Network Working Group                                          R. Shirey
Request for Comments: 4949                                   August 2007
FYI: 36
Obsoletes: 2828
Category: Informational
Network Working Group                                          R. Shirey
Request for Comments: 4949                                   August 2007
FYI: 36
Obsoletes: 2828
Category: Informational

Internet Security Glossary, Version 2


Status of This Memo


This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.


Copyright Notice


Copyright (C) The IETF Trust (2007).


RFC Editor Note


This document is both a major revision and a major expansion of the Security Glossary in RFC 2828. This revised Glossary is an extensive reference that should help the Internet community to improve the clarity of documentation and discussion in an important area of Internet technology. However, readers should be aware of the following:

本文档是RFC 2828中安全术语表的主要修订和主要扩展。本修订词汇表是一份广泛的参考资料,应有助于互联网社区提高互联网技术一个重要领域的文档和讨论的清晰度。但是,读者应注意以下几点:

(1) The recommendations and some particular interpretations in definitions are those of the author, not an official IETF position. The IETF has not taken a formal position either for or against recommendations made by this Glossary, and the use of RFC 2119 language (e.g., SHOULD NOT) in the Glossary must be understood as unofficial. In other words, the usage rules, wording interpretations, and other recommendations that the Glossary offers are personal opinions of the Glossary's author. Readers must judge for themselves whether or not to follow his recommendations, based on their own knowledge combined with the reasoning presented in the Glossary.

(1) 定义中的建议和某些特定解释是作者的建议和解释,而不是IETF的官方立场。IETF尚未采取正式立场支持或反对本术语表提出的建议,术语表中使用RFC 2119语言(如不应)必须理解为非官方。换句话说,术语表提供的使用规则、措辞解释和其他建议是术语表作者的个人意见。读者必须根据自己的知识,结合词汇表中的推理,自行判断是否遵循他的建议。

(2) The glossary is rich in the history of early network security work, but it may be somewhat incomplete in describing recent security work, which has been developing rapidly.

(2) 该词汇表丰富了早期网络安全工作的历史,但在描述最近迅速发展的安全工作时可能有些不完整。



This Glossary provides definitions, abbreviations, and explanations of terminology for information system security. The 334 pages of entries offer recommendations to improve the comprehensibility of written material that is generated in the Internet Standards Process (RFC 2026). The recommendations follow the principles that such writing should (a) use the same term or definition whenever the same concept is mentioned; (b) use terms in their plainest, dictionary sense; (c) use terms that are already well-established in open publications; and (d) avoid terms that either favor a particular vendor or favor a particular technology or mechanism over other, competing techniques that already exist or could be developed.

本术语表提供信息系统安全术语的定义、缩写和解释。334页的条目为提高互联网标准过程(RFC 2026)中产生的书面材料的可理解性提供了建议。这些建议遵循的原则是,此类文字应(a)在提及相同概念时使用相同的术语或定义;(b) 使用最简单的词典意义上的术语;(c) 使用公开出版物中已经确立的术语;和(d)避免使用有利于特定供应商或有利于特定技术或机制的条款,而不是使用已经存在或可以开发的其他竞争技术。

Table of Contents


   1. Introduction ....................................................3
   2. Format of Entries ...............................................4
      2.1. Order of Entries ...........................................4
      2.2. Capitalization and Abbreviations ...........................5
      2.3. Support for Automated Searching ............................5
      2.4. Definition Type and Context ................................5
      2.5. Explanatory Notes ..........................................6
      2.6. Cross-References ...........................................6
      2.7. Trademarks .................................................6
      2.8. The New Punctuation ........................................6
   3. Types of Entries ................................................7
      3.1. Type "I": Recommended Definitions of Internet Origin .......7
      3.2. Type "N": Recommended Definitions of Non-Internet Origin ...8
      3.3. Type "O": Other Terms and Definitions To Be Noted ..........8
      3.4. Type "D": Deprecated Terms and Definitions .................8
      3.5. Definition Substitutions ...................................8
   4. Definitions .....................................................9
   5. Security Considerations .......................................343
   6. Normative Reference ...........................................343
   7. Informative References ........................................343
   8. Acknowledgments ...............................................364
   1. Introduction ....................................................3
   2. Format of Entries ...............................................4
      2.1. Order of Entries ...........................................4
      2.2. Capitalization and Abbreviations ...........................5
      2.3. Support for Automated Searching ............................5
      2.4. Definition Type and Context ................................5
      2.5. Explanatory Notes ..........................................6
      2.6. Cross-References ...........................................6
      2.7. Trademarks .................................................6
      2.8. The New Punctuation ........................................6
   3. Types of Entries ................................................7
      3.1. Type "I": Recommended Definitions of Internet Origin .......7
      3.2. Type "N": Recommended Definitions of Non-Internet Origin ...8
      3.3. Type "O": Other Terms and Definitions To Be Noted ..........8
      3.4. Type "D": Deprecated Terms and Definitions .................8
      3.5. Definition Substitutions ...................................8
   4. Definitions .....................................................9
   5. Security Considerations .......................................343
   6. Normative Reference ...........................................343
   7. Informative References ........................................343
   8. Acknowledgments ...............................................364
1. Introduction
1. 介绍

This Glossary is *not* an Internet Standard, and its recommendations represent only the opinions of its author. However, this Glossary gives reasons for its recommendations -- especially for the SHOULD NOTs -- so that readers can judge for themselves what to do.


This Glossary provides an internally consistent and self-contained set of terms, abbreviations, and definitions -- supported by explanations, recommendations, and references -- for terminology that concerns information system security. The intent of this Glossary is to improve the comprehensibility of written materials that are generated in the Internet Standards Process (RFC 2026) -- i.e., RFCs, Internet-Drafts, and other items of discourse -- which are referred to here as IDOCs. A few non-security, networking terms are included to make the Glossary self-contained, but more complete glossaries of such terms are available elsewhere [A1523, F1037, R1208, R1983].

本术语表提供了一组内部一致且自包含的术语、缩写和定义,并提供了与信息系统安全相关的术语的解释、建议和参考。本词汇表旨在提高互联网标准过程(RFC 2026)中产生的书面材料的可理解性,即RFC、互联网草案和其他话语项目,此处称为IDOC。为了使术语表更加完整,还包括了一些非安全性的网络术语,但在其他地方可以找到更完整的此类术语表[A1523、F1037、R1208、R1983]。

This Glossary supports the goals of the Internet Standards Process:


o Clear, Concise, Easily Understood Documentation

o 清晰、简洁、易于理解的文档

This Glossary seeks to improve comprehensibility of security-related content of IDOCs. That requires wording to be clear and understandable, and requires the set of security-related terms and definitions to be consistent and self-supporting. Also, terminology needs to be uniform across all IDOCs; i.e., the same term or definition needs to be used whenever and wherever the same concept is mentioned. Harmonization of existing IDOCs need not be done immediately, but it is desirable to correct and standardize terminology when new versions are issued in the normal course of standards development and evolution.

本词汇表旨在提高IDOCs安全相关内容的可理解性。这要求措辞清晰易懂,并要求一套与安全相关的术语和定义保持一致和自我支持。此外,所有IDOC的术语都需要统一;i、 例如,无论何时何地提及相同的概念,都需要使用相同的术语或定义。不需要立即对现有的IDOC进行协调,但在标准开发和演变的正常过程中发布新版本时,需要纠正和标准化术语。

o Technical Excellence

o 技术卓越

Just as Internet Standard (STD) protocols should operate effectively, IDOCs should use terminology accurately, precisely, and unambiguously to enable standards to be implemented correctly.


o Prior Implementation and Testing

o 预先实施和测试

Just as STD protocols require demonstrated experience and stability before adoption, IDOCs need to use well-established language; and the robustness principle for protocols -- "be liberal in what you accept, and conservative in what you send" -- is also applicable to the language used in IDOCs that describe protocols. Using terms in their plainest, dictionary sense (when appropriate) helps to make them more easily understood by


international readers. IDOCs need to avoid using private, newly invented terms in place of generally accepted terms from open publications. IDOCs need to avoid substituting new definitions that conflict with established ones. IDOCs need to avoid using "cute" synonyms (e.g., "Green Book"), because no matter how popular a nickname may be in one community, it is likely to cause confusion in another.


However, although this Glossary strives for plain, internationally understood English language, its terms and definitions are biased toward English as used in the United States of America (U.S.). Also, with regard to terminology used by national governments and in national defense areas, the glossary addresses only U.S. usage.


o Openness, Fairness, and Timeliness

o 公开、公平和及时性

IDOCs need to avoid using proprietary and trademarked terms for purposes other than referring to those particular systems. IDOCs also need to avoid terms that either favor a particular vendor or favor a particular security technology or mechanism over other, competing techniques that already exist or might be developed in the future. The set of terminology used across the set of IDOCs needs to be flexible and adaptable as the state of Internet security art evolves.


In support of those goals, this Glossary offers guidance by marking terms and definitions as being either endorsed or deprecated for use in IDOCs. The key words "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are intended to be interpreted the same way as in an Internet Standard (i.e., as specified in RFC 2119 [R2119]). Other glossaries (e.g., [Raym]) list additional terms that deal with Internet security but have not been included in this Glossary because they are not appropriate for IDOCs.

为了支持这些目标,本术语表通过将术语和定义标记为已认可或已弃用以在IDOCs中使用来提供指导。关键词“应该”、“不应该”、“建议”、“可能”和“可选”的解释方式与互联网标准中的解释方式相同(即,如RFC 2119[R2119]中的规定)。其他词汇表(例如,[Raym])列出了涉及互联网安全的其他术语,但由于这些术语不适用于IDOC,因此未包含在本词汇表中。

2. Format of Entries
2. 条目格式

Section 4 presents Glossary entries in the following manner:


2.1. Order of Entries
2.1. 条目顺序

Entries are sorted in lexicographic order, without regard to capitalization. Numeric digits are treated as preceding alphabetic characters, and special characters are treated as preceding digits. Blanks are treated as preceding non-blank characters, except that a hyphen or slash between the parts of a multiword entry (e.g., "RED/BLACK separation") is treated like a blank.


If an entry has multiple definitions (e.g., "domain"), they are numbered beginning with "1", and any of those multiple definitions that are RECOMMENDED for use in IDOCs are presented before other definitions for that entry. If definitions are closely related (e.g., "threat"), they are denoted by adding letters to a number, such as "1a" and "1b".


2.2. Capitalization and Abbreviations
2.2. 大写和缩写

Entries that are proper nouns are capitalized (e.g., "Data Encryption Algorithm"), as are other words derived from proper nouns (e.g., "Caesar cipher"). All other entries are not capitalized (e.g., "certification authority"). Each acronym or other abbreviation that appears in this Glossary, either as an entry or in a definition or explanation, is defined in this Glossary, except items of common English usage, such as "a.k.a.", "e.g.", "etc.", "i.e.", "vol.", "pp.", and "U.S.".


2.3. Support for Automated Searching
2.3. 支持自动搜索

Each entry is preceded by a dollar sign ($) and a space. This makes it possible to find the defining entry for an item "X" by searching for the character string "$ X", without stopping at other entries in which "X" is used in explanations.


2.4. Definition Type and Context
2.4. 定义类型和上下文

Each entry is preceded by a character -- I, N, O, or D -- enclosed in parentheses, to indicate the type of definition (as is explained further in Section 3): - "I" for a RECOMMENDED term or definition of Internet origin. - "N" if RECOMMENDED but not of Internet origin. - "O" for a term or definition that is NOT recommended for use in IDOCs but is something that authors of Internet documents should know about. - "D" for a term or definition that is deprecated and SHOULD NOT be used in Internet documents.


If a definition is valid only in a specific context (e.g., "baggage"), that context is shown immediately following the definition type and is enclosed by a pair of slash symbols (/). If the definition is valid only for specific parts of speech, that is shown in the same way (e.g., "archive").


2.5. Explanatory Notes
2.5. 注释

Some entries have explanatory text that is introduced by one or more of the following keywords: - Deprecated Abbreviation (e.g., "AA") - Deprecated Definition (e.g., "digital certification") - Deprecated Usage (e.g., "authenticate") - Deprecated Term (e.g., "certificate authority") - Pronunciation (e.g., "*-property") - Derivation (e.g., "discretionary access control") - Tutorial (e.g., "accreditation") - Example (e.g., "back door") - Usage (e.g., "access")


Explanatory text in this Glossary MAY be reused in IDOCs. However, this text is not intended to authoritatively supersede text of an IDOC in which the Glossary entry is already used.


2.6. Cross-References
2.6. 交叉引用

Some entries contain a parenthetical remark of the form "(See: X.)", where X is a list of other, related terms. Some entries contain a remark of the form "(Compare: X)", where X is a list of terms that either are antonyms of the entry or differ in some other manner worth noting.


2.7. Trademarks
2.7. 商标

All servicemarks and trademarks that appear in this Glossary are used in an editorial fashion and to the benefit of the mark owner, without any intention of infringement.


2.8. The New Punctuation
2.8. 新标点符号

This Glossary uses the "new" or "logical" punctuation style favored by computer programmers, as described by Raymond [Raym]: Programmers use pairs of quotation marks the same way they use pairs of parentheses, i.e., as balanced delimiters. For example, if "Alice sends" is a phrase, and so are "Bill receives" and "Eve listens", then a programmer would write the following sentence:

本术语表使用计算机程序员喜欢的“新”或“逻辑”标点符号样式,如Raymond[Raym]所述:程序员使用引号对的方式与使用括号对的方式相同,即作为平衡分隔符。例如,如果“Alice sends”是一个短语,“Bill receives”和“Eve listens”也是一个短语,那么程序员将编写以下句子:

"Alice sends", "Bill receives", and "Eve listens".


According to standard American usage, the punctuation in that sentence is incorrect; the continuation commas and the final period should go inside the string quotes, like this:


"Alice sends," "Bill receives," and "Eve listens."


However, a programmer would not include a character in a literal string if the character did not belong there, because that could cause an error. For example, suppose a sentence in a draft of a tutorial on the vi editing language looked like this:


Then delete one line from the file by typing "dd".


A book editor following standard usage might change the sentence to look like this:


Then delete one line from the file by typing "dd."


However, in the vi language, the dot character repeats the last command accepted. So, if a reader entered "dd.", two lines would be deleted instead of one.


Similarly, use of standard American punctuation might cause misunderstanding in entries in this Glossary. Thus, the new punctuation is used here, and we recommend it for IDOCs.


3. Types of Entries
3. 条目类型

Each entry in this Glossary is marked as type I, N, O, or D:


3.1. Type "I": Recommended Definitions of Internet Origin
3.1. “I”类:互联网来源的建议定义

The marking "I" indicates two things: - Origin: "I" (as opposed to "N") means either that the Internet Standards Process or Internet community is authoritative for the definition *or* that the term is sufficiently generic that this Glossary can freely state a definition without contradicting a non-Internet authority (e.g., "attack"). - Recommendation: "I" (as opposed to "O") means that the term and definition are RECOMMENDED for use in IDOCs. However, some "I" entries may be accompanied by a "Usage" note that states a limitation (e.g., "certification"), and IDOCs SHOULD NOT use the defined term outside that limited context.


Many "I" entries are proper nouns (e.g., "Internet Protocol") for which the definition is intended only to provide basic information; i.e., the authoritative definition of such terms is found elsewhere. For a proper noun described as an "Internet protocol", please refer to the current edition of "Internet Official Protocol Standards" (Standard 1) for the standardization status of the protocol.

许多“I”条目是专有名词(例如,“互联网协议”),其定义仅用于提供基本信息;i、 例如,此类术语的权威定义可在其他地方找到。对于被描述为“互联网协议”的专有名词,请参考当前版本的“互联网官方协议标准”(标准1),了解协议的标准化状态。

3.2. Type "N": Recommended Definitions of Non-Internet Origin
3.2. 类型“N”:非互联网来源的建议定义

The marking "N" indicates two things: - Origin: "N" (as opposed to "I") means that the entry has a non-Internet basis or origin. - Recommendation: "N" (as opposed to "O") means that the term and definition are RECOMMENDED for use in IDOCs, if they are needed at all in IDOCs. Many of these entries are accompanied by a label that states a context (e.g., "package") or a note that states a limitation (e.g., "data integrity"), and IDOCs SHOULD NOT use the defined term outside that context or limit. Some of the contexts are rarely if ever expected to occur in an IDOC (e.g., "baggage"). In those cases, the listing exists to make Internet authors aware of the non-Internet usage so that they can avoid conflicts with non-Internet documents.


3.3. Type "O": Other Terms and Definitions To Be Noted
3.3. 类型“O”:需注明的其他术语和定义

The marking "O" means that the definition is of non-Internet origin and SHOULD NOT be used in IDOCs *except* in cases where the term is specifically identified as non-Internet.


For example, an IDOC might mention "BCA" (see: brand certification authority) or "baggage" as an example of some concept; in that case, the document should specifically say "SET(trademark) BCA" or "SET(trademark) baggage" and include the definition of the term.


3.4. Type "D": Deprecated Terms and Definitions
3.4. 类型“D”:不推荐使用的术语和定义

If this Glossary recommends that a term or definition SHOULD NOT be used in IDOCs, then the entry is marked as type "D", and an explanatory note -- "Deprecated Term", "Deprecated Abbreviation", "Deprecated Definition", or "Deprecated Usage" -- is provided.


3.5. Definition Substitutions
3.5. 定义替换

Some terms have a definition published by a non-Internet authority -- a government (e.g., "object reuse"), an industry (e.g., "Secure Data Exchange"), a national authority (e.g., "Data Encryption Standard"), or an international body (e.g., "data confidentiality") -- that is suitable for use in IDOCs. In those cases, this Glossary marks the definition "N", recommending its use in Internet documents.


Other such terms have definitions that are inadequate or inappropriate for IDOCs. For example, a definition might be outdated or too narrow, or it might need clarification by substituting more careful wording (e.g., "authentication exchange") or explanations, using other terms that are defined in this Glossary. In those cases,


this Glossary marks the entry "O", and provides an "I" or "N" entry that precedes, and is intended to supersede, the "O" entry.


In some cases where this Glossary provides a definition to supersede an "O" definition, the substitute is intended to subsume the meaning of the "O" entry and not conflict with it. For the term "security service", for example, the "O" definition deals narrowly with only communication services provided by layers in the OSIRM and is inadequate for the full range of IDOC usage, while the new "I" definition provided by this Glossary can be used in more situations and for more kinds of service. However, the "O" definition is also listed so that IDOC authors will be aware of the context in which the term is used more narrowly.


When making substitutions, this Glossary attempts to avoid contradicting any non-Internet authority. Still, terminology differs between authorities such as the American Bar Association, OSI, SET, the U.S. DoD, and other authorities; and this Glossary probably is not exactly aligned with any of them.


4. Definitions
4. 定义

$ *-property (N) Synonym for "confinement property" in the context of the Bell-LaPadula model. Pronunciation: star property.

$ *-属性(N)是贝尔-拉帕杜拉模型中“限制属性”的同义词。发音:星级酒店。

$ 3DES (N) See: Triple Data Encryption Algorithm.

$ 3DES(N)参见:三重数据加密算法。

$ A1 computer system (O) /TCSEC/ See: Tutorial under "Trusted Computer System Evaluation Criteria". (Compare: beyond A1.)

$ A1计算机系统(O)/TCSEC/参见“可信计算机系统评估标准”下的教程。(比较:超出A1。)

$ AA (D) See: Deprecated Usage under "attribute authority".

$ AA(D)参见“属性权限”下的不推荐用法。

$ ABA Guidelines (N) "American Bar Association (ABA) Digital Signature Guidelines" [DSG], a framework of legal principles for using digital signatures and digital certificates in electronic commerce.

$ 美国律师协会指南(N)“美国律师协会(ABA)数字签名指南”[DSG],在电子商务中使用数字签名和数字证书的法律原则框架。

$ Abstract Syntax Notation One (ASN.1) (N) A standard for describing data objects. [Larm, X680] (See: CMS.)

$ 抽象语法符号1(ASN.1)(N)描述数据对象的标准。[Larm,X680](参见:CMS)

Usage: IDOCs SHOULD use the term "ASN.1" narrowly to describe the notation or language called "Abstract Syntax Notation One". IDOCs MAY use the term more broadly to encompass the notation, its


associated encoding rules (see: BER), and software tools that assist in its use, when the context makes this meaning clear.


Tutorial: OSIRM defines computer network functionality in layers. Protocols and data objects at higher layers are abstractly defined to be implemented using protocols and data objects from lower layers. A higher layer may define transfers of abstract objects between computers, and a lower layer may define those transfers concretely as strings of bits. Syntax is needed to specify data formats of abstract objects, and encoding rules are needed to transform abstract objects into bit strings at lower layers. OSI standards use ASN.1 for those specifications and use various encoding rules for those transformations. (See: BER.)


In ASN.1, formal names are written without spaces, and separate words in a name are indicated by capitalizing the first letter of each word except the first word. For example, the name of a CRL is "certificateRevocationList".


$ ACC (I) See: access control center.

$ ACC(一)见:门禁中心。

$ acceptable risk (I) A risk that is understood and tolerated by a system's user, operator, owner, or accreditor, usually because the cost or difficulty of implementing an effective countermeasure for the associated vulnerability exceeds the expectation of loss. (See: adequate security, risk, "second law" under "Courtney's laws".)

$ 可接受风险(I)系统用户、运营商、所有者或认证机构理解和容忍的风险,通常是因为针对相关漏洞实施有效对策的成本或难度超过了损失预期。(参见:充分的安全、风险、“考特尼定律”下的“第二定律”。)

$ access 1a. (I) The ability and means to communicate with or otherwise interact with a system to use system resources either to handle information or to gain knowledge of the information the system contains. (Compare: handle.)

$ 通道1a。(一) 与系统通信或以其他方式与系统交互以使用系统资源来处理信息或获取系统包含的信息的能力和方法。(比较:句柄。)

Usage: The definition is intended to include all types of communication with a system, including one-way communication in either direction. In actual practice, however, passive users might be treated as not having "access" and, therefore, be exempt from most requirements of the system's security policy. (See: "passive user" under "user".)


1b. (O) "Opportunity to make use of an information system (IS) resource." [C4009]

1b。(O) “利用信息系统(IS)资源的机会。”[C4009]

2. (O) /formal model/ "A specific type of interaction between a subject and an object that results in the flow of information from one to the other." [NCS04]

2. (O) /formal model/“主体和客体之间的一种特定类型的交互,导致信息从一个流向另一个。”[NCS04]

$ Access Certificate for Electronic Services (ACES) (O) A PKI operated by the U.S. Government's General Services Administration in cooperation with industry partners. (See: CAM.)

$ 电子服务访问证书(ACES)(O)由美国政府总务管理局与行业合作伙伴合作运营的PKI。(请参阅:CAM。)

$ access control 1. (I) Protection of system resources against unauthorized access.

$ 访问控制1。(一) 保护系统资源,防止未经授权的访问。

2. (I) A process by which use of system resources is regulated according to a security policy and is permitted only by authorized entities (users, programs, processes, or other systems) according to that policy. (See: access, access control service, computer security, discretionary access control, mandatory access control, role-based access control.)

2. (一) 一种过程,通过该过程,系统资源的使用根据安全策略进行管理,并且根据该策略,只有授权实体(用户、程序、进程或其他系统)才允许使用系统资源。(请参阅:访问、访问控制服务、计算机安全、自主访问控制、强制访问控制、基于角色的访问控制。)

3. (I) /formal model/ Limitations on interactions between subjects and objects in an information system.

3. (一) /形式模型/信息系统中主体和对象之间交互的限制。

4. (O) "The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner." [I7498-2]

4. (O) “防止未经授权使用资源,包括防止以未经授权的方式使用资源。”[I7498-2]

5. (O) /U.S. Government/ A system using physical, electronic, or human controls to identify or admit personnel with properly authorized access to a SCIF.

