1、INTERNATIONA1.STANDARDISO/IEC27071editionFirSt202307CybersecuritySecurityrecommendationsforestab1.ishingtrustedconnectionsbetweendevicesandservicesCybersecuriteRecommandationsdesecuritepouretab1.issementdeconnexionsdeconfianceentredispositifsetservicesReferencenumberISO/IEC27071:2023(E)ISO/IEC2023CO
2、PYRIGHTPROTECTEDDOCUMENTIS0/1EC2023IUirhM*hedbdi1.iUedotherwiseupdhi.o啪InyM1.tta0DmkfifiU81.andonnet8CH-1214Vernier,GenevaPhone：M1.227490111觥ftte:丽丽BQrgPub1.ishedinSwitzer1.andContentsForewordivIntroductionv2 Scope13 Normativereferences1Termsanddefinitions13.1 Termsre1.atingtoc1.oudcomputing13.2 Ter
3、msre1.atingtoc1.oudcomputingro1.esandactivities245 Abbreviatedterms5Frameworkandcomponentsforestab1.ishingatrustedconnection55.1 Overview55.2 Hardwaresecuritymodu1.e95.3 RtHJttdStrust105.5 Authenticationandkeyestab1.ishment105.6 Remoteattestation10Securityrecommendationsforestab1.ishingatrustedconne
4、ction106.1 Hardwaresecuritymodu1.e106.2 Rootoftrust116.3 AtohettyMiOn一.andkey.estab1.ishment116.5 Remoteattestation116.6 DatOInteg1.1.tyandauthenticity.126.7 Trusteduserinterface12Annex A (informative)Threats13Annex B (informative)So1.utionsforcomponentsofatrustedconnection18Annex C (informative)Exa
5、mp1.eofestab1.ishingatrustedconnection一.一._.一,23Bib1.iography24ForewordISO(theInternationa1.OrganizationforStandardization)andIEC(theInternationa1.E1.ectrotechnica1.(Jtunibcnjot)SdrniIHGspartHipidisye耐unr3optowMi01.HtanrfandaiionS出adwrddBudiughtechnimitteesestab1.ishedbytherespectiveorganizationtode
6、a1.withparticu1.arfie1.dsoftechnica1.activity.ISOandIECmitteesco1.1.aborateinfie1.dsofmutua1.interestOtherinternationa1.ornizations,governmenta1.andnon-governmenta1.rin1.iaisonwithISOandIEC,a1.sotakepartintheTheproceduresusedtodeve1.opthisdocumentandthoseintendedforitsfurthermaintenanceftKdeddeatibe
7、dthcindFrent1.S(W山也(Wmr小曲如卿闻IarJ帏序瞅崛jp15gIraJi1dinISO/IECDirectives.Part2(seewww.iso.org/dircctivesorwww.iec.ch/members.experts/refdocs).屣Gd（八）IEC0MYn(S温食闸由KM段粒SSibA哂Atef1.Wferni佃前VhIent菰加iMMi俄艇abih1.yiheanyc1.aimedpatentrightsinrespectthereof.Asofthedateofpub1.icationofthisdocument,ISOandIEChadnotr
8、eceivednoticeof（八）patent(三)whichmayberequiredtoimp1.ementthisdocument.However,寐降艇由曲觎eda祜b1.三WWeM0碗notbehe1.dresponsib1.eforidentifyinganyora1.1.suchpatentrights.AnytradeusedinthisconstitutenameendorsementdocumentisinformationgivenfortheconvenienceofusersanddoesnotForanexp1.anationofthevo1.untarynatu
9、reofstandards,themeaningofISOspecifictermsand邮)X觑怂1.itedOrRan脚娜I删01ass热情h2ton住排触标福dead明ces陕www.iso.org/iso/foreword.htm1.IntheIEC,seevrww.iec.chunderstanding-standards.瓯Cv腑。胁也加卜破舰。到6腑Wg仍SO1.Jtecom/n/hrmotiontechno1.ogy,Anyfeedbackorquestionsonthisdocumentshou1.dbedirectedtotheusersnationa1.standards
10、屋.2R)，隔U*P8RMiteesthesebodiescanbefoundatwwwishFgmembeFht111.andIntroductionartificia1.inte1.1.igence(A1.),scenarios.essentia1.toestab1.ishtrustedconnectionsbetweendevicesandservicesessentia1.devicesServiceservicesdistinguishconfidentia1.itjrbyintegritytheauthorizeddeviceenough.thosema1.iciousServic
