programming decision interface	Valid

Similar standards

GB/T 31509   GB/T 31722   GB/T 31505   GB/T 31500   GB/T 31497   

Basic data

Standard ID: GB/T 31501-2015 (GB/T31501-2015)
Description (Translated English): Information security technology -- Authentication and authorization -- Specification for authorization application programming decision interface
Sector / Industry: National Standard (Recommended)
Classification of Chinese Standard: L80
Classification of International Standard: 35.040
Word Count Estimation: 56,552
Date of Issue: 2015-05-15
Date of Implementation: 2016-01-01
Quoted Standard: GB/T 18794.3-2003; GB/T 25069-2010
Regulation (derived from): National Standard Announcement 2015 No. 15
Issuing agency(ies): General Administration of Quality Supervision, Inspection and Quarantine of the People's Republic of China, Standardization Administration of the People's Republic of China
Summary: This Standard specifies the interface associated with the determination of the C language in the form of data structures and interfaces to control unauthorized access to authorized applications and services for the determination of the application programming interfaces, and defined. This Standard applies to access control service authorization determination design and implementation of the interface, access control, testing and product procurement services may also refer to use.

GB/T 31501-2015: Information security technology -- Authentication and authorization -- Specification for authorization application programming decision interface

---This is a DRAFT version for illustration, not a final translation. Full copy of true-PDF in English version (including equations, symbols, images, flow-chart, tables, and figures etc.) will be manually/carefully translated upon your order.
Information security technology. Authentication and authortation. Specification for authorization application programming decision interface ICS 35.040 L80 National Standards of People's Republic of China Information Security Technology Authentication and Authorization Authorized Application Interface Specification judgment Issued on. 2015-05-15 2016-01-01 implementation Administration of Quality Supervision, Inspection and Quarantine of People's Republic of China Standardization Administration of China released

Table of Contents

Preface Ⅰ Introduction Ⅱ 1 Scope 1 2 Normative references 1 3 Terms and definitions 4 Abbreviations 3 5 frame 3 5.1 access control framework 3 5.2 Access Control Service Component 4 5.3 access control information 5 6 Authorization API usage model 10 6.1 System Structure 10 10 6.2 Support functions 6.3 The state machine 11 6.4 Trust Model 13 7 features and portability requirements 15 7.1 Functional requirements 15 7.2 portability requirements 15 8 constants and variables defined 16 8.1 string class string data 16 8.2 17 state value 8.3 Constant 18 8.4 Authorization and mechanisms ID 20 Appendix A (informative) Function Description 22 References 51

Foreword

This standard was drafted in accordance with GB/T 1.1-2009 given rules. Please note that some of the content of this document may involve patents. Release mechanism of the present document does not assume responsibility for the identification of these patents. This standard by the National Safety Standardization Technical Committee (SAC/TC260) and focal points. This standard was drafted. Institute of Software, Beijing digital certificate authentication center Co., Zhengyang Branch Information Security Technology Limited surgery. The main drafters of this standard. FENG Deng, Zhang Liwu, Li Xiaofeng, Wang Yazhe, Gao Zhigang, Xu Zhen, paragraph Meijiao, Wang Dan, Huang Liang, Di Zhengde, Zhan Banghua.