5. (O) /美国政府/A使用物理、电子或人工控制来识别或接纳有权访问SCIF的人员的系统。

$ access control center (ACC) (I) A computer that maintains a database (possibly in the form of an access control matrix) defining the security policy for an access control service, and that acts as a server for clients requesting access control decisions.

$ 访问控制中心(ACC)(I)维护数据库(可能以访问控制矩阵的形式)的计算机,该数据库定义访问控制服务的安全策略,并充当请求访问控制决策的客户端的服务器。

Tutorial: An ACC is sometimes used in conjunction with a key center to implement access control in a key-distribution system for symmetric cryptography. (See: BLACKER, Kerberos.)


$ access control list (ACL) (I) /information system/ A mechanism that implements access control for a system resource by enumerating the system entities that are permitted to access the resource and stating, either implicitly or explicitly, the access modes granted to each entity. (Compare: access control matrix, access list, access profile, capability list.)

$ 访问控制列表(ACL)(I)/信息系统/通过列举允许访问资源的系统实体并隐式或显式说明授予每个实体的访问模式,实现系统资源访问控制的机制。(比较:访问控制矩阵、访问列表、访问配置文件、能力列表。)

$ access control matrix (I) A rectangular array of cells, with one row per subject and one column per object. The entry in a cell -- that is, the entry for a particular subject-object pair -- indicates the access mode that the subject is permitted to exercise on the object. Each column is

$ 访问控制矩阵(I)单元格的矩形阵列,每个主题一行,每个对象一列。单元格中的条目(即特定的subject-object对的条目)表示允许主体在对象上执行的访问模式。每列都是

equivalent to an "access control list" for the object; and each row is equivalent to an "access profile" for the subject.


$ access control service (I) A security service that protects against a system entity using a system resource in a way not authorized by the system's security policy. (See: access control, discretionary access control, identity-based security policy, mandatory access control, rule-based security policy.)

$ 访问控制服务(I)防止系统实体以未经系统安全策略授权的方式使用系统资源的安全服务。(请参阅:访问控制、自主访问控制、基于身份的安全策略、强制访问控制、基于规则的安全策略。)

Tutorial: This service includes protecting against use of a resource in an unauthorized manner by an entity (i.e., a principal) that is authorized to use the resource in some other manner. (See: insider.) The two basic mechanisms for implementing this service are ACLs and tickets.


$ access level 1. (D) Synonym for the hierarchical "classification level" in a security level. [C4009] (See: security level.)

$ 访问级别1。(D) 安全级别中分层“分类级别”的同义词。[C4009](请参阅:安全级别。)

2. (D) Synonym for "clearance level".

2. (D) “清除水平”的同义词。

Deprecated Definitions: IDOCs SHOULD NOT use this term with these definitions because they duplicate the meaning of more specific terms. Any IDOC that uses this term SHOULD provide a specific definition for it because access control may be based on many attributes other than classification level and clearance level.


$ access list (I) /physical security/ Roster of persons who are authorized to enter a controlled area. (Compare: access control list.)

$ 有权进入控制区的人员名单(I)/人身安全/名册。(比较:访问控制列表。)

$ access mode (I) A distinct type of data processing operation (e.g., read, write, append, or execute, or a combination of operations) that a subject can potentially perform on an object in an information system. [Huff] (See: read, write.)

$ 访问模式(I)主体可能对信息系统中的对象执行的不同类型的数据处理操作(例如,读取、写入、附加或执行,或操作组合)。[Huff](参见:读、写)

$ access policy (I) A kind of "security policy". (See: access, access control.)

$ 访问策略(I)一种“安全策略”。(请参见:访问,访问控制。)

$ access profile (O) Synonym for "capability list".

$ 访问配置文件(O)是“能力列表”的同义词。

Usage: IDOCs that use this term SHOULD state a definition for it because the definition is not widely known.


$ access right (I) Synonym for "authorization"; emphasizes the possession of the authorization by a system entity.

$ 访问权(I)“授权”的同义词;强调系统实体拥有授权。

$ accountability (I) The property of a system or system resource that ensures that the actions of a system entity may be traced uniquely to that entity, which can then be held responsible for its actions. [Huff] (See: audit service.)

$ 责任(I)系统或系统资源的属性,确保系统实体的行为可以唯一地追溯到该实体,然后该实体可以对其行为负责。[Huff](请参阅:审计服务。)

Tutorial: Accountability (a.k.a. individual accountability) typically requires a system ability to positively associate the identity of a user with the time, method, and mode of the user's access to the system. This ability supports detection and subsequent investigation of security breaches. Individual persons who are system users are held accountable for their actions after being notified of the rules of behavior for using the system and the penalties associated with violating those rules.


$ accounting See: COMSEC accounting.

$ 会计见:通信安全会计。

$ accounting legend code (ALC) (O) /U.S. Government/ Numeric system used to indicate the minimum accounting controls required for items of COMSEC material within the CMCS. [C4009] (See: COMSEC accounting.)

$ 会计图例代码(ALC)(O)/美国政府/数字系统,用于指示CMCS内通信安全材料项目所需的最低会计控制。[C4009](参见:通信安全会计)

$ accreditation (N) An administrative action by which a designated authority declares that an information system is approved to operate in a particular security configuration with a prescribed set of safeguards. [FP102, SP37] (See: certification.)

$ 认证(N):一种行政行为,指定机构通过该行为宣布信息系统已获准在特定的安全配置下运行,并具有一套规定的安全措施。[FP102,SP37](参见:认证。)

Tutorial: An accreditation is usually based on a technical certification of the system's security mechanisms. To accredit a system, the approving authority must determine that any residual risk is an acceptable risk. Although the terms "certification" and "accreditation" are used more in the U.S. DoD and other U.S. Government agencies than in commercial organizations, the concepts apply any place where managers are required to deal with and accept responsibility for security risks. For example, the American Bar Association is developing accreditation criteria for CAs.


$ accreditation boundary (O) Synonym for "security perimeter". [C4009]

$ 认证边界(O)是“安全边界”的同义词。[C4009]

$ accreditor (N) A management official who has been designated to have the formal authority to "accredit" an information system, i.e., to authorize the operation of, and the processing of sensitive data in, the system and to accept the residual risk associated with the system. (See: accreditation, residual risk.)

$ 授权人(N):被指定具有正式授权对信息系统进行“授权”的管理人员,即授权对系统中的敏感数据进行操作和处理,并接受与系统相关的剩余风险。(参见:认证,剩余风险。)

$ ACES (O) See: Access Certificate for Electronic Services.

$ ACES(O)见:电子服务准入证书。

$ ACL (I) See: access control list.

$ ACL(I)见:访问控制列表。

$ acquirer 1. (O) /SET/ "The financial institution that establishes an account with a merchant and processes payment card authorizations and payments." [SET1]

$ 收单机构1。(O) /SET/“与商户建立账户并处理支付卡授权和支付的金融机构。”[SET1]

2. (O) /SET/ "The institution (or its agent) that acquires from the card acceptor the financial data relating to the transaction and initiates that data into an interchange system." [SET2]

2. (O) /SET/“从卡接受人处获取与交易有关的财务数据并将该数据导入交换系统的机构(或其代理人)。[SET2]

$ activation data (N) Secret data, other than keys, that is required to access a cryptographic module. (See: CIK. Compare: initialization value.)

$ 激活数据(N)访问加密模块所需的除密钥以外的机密数据。(请参见:CIK.Compare:初始化值。)

$ active attack (I) See: secondary definition under "attack".

$ 主动攻击(I)见“攻击”下的二级定义。

$ active content 1a. (I) Executable software that is bound to a document or other data file and that executes automatically when a user accesses the file, without explicit initiation by the user. (Compare: mobile code.)

$ 活性成分1a。(一) 绑定到文档或其他数据文件并在用户访问该文件时自动执行的可执行软件,无需用户明确启动。(比较:移动代码。)

Tutorial: Active content can be mobile code when its associated file is transferred across a network.


1b. (O) "Electronic documents that can carry out or trigger actions automatically on a computer platform without the intervention of a user. [This technology enables] mobile code associated with a document to execute as the document is rendered." [SP28]

1b。(O) “无需用户干预即可在计算机平台上自动执行或触发操作的电子文档。[该技术使]与文档相关联的移动代码能够在呈现文档时执行。”[SP28]

$ active user (I) See: secondary definition under "system user".

$ 活动用户(I)参见“系统用户”下的二级定义。

$ active wiretapping (I) A wiretapping attack that attempts to alter data being communicated or otherwise affect data flow. (See: wiretapping. Compare: active attack, passive wiretapping.)

$ 主动窃听(I)试图改变正在通信的数据或以其他方式影响数据流的窃听攻击。(请参阅:窃听。比较:主动攻击和被动窃听。)

$ add-on security (N) The retrofitting of protection mechanisms, implemented by hardware or software, in an information system after the system has become operational. [FP039] (Compare: baked-in security.)

$ 附加安全性(N):在信息系统开始运行后,通过硬件或软件对保护机制进行改造。[FP039](比较:安全烘焙。)

$ adequate security (O) /U.S. DoD/ "Security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information." (See: acceptable risk, residual risk.)

$ 充分安全(O)/美国国防部/“与信息丢失、误用或未经授权访问或修改造成的危害风险和程度相称的安全。”(参见:可接受风险,剩余风险。)

$ administrative security 1. (I) Management procedures and constraints to prevent unauthorized access to a system. (See: "third law" under "Courtney's laws", manager, operational security, procedural security, security architecture. Compare: technical security.)

$ 行政安全1。(一) 防止未经授权访问系统的管理程序和限制。(参见“科特尼定律”下的“第三定律”,运营安全、程序安全、安全架构经理。比较:技术安全。)

Examples: Clear delineation and separation of duties; configuration control.


Usage: Administrative security is usually understood to consist of methods and mechanisms that are implemented and executed primarily by people, rather than by automated systems.


2. (O) "The management constraints, operational procedures, accountability procedures, and supplemental controls established to provide an acceptable level of protection for sensitive data." [FP039]

2. (O) “为为敏感数据提供可接受的保护水平而建立的管理约束、操作程序、问责程序和补充控制。”[FP039]

$ administrator 1. (O) /Common Criteria/ A person that is responsible for configuring, maintaining, and administering the TOE in a correct manner for maximum security. (See: administrative security.)

$ 管理员1。(O) /Common Criteria/负责以正确的方式配置、维护和管理TOE以实现最大安全性的人员。(请参阅:管理安全。)

2. (O) /ITSEC/ A person in contact with the TOE, who is responsible for maintaining its operational capability.

2. (O) /ITSEC/与TOE接触的人员,负责维持其操作能力。

$ Advanced Encryption Standard (AES) (N) A U.S. Government standard [FP197] (the successor to DES) that (a) specifies "the AES algorithm", which is a symmetric block cipher that is based on Rijndael and uses key sizes of 128, 192, or 256 bits to operate on a 128-bit block, and (b) states policy for using that algorithm to protect unclassified, sensitive data.

$ 高级加密标准(AES)(N)美国政府标准[FP197](DES的继承者),其中(A)规定了“AES算法”,这是一种基于Rijndael的对称分组密码,使用128、192或256位密钥大小对128位块进行操作,并且(b)规定了使用该算法保护未分类数据的策略,敏感数据。

Tutorial: Rijndael was designed to handle additional block sizes and key lengths that were not adopted in the AES. Rijndael was selected by NIST through a public competition that was held to find a successor to the DEA; the other finalists were MARS, RC6, Serpent, and Twofish.


$ adversary 1. (I) An entity that attacks a system. (Compare: cracker, intruder, hacker.)

$ 对手1。(一) 攻击系统的实体。(比较:黑客、入侵者、黑客。)

2. (I) An entity that is a threat to a system.

2. (一) 对系统构成威胁的实体。

$ AES (N) See: Advanced Encryption Standard.

$ AES(N)参见:高级加密标准。

$ Affirm (O) A formal methodology, language, and integrated set of software tools developed at the University of Southern California's Information Sciences Institute for specifying, coding, and verifying software to produce correct and reliable programs. [Cheh]

$ 肯定(o)在南加州大学信息科学研究所开发的用于指定、编码和验证软件以产生正确和可靠程序的正式方法、语言和成套软件工具。[车]

$ aggregation (I) A circumstance in which a collection of information items is required to be classified at a higher security level than any of the items is classified individually. (See: classification.)

$ 聚合(I)一种情况,在这种情况下,信息项集合需要在比单独分类的任何信息项更高的安全级别上进行分类。(见:分类。)

$ AH (I) See: Authentication Header

$ AH(I)参见:认证头

$ air gap (I) An interface between two systems at which (a) they are not connected physically and (b) any logical connection is not automated (i.e., data is transferred through the interface only manually, under human control). (See: sneaker net. Compare: gateway.)

$ 气隙(I)两个系统之间的接口,其中(a)它们没有物理连接,(b)任何逻辑连接都不是自动的(即,数据仅在人工控制下通过接口传输)。(参见:运动鞋网。比较:网关。)

Example: Computer A and computer B are on opposite sides of a room. To move data from A to B, a person carries a disk across the room. If A and B operate in different security domains, then moving data across the air gap may involve an upgrade or downgrade operation.


$ ALC (O) See: accounting legend code.

$ ALC(O)参见:会计图例代码。

$ algorithm (I) A finite set of step-by-step instructions for a problem-solving or computation procedure, especially one that can be implemented by a computer. (See: cryptographic algorithm.)

$ 算法(I)用于解决问题或计算过程的一组有限的分步指令,特别是可以由计算机实现的指令。(请参阅:加密算法。)

$ alias (I) A name that an entity uses in place of its real name, usually for the purpose of either anonymity or masquerade.

$ 别名(I)实体用以代替真实姓名的名称,通常用于匿名或伪装。

$ Alice and Bob (I) The parties that are most often called upon to illustrate the operation of bipartite security protocols. These and other dramatis personae are listed by Schneier [Schn].

$ Alice和Bob(I)最常被要求说明双边安全协议操作的各方。Schneier[Schn]列出了这些和其他戏剧人物。

$ American National Standards Institute (ANSI) (N) A private, not-for-profit association that administers U.S. private-sector voluntary standards.

$ 美国国家标准协会(ANSI)(N):一个管理美国私营部门自愿性标准的非营利私人协会。

Tutorial: ANSI has approximately 1,000 member organizations, including equipment users, manufacturers, and others. These include commercial firms, governmental agencies, and other institutions and international entities.


ANSI is the sole U.S. representative to (a) ISO and (b) (via the U.S. National Committee) the International Electrotechnical Commission (IEC), which are the two major, non-treaty, international standards organizations.


ANSI provides a forum for ANSI-accredited standards development groups. Among those groups, the following are especially relevant to Internet security: - International Committee for Information Technology Standardization (INCITS) (formerly X3): Primary U.S. focus of standardization in information and communications technologies, encompassing storage, processing, transfer, display, management, organization, and retrieval of information. Example: [A3092]. - Accredited Standards Committee X9: Develops, establishes, maintains, and promotes standards for the financial services industry. Example: [A9009]. - Alliance for Telecommunications Industry Solutions (ATIS): Develops standards, specifications, guidelines, requirements, technical reports, industry processes, and verification tests for interoperability and reliability of telecommunications networks, equipment, and software. Example: [A1523].


$ American Standard Code for Information Interchange (ASCII) (N) A scheme that encodes 128 specified characters -- the numbers 0-9, the letters a-z and A-Z, some basic punctuation symbols, some control codes that originated with Teletype machines, and a blank space -- into the 7-bit binary integers. Forms the basis of the character set representations used in most computers and many Internet standards. [FP001] (See: code.)

$ 美国信息交换标准代码(ASCII)(N)一种将128个指定字符(数字0-9、字母A-z和A-z、一些基本标点符号、一些源自电传打字机的控制代码和一个空格)编码为7位二进制整数的方案。构成大多数计算机和许多Internet标准中使用的字符集表示的基础。[FP001](见:代码)

$ Anderson report (O) A 1972 study of computer security that was written by James P. Anderson for the U.S. Air Force [Ande].

$ 安德森报告(O):一份1972年的计算机安全研究报告,由詹姆斯·安德森为美国空军[Ande]撰写。

Tutorial: Anderson collaborated with a panel of experts to study Air Force requirements for multilevel security. The study recommended research and development that was urgently needed to provide secure information processing for command and control systems and support systems. The report introduced the reference monitor concept and provided development impetus for computer and network security technology. However, many of the security problems that the 1972 report called "current" still plague information systems today.


$ anomaly detection (I) An intrusion detection method that searches for activity that is different from the normal behavior of system entities and system resources. (See: IDS. Compare: misuse detection.)

$ 异常检测(I)一种入侵检测方法,用于搜索与系统实体和系统资源的正常行为不同的活动。(请参阅:IDS.Compare:误用检测。)

$ anonymity (I) The condition of an identity being unknown or concealed. (See: alias, anonymizer, anonymous credential, anonymous login, identity, onion routing, persona certificate. Compare: privacy.)

$ 匿名性(I)身份未知或隐藏的情况。(请参阅:别名、匿名者、匿名凭据、匿名登录、身份、洋葱路由、角色证书。比较:隐私。)

Tutorial: An application may require security services that maintain anonymity of users or other system entities, perhaps to preserve their privacy or hide them from attack. To hide an entity's real name, an alias may be used; for example, a financial institution may assign account numbers. Parties to transactions can thus remain relatively anonymous, but can also accept the transactions as legitimate. Real names of the parties cannot be easily determined by observers of the transactions, but an authorized third party may be able to map an alias to a real name, such as by presenting the institution with a court order. In other applications, anonymous entities may be completely untraceable.


$ anonymizer (I) An internetwork service, usually provided via a proxy server, that provides anonymity and privacy for clients. That is, the service enables a client to access servers (a) without allowing

$ 匿名者(I)通常通过代理服务器提供的互联网服务,为客户提供匿名性和隐私。也就是说,该服务允许客户端访问服务器(a),而不允许

anyone to gather information about which servers the client accesses and (b) without allowing the accessed servers to gather information about the client, such as its IP address.


$ anonymous credential (D) /U.S. Government/ A credential that (a) can be used to authenticate a person as having a specific attribute or being a member of a specific group (e.g., military veterans or U.S. citizens) but (b) does not reveal the individual identity of the person that presents the credential. [M0404] (See: anonymity.)

$ 匿名凭证(D)/美国政府/一种凭证,该凭证(A)可用于认证具有特定属性的人员或特定群体的成员(如退伍军人或美国公民),但(b)不显示出示凭证人员的个人身份。[M0404](参见:匿名。)

Deprecated Term: IDOCs SHOULD NOT use this term; it mixes concepts in a potentially misleading way. For example, when the credential is an X.509 certificate, the term could be misunderstood to mean that the certificate was signed by a CA that has a persona certificate. Instead, use "attribute certificate", "organizational certificate", or "persona certificate" depending on what is meant, and provide additional explanations as needed.


$ anonymous login (I) An access control feature (actually, an access control vulnerability) in many Internet hosts that enables users to gain access to general-purpose or public services and resources of a host (such as allowing any user to transfer data using FTP) without having a pre-established, identity-specific account (i.e., user name and password). (See: anonymity.)

$ 匿名登录(I)许多Internet主机中的一种访问控制功能(实际上是一种访问控制漏洞),使用户能够访问主机的通用或公共服务和资源(例如,允许任何用户使用FTP传输数据),而无需预设特定于身份的帐户(即用户名和密码)。(请参阅:匿名。)

Tutorial: This feature exposes a system to more threats than when all the users are known, pre-registered entities that are individually accountable for their actions. A user logs in using a special, publicly known user name (e.g., "anonymous", "guest", or "ftp"). To use the public login name, the user is not required to know a secret password and may not be required to input anything at all except the name. In other cases, to complete the normal sequence of steps in a login protocol, the system may require the user to input a matching, publicly known password (such as "anonymous") or may ask the user for an e-mail address or some other arbitrary character string.


$ ANSI (N) See: American National Standards Institute.

$ ANSI(N)见:美国国家标准协会。

$ anti-jam (N) "Measures ensuring that transmitted information can be received despite deliberate jamming attempts." [C4009] (See: electronic security, frequency hopping, jam, spread spectrum.)

$ 抗干扰(N)“确保在故意干扰的情况下仍能接收传输信息的措施。”[C4009](见:电子安全、跳频、干扰、扩频。)

$ apex trust anchor (N) The trust anchor that is superior to all other trust anchors in a particular system or context. (See: trust anchor, top CA.)

$ 顶点信任锚(N)在特定系统或上下文中优于所有其他信任锚的信任锚。(请参阅:信任锚,顶部CA)

$ API (I) See: application programming interface.

$ API(I)见:应用程序编程接口。

$ APOP (I) See: POP3 APOP.


$ Application Layer See: Internet Protocol Suite, OSIRM.

$ 应用层请参阅:互联网协议套件,OSIRM。

$ application program (I) A computer program that performs a specific function directly for a user (as opposed to a program that is part of a computer operating system and exists to perform functions in support of application programs).

$ 应用程序(I)直接为用户执行特定功能的计算机程序(与作为计算机操作系统的一部分并用于执行支持应用程序的功能的程序相反)。

$ architecture (I) See: security architecture, system architecture.

$ 架构(I)参见:安全架构、系统架构。

$ archive 1a. (I) /noun/ A collection of data that is stored for a relatively long period of time for historical and other purposes, such as to support audit service, availability service, or system integrity service. (Compare: backup, repository.)

$ 档案1a。(一) /noon/A出于历史和其他目的(如支持审核服务、可用性服务或系统完整性服务)而存储相对较长时间的数据集合。(比较:备份、存储库。)

1b. (I) /verb/ To store data in such a way as to create an archive. (Compare: back up.)

1b。(一) /verb/以创建存档的方式存储数据。(比较:备份。)

Tutorial: A digital signature may need to be verified many years after the signing occurs. The CA -- the one that issued the certificate containing the public key needed to verify that signature -- may not stay in operation that long. So every CA needs to provide for long-term storage of the information needed to verify the signatures of those to whom it issues certificates.


$ ARPANET (I) Advanced Research Projects Agency (ARPA) Network, a pioneer packet-switched network that (a) was designed, implemented, operated, and maintained by BBN from January 1969 until July 1975 under contract to the U.S. Government; (b) led to the development of today's Internet; and (c) was decommissioned in June 1990. [B4799, Hafn]

$ ARPANET(I)高级研究计划署(ARPA)网络,一个先锋分组交换网络,根据与美国政府签订的合同,BBN于1969年1月至1975年7月设计、实施、运营和维护;(b) 导致了当今互联网的发展;(c)于1990年6月退役。[B4799,哈芬]

$ ASCII (N) See: American Standard Code for Information Interchange.

$ ASCII(N)参见:美国信息交换标准代码。

$ ASN.1 (N) See: Abstract Syntax Notation One.

$ ASN.1(N)见:抽象语法符号一。

$ asset (I) A system resource that is (a) required to be protected by an information system's security policy, (b) intended to be protected by a countermeasure, or (c) required for a system's mission.

$ 资产(I)(A)需要由信息系统安全策略保护的系统资源,(b)打算由对策保护的系统资源,或(c)系统任务所需的系统资源。

$ association (I) A cooperative relationship between system entities, usually for the purpose of transferring information between them. (See: security association.)

$ 关联(I)系统实体之间的合作关系,通常用于在它们之间传输信息。(见:安全协会。)

$ assurance See: security assurance.

$ 保证见:安全保证。

$ assurance level (N) A rank on a hierarchical scale that judges the confidence someone can have that a TOE adequately fulfills stated security requirements. (See: assurance, certificate policy, EAL, TCSEC.)