11、esxrucia1.thisway,shou1.dtogRCEJSOIEC22123-1:2023,3.3.4tenantc1.oudserviceuser(3.2.4)sharingaccesstoasetofphysica1.andvirtua1.resourcesSOURCE:definition.1SOIEC22123-1:2023,3.4.2,modifiedoneormorehasbeende1.etedfromorigina1.3.3 Termsre1.atingtosecurityandprivacy3.3.1avai1.abi1.itypropertyofbeingacces
12、sib1.eandusab1.eondemandbyanauthorizedentityfRCE;ISO/IEC27000:2018,3.7confidentia1.itypropertythatinformationisnotmadeavai1.ab1.eordisc1.osedtounauthorizedindividua1.s,entities,orprocessesyiOURCE:ISO/IEC27000:2018,3.10integritypropertyOfaccuracyandcomp1.etenessgJ1.RCE:ISO/IEC27000:2018,3.36)hardware
13、securitymodu1.eHSMtamper-resistanthardwaremodu1.ewhichsafeguardsandmanageskeysandprovidescryptographicfunctionsNote1toentry:Trustedmodu1.eisaspecifickindofHSM.3.3.5trustanchormodu1.eTAM3.3.61toentrr:Trustanchormodu1.eisanabstractmodu1.ethatcontainsoneormorehardwaresecuritymodu1.es.trusteduserinterfa
14、ceTU1.3.3.7identitykeyIKenvironmentcharacteristicsrootoftrustRoTphysica1.rootoftrustNote1p1.atformcharacteristicsthataffectthetrusthasthePhtfOrm.minimumsetffunctionstoenab1.eadescriptionterm.Jvirtua1.izedrootoftrustvRoTNoteoftrustSimu1.Uneousiy.environments,therecanbemu1.tip1.eriFtua1.izedrootsoftru
15、stbasedonthesing1.e3.3.10rootoftrustformeasurementmeasurements)androutsthcm(3.3.8)fo11natSuitab1.cdcviccenvironmentCharactcristicsp1.atformfirmwarcintegrity3.3.11rootoftrustforstoragehardwaresecuritymodu1.e(3.3.4)thatactsastherootsoftrust(33.8)Notedevicecomponu-u4thauserinterfacewhoseintegrity(3.3.3
16、)andauthenticityismanagedbythetrustanchormodu1.e(3.3.S)signingkeyusedforauthenticationandtosigncharacteristicsofthedevU-(orservice)environment(e.g.adigest)inordertopreventforgeryandprotecttheintegrity(3.3.3)ofthedevice(orservice)3.3.8componentthatneedstoa1.waysbehaveintheexpectedmannerbecauseitsmisb
17、ehaviourcannotbedetectedoftheentry：Thecomp1.etesetofrootsofofat1.easttheSOURCE:ISO/IEC27070:2021,3.4,modiedphysica1.rootoftrusthasbeenaddedasanadmitted3.3.9securityfunctioncomponentestab1.ishedbasedontherootoftrust(3.3.8),whichprovidessimi1.arfunctionastherootoftrustroot1toentry:Iputationenginethatr
18、esetsoneormorep1.atformconfigurationregisters,makestheinitia1.integrity(3.3.3)measurement,andextendsitintoap1.atformconfigurationregisterNote1toentry:Aoftrustinathatco1.1.ectsforattestation(c.g.trusted(c.g.modu1.ep1.atformconfigurationregisters).componentoftherootoftrust(3.3.8)thatprovidesstoringcon
19、fidentia1.informationandmeasuredva1.uesinshie1.ded1.ocationsaccessedusingprotectedcapabi1.ities3.3.12rootoftrustforreportingauthenticityentry:nonrepudiationServicesusesthepurposes(orserviced)Ideneffyorigin3.3.7integrityre1.iab1.yprovide3.3.13securee1.ementSErequirementssetbywe1.1.-identifiedtrusteda