Introduction

Access control as a basic security measures widely used in the actual system, with access control technology is becoming more complex, Access control has become the basis for a class of security services, and application integration needs of a wide range of security services need to be able to control access to the application mentioned For a unified programming interface that enables applications to be portable across different access control services, and the current lack of such National standard. To solve this problem, the standard reference technical standards OpenGroup (Ref. [1]) and other relevant standards and regulations Fan, to ensure adapt to a variety of scenarios, the definition of the authorization application determines interface specifications. This standard defines the Authorized Application Interface Specification can be used for determining compliance with GB/T 18794.3 framework for access control systems, although This standard provides a tube which allows the principal privilege attribute controls can be used to control access authorization request determination (often referred to as minimum feature Right), but it does not provide privileged property management. The standard is designed with the following objectives. a) the definition of a simple and flexible API, and security components provide the security needed to protect application developers can call This API to implement authorization capabilities; b) can be applied transparently assess policy rule when determining access; c) independent of the policy applied to centralized management; d) providing a wide range of policy rules lexical and semantic (such as access control lists, capabilities, tags, predicate logic, etc.) transparently; e) the separation of authentication and authorization; f) allows authorization attributes derived from the identification data; g) transparently support any reasonable authorization attribute type (such as access IDs, groups, roles, etc.); h) Ease of authorization services in the application system of multi-level structure; i) the multi-application configuration properties using the external authorization; j) application can access resources used in its access control policy; k) implementation of the API supports a variety of access control mechanisms; l) a single program can use multiple authentication and authorization services; m) support for application access and authorization services related to the operation of audit data. This standard does not address the following. a) authorization policy management; b) certificate authorized service or semantic description; c) a description of audit services API; d) Describe how and when the authorized service generates audit events; e) in a heterogeneous environment, the definition of the format for the exchange of PAC certificate information; f) support every possible authorization policy lexical and semantic rules. Information Security Technology Authentication and Authorization Authorized Application Interface Specification judgment

1 Scope

This standard defines the authorization access control services for authorized applications to provide application programming interfaces determines and defines the interfaces associated with the determination Data structures and C language interface. This standard applies to the access control service authorization determination and implementation of the interface design, testing and access control products and services can also purchase Referring use.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version suitable for use herein Member. For undated references, the latest edition (including any amendments) applies to this document. Section 3 GB/T 18794.3-2003 Information technology - Open Systems Interconnection - Security frameworks for open systems. Access control framework GB/T 25069-2010 Information security technology terms

3 Terms and Definitions

GB/T 25069-2010 define the following terms and definitions apply to this document. 3.1 Access control information accesscontrolinformation Any information used for access control purposes, including context information. [GB/T 18794.3-2003, the definition 3.4.5] 3.2 Access control decision function accesscontroldecisionfunction A particular function, through access requests, ADI (initiator, target, access request or previous decisions preserved ADI) and the context of the access request, and the determination to make access control using access control policy rules. [GB/T 18794.3-2003, the definition 3.4.3] 3.3 Access control determination information accesscontroldecisioninformation Part in making access control decisions for a particular use of the ADF (possibly all) ACI. [GB/T 18794.3-2003, the definition 3.4.2] 3.4 Access control enforcement function accesscontrolenforcementfunction A particular feature, which is part of the access path between the initiator and the target for each access request, made and implemented by the ADF decision making. [GB/T 18794.3-2003, the definition 3.4.4] ......

Image     

Tips & Frequently Asked Questions:

Question 1: How long will the true-PDF of GB/T 31501-2015_English be delivered?

Answer: Upon your order, we will start to translate GB/T 31501-2015_English as soon as possible, and keep you informed of the progress. The lead time is typically 5 ~ 8 working days. The lengthier the document the longer the lead time.

Question 2: Can I share the purchased PDF of GB/T 31501-2015_English with my colleagues?

Answer: Yes. The purchased PDF of GB/T 31501-2015_English will be deemed to be sold to your employer/organization who actually pays for it, including your colleagues and your employer's intranet.

Question 3: Does the price include tax/VAT?

Answer: Yes. Our tax invoice, downloaded/delivered in 9 seconds, includes all tax/VAT and complies with 100+ countries' tax regulations (tax exempted in 100+ countries) -- See Avoidance of Double Taxation Agreements (DTAs): List of DTAs signed between Singapore and 100+ countries

Question 4: Do you accept my currency other than USD?

Answer: Yes. If you need your currency to be printed on the invoice, please write an email to Sales@ChineseStandard.net. In 2 working-hours, we will create a special link for you to pay in any currencies. Otherwise, follow the normal steps: Add to Cart -- Checkout -- Select your currency to pay.