$ 保证水平(N):等级等级评定中的一个等级,用于判断某人对某个脚趾能够充分满足规定的安全要求的信心。(参见:保证、证书政策、EAL、TCSEC。)

Example: U.S. Government guidance [M0404] describes four assurance levels for identity authentication, where each level "describes the [U.S. Federal Government] agency's degree of certainty that the user has presented [a credential] that refers to [the user's] identity." In that guidance, assurance is defined as (a) "the degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued" and (b) "the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued."


The four levels are described as follows: - Level 1: Little or no confidence in the asserted identity. - Level 2: Some confidence in the asserted identity. - Level 3: High confidence in the asserted identity. - Level 4: Very high confidence in the asserted identity.


Standards for determining these levels are provided in a NIST publication [SP12]. However, as noted there, an assurance level is "a degree of confidence, not a true measure of how secure the system actually is. This distinction is necessary because it is extremely difficult -- and in many cases, virtually impossible -- to know exactly how secure a system is."


$ asymmetric cryptography (I) A modern branch of cryptography (popularly known as "public-key cryptography") in which the algorithms use a pair of keys (a public key and a private key) and use a different component of the pair for each of two counterpart cryptographic operations (e.g.,

$ 非对称密码学(I)密码学的一个现代分支(通常称为“公钥密码学”),其中算法使用一对密钥(公钥和私钥),并为两个对应的加密操作(例如。,

encryption and decryption, or signature creation and signature verification). (See: key pair, symmetric cryptography.)


Tutorial: Asymmetric algorithms have key management advantages over equivalently strong symmetric ones. First, one key of the pair need not be known by anyone but its owner; so it can more easily be kept secret. Second, although the other key is shared by all entities that use the algorithm, that key need not be kept secret from other, non-using entities; thus, the key-distribution part of key management can be done more easily.


Asymmetric cryptography can be used to create algorithms for encryption, digital signature, and key agreement: - In an asymmetric encryption algorithm (e.g., "RSA"), when Alice wants to ensure confidentiality for data she sends to Bob, she encrypts the data with a public key provided by Bob. Only Bob has the matching private key that is needed to decrypt the data. (Compare: seal.) - In an asymmetric digital signature algorithm (e.g., "DSA"), when Alice wants to ensure data integrity or provide authentication for data she sends to Bob, she uses her private key to sign the data (i.e., create a digital signature based on the data). To verify the signature, Bob uses the matching public key that Alice has provided. - In an asymmetric key-agreement algorithm (e.g., "Diffie-Hellman-Merkle"), Alice and Bob each send their own public key to the other party. Then each uses their own private key and the other's public key to compute the new key value.


$ asymmetric key (I) A cryptographic key that is used in an asymmetric cryptographic algorithm. (See: asymmetric cryptography, private key, public key.)

$ 非对称密钥(I)非对称加密算法中使用的加密密钥。(请参阅:非对称加密、私钥、公钥。)

$ ATIS (N) See: "Alliance for Telecommunications Industry Solutions" under "ANSI".

$ ATI(N)参见“ANSI”下的“电信行业解决方案联盟”。

$ attack 1. (I) An intentional act by which an entity attempts to evade security services and violate the security policy of a system. That is, an actual assault on system security that derives from an intelligent threat. (See: penetration, violation, vulnerability.)

$ 攻击1。(一) 实体试图逃避安全服务并违反系统安全策略的故意行为。也就是说,对系统安全的实际攻击源自智能威胁。(请参阅:渗透、违规、漏洞。)

2. (I) A method or technique used in an assault (e.g., masquerade). (See: blind attack, distributed attack.)

2. (一) 在攻击中使用的方法或技巧(如伪装)。(请参阅:盲攻击、分布式攻击。)

Tutorial: Attacks can be characterized according to intent: - An "active attack" attempts to alter system resources or affect their operation. - A "passive attack" attempts to learn or make use of information from a system but does not affect system resources of that system. (See: wiretapping.)


The object of a passive attack might be to obtain data that is needed for an off-line attack. - An "off-line attack" is one in which the attacker obtains data from the target system and then analyzes the data on a different system of the attacker's own choosing, possibly in preparation for a second stage of attack on the target.


Attacks can be characterized according to point of initiation: - An "inside attack" is one that is initiated by an entity inside the security perimeter (an "insider"), i.e., an entity that is authorized to access system resources but uses them in a way not approved by the party that granted the authorization. - An "outside attack" is initiated from outside the security perimeter, by an unauthorized or illegitimate user of the system (an "outsider"). In the Internet, potential outside attackers range from amateur pranksters to organized criminals, international terrorists, and hostile governments. Attacks can be characterized according to method of delivery: - In a "direct attack", the attacker addresses attacking packets to the intended victim(s). - In an "indirect attack", the attacker addresses packets to a third party, and the packets either have the address(es) of the intended victim(s) as their source address(es) or indicate the intended victim(s) in some other way. The third party responds by sending one or more attacking packets to the intended victims. The attacker can use third parties as attack amplifiers by providing a broadcast address as the victim address (e.g., "smurf attack"). (See: reflector attack. Compare: reflection attack, replay attack.)


The term "attack" relates to some other basic security terms as shown in the following diagram:


      + - - - - - - - - - - - - +  + - - - - +  + - - - - - - - - - - -+
      | An Attack:              |  |Counter- |  | A System Resource:   |
      | i.e., A Threat Action   |  | measure |  | Target of the Attack |
      | +----------+            |  |         |  | +-----------------+  |
      | | Attacker |<==================||<=========                 |  |
      | |   i.e.,  |   Passive  |  |         |  | |  Vulnerability  |  |
      | | A Threat |<=================>||<========>                 |  |
      | |  Agent   |  or Active |  |         |  | +-------|||-------+  |
      | +----------+   Attack   |  |         |  |         VVV          |
      |                         |  |         |  | Threat Consequences  |
      + - - - - - - - - - - - - +  + - - - - +  + - - - - - - - - - - -+
      + - - - - - - - - - - - - +  + - - - - +  + - - - - - - - - - - -+
      | An Attack:              |  |Counter- |  | A System Resource:   |
      | i.e., A Threat Action   |  | measure |  | Target of the Attack |
      | +----------+            |  |         |  | +-----------------+  |
      | | Attacker |<==================||<=========                 |  |
      | |   i.e.,  |   Passive  |  |         |  | |  Vulnerability  |  |
      | | A Threat |<=================>||<========>                 |  |
      | |  Agent   |  or Active |  |         |  | +-------|||-------+  |
      | +----------+   Attack   |  |         |  |         VVV          |
      |                         |  |         |  | Threat Consequences  |
      + - - - - - - - - - - - - +  + - - - - +  + - - - - - - - - - - -+

$ attack potential (I) The perceived likelihood of success should an attack be launched, expressed in terms of the attacker's ability (i.e., expertise and resources) and motivation. (Compare: threat, risk.)

$ 攻击可能性(I)攻击成功的感知可能性,以攻击者的能力(即专业知识和资源)和动机表示。(比较:威胁、风险。)

$ attack sensing, warning, and response (I) A set of security services that cooperate with audit service to detect and react to indications of threat actions, including both inside and outside attacks. (See: indicator.)

$ 攻击感知、警告和响应(I)一组安全服务,与审计服务合作,以检测和响应威胁行动的迹象,包括内部和外部攻击。(见:指标。)

$ attack tree (I) A branching, hierarchical data structure that represents a set of potential approaches to achieving an event in which system security is penetrated or compromised in a specified way. [Moor]

$ 攻击树(I)一种分支、分层的数据结构,表示一组潜在的方法,以实现以特定方式渗透或破坏系统安全的事件。[摩尔]

Tutorial: Attack trees are special cases of fault trees. The security incident that is the goal of the attack is represented as the root node of the tree, and the ways that an attacker could reach that goal are iteratively and incrementally represented as branches and subnodes of the tree. Each subnode defines a subgoal, and each subgoal may have its own set of further subgoals, etc. The final nodes on the paths outward from the root, i.e., the leaf nodes, represent different ways to initiate an attack. Each node other than a leaf is either an AND-node or an OR-node. To achieve the goal represented by an AND-node, the subgoals represented by all of that node's subnodes must be achieved; and for an OR-node, at least one of the subgoals must be achieved. Branches can be labeled with values representing difficulty, cost, or other attack attributes, so that alternative attacks can be compared.


$ attribute (N) Information of a particular type concerning an identifiable system entity or object. An "attribute type" is the component of an attribute that indicates the class of information given by the attribute; and an "attribute value" is a particular instance of the class of information indicated by an attribute type. (See: attribute certificate.)

$ 属性(N)与可识别系统实体或对象有关的特定类型的信息。“属性类型”是一个属性的组成部分,表示该属性给出的信息类别;“属性值”是由属性类型指示的信息类的特定实例。(请参阅:属性证书。)

$ attribute authority (AA) 1. (N) A CA that issues attribute certificates.

$ 属性权限(AA)1。(N) 颁发属性证书的CA。

2. (O) "An authority [that] assigns privileges by issuing attribute certificates." [X509]

2. (O) “通过颁发属性证书来分配权限的机构。”[X509]

Deprecated Usage: The abbreviation "AA" SHOULD NOT be used in an IDOC unless it is first defined in the IDOC.


$ attribute certificate 1. (I) A digital certificate that binds a set of descriptive data items, other than a public key, either directly to a subject name or to the identifier of another certificate that is a public-key certificate. (See: capability token.)

$ 属性证书1。(一) 一种数字证书,它将一组描述性数据项(公钥除外)直接绑定到使用者名称或另一证书(公钥证书)的标识符上。(请参阅:功能令牌。)

2. (O) "A data structure, digitally signed by an [a]ttribute [a]uthority, that binds some attribute values with identification information about its holder." [X509]

2. (O) “一种数据结构,由[A]属性[A]权限进行数字签名,将某些属性值与其持有者的标识信息绑定在一起。”[X509]

Tutorial: A public-key certificate binds a subject name to a public key value, along with information needed to perform certain cryptographic functions using that key. Other attributes of a subject, such as a security clearance, may be certified in a separate kind of digital certificate, called an attribute certificate. A subject may have multiple attribute certificates associated with its name or with each of its public-key certificates.


An attribute certificate might be issued to a subject in the following situations: - Different lifetimes: When the lifetime of an attribute binding is shorter than that of the related public-key certificate, or when it is desirable not to need to revoke a subject's public key just to revoke an attribute. - Different authorities: When the authority responsible for the attributes is different than the one that issues the public-key certificate for the subject. (There is no requirement that an attribute certificate be issued by the same CA that issued the associated public-key certificate.)


$ audit See: security audit.

$ 审计参见:安全审计。

$ audit log (I) Synonym for "security audit trail".

$ 审核日志(I)“安全审核跟踪”的同义词。

$ audit service (I) A security service that records information needed to establish accountability for system events and for the actions of system entities that cause them. (See: security audit.)

$ 审计服务(I)一种安全服务,记录建立系统事件责任和导致系统事件的系统实体行为责任所需的信息。(请参阅:安全审计。)

$ audit trail (I) See: security audit trail.

$ 审计跟踪(I)参见:安全审计跟踪。

$ AUTH (I) See: POP3 AUTH.


$ authenticate (I) Verify (i.e., establish the truth of) an attribute value claimed by or for a system entity or system resource. (See: authentication, validate vs. verify, "relationship between data integrity service and authentication services" under "data integrity service".)

$ 验证(I)验证(即,确定)系统实体或系统资源声明的属性值。(请参阅“数据完整性服务”下的“身份验证、验证与验证”、“数据完整性服务与身份验证服务之间的关系”。)

Deprecated Usage: In general English usage, this term is used with the meaning "to prove genuine" (e.g., an art expert authenticates a Michelangelo painting); but IDOCs should restrict usage as follows: - IDOCs SHOULD NOT use this term to refer to proving or checking that data has not been changed, destroyed, or lost in an unauthorized or accidental manner. Instead, use "verify". - IDOCs SHOULD NOT use this term to refer to proving the truth or accuracy of a fact or value such as a digital signature. Instead, use "verify". - IDOCs SHOULD NOT use this term to refer to establishing the soundness or correctness of a construct, such as a digital certificate. Instead, use "validate".


$ authentication (I) The process of verifying a claim that a system entity or system resource has a certain attribute value. (See: attribute, authenticate, authentication exchange, authentication information, credential, data origin authentication, peer entity authentication, "relationship between data integrity service and authentication services" under "data integrity service", simple authentication, strong authentication, verification, X.509.)

$ 认证(I)验证系统实体或系统资源具有特定属性值的声明的过程。(请参阅:属性、身份验证、身份验证交换、身份验证信息、凭证、数据源身份验证、对等实体身份验证、“数据完整性服务”下的“数据完整性服务和身份验证服务之间的关系”、简单身份验证、强身份验证、验证,X.509。)

Tutorial: Security services frequently depend on authentication of the identity of users, but authentication may involve any type of attribute that is recognized by a system. A claim may be made by a subject about itself (e.g., at login, a user typically asserts its identity) or a claim may be made on behalf of a subject or object by some other system entity (e.g., a user may claim that a data object originates from a specific source, or that a data object is classified at a specific security level).


An authentication process consists of two basic steps: - Identification step: Presenting the claimed attribute value (e.g., a user identifier) to the authentication subsystem. - Verification step: Presenting or generating authentication information (e.g., a value signed with a private key) that acts as evidence to prove the binding between the attribute and that for which it is claimed. (See: verification.)


$ authentication code (D) Synonym for a checksum based on cryptography. (Compare: Data Authentication Code, Message Authentication Code.)

$ 身份验证码(D)是基于密码学的校验和的同义词。(比较:数据身份验证代码、消息身份验证代码。)

Deprecated Term: IDOCs SHOULD NOT use this uncapitalized term as a synonym for any kind of checksum, regardless of whether or not the checksum is cryptographic. Instead, use "checksum", "Data Authentication Code", "error detection code", "hash", "keyed hash", "Message Authentication Code", "protected checksum", or some other recommended term, depending on what is meant.


The term mixes concepts in a potentially misleading way. The word "authentication" is misleading because the checksum may be used to perform a data integrity function rather than a data origin authentication function.


$ authentication exchange 1. (I) A mechanism to verify the identity of an entity by means of information exchange.

$ 身份验证exchange 1。(一) 通过信息交换验证实体身份的机制。

2. (O) "A mechanism intended to ensure the identity of an entity by means of information exchange." [I7498-2]

2. (O) “旨在通过信息交换确保实体身份的机制。”[I7498-2]

$ Authentication Header (AH) (I) An Internet protocol [R2402, R4302] designed to provide connectionless data integrity service and connectionless data origin authentication service for IP datagrams, and (optionally) to provide partial sequence integrity and protection against replay attacks. (See: IPsec. Compare: ESP.)

$ 认证头(AH)(I)互联网协议[R2402,R4302],旨在为IP数据报提供无连接数据完整性服务和无连接数据源认证服务,以及(可选)提供部分序列完整性和防止重放攻击。(请参阅:IPsec。比较:ESP)

Tutorial: Replay protection may be selected by the receiver when a security association is established. AH authenticates the upper-layer PDU that is carried as an IP SDU, and also authenticates as much of the IP PCI (i.e., the IP header) as possible. However, some IP header fields may change in transit, and the value of these fields, when the packet arrives at the receiver, may not be predictable by the sender. Thus, the values of such fields cannot be protected end-to-end by AH; protection of the IP header by AH is only partial when such fields are present.

教程:当建立安全关联时,接收方可以选择重播保护。AH认证作为IP SDU携带的上层PDU,并且还认证尽可能多的IP PCI(即,IP报头)。然而,一些IP报头字段可能在传输过程中发生变化,并且当数据包到达接收方时,发送方可能无法预测这些字段的值。因此,AH不能端到端地保护这些字段的值;仅当存在此类字段时,AH对IP报头的保护才是部分的。

AH may be used alone, or in combination with the ESP, or in a nested fashion with tunneling. Security services can be provided between a pair of communicating hosts, between a pair of communicating security gateways, or between a host and a gateway. ESP can provide nearly the same security services as AH, and ESP can also provide data confidentiality service. The main difference between authentication services provided by ESP and AH is the extent of the coverage; ESP does not protect IP header fields unless they are encapsulated by AH.


$ authentication information (I) Information used to verify an identity claimed by or for an entity. (See: authentication, credential, user. Compare: identification information.)

$ 身份验证信息(I)用于验证实体声明的身份或为实体声明的身份的信息。(请参阅:身份验证、凭据、用户。比较:标识信息。)

Tutorial: Authentication information may exist as, or be derived from, one of the following: (a) Something the entity knows (see: password); (b) something the entity possesses (see: token); (c) something the entity is (see: biometric authentication).

教程:身份验证信息可能作为以下信息之一存在,或来源于以下信息之一:(a)实体知道的信息(请参阅:密码);(b) 实体拥有的东西(参见:令牌);(c) 实体是什么(参见:生物特征认证)。

$ authentication service (I) A security service that verifies an identity claimed by or for an entity. (See: authentication.)

$ 身份验证服务(I)验证实体声明的身份或为实体声明的身份的安全服务。(请参阅:身份验证。)

Tutorial: In a network, there are two general forms of authentication service: data origin authentication service and peer entity authentication service.


$ authenticity (I) The property of being genuine and able to be verified and be trusted. (See: authenticate, authentication, validate vs. verify.)

$ 真实性(I)真实、可验证和可信任的属性。(请参阅:身份验证、身份验证、验证与验证。)

$ authority (D) /PKI/ "An entity [that is] responsible for the issuance of certificates." [X509]

$ 管理局(D)/PKI/“负责颁发证书的实体。”[X509]

Deprecated Usage: IDOCs SHOULD NOT use this term as a synonym for attribute authority, certification authority, registration authority, or similar terms; the shortened form may cause confusion. Instead, use the full term at the first instance of usage and then, if it is necessary to shorten text, use AA, CA, RA, and other abbreviations defined in this Glossary.


$ authority certificate (D) "A certificate issued to an authority (e.g. either to a certification authority or to an attribute authority)." [X509] (See: authority.)

$ 颁发机构证书(D)“颁发给颁发机构的证书(例如,颁发给证书颁发机构或属性颁发机构)。”[X509](请参阅:颁发机构。)

Deprecated Term: IDOCs SHOULD NOT use this term because it is ambiguous. Instead, use the full term "certification authority certificate", "attribute authority certificate", "registration authority certificate", etc. at the first instance of usage and then, if it is necessary to shorten text, use AA, CA, RA, and other abbreviations defined in this Glossary.


$ Authority Information Access extension (I) The private extension defined by PKIX for X.509 certificates to indicate "how to access CA information and services for the issuer of the certificate in which the extension appears. Information and services may include on-line validation services and CA policy data." [R3280] (See: private extension.)

$ 权限信息访问扩展(I)PKIX为X.509证书定义的专用扩展,用于指示“如何访问证书颁发者的CA信息和服务(扩展出现在其中)。信息和服务可能包括在线验证服务和CA策略数据。”[R3280](请参阅:专用扩展。)

$ authorization 1a. (I) An approval that is granted to a system entity to access a system resource. (Compare: permission, privilege.)

$ 授权1a。(一) 授予系统实体访问系统资源的批准。(比较:权限、特权。)

Usage: Some synonyms are "permission" and "privilege". Specific terms are preferred in certain contexts: - /PKI/ "Authorization" SHOULD be used, to align with "certification authority" in the standard [X509]. - /role-based access control/ "Permission" SHOULD be used, to align with the standard [ANSI]. - /computer operating systems/ "Privilege" SHOULD be used, to align with the literature. (See: privileged process, privileged user.)


Tutorial: The semantics and granularity of authorizations depend on the application and implementation (see: "first law" under "Courtney's laws"). An authorization may specify a particular access mode -- such as read, write, or execute -- for one or more system resources.


1b. (I) A process for granting approval to a system entity to access a system resource.

1b。(一) 一种批准系统实体访问系统资源的过程。

2. (O) /SET/ "The process by which a properly appointed person or persons grants permission to perform some action on behalf of an organization. This process assesses transaction risk, confirms that a given transaction does not raise the account holder's debt above the account's credit limit, and reserves the specified amount of credit. (When a merchant obtains authorization, payment for the authorized amount is guaranteed -- provided, of course, that the merchant followed the rules associated with the authorization process.)" [SET2]

2. (O) /SET/“一个或多个适当任命的人员授权代表组织执行某些操作的过程。此过程评估交易风险,确认给定交易不会使账户持有人的债务超过账户的信用限额,并保留指定的信用额度。(当商户获得授权时,保证支付授权金额——当然,前提是商户遵守与授权流程相关的规则。)“[SET2]

$ authorization credential (I) See: /access control/ under "credential".

$ 授权凭证(I)请参见“凭证”下的:/access control/。

$ authorize (I) Grant an authorization to a system entity.

$ 授权(I)向系统实体授予授权。

$ authorized user (I) /access control/ A system entity that accesses a system resource for which the entity has received an authorization. (Compare: insider, outsider, unauthorized user.)

$ 授权用户(I)/访问控制/访问实体已收到授权的系统资源的系统实体。(比较:内部人、外部人、未授权用户。)

Deprecated Usage: IDOCs that use this term SHOULD state a definition for it because the term is used in many ways and could easily be misunderstood.


$ automated information system See: information system.

$ 自动化信息系统见:信息系统。

$ availability 1. (I) The property of a system or a system resource being accessible, or usable or operational upon demand, by an authorized system entity, according to performance specifications for the system; i.e., a system is available if it provides services according to the system design whenever users request them. (See: critical, denial of service. Compare: precedence, reliability, survivability.)

$ 可用性1。(一) 根据系统性能规范,授权系统实体可访问、可用或按需操作的系统或系统资源的属性;i、 例如,如果系统在用户请求时根据系统设计提供服务,则系统可用。(请参阅:关键,拒绝服务。比较:优先级,可靠性,生存能力。)

2. (O) "The property of being accessible and usable upon demand by an authorized entity." [I7498-2]

2. (O) “经授权实体要求可访问和使用的财产。”[I7498-2]

3. (D) "Timely, reliable access to data and information services for authorized users." [C4009]

3. (D) “授权用户及时、可靠地访问数据和信息服务。”[C4009]

Deprecated Definition: IDOCs SHOULD NOT use the term with definition 3; the definition mixes "availability" with "reliability", which is a different property. (See: reliability.)


Tutorial: Availability requirements can be specified by quantitative metrics, but sometimes are stated qualitatively, such as in the following: - "Flexible tolerance for delay" may mean that brief system outages do not endanger mission accomplishment, but extended outages may endanger the mission. - "Minimum tolerance for delay" may mean that mission accomplishment requires the system to provide requested services in a short time.


$ availability service (I) A security service that protects a system to ensure its availability.

$ 可用性服务(I)保护系统以确保其可用性的安全服务。

Tutorial: This service addresses the security concerns raised by denial-of-service attacks. It depends on proper management and control of system resources, and thus depends on access control service and other security services.


$ avoidance (I) See: secondary definition under "security".

$ 避免(I)见“担保”下的第二定义。

$ B1, B2, or B3 computer system (O) /TCSEC/ See: Tutorial under "Trusted Computer System Evaluation Criteria".

$ B1、B2或B3计算机系统(O)/TCSEC/请参阅“可信计算机系统评估标准”下的教程。

$ back door 1. (I) /COMPUSEC/ A computer system feature -- which may be (a) an unintentional flaw, (b) a mechanism deliberately installed by the system's creator, or (c) a mechanism surreptitiously installed by an intruder -- that provides access to a system resource by other than the usual procedure and usually is hidden or otherwise not well-known. (See: maintenance hook. Compare: Trojan Horse.)

$ 后门1。(一) /COMPUSEC/一种计算机系统功能,它可能是(A)无意中的缺陷,(b)系统创建者故意安装的机制,或(c)入侵者秘密安装的机制,提供对系统资源的访问,而不是通常的过程,通常是隐藏的或不为人所知的。(请参阅:维护挂钩。比较:特洛伊木马。)

Example: A way to access a computer other than through a normal login. Such an access path is not necessarily designed with malicious intent; operating systems sometimes are shipped by the manufacturer with hidden accounts intended for use by field service technicians or the vendor's maintenance programmers.