20、uthoritiestrustedcomputingTC3.3.15trustedexecutionenvironmentTEE3.3.16chainoftrusttrustedcomponent.Theo1.dcomponentcaneitherarooto1.dComponenttrustedcomponent.whichisnowa3.3.17trustedenvironmentTENote!Misce1.1.aneousexecutionenvironment(3.3.15)isaspecificTE.3.4.1deviceSOURCE:ISO/IEC22123-1:2023,3.13
21、4,modifiednote1toentryhasbeende1.eted.deviceho1.dercasesOtioInternetJnThings.cases,probab1.ywhopossesses(devices)usesnotmobi1.ecorrespondindeviceho1.der.ButinTheRoTcanbedirect1.yconst11ctedbasedontheHSM(TPMorCPUcombinedwithcipherchip)B.2.3theRoTnothavetheremaybeHSM.servicethebindingofsing1.eUniques
22、erverrwhichtheRoTinstance,avRoTcanbeused.Virtua1.izedrootoftrustisbasedonthephysica1.rootoft11stItscomputationa1.securityandIOsecurityareprotectedbysomesecuritytechno1.ogyonthecomputingSEmodu1.e.ISO/IECTPMakindofvirtua1.rootofandforconstructedInthisdocument,identitiesareusedtoidentifyadeviceoraservi
23、ceinstance.Identitiescanbe identityissuedbythemanufacturer; identitygeneratedbythec1.oudserviceprovider.ThetypeofboundtoRoT.IdentityissuedbythemanufacturerisboundtoaRoTandisgeneratedduringtheHSMproductioncanbeusedastheTPMisforidentitytrustedtheInothercases,thekeyofbeissuedtoanon-exportab1.ekeygenera
24、teintheciphermodu1.ebysigningapub1.ickeycertificate.ASHSMisbui1.tintoadeviceandRoTisderivedfromHSM,CA(atrustedpartyortrstedthirdparty)Deviceidentitycanbecreatedfromaninterna1.CA.Thefo1.1.owingstepsshowanexamp1.e: DevicemanufacturerstorestheX.509certifcate5inthedevice.Deviceidentitycanbecreatedbyathi
25、rd-partyCAafterde1.ivery.Thefo1.1.owingstepsgiveanexamp1.e: Theidentityofdeviceshou1.dbeboundtotherootsoftrustwhicharederivedfromtheHSM.Thedevicegeneratesacertificaterequestforitsrootoftrust,whichissignedbytheIK.-Theusersendsthecertificationrequesttothethird-partyCA.TheCAva1.idatesthecertificationre
26、questandissuesacertificatetothedevice.Thedevicestoresthecertificate.B.3.2.3Identitygeneratedwhentheserviceisdep1.oyedWhenaserviceisdep1.oyed,theservercancreateanidentitythatisboundtotheservice.BecausethertiufiihkeiEM*vbKoTi8firdpSvrfondingsp(rffckrtei.ForthosedevicesusingTPM1detai1.edstepsofrevocati
27、onarementionedB.4Authenticationandkeyestab1.ishmentSecureauthenticationandkeyestab1.ishmentcanbeimp1.ementedbyusingT1.S1.3(6orotherBAjNnatekeyattestaitiionprotocoIsthatensureauthenticationandkeynegotiationsecurity.8.5.1 Genera1.Remoteattestationisanimportantstepinestab1.ishingatrustedconnection.Byre
28、moteattestation,thedeviceandtheservicecanbemutua1.1.yconfirmedto: determinewhetherthecommunicationtargetistrusted,thatis,theavai1.abi1.ityofHSMrRoTandothercredibi1.itysupport; checktheI/Oofthep1.atformapp1.icationprocessandrunningstateintegrity; verifythatthecurrentrunningstateofthep1.atformconformstotheauthenticatorssecurityrequirement.agreementprotoco1.describedinB.5.The1.attercanbesupportedbytheso1.utionsgiveninB.4.8.5.2 So1.ution1:Binary-basedremoteattestationBinarf-basedremoteattestationisthemostbasicproofmethodofp1.atformintegrity.