2. (I) /cryptography/ A feature of a cryptographic system that makes it easily possible to break or circumvent the protection that the system is designed to provide.

2. (一) /cryptography/cryptography(密码术)/密码系统的一种功能,可轻易破坏或绕过系统设计提供的保护。

Example: A feature that makes it possible to decrypt cipher text much more quickly than by brute-force cryptanalysis, without having prior knowledge of the decryption key.


$ back up (I) /verb/ Create a reserve copy of data or, more generally, provide alternate means to perform system functions despite loss of system resources. (See: contingency plan. Compare: archive.)

$ 备份(I)/动词/创建数据的保留副本,或者更一般地说,提供替代方法,以在系统资源丢失的情况下执行系统功能。(参见:应急计划。比较:存档。)

$ backup (I) /noun or adjective/ Refers to alternate means of performing system functions despite loss of system resources. (See: contingency plan).

$ 备份(I)/名词或形容词/指在系统资源丢失的情况下执行系统功能的替代方法。(见:应急计划)。

Example: A reserve copy of data, preferably one that is stored separately from the original, for use if the original becomes lost or damaged. (Compare: archive.)


$ bagbiter (D) /slang/ "An entity, such as a program or a computer, that fails to work or that works in a remarkably clumsy manner. A person who has caused some trouble, inadvertently or otherwise, typically by failing to program the computer properly." [NCSSG] (See: flaw.)

$ bagbiter(D)/俚语/“一种实体,如程序或计算机,无法工作或工作异常笨拙。通常由于未能正确编程而在无意中或其他方面造成一些麻烦的人。”[NCSSG](见:缺陷。)

Deprecated Term: It is likely that other cultures use different metaphors for these concepts. Therefore, to avoid international misunderstanding, IDOCs SHOULD NOT use this term. (See: Deprecated Usage under "Green Book".)


$ baggage (O) /SET/ An "opaque encrypted tuple, which is included in a SET message but appended as external data to the PKCS encapsulated data. This avoids superencryption of the previously encrypted tuple, but guarantees linkage with the PKCS portion of the message." [SET2]

$ baggage(O)/SET/一个“不透明的加密元组,包含在SET消息中,但作为外部数据附加到PKCS封装的数据中。这避免了对先前加密的元组进行超级加密,但保证了与消息的PKCS部分的链接。”[SET2]

Deprecated Usage: IDOCs SHOULD NOT use this term to describe a data element, except in the form "SET(trademark) baggage" with the meaning given above.


$ baked-in security (D) The inclusion of security mechanisms in an information system beginning at an early point in the system's lifecycle, i.e., during the design phase, or at least early in the implementation phase. (Compare: add-on security.)

$ 烘焙式安全(D)从系统生命周期的早期开始,即在设计阶段,或至少在实施阶段的早期,在信息系统中包含安全机制。(比较:附加安全性。)

Deprecated Term: It is likely that other cultures use different metaphors for this concept. Therefore, to avoid international misunderstanding, IDOCs SHOULD NOT use this term (unless they also provide a definition like this one). (See: Deprecated Usage under "Green Book".)


$ bandwidth (I) The total width of the frequency band that is available to or used by a communication channel; usually expressed in Hertz (Hz). (RFC 3753) (Compare: channel capacity.)

$ 带宽(I)通信信道可用或使用的频带总宽度;通常以赫兹(Hz)表示。(RFC 3753)(比较:信道容量)

$ bank identification number (BIN) 1. (O) The digits of a credit card number that identify the issuing bank. (See: primary account number.)

$ 银行识别号(BIN)1。(O) 识别发卡行的信用卡号的数字。(请参阅:主帐号。)

2. (O) /SET/ The first six digits of a primary account number.

2. (O) /SET/主帐号的前六位数字。

$ Basic Encoding Rules (BER) (I) A standard for representing ASN.1 data types as strings of octets. [X690] (See: Distinguished Encoding Rules.)

$ 基本编码规则(BER)(I)将ASN.1数据类型表示为八位字节字符串的标准。[X690](请参阅:区分编码规则。)

Deprecated Usage: Sometimes incorrectly treated as part of ASN.1. However, ASN.1 properly refers only to a syntax description language, and not to the encoding rules for the language.


$ Basic Security Option (I) See: secondary definition under "IPSO".

$ 基本安全备选办法(I)见“国际公共部门会计准则”下的二级定义。

$ bastion host (I) A strongly protected computer that is in a network protected by a firewall (or is part of a firewall) and is the only host (or one of only a few) in the network that can be directly accessed from networks on the other side of the firewall. (See: firewall.)

$ 堡垒主机(I)在受防火墙保护的网络中(或是防火墙的一部分),是网络中唯一可以从防火墙另一端的网络直接访问的主机(或少数主机中的一个)。(请参阅:防火墙。)

Tutorial: Filtering routers in a firewall typically restrict traffic from the outside network to reaching just one host, the bastion host, which usually is part of the firewall. Since only this one host can be directly attacked, only this one host needs to be very strongly protected, so security can be maintained more easily and less expensively. However, to allow legitimate internal and external users to access application resources through the firewall, higher-layer protocols and services need to be relayed and forwarded by the bastion host. Some services (e.g., DNS and SMTP) have forwarding built in; other services (e.g., TELNET and FTP) require a proxy server on the bastion host.


$ BBN Technologies Corp. (BBN) (O) The research-and-development company (originally called Bolt Baranek and Newman, Inc.) that built the ARPANET.

$ BBN Technologies Corp.(BBN)(O)建造ARPANET的研发公司(原名为Bolt Baranek and Newman,Inc.)。

$ BCA (O) See: brand certification authority.

$ BCA(O)见:品牌认证机构。

$ BCR (O) See: BLACK/Crypto/RED.

$ BCR(O)见:黑色/加密/红色。

$ BCI (O) See: brand CRL identifier.

$ BCI(O)见:品牌CRL标识符。

$ Bell-LaPadula model (N) A formal, mathematical, state-transition model of confidentiality policy for multilevel-secure computer systems [Bell]. (Compare: Biba model, Brewer-Nash model.)

$ Bell-LaPadula模型(N)多级安全计算机系统保密策略的形式化、数学、状态转移模型[Bell]。(比较:Biba模型、Brewer-Nash模型。)

Tutorial: The model, devised by David Bell and Leonard LaPadula at The MITRE Corporation in 1973, characterizes computer system elements as subjects and objects. To determine whether or not a subject is authorized for a particular access mode on an object, the clearance of the subject is compared to the classification of the object. The model defines the notion of a "secure state", in which the only permitted access modes of subjects to objects are in accordance with a specified security policy. It is proven that each state transition preserves security by moving from secure state to secure state, thereby proving that the system is secure. In this model, a multilevel-secure system satisfies several rules, including the "confinement property" (a.k.a. the "*-property"), the "simple security property", and the "tranquility property".


$ benign 1. (N) /COMSEC/ "Condition of cryptographic data [such] that [the data] cannot be compromised by human access [to the data]." [C4009]

$ 良性1。(N) /COMSEC/“加密数据的状态[使[数据]不会被[数据]的人工访问所破坏]。”[C4009]

2. (O) /COMPUSEC/ See: secondary definition under "trust".

2. (O) /COMPUSEC/请参阅“信任”下的辅助定义。

$ benign fill (N) Process by which keying material is generated, distributed, and placed into an ECU without exposure to any human or other system entity, except the cryptographic module that consumes and uses the material. (See: benign.)

$ 良性填充(N)过程,通过该过程生成、分发密钥材料,并将其放入ECU中,而不暴露于任何人类或其他系统实体,消费和使用该材料的加密模块除外。(见:良性)

$ BER (I) See: Basic Encoding Rules.

$ BER(I)参见:基本编码规则。

$ beyond A1 1. (O) /formal/ A level of security assurance that is beyond the highest level (level A1) of criteria specified by the TCSEC. (See: Tutorial under "Trusted Computer System Evaluation Criteria".)

$ 超越A1 1。(O) /正式/超出TCSEC规定的最高标准(A1级)的安全保证级别。(请参阅“受信任的计算机系统评估标准”下的教程。)

2. (O) /informal/ A level of trust so high that it is beyond state-of-the-art technology; i.e., it cannot be provided or verified by currently available assurance methods, and especially not by currently available formal methods.

2. (O) /非正式/高度信任,超越最先进的技术;i、 例如,目前可用的保证方法无法提供或验证,尤其是目前可用的正式方法无法提供或验证。

$ Biba integrity (N) Synonym for "source integrity".

$ Biba integrity(N)是“源完整性”的同义词。

$ Biba model (N) A formal, mathematical, state-transition model of integrity policy for multilevel-secure computer systems [Biba]. (See: source integrity. Compare: Bell-LaPadula model.)

$ Biba模型(N):多级安全计算机系统完整性策略的形式化、数学、状态转移模型[Biba]。(参见:源完整性。比较:Bell-LaPadula模型。)

Tutorial: This model for integrity control is analogous to the Bell-LaPadula model for confidentiality control. Each subject and object is assigned an integrity level and, to determine whether or not a subject is authorized for a particular access mode on an object, the integrity level of the subject is compared to that of the object. The model prohibits the changing of information in an object by a subject with a lesser or incomparable level. The rules of the Biba model are duals of the corresponding rules in the Bell-LaPadula model.


$ billet (N) "A personnel position or assignment that may be filled by one person." [JCP1] (Compare: principal, role, user.)

$ (N)“可由一人担任的人员职位或任务。”[JCP1](比较:负责人、角色、用户。)

Tutorial: In an organization, a "billet" is a populational position, of which there is exactly one instance; but a "role" is functional position, of which there can be multiple instances. System entities are in one-to-one relationships with their billets, but may be in many-to-one and one-to-many relationships with their roles.


$ BIN (O) See: bank identification number.

$ 银行标识代码(O)见:银行标识代码。

$ bind (I) To inseparably associate by applying some security mechanism.

$ 绑定(I)通过应用某种安全机制进行不可分割的关联。

Example: A CA creates a public-key certificate by using a digital signature to bind together (a) a subject name, (b) a public key, and usually (c) some additional data items (e.g., "X.509 public-key certificate").


$ biometric authentication (I) A method of generating authentication information for a person by digitizing measurements of a physical or behavioral

$ 生物特征认证(I)通过数字化物理或行为特征的测量值,为个人生成认证信息的方法

characteristic, such as a fingerprint, hand shape, retina pattern, voiceprint, handwriting style, or face.


$ birthday attack (I) A class of attacks against cryptographic functions, including both encryption functions and hash functions. The attacks take advantage of a statistical property: Given a cryptographic function having an N-bit output, the probability is greater than 1/2 that for 2**(N/2) randomly chosen inputs, the function will produce at least two outputs that are identical. (See: Tutorial under "hash function".)

$ 生日攻击(I)针对加密函数的一类攻击,包括加密函数和哈希函数。这些攻击利用了统计特性:给定一个具有N位输出的加密函数,其概率大于1/2,即对于2**(N/2)个随机选择的输入,该函数将产生至少两个相同的输出。(请参阅“哈希函数”下的教程。)

Derivation: From the somewhat surprising fact (often called the "birthday paradox") that although there are 365 days in a year, the probability is greater than 1/2 that two of more people share the same birthday in any randomly chosen group of 23 people.


Birthday attacks enable an adversary to find two inputs for which a cryptographic function produces the same cipher text (or find two inputs for which a hash functions produces the same hash result) much faster than a brute-force attack can; and a clever adversary can use such a capability to create considerable mischief. However, no birthday attack can enable an adversary to decrypt a given cipher text (or find a hash input that results in a given hash result) any faster than a brute-force attack can.


$ bit (I) A contraction of the term "binary digit"; the smallest unit of information storage, which has two possible states or values. The values usually are represented by the symbols "0" (zero) and "1" (one). (See: block, byte, nibble, word.)

$ 位(I)术语“二进制数字”的缩写;信息存储的最小单位,有两种可能的状态或值。值通常由符号“0”(零)和“1”(一)表示。(请参阅:块、字节、半字节、字。)

$ bit string (I) A sequence of bits, each of which is either "0" or "1".

$ 位串(I)一个位序列,每个位都是“0”或“1”。

$ BLACK 1. (N) Designation for data that consists only of cipher text, and for information system equipment items or facilities that handle only cipher text. Example: "BLACK key". (See: BCR, color change, RED/BLACK separation. Compare: RED.)

$ 黑色1。(N) 仅由密文组成的数据以及仅处理密文的信息系统设备项或设施的名称。示例:“黑键”。(参见:BCR、颜色变化、红/黑分离。比较:红色。)

2. (O) /U.S. Government/ "Designation applied to information systems, and to associated areas, circuits, components, and equipment, in which national security information is encrypted or is not processed." [C4009]

2. (O) /U.S.Government/“适用于国家安全信息加密或未处理的信息系统以及相关区域、电路、组件和设备的名称。”[C4009]

3. (D) Any data that can be disclosed without harm.

3. (D) 任何可以在不造成损害的情况下披露的数据。

Deprecated Definition: IDOCs SHOULD NOT use the term with definition 3 because the definition is ambiguous with regard to whether or not the data is protected.


$ BLACK/Crypto/RED (BCR) (N) An experimental, end-to-end, network packet encryption system developed in a working prototype form by BBN and the Collins Radio division of Rockwell Corporation in the 1975-1980 time frame for the U.S. DoD. BCR was the first network security system to support TCP/IP traffic, and it incorporated the first DES chips that were validated by the U.S. National Bureau of Standards (now called NIST). BCR also was the first to use a KDC and an ACC to manage connections.

$ BLACK/Crypto/RED(BCR)(N)一种实验性的端到端网络数据包加密系统,由BBN和罗克韦尔公司柯林斯无线电部门在1975-1980年的时间框架内为美国国防部以工作原型形式开发。BCR是第一个支持TCP/IP通信的网络安全系统,它包含了第一个经美国国家标准局(现称NIST)验证的DES芯片。BCR也是第一个使用KDC和ACC来管理连接的公司。

$ BLACK key (N) A key that is protected with a key-encrypting key and that must be decrypted before use. (See: BLACK. Compare: RED key.)

$ 黑密钥(N):受密钥加密密钥保护且在使用前必须解密的密钥。(请参见:黑色。比较:红色键。)

$ BLACKER (O) An end-to-end encryption system for computer data networks that was developed by the U.S. DoD in the 1980s to provide host-to-host data confidentiality service for datagrams at OSIRM Layer 3. [Weis] (Compare: CANEWARE, IPsec.)

$ BLACKER(O):一种用于计算机数据网络的端到端加密系统,由美国国防部在20世纪80年代开发,为OSIRM第3层的数据报提供主机到主机的数据保密服务。[Weis](比较:CANEWARE、IPsec)

Tutorial: Each user host connects to its own bump-in-the-wire encryption device called a BLACKER Front End (BFE, TSEC/KI-111), through which the host connects to the subnetwork. The system also includes two types of centralized devices: one or more KDCs connect to the subnetwork and communicate with assigned sets of BFEs, and one or more ACCs connect to the subnetwork and communicate with assigned KDCs. BLACKER uses only symmetric encryption. A KDC distributes session keys to BFE pairs as authorized by an ACC. Each ACC maintains a database for a set of BFEs, and the database determines which pairs from that set (i.e., which pairs of user hosts behind the BFEs) are authorized to communicate and at what security levels.

教程:每个用户主机都连接到称为BLACKER Front End(BFE,TSEC/KI-111)的有线加密设备中自己的凸起,主机通过该凸起连接到子网。该系统还包括两种类型的集中式设备:一个或多个KDC连接到子网并与指定的BFE集通信,以及一个或多个ACC连接到子网并与指定的KDC通信。BLACKER只使用对称加密。KDC将会话密钥分发给ACC授权的BFE对。每个ACC为一组BFE维护一个数据库,该数据库确定该组中的哪些对(即BFE后面的哪些用户主机对)被授权通信以及处于何种安全级别。

The BLACKER system is MLS in three ways: (a) The BFEs form a security perimeter around a subnetwork, separating user hosts from the subnetwork, so that the subnetwork can operate at a different security level (possibly a lower, less expensive level) than the hosts. (b) The BLACKER components are trusted to separate datagrams of different security levels, so that each datagram of a given security level can be received only by a host that is authorized for that security level; and thus BLACKER can separate host communities that operate at different security levels. (c) The host side of a BFE is itself MLS and can recognize a security label on each packet, so that an MLS user host can be authorized

较黑的系统在三个方面是MLS:(a)BFE围绕子网形成安全周界,将用户主机与子网分开,以便子网可以在不同于主机的安全级别(可能更低、更便宜的级别)下运行。(b) 更黑的组件被信任来分离不同安全级别的数据报,以便给定安全级别的每个数据报只能由授权该安全级别的主机接收;因此BLACKER可以分离以不同安全级别运行的主机社区。(c) BFE的主机端本身就是MLS,可以识别每个数据包上的安全标签,因此可以授权MLS用户主机

to successively transmit datagrams that are labeled with different security levels.


$ blind attack (I) A type of network-based attack method that does not require the attacking entity to receive data traffic from the attacked entity; i.e., the attacker does not need to "see" data packets sent by the victim. Example: SYN flood.

$ 盲攻击(I)一种基于网络的攻击方法,不要求攻击实体从被攻击实体接收数据流量;i、 例如,攻击者不需要“查看”受害者发送的数据包。示例:synflood。

Tutorial: If an attack method is blind, the attacker's packets can carry (a) a false IP source address (making it difficult for the victim to find the attacker) and (b) a different address on every packet (making it difficult for the victim to block the attack). If the attacker needs to receive traffic from the victim, the attacker must either (c) reveal its own IP address to the victim (which enables the victim to find the attacker or block the attack by filtering) or (d) provide a false address and also subvert network routing mechanisms to divert the returning packets to the attacker (which makes the attack more complex, more difficult, or more expensive). [R3552]


$ block (I) A bit string or bit vector of finite length. (See: bit, block cipher. Compare: byte, word.)

$ 块(I)有限长度的位字符串或位向量。(请参阅:位,分组密码。比较:字节,字。)

Usage: An "N-bit block" contains N bits, which usually are numbered from left to right as 1, 2, 3, ..., N.


$ block cipher (I) An encryption algorithm that breaks plain text into fixed-size segments and uses the same key to transform each plaintext segment into a fixed-size segment of cipher text. Examples: AES, Blowfish, DEA, IDEA, RC2, and SKIPJACK. (See: block, mode. Compare: stream cipher.)

$ 分组密码(I)一种加密算法,它将明文分成固定大小的段,并使用相同的密钥将每个明文段转换成固定大小的密文段。示例:AES、河豚、DEA、IDEA、RC2和SKIPJACK。(请参阅:块,模式。比较:流密码。)

Tutorial: A block cipher can be adapted to have a different external interface, such as that of a stream cipher, by using a mode of cryptographic operation to package the basic algorithm. (See: CBC, CCM, CFB, CMAC, CTR, DEA, ECB, OFB.)


$ Blowfish (N) A symmetric block cipher with variable-length key (32 to 448 bits) designed in 1993 by Bruce Schneier as an unpatented, license-free, royalty-free replacement for DES or IDEA. [Schn] (See: Twofish.)

$ Blowfish(N):一种具有可变长度密钥(32至448位)的对称分组密码,由Bruce Schneier于1993年设计,作为DES或IDEA的无专利、无许可证、免版税的替代品。[Schn](见:双鱼)

$ brain-damaged (D) /slang/ "Obviously wrong: extremely poorly designed. Calling something brain-damaged is very extreme. The word implies that the thing is completely unusable, and that its failure to work is due to poor design, not accident." [NCSSG] (See: flaw.)

$ 脑损伤(D)/俚语/“显然是错误的:设计极为糟糕。将某事物称为脑损伤是非常极端的。该词暗示该事物完全无法使用,其失效是由于设计不当,而非意外。”[NCSSG](见:缺陷。)

Deprecated Term: It is likely that other cultures use different metaphors for this concept. Therefore, to avoid international misunderstanding, IDOCs SHOULD NOT use this term. (See: Deprecated Usage under "Green Book".)


$ brand 1. (I) A distinctive mark or name that identifies a product or business entity.

$ 品牌1。(一) 标识产品或商业实体的独特标记或名称。

2. (O) /SET/ The name of a payment card. (See: BCA.)

2. (O) /SET/支付卡的名称。(见:BCA)

Tutorial: Financial institutions and other companies have founded payment card brands, protect and advertise the brands, establish and enforce rules for use and acceptance of their payment cards, and provide networks to interconnect the financial institutions. These brands combine the roles of issuer and acquirer in interactions with cardholders and merchants. [SET1]


$ brand certification authority (BCA) (O) /SET/ A CA owned by a payment card brand, such as MasterCard, Visa, or American Express. [SET2] (See: certification hierarchy, SET.)

$ 品牌认证机构(BCA)(O)/SET/A支付卡品牌(如万事达卡、Visa卡或美国运通卡)拥有的CA。[SET2](请参阅:证书层次结构,集合。)

$ brand CRL identifier (BCI) (O) /SET/ A digitally signed list, issued by a BCA, of the names of CAs for which CRLs need to be processed when verifying signatures in SET messages. [SET2]

$ 品牌CRL标识符(BCI)(O)/SET/BCA发布的数字签名列表,在验证SET消息中的签名时,需要为其处理CRL的CA名称。[SET2]

$ break (I) /cryptography/ To successfully perform cryptanalysis and thus succeed in decrypting data or performing some other cryptographic function, without initially having knowledge of the key that the function requires. (See: penetrate, strength, work factor.)

$ break(I)/cryptography/成功执行密码分析,从而成功解密数据或执行其他加密功能,而最初不知道该功能所需的密钥。(参见:穿透力、强度、功系数。)

Usage: This term applies to encrypted data or, more generally, to a cryptographic algorithm or cryptographic system. Also, while the most common use is to refer to completely breaking an algorithm, the term is also used when a method is found that substantially reduces the work factor.


$ Brewer-Nash model (N) A security model [BN89] to enforce the Chinese wall policy. (Compare: Bell-LaPadula model, Clark-Wilson model.)

$ Brewer-Nash模型(N)一种安全模型[BN89],用于实施中国墙政策。(比较:贝尔-拉帕杜拉模型、克拉克-威尔逊模型。)

Tutorial: All proprietary information in the set of commercial firms F(1), F(2), ..., F(N) is categorized into mutually exclusive conflict-of-interest classes I(1), I(2), ..., I(M) that apply across all firms. Each firm belongs to exactly one class. The Brewer-Nash model has the following mandatory rules: - Brewer-Nash Read Rule: Subject S can read information object O from firm F(i) only if either (a) O is from the same firm as some object previously read by S *or* (b) O belongs to a class I(i) from which S has not previously read any object. (See: object, subject.) - Brewer-Nash Write Rule: Subject S can write information object O to firm F(i) only if (a) S can read O by the Brewer-Nash Read Rule *and* (b) no object can be read by S from a different firm F(j), no matter whether F(j) belongs to the same class as F(i) or to a different class.


$ bridge (I) A gateway for traffic flowing at OSIRM Layer 2 between two networks (usually two LANs). (Compare: bridge CA, router.)

$ 网桥(I)两个网络(通常是两个局域网)之间OSIRM第2层流量的网关。(比较:网桥CA、路由器。)

$ bridge CA (I) A PKI consisting of only a CA that cross-certifies with CAs of some other PKIs. (See: cross-certification. Compare: bridge.)

$ 桥接CA(I)仅由一个CA组成的PKI,该CA与一些其他PKI的CA交叉认证。(请参阅:交叉认证。比较:桥接。)

Tutorial: A bridge CA functions as a hub that enables a certificate user in any of the PKIs that attach to the bridge, to validate certificates issued in the other attached PKIs.


      For example, a bridge CA (BCA)                 CA1
      could cross-certify with four                   ^
      PKIs that have the roots CA1,                   |
      CA2, CA3, and CA4. The cross-                   v
      certificates that the roots            CA2 <-> BCA <-> CA3
      exchange with the BCA enable an                 ^
      end entity EE1 certified under                  |
      under CA1 in PK1 to construct                   v
      a certification path needed to                 CA4
      validate the certificate of
      end entity EE2 under CA2,           CA1 -> BCA -> CA2 -> EE2
      or vice versa.                     CA2 -> BCA -> CA1 -> EE1
      For example, a bridge CA (BCA)                 CA1
      could cross-certify with four                   ^
      PKIs that have the roots CA1,                   |
      CA2, CA3, and CA4. The cross-                   v
      certificates that the roots            CA2 <-> BCA <-> CA3
      exchange with the BCA enable an                 ^
      end entity EE1 certified under                  |
      under CA1 in PK1 to construct                   v
      a certification path needed to                 CA4
      validate the certificate of
      end entity EE2 under CA2,           CA1 -> BCA -> CA2 -> EE2
      or vice versa.                     CA2 -> BCA -> CA1 -> EE1

$ British Standard 7799 (N) Part 1 of the standard is a code of practice for how to secure an information system. Part 2 specifies the management framework, objectives, and control requirements for information security management systems. [BS7799] (See: ISO 17799.)

$ 英国标准7799(N)本标准的第1部分是关于如何保护信息系统的实施规程。第2部分规定了信息安全管理系统的管理框架、目标和控制要求。[BS7799](见:ISO 17799)

$ browser (I) A client computer program that can retrieve and display information from servers on the World Wide Web. Examples: Netscape Navigator and Microsoft Internet Explorer.

$ 浏览器(I)一种客户端计算机程序,可从万维网上的服务器检索和显示信息。示例:Netscape Navigator和Microsoft Internet Explorer。

$ brute force (I) A cryptanalysis technique or other kind of attack method involving an exhaustive procedure that tries a large number of possible solutions to the problem. (See: impossible, strength, work factor.)

$ 暴力(I)一种密码分析技术或其他类型的攻击方法,涉及一个穷举过程,尝试大量可能的问题解决方案。(参见:不可能、强度、工作系数。)

Tutorial: In some cases, brute force involves trying all of the possibilities. For example, for cipher text where the analyst already knows the decryption algorithm, a brute-force technique for finding matching plain text is to decrypt the message with every possible key. In other cases, brute force involves trying a large number of possibilities but substantially fewer than all of them. For example, given a hash function that produces an N-bit hash result, the probability is greater than 1/2 that the analyst will find two inputs that have the same hash result after trying only 2**(N/2) randomly chosen inputs. (See: birthday attack.)


$ BS7799 (N) See: British Standard 7799.

$ BS7799(N)参见:英国标准7799。

$ buffer overflow (I) Any attack technique that exploits a vulnerability resulting from computer software or hardware that does not check for exceeding the bounds of a storage area when data is written into a sequence of storage locations beginning in that area.

$ 缓冲区溢出(I)利用计算机软件或硬件产生的漏洞进行攻击的任何攻击技术,当数据写入从该区域开始的存储位置序列时,该漏洞未检查是否超出存储区域的边界。

Tutorial: By causing a normal system operation to write data beyond the bounds of a storage area, the attacker seeks to either disrupt system operation or cause the system to execute malicious software inserted by the attacker.


$ buffer zone (I) A neutral internetwork segment used to connect other segments that each operate under a different security policy.

$ 缓冲区(I)一个中立的网络网段,用于连接在不同安全策略下运行的其他网段。

Tutorial: To connect a private network to the Internet or some other relatively public network, one could construct a small, separate, isolated LAN and connect it to both the private network and the public network; one or both of the connections would implement a firewall to limit the traffic that could pass through the buffer zone.


$ bulk encryption 1. (I) Encryption of multiple channels by aggregating them into a single transfer path and then encrypting that path. (See: channel.)

$ 批量加密1。(一) 通过将多个通道聚合到单个传输路径中,然后对该路径进行加密,对多个通道进行加密。(请参阅:频道。)

2. (O) "Simultaneous encryption of all channels of a multichannel telecommunications link." [C4009] (Compare: bulk keying material.)

2. (O) “同时加密多信道电信链路的所有信道。”[C4009](比较:批量密钥材料。)

Usage: The use of "simultaneous" in definition 2 could be interpreted to mean that multiple channels are encrypted separately but at the same time. However, the common meaning of the term is that multiple data flows are combined into a single stream and then that stream is encrypted as a whole.


$ bulk key (D) In a few published descriptions of hybrid encryption for SSH, Windows 2000, and other applications, this term refers to a symmetric key that (a) is used to encrypt a relatively large amount of data and (b) is itself encrypted with a public key. (Compare: bulk keying material, session key.)

$ 大容量密钥(D)在为SSH、Windows 2000和其他应用程序发布的一些混合加密描述中,该术语指(a)用于加密相对大量数据的对称密钥,以及(b)本身使用公钥加密的对称密钥。(比较:批量关键点材质、会话关键点。)

Example: To send a large file to Bob, Alice (a) generates a symmetric key and uses it to encrypt the file (i.e., encrypt the bulk of the information that is to be sent) and then (b) encrypts that symmetric key (the "bulk key") with Bob's public key.


Deprecated Term: IDOCs SHOULD NOT use this term or definition; the term is not well-established and could be confused with the established term "bulk keying material". Instead, use "symmetric key" and carefully explain how the key is applied.


$ bulk keying material (N) Refers to handling keying material in large quantities, e.g., as a dataset that contains many items of keying material. (See: type 0. Compare: bulk key, bulk encryption.)

$ 批量键控材料(N)是指大量处理键控材料,例如,作为包含许多键控材料项的数据集。(请参见:键入0。比较:批量密钥、批量加密。)

$ bump-in-the-stack (I) An implementation approach that places a network security mechanism inside the system that is to be protected. (Compare: bump-in-the-wire.)

$ 堆栈中的bump(I)一种将网络安全机制置于要保护的系统内的实现方法。(比较:导线中的凹凸。)

Example: IPsec can be implemented inboard, in the protocol stack of an existing system or existing system design, by placing a new layer between the existing IP layer and the OSIRM Layer 3 drivers. Source code access for the existing stack is not required, but the system that contains the stack does need to be modified [R4301].


$ bump-in-the-wire (I) An implementation approach that places a network security mechanism outside of the system that is to be protected. (Compare: bump-in-the-stack.)

$ 线路中断(I)将网络安全机制置于受保护系统之外的一种实现方法。(比较:堆栈中的凹凸。)

Example: IPsec can be implemented outboard, in a physically separate device, so that the system that receives the IPsec protection does not need to be modified at all [R4301]. Military-grade link encryption has mainly been implemented as bump-in-the-wire devices.


$ business-case analysis (N) An extended form of cost-benefit analysis that considers factors beyond financial metrics, including security factors such as the requirement for security services, their technical and programmatic feasibility, their qualitative benefits, and associated risks. (See: risk analysis.)

$ 业务案例分析(N):成本效益分析的一种扩展形式,它考虑财务指标以外的因素,包括安全因素,如安全服务的要求、其技术和规划可行性、其质量效益和相关风险。(参见:风险分析。)

$ byte (I) A fundamental unit of computer storage; the smallest addressable unit in a computer's architecture. Usually holds one character of information and, today, usually means eight bits. (Compare: octet.)

$ 字节(I)计算机存储的基本单位;计算机体系结构中最小的可寻址单元。通常包含一个字符的信息,今天通常表示八位。(比较:八位组。)

Usage: Understood to be larger than a "bit", but smaller than a "word". Although "byte" almost always means "octet" today, some computer architectures have had bytes in other sizes (e.g., six bits, nine bits). Therefore, an STD SHOULD state the number of bits in a byte where the term is first used in the STD.


$ C field (D) See: Compartments field.

$ C字段(D)参见:隔间字段。

$ C1 or C2 computer system (O) /TCSEC/ See: Tutorial under "Trusted Computer System Evaluation Criteria".

$ C1或C2计算机系统(O)/TCSEC/参见“可信计算机系统评估标准”下的教程。

$ CA (I) See: certification authority.

$ CA(I)见:认证机构。

$ CA certificate (D) "A [digital] certificate for one CA issued by another CA." [X509]

$ CA证书(D)“一个CA由另一个CA颁发的[数字]证书”[X509]

Deprecated Definition: IDOCs SHOULD NOT use the term with this definition; the definition is ambiguous with regard to how the certificate is constructed and how it is intended to be used. IDOCs that use this term SHOULD provide a technical definition for it. (See: certificate profile.)


Tutorial: There is no single, obvious choice for a technical definition of this term. Different PKIs can use different certificate profiles, and X.509 provides several choices of how to issue certificates to CAs. For example, one possible definition is the following: A v3 X.509 public-key certificate that has a "basicConstraints" extension containing a "cA" value of "TRUE". That would specifically indicate that "the certified public key may be used to verify certificate signatures", i.e., that the private key may be used by a CA.

教程:对于这个术语的技术定义,没有单一的、明显的选择。不同的PKI可以使用不同的证书配置文件,X.509提供了几种向CA颁发证书的方法。例如,一个可能的定义如下:v3 X.509公钥证书,其“basicConstraints”扩展名包含“cA”值“TRUE”。这将明确表示“经认证的公钥可用于验证证书签名”,即,私钥可由CA使用。

However, there also are other ways to indicate such usage. The certificate may have a "key Usage" extension that indicates the purposes for which the public key may be used, and one of the values that X.509 defines for that extension is "keyCertSign", to indicate that the certificate may be used for verifying a CA's signature on certificates. If "keyCertSign" is present in a certificate that also has a "basicConstraints" extension, then "cA" is set to "TRUE" in that extension. Alternatively, a CA could be issued a certificate in which "keyCertSign" is asserted without "basicConstraints" being present; and an entity that acts as a CA could be issued a certificate with "keyUsage" set to other values, either with or without "keyCertSign".


$ CA domain (N) /PKI/ A security policy domain that "consists of a CA and its subjects [i.e., the entities named in the certificates issued by the CA]. Sometimes referred to as a PKI domain." [PAG] (See: domain.)

$ CA域(N)/PKI/一种安全策略域,“由CA及其主题[即CA颁发的证书中命名的实体]组成”。有时称为PKI域。“[PAG](请参阅:域。)

   $ Caesar cipher
      (I) A cipher that is defined for an alphabet of N characters,
      A(1), A(2), ..., A(N), and creates cipher text by replacing each
      plaintext character A(i) by A(i+K, mod N) for some 0<K<N+1. [Schn]
   $ Caesar cipher
      (I) A cipher that is defined for an alphabet of N characters,
      A(1), A(2), ..., A(N), and creates cipher text by replacing each
      plaintext character A(i) by A(i+K, mod N) for some 0<K<N+1. [Schn]

Examples: (a) During the Gallic wars, Julius Caesar used a cipher with K=3. In a Caesar cipher with K=3 for the English alphabet, A is replaced by D, B by E, C by F, ..., W by Z, X by A, Y by B, Z


by C. (b) UNIX systems sometimes include "ROT13" software that implements a Caesar cipher with K=13 (i.e., ROTate by 13).


$ call back (I) An authentication technique for terminals that remotely access a computer via telephone lines; the host system disconnects the caller and then reconnects on a telephone number that was previously authorized for that terminal.

$ 回拨(I)用于通过电话线远程访问计算机的终端的认证技术;主机系统断开呼叫者的连接,然后重新连接先前为该终端授权的电话号码。

$ CAM (O) See: Certificate Arbitrator Module.

$ CAM(O)请参阅:证书仲裁器模块。

$ CANEWARE (O) An end-to-end encryption system for computer data networks that was developed by the U.S. DoD in the 1980s to provide host-to-host data confidentiality service for datagrams in OSIRM Layer 3. [Roge] (Compare: BLACKER, IPsec.)

$ CANEWARE(O):一种用于计算机数据网络的端到端加密系统,由美国国防部在20世纪80年代开发,用于为OSIRM第3层中的数据报提供主机到主机的数据保密服务。[Roge](比较:BLACKER,IPsec)

Tutorial: Each user host connects to its own bump-in-the-wire encryption device called a CANEWARE Front End (CFE), through which the host connects to the subnetwork. CANEWARE uses symmetric encryption for CFE-to-CFE traffic, but also uses FIREFLY to establish those session keys. The public-key certificates issued by the FIREFLY system include credentials for mandatory access control. For discretionary access control, the system also includes one or more centralized CANEWARE Control Processors (CCPs) that connect to the subnetwork, maintain a database for discretionary access control authorizations, and communicate those authorizations to assigned sets of CFEs.


The CANEWARE system is MLS in only two of the three ways that BLACKER is MLS: (a) Like BLACKER BFEs, CFEs form a security perimeter around a subnetwork, separating user hosts from the subnetwork, so that the subnetwork can operate at a different security level than the hosts. (b) Like BLACKER, the CANEWARE components are trusted to separate datagrams of different security levels, so that each datagram of a given security level can be received only by a host that is authorized for that security level; and thus CANEWARE can separate host communities that operate at different security levels. (c) Unlike a BFE, the host side of a CFE is not MLS, and treats all packets received from a user host as being at the same mandatory security level.

CANEWARE系统在三种方式中只有两种是MLS,BLACKER是MLS:(a)与BLACKER BFE一样,CFE在子网周围形成一个安全周界,将用户主机与子网分开,因此子网可以在不同于主机的安全级别上运行。(b) 与BLACKER一样,CANEWARE组件被信任来分离不同安全级别的数据报,因此给定安全级别的每个数据报只能由授权该安全级别的主机接收;因此,CANEWARE可以分离以不同安全级别运行的主机社区。(c) 与BFE不同,CFE的主机端不是MLS,并且将从用户主机接收的所有数据包视为处于相同的强制安全级别。

$ capability list (I) /information system/ A mechanism that implements access control for a system entity by enumerating the system resources that the entity is permitted to access and, either implicitly or explicitly, the access modes granted for each resource. (Compare:

$ 能力列表(I)/信息系统/通过枚举允许实体访问的系统资源以及隐式或显式为每个资源授予的访问模式,实现系统实体访问控制的机制。(比较:

access control list, access control matrix, access profile, capability token.)


$ capability token (I) A token (usually an unforgeable data object) that gives the bearer or holder the right to access a system resource. Possession of the token is accepted by a system as proof that the holder has been authorized to access the resource indicated by the token. (See: attribute certificate, capability list, credential, digital certificate, ticket, token.)

$ 能力令牌(I)一种令牌(通常是不可伪造的数据对象),赋予承载者或持有者访问系统资源的权利。系统接受对令牌的拥有作为持有者已被授权访问令牌指示的资源的证据。(请参阅:属性证书、能力列表、凭证、数字证书、票证、令牌。)

$ Capability Maturity Model (CMM) (N) Method for judging the maturity of software processes in an organization and for identifying crucial practices needed to increase process maturity. [Chris] (Compare: Common Criteria.)

$ 能力成熟度模型(CMM)(N)用于判断组织中软件过程的成熟度并识别提高过程成熟度所需的关键实践的方法。[Chris](比较:通用标准。)

Tutorial: The CMM does not specify security evaluation criteria (see: assurance level), but its use may improve security assurance. The CMM describes principles and practices that can improve software processes in terms of evolving from ad hoc processes to disciplined processes. The CMM has five levels: - Initial: Software processes are ad hoc or chaotic, and few are well-defined. Success depends on individual effort and heroics. - Repeatable: Basic project management processes are established to track cost, schedule, and functionality. Necessary process discipline is in place to repeat earlier successes on projects with similar applications. - Defined: Software process for both management and engineering activities is documented, standardized, and integrated into a standard software process for the organization. Each project uses an approved, tailored version of the organization's standard process for developing and maintaining software. - Managed: Detailed measures of software process and product quality are collected. Both software process and products are quantitatively understood and controlled. - Optimizing: Continuous process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies.


$ CAPI (I) See: cryptographic application programming interface.

$ CAPI(I)见:加密应用程序编程接口。

$ CAPSTONE (N) An integrated microcircuit (in MYK-8x series manufactured by Mykotronx, Inc.) that implements SKIPJACK, KEA, DSA, SHA, and basic mathematical functions needed to support asymmetric cryptography; has a non-deterministic random number generator; and supports key escrow. (See: FORTEZZA. Compare: CLIPPER.)

$ CAPSTONE(N)集成微电路(Mykotronx,Inc.制造的MYK-8x系列),实现SKIPJACK、KEA、DSA、SHA以及支持非对称加密所需的基本数学函数;具有非确定性随机数生成器;并支持密钥托管。(参见:FORTEZZA。比较:CLIPPER。)

$ card See: cryptographic card, FORTEZZA, payment card, PC card, smart card, token.

$ 卡片见:加密卡,FORTEZZA,支付卡,PC卡,智能卡,代币。

$ card backup See: token backup.

$ 卡备份请参阅:令牌备份。

$ card copy See: token copy.

$ 卡副本见:令牌副本。

$ card restore See: token restore.

$ 卡还原请参阅:令牌还原。

$ cardholder 1. (I) An entity to whom or to which a card has been issued.

$ 持卡人1。(一) 向其或向其发放信用卡的实体。

Usage: Usually refers to a living human being, but might refer (a) to a position (see: billet, role) in an organization or (b) to an automated process. (Compare: user.)


2. (O) /SET/ "The holder of a valid payment card account and user of software supporting electronic commerce." [SET2] A cardholder is issued a payment card by an issuer. SET ensures that in the cardholder's interactions with merchants, the payment card account information remains confidential. [SET1]

2. (O) /SET/“有效支付卡账户的持有人和支持电子商务的软件的用户。”[SET2]发卡机构向持卡人发放支付卡。SET确保在持卡人与商户的互动中,支付卡账户信息保持机密。[SET1]

$ cardholder certificate (O) /SET/ A digital certificate that is issued to a cardholder upon approval of the cardholder's issuing financial institution and that is transmitted to merchants with purchase requests and encrypted payment instructions, carrying assurance that the account number has been validated by the issuing financial institution and cannot be altered by a third party. [SET1]

$ 持卡人证书(O)/SET/经持卡人的发卡金融机构批准后向持卡人颁发的数字证书,通过购买请求和加密支付指令传输给商户,保证账号已由发行金融机构验证,且第三方不得更改。[SET1]

$ cardholder certification authority (CCA) (O) /SET/ A CA responsible for issuing digital certificates to cardholders and operated on behalf of a payment card brand, an issuer, or another party according to brand rules. A CCA maintains relationships with card issuers to allow for the verification of cardholder accounts. A CCA does not issue a CRL but does distribute CRLs issued by root CAs, brand CAs, geopolitical CAs, and payment gateway CAs. [SET2]

$ 持卡人认证机构(CCA)(O)/SET/A CA负责向持卡人颁发数字证书,并根据品牌规则代表支付卡品牌、发卡机构或另一方运营。CCA与发卡机构保持关系,以便对持卡人账户进行验证。CCA不发行CRL,但发行根CA、品牌CA、地缘政治CA和支付网关CA发行的CRL。[SET2]

$ CAST (N) A design procedure for symmetric encryption algorithms, and a resulting family of algorithms, invented by Carlisle Adams (C.A.) and Stafford Tavares (S.T.). [R2144, R2612]

$ CAST(N)对称加密算法的设计过程,以及由此产生的算法系列,由Carlisle Adams(C.A.)和Stafford Tavares(S.T.)发明。[R2144,R2612]

$ category (I) A grouping of sensitive information items to which a non-hierarchical restrictive security label is applied to increase protection of the data. (See: formal access approval. Compare: compartment, classification.)

$ 类别(I)敏感信息项的分组,其中应用了非分层限制性安全标签,以加强对数据的保护。(参见:正式访问批准。比较:隔间,分类。)

$ CAW (N) See: certification authority workstation.

$ CAW(N)参见:证书颁发机构工作站。

$ CBC (N) See: cipher block chaining.

$ CBC(N)参见:密码块链接。

$ CCA (O) See: cardholder certification authority.

$ CCA(O)见:持卡人认证机构。

$ CCEP (O) See: Commercial COMSEC Endorsement Program.

$ CCEP(O)见:商业通信安全认可计划。

$ CCI (O) See: Controlled Cryptographic Item.

$ CCI(O)参见:受控加密项。

$ CCITT (N) Acronym for French translation of International Telephone and Telegraph Consultative Committee. Now renamed ITU-T.

$ CCITT(N)国际电话电报咨询委员会法语翻译的首字母缩写。现更名为ITU-T。

$ CCM (N) See: Counter with Cipher Block Chaining-Message Authentication Code.

$ CCM(N)请参阅:带有密码块链接消息认证码的计数器。

$ CERIAS (O) Purdue University's Center for Education and Research in Information Assurance and Security, which includes faculty from multiple schools and departments and takes a multidisciplinary approach to security problems ranging from technical to ethical, legal, educational, communicational, linguistic, and economic.

$ CERIAS(O)普渡大学信息保障和安全教育与研究中心,包括来自多个学校和部门的教员,对安全问题采取多学科方法,从技术到道德、法律、教育、通信、语言和经济。

$ CERT (I) See: computer emergency response team.

$ 证书(I)见:计算机应急响应小组。

$ certificate 1. (I) /general English/ A document that attests to the truth of something or the ownership of something.

$ 证书1。(一) /通用英语/证明某物真实性或所有权的文件。

2. (I) /general security/ See: capability token, digital certificate.

2. (一) /general security/请参阅:功能令牌、数字证书。

3. (I) /PKI/ See: attribute certificate, public-key certificate.

3. (一) /PKI/请参阅:属性证书、公钥证书。

$ Certificate Arbitrator Module (CAM) (O) An open-source software module that is designed to be integrated with an application for routing, replying to, and otherwise managing and meditating certificate validation requests between that application and the CAs in the ACES PKI.

$ 证书仲裁模块(CAM)(O):一种开源软件模块,设计用于与应用程序集成,用于路由、回复、管理和考虑该应用程序与ACES PKI中的CAs之间的证书验证请求。

$ certificate authority (D) Synonym for "certification authority".

$ 证书颁发机构(D)“证书颁发机构”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; it suggests careless use of the term "certification authority", which is preferred in PKI standards (e.g., [X509, R3280]).


$ certificate chain (D) Synonym for "certification path". (See: trust chain.)

$ 证书链(D)是“证书路径”的同义词。(请参阅:信任链。)

Deprecated Term: IDOCs SHOULD NOT use this term; it duplicates the meaning of a standardized term. Instead, use "certification path".


$ certificate chain validation (D) Synonym for "certificate validation" or "path validation".

$ 证书链验证(D)“证书验证”或“路径验证”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; it duplicates the meaning of standardized terms and mixes concepts in a potentially misleading way. Instead, use "certificate validation" or "path validation", depending on what is meant. (See: validate vs. verify.)


$ certificate creation (I) The act or process by which a CA sets the values of a digital certificate's data fields and signs it. (See: issue.)

$ 证书创建(I)CA设置数字证书数据字段的值并对其签名的行为或过程。(见:问题)

$ certificate expiration (I) The event that occurs when a certificate ceases to be valid because its assigned lifetime has been exceeded. (See: certificate revocation, expire.)

$ 证书过期(I)证书因其分配的生存期已超过而停止有效时发生的事件。(请参阅:证书吊销,过期。)

Tutorial: The assigned lifetime of an X.509 certificate is stated in the certificate itself. (See: validity period.)


$ certificate extension (I) See: extension.

$ 证书扩展(I)参见:扩展。

$ certificate holder (D) Synonym for the "subject" of a digital certificate. (Compare: certificate owner, certificate user.)

$ 证书持有人(D)数字证书“主体”的同义词。(比较:证书所有者、证书用户。)

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for the subject of a digital certificate; the term is potentially ambiguous. For example, the term could be misunderstood as referring to a system entity or component, such as a repository, that simply has possession of a copy of the certificate.


$ certificate management (I) The functions that a CA may perform during the lifecycle of a digital certificate, including the following: - Acquire and verify data items to bind into the certificate. - Encode and sign the certificate. - Store the certificate in a directory or repository. - Renew, rekey, and update the certificate. - Revoke the certificate and issue a CRL. (See: archive management, certificate management, key management, security architecture, token management.)

$ 证书管理(I)CA在数字证书生命周期内可能执行的功能,包括:-获取和验证要绑定到证书中的数据项。-对证书进行编码和签名。-将证书存储在目录或存储库中。-续订、重新设置密钥并更新证书。-吊销证书并颁发CRL。(请参阅:归档管理、证书管理、密钥管理、安全体系结构、令牌管理。)

$ certificate management authority (CMA) (D) /U.S. DoD/ Used to mean either a CA or an RA. [DoD7, SP32]

$ 证书管理机构(CMA)(D)/美国国防部/用于指CA或RA。[DoD7,SP32]

Deprecated Term: IDOCs SHOULD NOT use this term because it is potentially ambiguous, such as in a context involving ICRLs. Instead, use CA, RA, or both, depending on what is meant.


$ certificate owner (D) Synonym for the "subject" of a digital certificate. (Compare: certificate holder, certificate user.)

$ 证书所有者(D)是数字证书“主体”的同义词。(比较:证书持有人、证书用户。)

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for the subject of a digital certificate; the term is potentially ambiguous. For example, the term could refer to a system entity, such as a corporation, that has purchased a certificate to operate equipment, such as a Web server.


$ certificate path (D) Synonym for "certification path".

$ 证书路径(D)是“证书路径”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; it suggests careless use of "certification path", which is preferred in PKI standards (e.g., [X509, R3280]).


$ certificate policy (I) "A named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements." [X509] (Compare: CPS, security policy.)

$ 证书策略(I)“一组命名规则,指示证书对具有通用安全要求的特定社区和/或应用程序类别的适用性。”[X509](比较:CPS,安全策略。)

Example: U.S. DoD's certificate policy [DoD7] defined four classes (i.e., assurance levels) for X.509 public-key certificates and defines the applicability of those classes. (See: class 2.)


Tutorial: A certificate policy can help a certificate user to decide whether a certificate should be trusted in a particular application. "For example, a particular certificate policy might indicate applicability of a type of certificate for the authentication of electronic data interchange transactions for the trading of goods within a given price range." [R3647]


A v3 X.509 public-key certificate may have a "certificatePolicies" extension that lists certificate policies, recognized by the issuing CA, that apply to the certificate and govern its use. Each policy is denoted by an object identifier and may optionally have certificate policy qualifiers. (See: certificate profile.)

v3 X.509公钥证书可能具有“CertificatePolicys”扩展,该扩展列出了由颁发CA识别的证书策略,这些策略应用于证书并管理其使用。每个策略由对象标识符表示,并且可以选择具有证书策略限定符。(请参阅:证书配置文件。)

Each SET certificate specifies at least one certificate policy, that of the SET root CA. SET uses certificate policy qualifiers to point to the actual policy statement and to add qualifying policies to the root policy. (See: SET qualifier.)


$ certificate policy qualifier (I) Information that pertains to a certificate policy and is included in a "certificatePolicies" extension in a v3 X.509 public-key certificate.

$ 证书策略限定符(I)与证书策略相关的信息,包含在v3 X.509公钥证书的“CertificatePolicys”扩展中。

$ certificate profile (I) A specification (e.g., [DoD7, R3280]) of the format and semantics of public-key certificates or attribute certificates, constructed for use in a specific application context by selecting from among options offered by a broader standard. (Compare: protection profile.)

$ 证书配置文件(I)公钥证书或属性证书的格式和语义规范(如[DoD7,R3280]),通过从更广泛的标准提供的选项中进行选择,构建用于特定应用程序上下文。(比较:保护配置文件。)

$ certificate reactivation (I) The act or process by which a digital certificate, that a CA has designated for revocation but not yet listed on a CRL, is returned to the valid state.

$ 证书重新激活(I)CA指定要撤销但尚未在CRL上列出的数字证书返回到有效状态的行为或过程。

$ certificate rekey 1. (I) The act or process by which an existing public-key certificate has its key value changed by issuing a new certificate with a different (usually new) public key. (See: certificate renewal, certificate update, rekey.)

$ 证书密钥1。(一) 通过使用不同(通常是新的)公钥颁发新证书来更改现有公钥证书的密钥值的行为或过程。(请参阅:证书续订、证书更新、重新密钥。)

Tutorial: For an X.509 public-key certificate, the essence of rekey is that the subject stays the same and a new public key is bound to that subject. Other changes are made, and the old


certificate is revoked, only as required by the PKI and CPS in support of the rekey. If changes go beyond that, the process is a "certificate update".


2. (O) /MISSI/ The act or process by which a MISSI CA creates a new X.509 public-key certificate that is identical to the old one, except the new one has (a) a new, different KEA key or (b) a new, different DSS key or (c) new, different KEA and DSS keys. The new certificate also has a different serial number and may have a different validity period. A new key creation date and maximum key lifetime period are assigned to each newly generated key. If a new KEA key is generated, that key is assigned a new KMID. The old certificate remains valid until it expires, but may not be further renewed, rekeyed, or updated.

2. (O) /MISSI/MISSI CA创建与旧X.509公钥证书相同的新X.509公钥证书的行为或过程,但新证书具有(a)新的不同KEA密钥或(b)新的不同DSS密钥或(c)新的不同KEA和DSS密钥除外。新证书还具有不同的序列号,并且可能具有不同的有效期。为每个新生成的密钥分配一个新密钥创建日期和最大密钥生存期。如果生成了新的KEA密钥,则会为该密钥分配一个新的KMID。旧证书在到期前保持有效,但不能进一步续订、重新键入或更新。

$ certificate renewal (I) The act or process by which the validity of the binding asserted by an existing public-key certificate is extended in time by issuing a new certificate. (See: certificate rekey, certificate update.)

$ 证书续期(I)通过颁发新证书来及时延长现有公钥证书声明的绑定有效性的行为或过程。(请参阅:证书密钥更新、证书更新。)

Tutorial: For an X.509 public-key certificate, this term means that the validity period is extended (and, of course, a new serial number is assigned) but the binding of the public key to the subject and to other data items stays the same. The other data items are changed, and the old certificate is revoked, only as required by the PKI and CPS to support the renewal. If changes go beyond that, the process is a "certificate rekey" or "certificate update".


$ certificate request (D) Synonym for "certification request".

$ 证书申请(D)“证书申请”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; it suggests careless use of the term "certification request", which is preferred in PKI standards (e.g., see PKCS #10).


$ certificate revocation (I) The event that occurs when a CA declares that a previously valid digital certificate issued by that CA has become invalid; usually stated with an effective date.

$ 证书撤销(I)CA声明该CA颁发的以前有效的数字证书已失效时发生的事件;通常注明生效日期。

Tutorial: In X.509, a revocation is announced to potential certificate users by issuing a CRL that mentions the certificate. Revocation and listing on a CRL is only necessary prior to the certificate's scheduled expiration.


$ certificate revocation list (CRL) 1. (I) A data structure that enumerates digital certificates that have been invalidated by their issuer prior to when they were scheduled to expire. (See: certificate expiration, delta CRL, X.509 certificate revocation list.)

$ 证书吊销列表(CRL)1。(一) 一种数据结构,枚举在计划到期之前已由其颁发者失效的数字证书。(请参阅:证书到期、delta CRL、X.509证书吊销列表。)

2. (O) "A signed list indicating a set of certificates that are no longer considered valid by the certificate issuer. In addition to the generic term CRL, some specific CRL types are defined for CRLs that cover particular scopes." [X509]

2. (O) “一个签名列表,指示证书颁发者不再认为有效的一组证书。除了通用术语CRL外,还为覆盖特定范围的CRL定义了一些特定的CRL类型。”[X509]

$ certificate revocation tree (N) A mechanism for distributing notices of certificate revocations; uses a tree of hash results that is signed by the tree's issuer. Offers an alternative to issuing a CRL, but is not supported in X.509. (See: certificate status responder.)

$ 证书撤销树(N)分发证书撤销通知的机制;使用由树的颁发者签名的哈希结果树。提供了发布CRL的替代方案,但在X.509中不受支持。(请参阅:证书状态响应程序。)

$ certificate serial number 1. (I) An integer value that (a) is associated with, and may be carried in, a digital certificate; (b) is assigned to the certificate by the certificate's issuer; and (c) is unique among all the certificates produced by that issuer.

$ 证书序列号1。(一) (a)与数字证书相关联并且可以携带在数字证书中的整数值;(b) 由证书的颁发者分配给证书;和(c)在该发行人生产的所有证书中是唯一的。

2. (O) "An integer value, unique within the issuing CA, [that] is unambiguously associated with a certificate issued by that CA." [X509]

2. (O) “一个整数值,在颁发CA内唯一,[该值]与该CA颁发的证书明确关联。”[X509]

$ certificate status authority (D) /U.S. DoD/ "A trusted entity that provides on-line verification to a Relying Party of a subject certificate's trustworthiness [should instead say 'validity'], and may also provide additional attribute information for the subject certificate." [DoD7]

$ 证书状态管理局(D)/美国国防部/“向依赖方提供主体证书可信度在线验证的受信任实体[应改为说‘有效性’],还可以提供主体证书的附加属性信息。”[DoD7]

Deprecated Term: IDOCs SHOULD NOT use this term because it is not widely accepted; instead, use "certificate status responder" or "OCSP server", or otherwise explain what is meant.


$ certificate status responder (N) /FPKI/ A trusted online server that acts for a CA to provide authenticated certificate status information to certificate users [FPKI]. Offers an alternative to issuing a CR. (See: certificate revocation tree, OCSP.)

$ 证书状态响应程序(N)/FPKI/一个受信任的在线服务器,它代表CA向证书用户提供经过身份验证的证书状态信息[FPKI]。提供了颁发CR的替代方案。(请参阅:证书吊销树,OCSP。)

$ certificate update (I) The act or process by which non-key data items bound in an existing public-key certificate, especially authorizations granted

$ 证书更新(I)将非密钥数据项绑定到现有公钥证书中的行为或过程,尤其是授予的授权

to the subject, are changed by issuing a new certificate. (See: certificate rekey, certificate renewal.)


Usage: For an X.509 public-key certificate, the essence of this process is that fundamental changes are made in the data that is bound to the public key, such that it is necessary to revoke the old certificate. (Otherwise, the process is only a "certificate rekey" or "certificate renewal".)


$ certificate user 1. (I) A system entity that depends on the validity of information (such as another entity's public key value) provided by a digital certificate. (See: relying party. Compare: /digital certificate/ subject.)

$ 证书用户1。(一) 依赖于数字证书提供的信息(如另一实体的公钥值)的有效性的系统实体。(请参阅:依赖方。比较:/digital certificate/主题。)

Usage: The depending entity may be a human being or an organization, or a device or process controlled by a human or organization. (See: user.)


2. (O) "An entity that needs to know, with certainty, the public key of another entity." [X509]

2. (O) “需要确切了解另一实体公钥的实体。”[X509]

3. (D) Synonym for "subject" of a digital certificate.

3. (D) 数字证书“主题”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term with definition 3; the term could be confused with one of the other two definitions given above.


$ certificate validation 1. (I) An act or process by which a certificate user establishes that the assertions made by a digital certificate can be trusted. (See: valid certificate, validate vs. verify.)

$ 证书验证1。(一) 一种行为或过程,证书用户通过该行为或过程确定数字证书所作的断言是可信的。(请参阅:有效证书、验证与验证。)

2. (O) "The process of ensuring that a certificate was valid at a given time, including possibly the construction and processing of a certification path [R4158], and ensuring that all certificates in that path were valid (i.e. were not expired or revoked) at that given time." [X509]

2. (O) “确保证书在给定时间有效的过程,可能包括构建和处理证书路径[R4158],并确保该路径中的所有证书在给定时间有效(即未过期或吊销)。[X509]

Tutorial: To validate a certificate, a certificate user checks that the certificate is properly formed and signed and is currently in force: - Checks the syntax and semantics: Parses the certificate's syntax and interprets its semantics, applying rules specified for and by its data fields, such as for critical extensions in an X.509 certificate.


- Checks the signature: Uses the issuer's public key to verify the digital signature of the CA who issued the certificate in question. If the verifier obtains the issuer's public key from the issuer's own public-key certificate, that certificate should be validated, too. That validation may lead to yet another certificate to be validated, and so on. Thus, in general, certificate validation involves discovering and validating a certification path. - Checks currency and revocation: Verifies that the certificate is currently in force by checking that the current date and time are within the validity period (if that is specified in the certificate) and that the certificate is not listed on a CRL or otherwise announced as invalid. (The CRLs also must be checked by a similar validation process.)

- 检查签名:使用颁发者的公钥验证颁发证书的CA的数字签名。如果验证器从颁发者自己的公钥证书中获得颁发者的公钥,则该证书也应进行验证。该验证可能会导致另一个证书被验证,等等。因此,一般来说,证书验证涉及发现和验证证书路径检查货币和吊销:通过检查当前日期和时间是否在有效期内(如果证书中指定)以及证书是否未列在CRL上或以其他方式宣布为无效,验证证书当前是否有效。(CRL还必须通过类似的验证过程进行检查。)

$ certification 1. (I) /information system/ Comprehensive evaluation (usually made in support of an accreditation action) of an information system's technical security features and other safeguards to establish the extent to which the system's design and implementation meet a set of specified security requirements. [C4009, FP102, SP37] (See: accreditation. Compare: evaluation.)

$ 证书1。(一) /信息系统/对信息系统的技术安全功能和其他保障措施进行综合评估(通常是为了支持认证行动),以确定系统的设计和实施在多大程度上满足一系列特定的安全要求。[C4009、FP102、SP37](参见:认证。比较:评估。)

2. (I) /digital certificate/ The act or process of vouching for the truth and accuracy of the binding between data items in a certificate. (See: certify.)

2. (一) /数字证书/证明证书中数据项之间绑定的真实性和准确性的行为或过程。(见:证明)

3. (I) /PKI/ The act or process of vouching for the ownership of a public key by issuing a public-key certificate that binds the key to the name of the entity that possesses the matching private key. Besides binding a key with a name, a public-key certificate may bind those items with other restrictive or explanatory data items. (See: X.509 public-key certificate.)

3. (一) /PKI/通过颁发公钥证书,将公钥绑定到拥有匹配私钥的实体的名称,从而证明公钥所有权的行为或过程。除了使用名称绑定密钥外,公钥证书还可以将这些项与其他限制性或解释性数据项绑定。(请参阅:X.509公钥证书。)

4. (O) /SET/ "The process of ascertaining that a set of requirements or criteria has been fulfilled and attesting to that fact to others, usually with some written instrument. A system that has been inspected and evaluated as fully compliant with the SET protocol by duly authorized parties and process would be said to have been certified compliant." [SET2]

4. (O) /SET/“确定一套要求或标准已得到满足并向其他人证明该事实的过程,通常使用一些书面文书。经正式授权方检查和评估为完全符合SET协议的系统和过程将被视为已被证明符合要求。”[SET2]

$ certification authority (CA) 1. (I) An entity that issues digital certificates (especially X.509 certificates) and vouches for the binding between the data items in a certificate.

$ 核证机关(CA)1。(一) 颁发数字证书(特别是X.509证书)并为证书中的数据项之间的绑定提供担保的实体。

2. (O) "An authority trusted by one or more users to create and assign certificates. Optionally the certification authority may create the user's keys." [X509]

2. (O) “一个或多个用户信任的用于创建和分配证书的机构。证书颁发机构也可以创建用户的密钥。”[X509]

Tutorial: Certificate users depend on the validity of information provided by a certificate. Thus, a CA should be someone that certificate users trust and that usually holds an official position created and granted power by a government, a corporation, or some other organization. A CA is responsible for managing the life cycle of certificates (see: certificate management) and, depending on the type of certificate and the CPS that applies, may be responsible for the lifecycle of key pairs associated with the certificates (see: key management).


$ certification authority workstation (CAW) (N) A computer system that enables a CA to issue digital certificates and supports other certificate management functions as required.

$ 证书颁发机构工作站(CAW)(N)一种计算机系统,使CA能够颁发数字证书,并根据需要支持其他证书管理功能。

$ certification hierarchy 1. (I) A tree-structured (loop-free) topology of relationships between CAs and the entities to whom the CAs issue public-key certificates. (See: hierarchical PKI, hierarchy management.)

$ 认证层次结构1。(一) CA与CA向其颁发公钥证书的实体之间关系的树结构(无循环)拓扑。(请参阅:分层PKI,分层管理。)

Tutorial: In this structure, one CA is the top CA, the highest level of the hierarchy. (See: root, top CA.) The top CA may issue public-key certificates to one or more additional CAs that form the second-highest level. Each of these CAs may issue certificates to more CAs at the third-highest level, and so on. The CAs at the second-lowest level issue certificates only to non-CA entities that form the lowest level (see: end entity). Thus, all certification paths begin at the top CA and descend through zero or more levels of other CAs. All certificate users base path validations on the top CA's public key.

教程:在此结构中,一个CA是顶级CA,即层次结构的最高级别。(请参阅:root,top CA。)顶级CA可以向构成第二高级别的一个或多个附加CA颁发公钥证书。这些CA中的每一个都可以向第三高级别的更多CA颁发证书,以此类推。处于第二最低级别的CA仅向构成最低级别的非CA实体颁发证书(请参阅:end entity)。因此,所有认证路径都从顶部CA开始,然后下降到其他CA的零个或多个级别。所有证书用户都基于顶级CA的公钥进行路径验证。

2. (I) /PEM/ A certification hierarchy for PEM has three levels of CAs [R1422]: - The highest level is the "Internet Policy Registration Authority". - A CA at the second-highest level is a "policy certification authority". - A CA at the third-highest level is a "certification authority".

2. (一) /PEM/PEM的认证层次结构有三个级别的CA[R1422]:-最高级别是“Internet策略注册机构”。-第二高级别的CA是“策略证书颁发机构”——第三高级别的CA是“证书颁发机构”。

3. (O) /MISSI/ A certification hierarchy for MISSI has three or four levels of CAs: - A CA at the highest level, the top CA, is a "policy approving authority".

3. (O) /MISSI/A MISSI的认证层次结构有三到四个CA级别:-最高级别的CA,即顶级CA,是“策略批准机构”。

- A CA at the second-highest level is a "policy creation authority". - A CA at the third-highest level is a local authority called a "certification authority". - A CA at the fourth-highest (optional) level is a "subordinate certification authority".

- 第二高级别的CA是“策略创建机构”。-第三高级别的CA是一个称为“认证机构”的地方机构第四高级别(可选)的CA是“下级证书颁发机构”。

4. (O) /SET/ A certification hierarchy for SET has three or four levels of CAs: - The highest level is a "SET root CA". - A CA at the second-highest level is a "brand certification authority". - A CA at the third-highest (optional) level is a "geopolitical certification authority". - A CA at the fourth-highest level is a "cardholder CA", a "merchant CA", or a "payment gateway CA".

4. (O) /SET/SET的证书层次结构有三个或四个CA级别:-最高级别是“集合根CA”。-第二高级别的CA是“品牌认证机构”——第三高(可选)级别的CA是“地缘政治认证机构”——第四高级别的CA是“持卡人CA”、“商户CA”或“支付网关CA”。

$ certification path 1. (I) A linked sequence of one or more public-key certificates, or one or more public-key certificates and one attribute certificate, that enables a certificate user to verify the signature on the last certificate in the path, and thus enables the user to obtain (from that last certificate) a certified public key, or certified attributes, of the system entity that is the subject of that last certificate. (See: trust anchor, certificate validation, valid certificate.)

$ 认证路径1。(一) 一个或多个公钥证书或一个或多个公钥证书和一个属性证书的链接序列,使证书用户能够验证路径中最后一个证书上的签名,从而使用户能够(从该最后一个证书)获得经认证的公钥或经认证的属性,作为最后一个证书主题的系统实体的。(请参阅:信任锚、证书验证、有效证书。)

2. (O) "An ordered sequence of certificates of objects in the [X.500 Directory Information Tree] which, together with the public key of the initial object in the path, can be processed to obtain that of the final object in the path." [R3647, X509]

2. (O) [X.500目录信息树]中对象的有序证书序列,可与路径中初始对象的公钥一起处理,以获得路径中最终对象的公钥。“[R3647,X509]

Tutorial: The list is "linked" in the sense that the digital signature of each certificate (except possibly the first) is verified by the public key contained in the preceding certificate; i.e., the private key used to sign a certificate and the public key contained in the preceding certificate form a key pair that has previously been bound to the authority that signed.

教程:列表是“链接”的,因为每个证书(第一个证书除外)的数字签名都是由前一个证书中包含的公钥验证的;i、 例如,用于签署证书的私钥和前一证书中包含的公钥形成了一对密钥,该密钥先前已绑定到签署证书的机构。

The path is the "list of certificates needed to [enable] a particular user to obtain the public key [or attributes] of another [user]." [X509] Here, the word "particular" points out that a certification path that can be validated by one certificate user might not be able to be validated by another. That is because either the first certificate needs to be a trusted certificate or the signature on the first certificate needs to be verifiable by a trusted key (e.g., a root key), but such trust is established only


relative to a "particular" (i.e., specific) user, not absolutely for all users.


$ certification policy (D) Synonym for either "certificate policy" or "certification practice statement".

$ 认证政策(D)“认证政策”或“认证实践声明”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term as a synonym for either of those terms; that would be duplicative and would mix concepts in a potentially misleading way. Instead, use either "certificate policy" or "certification practice statement", depending on what is meant.


$ certification practice statement (CPS) (I) "A statement of the practices which a certification authority employs in issuing certificates." [DSG, R3647] (See: certificate policy.)

$ 认证惯例声明(CPS)(I)“认证机构在颁发证书时采用的惯例声明。”[DSG,R3647](见:证书政策。)

Tutorial: A CPS is a published security policy that can help a certificate user to decide whether a certificate issued by a particular CA can be trusted enough to use in a particular application. A CPS may be (a) a declaration by a CA of the details of the system and practices it uses in its certificate management operations, (b) part of a contract between the CA and an entity to whom a certificate is issued, (c) a statute or regulation applicable to the CA, or (d) a combination of these types involving multiple documents. [DSG]


A CPS is usually more detailed and procedurally oriented than a certificate policy. A CPS applies to a particular CA or CA community, while a certificate policy applies across CAs or communities. A CA with its single CPS may support multiple certificate policies, which may be used for different application purposes or by different user communities. On the other hand, multiple CAs, each with a different CPS, may support the same certificate policy. [R3647]


$ certification request (I) An algorithm-independent transaction format (e.g., PKCS #10, RFC 4211) that contains a DN, and a public key or, optionally, a set of attributes, collectively signed by the entity requesting certification, and sent to a CA, which transforms the request to an X.509 public-key certificate or another type of certificate.

$ 认证请求(I)一种独立于算法的事务格式(如PKCS#10、RFC 4211),其中包含一个DN、一个公钥或一组属性,由请求认证的实体共同签名,并发送给CA,CA将请求转换为X.509公钥证书或其他类型的证书。

$ certify 1. (I) Issue a digital certificate and thus vouch for the truth, accuracy, and binding between data items in the certificate (e.g., "X.509 public-key certificate"), such as the identity of the

$ 证明1。(一) 颁发数字证书,从而保证证书中数据项(例如,“X.509公钥证书”)之间的真实性、准确性和绑定性,例如

certificate's subject and the ownership of a public key. (See: certification.)


Usage: To "certify a public key" means to issue a public-key certificate that vouches for the binding between the certificate's subject and the key.


2. (I) The act by which a CA uses measures to verify the truth, accuracy, and binding between data items in a digital certificate.

2. (一) CA使用措施验证数字证书中数据项之间的真实性、准确性和绑定的行为。

Tutorial: A description of the measures used for verification should be included in the CA's CPS.


$ CFB (N) See: cipher feedback.

$ CFB(N)参见:密码反馈。

$ chain (D) See: trust chain.

$ 链(D)参见:信任链。

$ Challenge Handshake Authentication Protocol (CHAP) (I) A peer entity authentication method (employed by PPP and other protocols, e.g., RFC 3720) that uses a randomly generated challenge and requires a matching response that depends on a cryptographic hash of some combination of the challenge and a secret key. [R1994] (See: challenge-response, PAP.)

$ 质询握手认证协议(CHAP)(I)对等实体认证方法(由PPP和其他协议使用,例如RFC 3720),该方法使用随机生成的质询,并需要取决于质询和密钥的某种组合的密码散列的匹配响应。[R1994](参见:质询响应,PAP。)

$ challenge-response (I) An authentication process that verifies an identity by requiring correct authentication information to be provided in response to a challenge. In a computer system, the authentication information is usually a value that is required to be computed in response to an unpredictable challenge value, but it might be just a password.

$ 质询响应(I)通过要求提供正确的身份验证信息以响应质询来验证身份的身份验证过程。在计算机系统中,身份验证信息通常是响应不可预测的质询值而需要计算的值,但它可能只是一个密码。

$ Challenge-Response Authentication Mechanism (CRAM) (I) /IMAP4/ A mechanism [R2195], intended for use with IMAP4 AUTHENTICATE, by which an IMAP4 client uses a keyed hash [R2104] to authenticate itself to an IMAP4 server. (See: POP3 APOP.)

$ 质询-响应身份验证机制(CRAM)(I)/IMAP4/A机制[R2195],用于IMAP4身份验证,通过该机制,IMAP4客户端使用密钥哈希[R2104]向IMAP4服务器进行身份验证。(参见:POP3 APOP。)

Tutorial: The server includes a unique time stamp in its ready response to the client. The client replies with the client's name and the hash result of applying MD5 to a string formed from concatenating the time stamp with a shared secret that is known only to the client and the server.


$ channel 1. (I) An information transfer path within a system. (See: covert channel.)

$ 第一频道。(一) 系统内的信息传输路径。(请参阅:隐蔽通道。)

2. (O) "A subdivision of the physical medium allowing possibly shared independent uses of the medium." (RFC 3753)

2. (O) “物理介质的一个细分,允许可能共享的独立介质使用。”(RFC 3753)

$ channel capacity (I) The total capacity of a link to carry information; usually expressed in bits per second. (RFC 3753) (Compare: bandwidth.)

$ 信道容量(I)链路承载信息的总容量;通常以每秒比特数表示。(RFC 3753)(比较:带宽)

Tutorial: Within a given bandwidth, the theoretical maximum channel capacity is given by Shannon's Law. The actual channel capacity is determined by the bandwidth, the coding system used, and the signal-to-noise ratio.


$ CHAP (I) See: Challenge Handshake Authentication Protocol.

$ 第(I)章见:质询握手认证协议。

$ checksum (I) A value that (a) is computed by a function that is dependent on the contents of a data object and (b) is stored or transmitted together with the object, for detecting changes in the data. (See: cyclic redundancy check, data integrity service, error detection code, hash, keyed hash, parity bit, protected checksum.)

$ 校验和(I)(A)由依赖于数据对象内容的函数计算的值,以及(b)与对象一起存储或传输的值,用于检测数据中的变化。(请参阅:循环冗余校验、数据完整性服务、错误检测代码、哈希、键控哈希、奇偶校验位、受保护校验和。)

Tutorial: To gain confidence that a data object has not been changed, an entity that later uses the data can independently recompute the checksum value and compare the result with the value that was stored or transmitted with the object.


Computer systems and networks use checksums (and other mechanisms) to detect accidental changes in data. However, active wiretapping that changes data could also change an accompanying checksum to match the changed data. Thus, some checksum functions by themselves are not good countermeasures for active attacks. To protect against active attacks, the checksum function needs to be well-chosen (see: cryptographic hash), and the checksum result needs to be cryptographically protected (see: digital signature, keyed hash).


$ Chinese wall policy (I) A security policy to prevent conflict of interest caused by an entity (e.g., a consultant) interacting with competing firms. (See: Brewer-Nash model.)

$ 中国墙政策(I)防止实体(如顾问)与竞争公司互动造成利益冲突的安全政策。(参见:布鲁尔-纳什模型。)

      Tutorial: All information is categorized into mutually exclusive
      conflict-of-interest classes I(1), I(2), ..., I(M), and each firm
      F(1), F(2), ..., F(N) belongs to exactly one class. The policy
      states that if a consultant has access to class I(i) information
      from a firm in that class, then the consultant may not access
      information from another firm in that same class, but may access
      Tutorial: All information is categorized into mutually exclusive
      conflict-of-interest classes I(1), I(2), ..., I(M), and each firm
      F(1), F(2), ..., F(N) belongs to exactly one class. The policy
      states that if a consultant has access to class I(i) information
      from a firm in that class, then the consultant may not access
      information from another firm in that same class, but may access

information from another firm that is in a different class. Thus, the policy creates a barrier to communication between firms that are in the same conflict-of-interest class. Brewer and Nash modeled enforcement of this policy [BN89], including dealing with policy violations that could occur because two or more consultants work for the same firm.


$ chosen-ciphertext attack (I) A cryptanalysis technique in which the analyst tries to determine the key from knowledge of plain text that corresponds to cipher text selected (i.e., dictated) by the analyst.

$ 选择密文攻击(I)一种密码分析技术,分析员试图根据与分析员选择(即口述)的密文相对应的纯文本知识确定密钥。

$ chosen-plaintext attack (I) A cryptanalysis technique in which the analyst tries to determine the key from knowledge of cipher text that corresponds to plain text selected (i.e., dictated) by the analyst.

$ 选择明文攻击(I)一种密码分析技术,分析员试图根据密码文本的知识确定密钥,密码文本对应于分析员选择(即口述)的明文。

$ CIAC (O) See: Computer Incident Advisory Capability.

$ CIAC(O)见:计算机事故咨询能力。

$ CIK (N) See: cryptographic ignition key.

$ CIK(N)参见:加密点火钥匙。

$ cipher (I) A cryptographic algorithm for encryption and decryption.

$ 密码(I)用于加密和解密的加密算法。

$ cipher block chaining (CBC) (N) A block cipher mode that enhances ECB mode by chaining together blocks of cipher text it produces. [FP081] (See: block cipher, [R1829], [R2405], [R2451], [SP38A].)

$ 密码分组链接(CBC)(N)一种分组密码模式,它通过将产生的密文块链接在一起来增强ECB模式。[FP081](参见:分组密码[R1829]、[R2405]、[R2451]、[SP38A]。)

Tutorial: This mode operates by combining (exclusive OR-ing) the algorithm's ciphertext output block with the next plaintext block to form the next input block for the algorithm.


$ cipher feedback (CFB) (N) A block cipher mode that enhances ECB mode by chaining together the blocks of cipher text it produces and operating on plaintext segments of variable length less than or equal to the block length. [FP081] (See: block cipher, [SP38A].)

$ 密码反馈(CFB)(N)一种分组密码模式,通过将其产生的密文块链接在一起,并对长度小于或等于块长度的明文段进行操作,从而增强ECB模式。[FP081](参见:分组密码[SP38A]。)

Tutorial: This mode operates by using the previously generated ciphertext segment as the algorithm's input (i.e., by "feeding back" the cipher text) to generate an output block, and then combining (exclusive OR-ing) that output block with the next plaintext segment (block length or less) to form the next ciphertext segment.


$ cipher text 1. (I) /noun/ Data that has been transformed by encryption so that its semantic information content (i.e., its meaning) is no longer intelligible or directly available. (See: ciphertext. Compare: clear text, plain text.)

$ 密文1。(一) /noon/通过加密转换的数据,其语义信息内容(即其含义)不再可理解或直接可用。(请参阅:密文。比较:明文和纯文本。)

2. (O) "Data produced through the use of encipherment. The semantic content of the resulting data is not available." [I7498-2]

2. (O) “通过使用加密产生的数据。结果数据的语义内容不可用。”[I7498-2]

$ ciphertext 1. (O) /noun/ Synonym for "cipher text" [I7498-2].

$ 密文1。(O) /名词/同义词“密文”[I7498-2]。

2. (I) /adjective/ Referring to cipher text. Usage: Commonly used instead of "cipher-text". (Compare: cleartext, plaintext.)

2. (一) /形容词/指密文。用法:常用代替“密文”。(比较:明文、明文。)

$ ciphertext auto-key (CTAK) (D) "Cryptographic logic that uses previous cipher text to generate a key stream." [C4009, A1523] (See: KAK.)

$ 密文自动密钥(CTAK)(D)“使用以前的密文生成密钥流的加密逻辑。”[C4009,A1523](参见:KAK.)

Deprecated Term: IDOCs SHOULD NOT use this term; it is neither well-known nor precisely defined. Instead, use terms associated with modes that are defined in standards, such as CBC, CFB, and OFB.


$ ciphertext-only attack (I) A cryptanalysis technique in which the analyst tries to determine the key solely from knowledge of intercepted cipher text (although the analyst may also know other clues, such as the cryptographic algorithm, the language in which the plain text was written, the subject matter of the plain text, and some probable plaintext words.)

$ 纯密文攻击(I)一种密码分析技术,分析人员试图仅从截获密文的知识中确定密钥(尽管分析员可能还知道其他线索,例如加密算法、明文的编写语言、明文的主题以及一些可能的明文单词。)

$ ciphony (O) The process of encrypting audio information.

$ 加密(O)对音频信息进行加密的过程。

$ CIPSO (I) See: Common IP Security Option.

$ CIPSO(I)见:通用IP安全选项。

$ CKL (I) See: compromised key list.

$ CKL(I)见:泄露密钥列表。

$ Clark-Wilson model (N) A security model [Clark] to maintain data integrity in the commercial world. (Compare: Bell-LaPadula model.)

$ Clark Wilson模型(N)一种在商业领域维护数据完整性的安全模型[Clark]。(比较:Bell-LaPadula模型。)

$ class 2, 3, 4, 5 (O) /U.S. DoD/ Assurance levels for PKIs, and for X.509 public-key certificates issued by a PKI. [DoD7] (See: "first law" under "Courtney's laws".) - "Class 2": Intended for applications handling unclassified, low-value data in minimally or moderately protected environments. - "Class 3": Intended for applications handling unclassified, medium-value data in moderately protected environments, or handling unclassified or high-value data in highly protected environments, and for discretionary access control of classified data in highly protected environments. - "Class 4": Intended for applications handling unclassified, high-value data in minimally protected environments. - "Class 5": Intended for applications handling classified data in minimally protected environments, and for authentication of material that would affect the security of classified systems.

$ PKI和PKI颁发的X.509公钥证书的第2、3、4、5(O)类/美国国防部/保证级别。[DoD7](参见“考特尼定律”下的“第一定律”)-“第2类”:适用于在最低或适度保护的环境中处理非机密、低价值数据的应用程序。-“3级”:适用于在中度保护环境中处理非机密、中等价值数据的应用程序,或在高度保护环境中处理非机密或高价值数据的应用程序,以及在高度保护环境中对机密数据进行自主访问控制的应用程序。-“4级”:适用于在最低保护环境中处理非机密、高价值数据的应用程序。-“5级”:用于在最低保护环境中处理机密数据的应用程序,以及用于对可能影响机密系统安全性的材料进行认证。

      The environments are defined as follows:
      -  "Highly protected environment": Networks that are protected
         either with encryption devices approved by NSA for protection
         of classified data or via physical isolation, and that are
         certified for processing system-high classified data, where
         exposure of unencrypted data is limited to U.S. citizens
         holding appropriate security clearances.
      -  "Moderately protected environment":
         -- Physically isolated unclassified, unencrypted networks in
            which access is restricted based on legitimate need.
         -- Networks protected by NSA-approved, type 1 encryption,
            accessible by U.S.-authorized foreign nationals.
      -  "Minimally protected environments": Unencrypted networks
         connected to either the Internet or NIPRNET, either directly or
         via a firewall.
      The environments are defined as follows:
      -  "Highly protected environment": Networks that are protected
         either with encryption devices approved by NSA for protection
         of classified data or via physical isolation, and that are
         certified for processing system-high classified data, where
         exposure of unencrypted data is limited to U.S. citizens
         holding appropriate security clearances.
      -  "Moderately protected environment":
         -- Physically isolated unclassified, unencrypted networks in
            which access is restricted based on legitimate need.
         -- Networks protected by NSA-approved, type 1 encryption,
            accessible by U.S.-authorized foreign nationals.
      -  "Minimally protected environments": Unencrypted networks
         connected to either the Internet or NIPRNET, either directly or
         via a firewall.

$ Class A1, B3, B2, B1, C2, or C1 computer system (O) /TCSEC/ See: Tutorial under "Trusted Computer System Evaluation Criteria".

$ A1类、B3类、B2类、B1类、C2类或C1类计算机系统(O)/TCSEC/参见“可信计算机系统评估标准”下的教程。

$ classification 1. (I) A grouping of classified information to which a hierarchical, restrictive security label is applied to increase protection of the data from unauthorized disclosure. (See: aggregation, classified, data confidentiality service. Compare: category, compartment.)

$ 第1类。(一) 一组机密信息,对其应用分层的、限制性的安全标签,以加强对数据的保护,防止未经授权的泄露。(请参阅:聚合、分类、数据保密服务。比较:类别、隔间。)

2. (I) An authorized process by which information is determined to be classified and assigned to a security level. (Compare: declassification.)

2. (一) 一种经过授权的过程,通过该过程,信息被确定为机密信息并分配给安全级别。(比较:解密。)

Usage: Usually understood to involve data confidentiality, but IDOCs SHOULD make this clear when data also is sensitive in other ways and SHOULD use other terms for those other sensitivity concepts. (See: sensitive information, data integrity.)


$ classification label (I) A security label that tells the degree of harm that will result from unauthorized disclosure of the labeled data, and may also tell what countermeasures are required to be applied to protect the data from unauthorized disclosure. Example: IPSO. (See: classified, data confidentiality service. Compare: integrity label.)

$ 分类标签(I)一种安全标签,说明未经授权披露标签数据将造成的危害程度,还可能说明需要采取哪些对策来保护数据不被未经授权披露。例如:IPSO。(请参阅:机密数据保密服务。比较:完整性标签。)

Usage: Usually understood to involve data confidentiality, but IDOCs SHOULD make this clear when data also is sensitive in other ways and SHOULD use other terms for those other sensitivity concepts. (See: sensitive information, data integrity.)


$ classification level (I) A hierarchical level of protection (against unauthorized disclosure) that is required to be applied to certain classified data. (See: classified. Compare: security level.)

$ 分类级别(I)要求应用于某些机密数据的分层保护级别(防止未经授权的披露)。(请参阅:已分类。比较:安全级别。)

Usage: Usually understood to involve data confidentiality, but IDOCs SHOULD make this clear when data also is sensitive in other ways and SHOULD use other terms for those other sensitivity concepts. (See: sensitive information, data integrity.)


$ classified 1. (I) Refers to information (stored or conveyed, in any form) that is formally required by a security policy to receive data confidentiality service and to be marked with a security label (which, in some cases, might be implicit) to indicate its protected status. (See: classify, collateral information, SAP, security level. Compare: unclassified.)

$ 第1类。(一) 指安全策略正式要求的信息(以任何形式存储或传输),以接收数据保密服务,并用安全标签(在某些情况下可能是隐式的)标记以指示其受保护状态。(请参阅:分类、辅助信息、SAP、安全级别。比较:未分类。)

Usage: Usually understood to involve data confidentiality, but IDOCs SHOULD make this clear when data also is sensitive in other ways and SHOULD use other terms for those other sensitivity concepts. (See: sensitive information, data integrity.)


Mainly used by national governments, especially by the military, but the underlying concept also applies outside of governments.


2. (O) /U.S. Government/ "Information that has been determined pursuant to Executive Order 12958 or any predecessor Order, or by the Atomic Energy Act of 1954, as amended, to require protection

2. (O) /U.S.Government/“根据12958号行政命令或任何先前命令或经修订的1954年《原子能法》确定需要保护的信息

against unauthorized disclosure and is marked to indicate its classified status." [C4009]


$ classify (I) To officially designate an information item or type of information as being classified and assigned to a specific security level. (See: classified, declassify, security level.)

$ 分类(I)将信息项或信息类型正式指定为已分类并分配给特定安全级别。(请参阅:机密、解密、安全级别。)

$ clean system (I) A computer system in which the operating system and application system software and files have been freshly installed from trusted software distribution media. (Compare: secure state.)

$ clean system(I)一种计算机系统,其中操作系统和应用系统软件及文件是从受信任的软件分发介质新安装的。(比较:安全状态。)

$ clear (D) /verb/ Synonym for "erase". [C4009]

$ 清除(D)/动词/同义词“擦除”。[C4009]

Deprecated Definition: IDOCs SHOULD NOT use the term with this definition; that could be confused with "clear text" in which information is directly recoverable.


$ clear text 1. (I) /noun/ Data in which the semantic information content (i.e., the meaning) is intelligible or is directly available, i.e., not encrypted. (See: cleartext, in the clear. Compare: cipher text, plain text.)

$ 明文1。(一) /名词/语义信息内容(即含义)可理解或直接可用(即未加密)的数据。(请参见:明文,在明文中。比较:密文,纯文本。)

2. (O) /noun/ "Intelligible data, the semantic content of which is available." [I7498-2]

2. (O) /noun/“可理解的数据,其语义内容可用。”[I7498-2]

3. (D) /noun/ Synonym for "plain text".

3. (D) /noun/纯文本的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for "plain text", because the plain text that is input to an encryption operation may itself be cipher text that was output from a previous encryption operation. (See: superencryption.)


$ clearance See: security clearance.

$ 许可见:安全许可。

$ clearance level (I) The security level of information to which a security clearance authorizes a person to have access.

$ 许可级别(I)安全许可授权人员访问的信息的安全级别。

$ cleartext 1. (O) /noun/ Synonym for "clear text" [I7498-2].

$ 明文1。(O) /名词/同义词“明文”[I7498-2]。

2. (I) /adjective/ Referring to clear text. Usage: Commonly used instead of "clear-text". (Compare: ciphertext, plaintext.)

2. (一) /形容词/指明文。用法:常用而非“明文”。(比较:密文、明文。)

3. (D) /adjective/ Synonym for "plaintext".

3. (D) /形容词/同义词“明文”。

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for "plaintext", because the plaintext data that is input to an encryption operation may itself be ciphertext data that was output from a previous encryption operation. (See: superencryption.)


$ CLEF (N) See: commercially licensed evaluation facility.

$ CLEF(N)见:商业许可评估机构。

$ client (I) A system entity that requests and uses a service provided by another system entity, called a "server". (See: server.)

$ 客户端(I)请求并使用另一个系统实体(称为“服务器”)提供的服务的系统实体。(请参阅:服务器。)

Tutorial: Usually, it is understood that the client and server are automated components of the system, and the client makes the request on behalf of a human user. In some cases, the server may itself be a client of some other server.


$ client-server system (I) A distributed system in which one or more entities, called clients, request a specific service from one or more other entities, called servers, that provide the service to the clients.

$ 客户机-服务器系统(I)一个分布式系统,其中一个或多个实体(称为客户机)向向客户机提供服务的一个或多个其他实体(称为服务器)请求特定服务。

Example: The Word Wide Web, in which component servers provide information that is requested by component clients called "browsers".


$ CLIPPER (N) An integrated microcircuit (in MYK-7x series manufactured by Mykotronx, Inc.) that implements SKIPJACK, has a non-deterministic random number generator, and supports key escrow. (See: Escrowed Encryption Standard. Compare: CLIPPER.)

$ CLIPPER(N)一种集成微电路(MYK-7x系列,由Mykotronx,Inc.制造),实现SKIPJACK,具有非确定性随机数生成器,并支持密钥托管。(请参阅:托管加密标准。比较:CLIPPER。)

Tutorial: The chip was mainly intended for protecting telecommunications over the public switched network. The key escrow scheme for the chip involves a SKIPJACK key that is common to all chips and that protects the unique serial number of the chip, and a second SKIPJACK key unique to the chip that protects all data encrypted by the chip. The second key is escrowed as split key components held by NIST and the U.S. Treasury Department.


$ closed security environment (O) /U.S. DoD/ A system environment that meets both of the following conditions: (a) Application developers (including maintainers) have sufficient clearances and authorizations to provide an acceptable presumption that they have not introduced

$ 满足以下两个条件的封闭安全环境(O)/美国国防部/A系统环境:(A)应用程序开发人员(包括维护人员)有足够的许可和授权,以提供一个可接受的假设,即他们没有引入

malicious logic. (b) Configuration control provides sufficient assurance that system applications and the equipment they run on are protected against the introduction of malicious logic prior to and during the operation of applications. [NCS04] (See: "first law" under "Courtney's laws". Compare: open security environment.)

恶意逻辑。(b) 配置控制提供了充分的保证,系统应用程序及其运行的设备在应用程序运行之前和运行期间受到保护,防止引入恶意逻辑。[NCS04](参见“考特尼定律”下的“第一定律”。比较:开放安全环境。)

$ CMA (D) See: certificate management authority.

$ CMA(D)参见:证书管理机构。

$ CMAC (N) A message authentication code [SP38B] that is based on a symmetric block cipher. (See: block cipher.)

$ CMAC(N)基于对称分组密码的消息身份验证码[SP38B]。(请参阅:分组密码。)

Derivation: Cipher-based MAC. (Compare: HMAC.)


Tutorial: Because CMAC is based on approved, symmetric-key block ciphers, such as AES, CMAC can be considered a mode of operation for those block ciphers. (See: mode of operation.)


$ CMCS (O) See: COMSEC Material Control System.

$ CMCS(O)见:通信安全材料控制系统。

$ CMM (N) See: Capability Maturity Model.

$ CMM(N)参见:能力成熟度模型。

$ CMS (I) See: Cryptographic Message Syntax.

$ CMS(I)见:加密消息语法。

$ code 1. (I) A system of symbols used to represent information, which might originally have some other representation. Examples: ASCII, BER, country code, Morse code. (See: encode, object code, source code.)

$ 代码1。(一) 一种用于表示信息的符号系统,最初可能有其他表示形式。示例:ASCII、BER、国家代码、摩尔斯电码。(请参见:编码、目标代码、源代码。)

Deprecated Abbreviation: To avoid confusion with definition 1, IDOCs SHOULD NOT use "code" as an abbreviation of "country code", "cyclic redundancy code", "Data Authentication Code", "error detection code", or "Message Authentication Code". To avoid misunderstanding, use the fully qualified term in these other cases, at least at the point of first usage.


2. (I) /cryptography/ An encryption algorithm based on substitution; i.e., a system for providing data confidentiality by using arbitrary groups (called "code groups") of letters, numbers, or symbols to represent units of plain text of varying length. (See: codebook, cryptography.)

2. (一) /加密/基于替换的加密算法;i、 例如,通过使用字母、数字或符号的任意组(称为“代码组”)来表示不同长度的纯文本单位,从而提供数据保密性的系统。(请参阅:代码本,密码学。)

Deprecated Usage: To avoid confusion with definition 1, IDOCs SHOULD NOT use "code" as a synonym for any of the following terms: (a) "cipher", "hash", or other words that mean "a cryptographic algorithm"; (b) "cipher text"; or (c) "encrypt", "hash", or other words that refer to applying a cryptographic algorithm.

不推荐使用:为避免与定义1混淆,IDOC不应将“code”用作以下任何术语的同义词:(a)“cipher”、“hash”或其他表示“加密算法”的词语;(b) “密文”;或(c)“加密”、“哈希”或其他指应用加密算法的词语。

3. (I) An algorithm based on substitution, but used to shorten messages rather than to conceal their content.

3. (一) 一种基于替换的算法,但用于缩短消息而不是隐藏其内容。

4. (I) /computer programming/ To write computer software. (See: object code, source code.)

4. (一) /计算机编程/编写计算机软件。(请参见:目标代码,源代码。)

Deprecated Abbreviation: To avoid confusion with definition 1, IDOCs SHOULD NOT use "code" as an abbreviation of "object code" or "source code". To avoid misunderstanding, use the fully qualified term in these other cases, at least at the point of first usage.


$ code book 1. (I) Document containing a systematically arranged list of plaintext units and their ciphertext equivalents. [C4009]

$ 代码手册1。(一) 包含系统排列的明文单元及其密文等价物列表的文件。[C4009]

2. (I) An encryption algorithm that uses a word substitution technique. [C4009] (See: code, ECB.)

2. (一) 一种使用字替换技术的加密算法。[C4009](见:欧洲中央银行代码)

$ code signing (I) A security mechanism that uses a digital signature to provide data integrity and data origin authentication for software that is being distributed for use. (See: mobile code, trusted distribution.)

$ 代码签名(I)一种安全机制,使用数字签名为正在分发使用的软件提供数据完整性和数据源身份验证。(请参阅:移动代码,可信分发。)

Tutorial: In some cases, the signature on a software module may imply some assertion that the signer makes about the software. For example, a signature may imply that the software has been designed, developed, or tested according to some criterion.


$ code word (O) /U.S. Government/ A single word that is used as a security label (usually applied to classified information) but which itself has a classified meaning. (See: classified, /U.S. Government/ security label.)

$ 代码词(O)/美国政府/用作安全标签的单个词(通常用于机密信息),但其本身具有机密含义。(请参阅:分类/美国政府/安全标签。)

$ COI (I) See: community of interest.

$ COI(I)见:利益共同体。

$ cold start (N) /cryptographic module/ A procedure for initially keying cryptographic equipment. [C4009]

$ 冷启动(N)/加密模块/用于初始键入加密设备的程序。[C4009]

$ collateral information (O) /U.S. Government/ Information that is classified but is not required to be protected by an SAP. (See: /U.S. Government/ classified.)

$ 附属信息(O)/美国政府/已分类但不需要SAP保护的信息。(见:/美国政府/机密文件)

$ color change (I) In a system being operated in periods-processing mode, the act of purging all information from one processing period and then changing over to the next processing period. (See: BLACK, RED.)

$ 颜色变化(I)在周期处理模式下运行的系统中,清除一个处理周期中的所有信息,然后切换到下一个处理周期的行为。(参见:黑色、红色。)

$ Commercial COMSEC Evaluation Program (CCEP) (O) "Relationship between NSA and industry in which NSA provides the COMSEC expertise (i.e., standards, algorithms, evaluations, and guidance) and industry provides design, development, and production capabilities to produce a type 1 or type 2 product." [C4009]

$ 商业通信安全评估计划(CCEP)(O)“NSA与行业之间的关系,其中NSA提供通信安全专业知识(即标准、算法、评估和指导),行业提供设计、开发和生产能力,以生产1类或2类产品。”[C4009]

$ commercially licensed evaluation facility (CLEF) (N) An organization that has official approval to evaluate the security of products and systems under the Common Criteria, ITSEC, or some other standard. (Compare: KLIF.)

$ 商业许可评估机构(CLEF)(N):获得官方批准,根据通用标准、ITSEC或其他标准评估产品和系统安全性的组织。(比较:KLIF。)

$ Committee on National Security Systems (CNSS) (O) /U.S. Government/ A Government, interagency, standing committee of the President's Critical Infrastructure Protection Board. The CNSS is chaired by the Secretary of Defense and provides a forum for the discussion of policy issues, sets national policy, and promulgates direction, operational procedures, and guidance for the security of national security systems. The Secretary of Defense and the Director of Central Intelligence are responsible for developing and overseeing the implementation of Government-wide policies, principles, standards, and guidelines for the security of systems that handle national security information.

$ 国家安全系统委员会(CNSS)(O)/美国政府/A政府、跨机构、总统关键基础设施保护委员会常务委员会。CNSS由国防部长担任主席,为讨论政策问题提供论坛,制定国家政策,并发布国家安全系统安全的方向、操作程序和指南。国防部长和中央情报局局长负责制定和监督政府范围内有关处理国家安全信息系统安全的政策、原则、标准和指南的实施。

$ Common Criteria for Information Technology Security (N) A standard for evaluating information technology (IT) products and systems. It states requirements for security functions and for assurance measures. [CCIB] (See: CLEF, EAL, packages, protection profile, security target, TOE. Compare: CMM.)

$ 信息技术安全通用标准(N)评估信息技术(IT)产品和系统的标准。它规定了安全功能和保证措施的要求。[CCIB](参见:CLEF、EAL、包、保护配置文件、安全目标、TOE。比较:CMM。)

Tutorial: Canada, France, Germany, the Netherlands, the United Kingdom, and the United States (NIST and NSA) began developing this standard in 1993, based on the European ITSEC, the Canadian Trusted Computer Product Evaluation Criteria (CTCPEC), and the U.S. "Federal Criteria for Information Technology Security" and its precursor, the TCSEC. Work was done in cooperation with ISO/IEC Joint Technical Committee 1 (Information Technology),


Subcommittee 27 (Security Techniques), Working Group 3 (Security Criteria). Version 2.0 of the Criteria has been issued as ISO's International Standard 15408. The U.S. Government intends this standard to supersede both the TCSEC and FIPS PUB 140. (See: NIAP.)

第27小组委员会(安全技术),第3工作组(安全标准)。标准的2.0版已作为ISO的国际标准15408发布。美国政府打算用本标准取代TCSEC和FIPS PUB 140。(见:NIAP)

The standard addresses data confidentiality, data integrity, and availability and may apply to other aspects of security. It focuses on threats to information arising from human activities, malicious or otherwise, but may apply to non-human threats. It applies to security measures implemented in hardware, firmware, or software. It does not apply to (a) administrative security not related directly to technical security, (b) technical physical aspects of security such as electromagnetic emanation control, (c) evaluation methodology or administrative and legal framework under which the criteria may be applied, (d) procedures for use of evaluation results, or (e) assessment of inherent qualities of cryptographic algorithms.


Part 1, Introduction and General Model, defines general concepts and principles of IT security evaluation; presents a general model of evaluation; and defines constructs for expressing IT security objectives, for selecting and defining IT security requirements, and for writing high-level specifications for products and systems.


Part 2, Security Functional Requirements, contains a catalog of well-defined and well-understood functional requirement statements that are intended to be used as a standard way of expressing the security requirements for IT products and systems.


Part 3, Security Assurance Requirements, contains a catalog of assurance components for use as a standard way of expressing such requirements for IT products and systems, and defines evaluation criteria for protection profiles and security targets.


$ Common IP Security Option (CIPSO) (I) See: secondary definition under "IPSO".

$ 通用IP安全选项(CIPSO)(I)见“IPSO”下的二级定义。

$ common name (N) A character string that (a) may be a part of the X.500 DN of a Directory object ("commonName" attribute), (b) is a (possibly ambiguous) name by which the object is commonly known in some limited scope (such as an organization), and (c) conforms to the naming conventions of the country or culture with which it is associated. [X520] (See: "subject" and "issuer" under "X.509 public-key certificate".)

$ common name(N)(A)可能是目录对象的X.500 DN的一部分(“commonName”属性),(b)是一个(可能不明确的)名称,通过该名称,对象在某些有限范围内(如组织)是众所周知的,(c)符合与其关联的国家或文化的命名约定。[X520](参见“X.509公钥证书”下的“主体”和“颁发者”。)

Examples: "Dr. Albert Einstein", "The United Nations", and "12-th Floor Laser Printer".


$ communications cover (N) "Concealing or altering of characteristic communications patterns to hide information that could be of value to an adversary." [C4009] (See: operations security, traffic-flow confidentiality, TRANSEC.)

$ 通信内容包括(N)“隐藏或改变特征通信模式,以隐藏可能对敌方有价值的信息。”[C4009](参见:作战安全、交通流保密、TRANSEC。)

$ communication security (COMSEC) (I) Measures that implement and assure security services in a communication system, particularly those that provide data confidentiality and data integrity and that authenticate communicating entities.

$ 通信安全(COMSEC)(I)在通信系统中实施和确保安全服务的措施,特别是提供数据机密性和数据完整性以及认证通信实体的措施。

Usage: COMSEC is usually understood to include (a) cryptography and its related algorithms and key management methods and processes, devices that implement those algorithms and processes, and the lifecycle management of the devices and keying material. Also, COMSEC is sometimes more broadly understood as further including (b) traffic-flow confidentiality, (c) TRANSEC, and (d) steganography [Kahn]. (See: cryptology, signal security.)


$ community of interest (COI) 1. (I) A set of entities that operate under a common security policy. (Compare: domain.)

$ 利益共同体(COI)1。(一) 在通用安全策略下运行的一组实体。(比较:域。)

2. (I) A set of entities that exchange information collaboratively for some purpose.

2. (一) 为某种目的协同交换信息的一组实体。

$ community risk (N) Probability that a particular vulnerability will be exploited within an interacting population and adversely affect some members of that population. [C4009] (See: Morris worm, risk.)

$ 社区风险(N):特定脆弱性在相互作用的人群中被利用并对该人群中的某些成员产生不利影响的概率。[C4009](参见:莫里斯蠕虫,风险)

$ community string (I) A community name in the form of an octet string that serves as a cleartext password in SNMP version 1 (RFC 1157) and version 2 (RFC 1901). (See: password, Simple Network Management Protocol.)

$ 社区字符串(I)以八位字节字符串形式表示的社区名称,在SNMP版本1(RFC 1157)和版本2(RFC 1901)中用作明文密码。(请参阅:密码,简单网络管理协议。)

Tutorial: The SNMPv1 and SNMPv2 protocols have been declared "historic" and have been replaced by the more secure SNMPv3 standard (RFCs 3410-3418), which does not use cleartext passwords.

教程:SNMPv1和SNMPv2协议已被宣布为“历史”协议,并被更安全的SNMPv3标准(RFCs 3410-3418)所取代,该标准不使用明文密码。

$ compartment 1. (I) A grouping of sensitive information items that require special access controls beyond those normally provided for the basic classification level of the information. (See: compartmented security mode. Compare: category, classification.)

$ 1舱。(一) 需要特殊访问控制的一组敏感信息项,超出了通常为信息基本分类级别提供的访问控制。(请参阅:分隔安全模式。比较:类别、分类。)

Usage: The term is usually understood to include the special handling procedures to be used for the information.


2. (I) Synonym for "category".

2. (一) “类别”的同义词。

Deprecated Usage: This Glossary defines "category" with a slightly narrower meaning than "compartment". That is, a security label is assigned to a category because the data owner needs to handle the data as a compartment. However, a compartment could receive special protection in a system without being assigned a category label.


$ compartmented security mode (N) A mode of system operation wherein all users having access to the system have the necessary security clearance for the single, hierarchical classification level of all data handled by the system, but some users do not have the clearance for a non-hierarchical category of some data handled by the system. (See: category, /system operation/ under "mode", protection level, security clearance.)

$ 分区安全模式(N):一种系统操作模式,其中所有访问系统的用户都对系统处理的所有数据的单一层次分类级别具有必要的安全许可,但一些用户对系统处理的某些数据的非层次分类没有许可。(请参阅:类别/系统操作/在“模式”下、保护级别、安全许可。)

Usage: Usually abbreviated as "compartmented mode". This term was defined in U.S. Government policy on system accreditation. In this mode, a system may handle (a) a single hierarchical classification level and (b) multiple non-hierarchical categories within that level.


$ Compartments field (I) A 16-bit field (the "C field") that specifies compartment values in the security option (option type 130) of version 4 IP's datagram header format. The valid field values are assigned by the U.S. Government, as specified in RFC 791.

$ 隔间字段(I)一个16位字段(“C字段”),用于指定版本4 IP数据报报头格式的安全选项(选项类型130)中的隔间值。根据RFC 791的规定,有效字段值由美国政府指定。

Deprecated Abbreviation: IDOCs SHOULD NOT use the abbreviation "C field"; the abbreviation is potentially ambiguous. Instead, use "Compartments field".


$ component See: system component.

$ 组件请参见:系统组件。

$ compression (I) A process that encodes information in a way that minimizes the number of resulting code symbols and thus reduces storage space or transmission time.

$ 压缩(I)一种编码信息的过程,其编码方式可使产生的代码符号数量最小化,从而减少存储空间或传输时间。

Tutorial: A data compression algorithm may be "lossless", i.e., retain all information that was encoded in the data, so that decompression can recover all the information; or an algorithm may be "lossy". Text usually needs to be compressed losslessly, but images are often compressed with lossy schemes.


Not all schemes that encode information losslessly for machine processing are efficient in terms of minimizing the number of output bits. For example, ASCII encoding is lossless, but ASCII data can often be losslessly reencoded in fewer bits with other schemes. These more efficient schemes take advantage of some sort of inherent imbalance, redundancy, or repetition in the data, such as by replacing a character string in which all characters are the same by a shorter string consisting of only the single character and a character count.


Lossless compression schemes cannot effectively reduce the number of bits in cipher text produced by a strong encryption algorithm, because the cipher text is essentially a pseudorandom bit string that does not contain patterns susceptible to reencoding. Therefore, protocols that offer both encryption and compression services (e.g., SSL) need to perform the compression operation before the encryption operation.


$ compromise See: data compromise, security compromise.

$ 危害见:数据危害,安全危害。

$ compromise recovery (I) The process of regaining a secure state for a system after detecting that the system has experienced a security compromise.

$ 折衷恢复(I)在检测到系统发生安全折衷后,恢复系统安全状态的过程。

$ compromised key list (CKL) (N) /MISSI/ A list that identifies keys for which unauthorized disclosure or alteration may have occurred. (See: compromise.)

$ 泄露密钥列表(CKL)(N)/MSI/A识别可能发生未经授权泄露或更改的密钥的列表。(见:妥协。)

Tutorial: A CKL is issued by a CA, like a CRL is issued. But a CKL lists only KMIDs, not subjects that hold the keys, and not certificates in which the keys are bound.


$ COMPUSEC (I) See: computer security.

$ 计算机安全(I)见:计算机安全。

$ computer emergency response team (CERT) (I) An organization that studies computer and network INFOSEC in order to provide incident response services to victims of attacks, publish alerts concerning vulnerabilities and threats, and offer other information to help improve computer and network security. (See: CSIRT, security incident.)

$ 计算机应急响应团队(CERT)(I)一个研究计算机和网络信息安全的组织,旨在为攻击受害者提供事件响应服务,发布有关漏洞和威胁的警报,并提供其他信息以帮助提高计算机和网络安全性。(参见:CSIRT,安全事件)

Examples: CERT Coordination Center at Carnegie Mellon University (sometimes called "the" CERT); CIAC.


$ Computer Incident Advisory Capability (CIAC) (O) The centralized CSIRT of the U.S. Department of Energy; a member of FIRST.

$ 计算机事故咨询能力(CIAC)(O)美国能源部的中央CSIRT;第一委员会的成员。

$ computer network (I) A collection of host computers together with the subnetwork or internetwork through which they can exchange data.

$ 计算机网络(I)主机与子网或互联网络的集合,通过它们可以交换数据。

Usage: This definition is intended to cover systems of all sizes and types, ranging from the complex Internet to a simple system composed of a personal computer dialing in as a remote terminal of another computer.


$ computer platform (I) A combination of computer hardware and an operating system (which may consist of software, firmware, or both) for that hardware. (Compare: computer system.)

$ 计算机平台(I)计算机硬件和用于该硬件的操作系统(可能包括软件、固件或两者)的组合。(比较:计算机系统。)

$ computer security (COMPUSEC) 1. (I) Measures to implement and assure security services in a computer system, particularly those that assure access control service.

$ 计算机安全(计算机安全)1。(一) 在计算机系统中实施和保证安全服务的措施,特别是保证访问控制服务的措施。

Usage: Usually refers to internal controls (functions, features, and technical characteristics) that are implemented in software (especially in operating systems); sometimes refers to internal controls implemented in hardware; rarely used to refer to external controls.


2. (O) "The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of information system resources (includes hardware, software, firmware, information/data, and telecommunications)." [SP12]

2. (O) “为实现保护信息系统资源(包括硬件、软件、固件、信息/数据和电信)的完整性、可用性和机密性的适用目标而对自动化信息系统提供的保护。”[SP12]

$ computer security incident response team (CSIRT) (I) An organization "that coordinates and supports the response to security incidents that involve sites within a defined constituency." [R2350] (See: CERT, FIRST, security incident.)

$ 计算机安全事件响应团队(CSIRT)(I)“协调和支持对涉及指定选区内站点的安全事件的响应的组织。”[R2350](见:CERT,第一,安全事件。)

Tutorial: To be considered a CSIRT, an organization must do as follows: (a) Provide a (secure) channel for receiving reports about suspected security incidents. (b) Provide assistance to members of its constituency in handling the incidents. (c) Disseminate incident-related information to its constituency and other involved parties.

教程:要被视为CSIRT,组织必须做到以下几点:(a)提供一个(安全的)渠道来接收可疑安全事件的报告。(b) 协助其选区成员处理事件。(c) 向其选区和其他相关方传播事件相关信息。

$ computer security object (I) The definition or representation of a resource, tool, or mechanism used to maintain a condition of security in computerized environments. Includes many items referred to in standards that are either selected or defined by separate user communities. [CSOR] (See: object identifier, Computer Security Objects Register.)

$ 计算机安全对象(I)用于在计算机化环境中维护安全条件的资源、工具或机制的定义或表示。包括标准中提及的许多项目,这些项目由单独的用户社区选择或定义。[CSOR](请参阅:对象标识符,计算机安全对象寄存器。)

$ Computer Security Objects Register (CSOR) (N) A service operated by NIST is establishing a catalog for computer security objects to provide stable object definitions identified by unique names. The use of this register will enable the unambiguous specification of security parameters and algorithms to be used in secure data exchanges. (See: object identifier.)

$ 计算机安全对象注册(CSOR)(N)NIST运营的一项服务正在为计算机安全对象建立目录,以提供由唯一名称标识的稳定对象定义。该寄存器的使用将使安全数据交换中使用的安全参数和算法的明确规范成为可能。(请参见:对象标识符。)

Tutorial: The CSOR follows registration guidelines established by the international standards community and ANSI. Those guidelines establish minimum responsibilities for registration authorities and assign the top branches of an international registration hierarchy. Under that international registration hierarchy, the CSOR is responsible for the allocation of unique identifiers under the branch: {joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3)}.

教程:CSOR遵循国际标准协会和ANSI制定的注册指南。这些准则规定了登记机关的最低责任,并指定了国际登记层级的最高分支机构。根据这一国际注册层级,CSOR负责分配分支机构下的唯一标识符:{联合iso ccitt(2)国家(16)美国(840)组织(1)政府(101)CSOR(3)}。

$ computer system (I) Synonym for "information system", or a component thereof. (Compare: computer platform.)

$ 计算机系统(I)“信息系统”或其组成部分的同义词。(比较:计算机平台。)

$ Computers At Risk (O) The 1991 report [NRC91] of the System Security Study Committee, sponsored by the U.S. National Academy of Sciences and supported by the Defense Advanced Research Projects Agency of the U.S. DoD. It made many recommendations for industry and governments to improve computer security and trustworthiness. Some of the most important recommendations (e.g., establishing an

$ 风险计算机(O)系统安全研究委员会1991年的报告[NRC91],由美国国家科学院赞助,美国国防部国防高级研究计划局支持。它为业界和政府提出了许多建议,以提高计算机的安全性和可靠性。一些最重要的建议(例如,建立

Information Security Foundation chartered by the U.S. Government) have not been implemented at all, and others (e.g., codifying Generally Accepted System Security Principles similar to accounting principles) have been implemented but not widely adopted [SP14, SP27].

美国政府特许的信息安全基金会根本没有实施,而其他(例如,编纂普遍接受的类似于会计原则的系统安全原则)已经实施,但未被广泛采用[SP14,SP27 ]。

$ COMSEC (I) See: communication security.

$ 通信安全(I)见:通信安全。

$ COMSEC account (O) /U.S. Government/ "Administrative entity, identified by an account number, used to maintain accountability, custody, and control of COMSEC material." [C4009] (See: COMSEC custodian.)

$ 通信安全账户(O)/美国政府/“由账号标识的行政实体,用于维护通信安全材料的责任、保管和控制。”[C4009](见:通信安全保管人。)

$ COMSEC accounting (O) /U.S. Government/ The process of creating, collecting, and maintaining data records that describe the status and custody of designated items of COMSEC material. (See: accounting legend code.)

$ 通信安全会计(O)/美国政府/创建、收集和维护描述通信安全材料指定项目状态和保管的数据记录的过程。(请参阅:会计图例代码。)

Tutorial: Almost any secure information system needs to record a security audit trail, but a system that manages COMSEC material needs to record additional data about the status and custody of COMSEC items. - COMSEC tracking: The process of automatically collecting, recording, and managing information that describes the status of designated items of COMSEC material at all times during each product's lifecycle. - COMSEC controlling: The process of supplementing tracking data with custody data, which consists of explicit acknowledgements of system entities that they (a) have received specific COMSEC items and (b) are responsible for preventing exposure of those items.


For example, a key management system that serves a large customer base needs to record tracking data for the same reasons that a national parcel delivery system does, i.e., to answer the question "Where is that thing now?". If keys are encrypted immediately upon generation and handled only in BLACK form between the point of generation and the point of use, then tracking may be all that is needed. However, in cases where keys are handled at least partly in RED form and are potentially subject to exposure, then tracking needs to be supplemented by controlling.


Data that is used purely for tracking need be retained only temporarily, until an item's status changes. Data that is used for controlling is retained indefinitely to ensure accountability and support compromise recovery.


$ COMSEC boundary (N) "Definable perimeter encompassing all hardware, firmware, and software components performing critical COMSEC functions, such as key generation and key handling and storage." [C4009] (Compare: cryptographic boundary.)

$ 通信安全边界(N)“可定义的边界,包括执行关键通信安全功能的所有硬件、固件和软件组件,如密钥生成、密钥处理和存储。”[C4009](比较:加密边界。)

$ COMSEC custodian (O) /U.S. Government/ "Individual designated by proper authority to be responsible for the receipt, transfer, accounting, safeguarding, and destruction of COMSEC material assigned to a COMSEC account." [C4009]

$ 通信安全托管人(O)/美国政府/“经适当授权指定负责接收、转移、核算、保护和销毁分配给通信安全账户的通信安全材料的个人。”[C4009]

$ COMSEC material (N) /U.S. Government/ Items designed to secure or authenticate communications or information in general; these items include (but are not limited to) keys; equipment, devices, documents, firmware, and software that embodies or describes cryptographic logic; and other items that perform COMSEC functions. [C4009] (Compare: keying material.)

$ 通信安全材料(N)/美国政府/设计用于保护或认证通信或信息的物品;这些项目包括(但不限于)钥匙;包含或描述加密逻辑的设备、装置、文件、固件和软件;以及执行通信安全功能的其他项目。[C4009](比较:键控材质。)

$ COMSEC Material Control System (CMCS) (O) /U.S. Government/ "Logistics and accounting system through which COMSEC material marked 'CRYPTO' is distributed, controlled, and safeguarded." [C4009] (See: COMSEC account, COMSEC custodian.)

$ 通信安全物资控制系统(CMCS)(O)/美国政府/“分配、控制和保护标有“加密”的通信安全物资的物流和会计系统。”[C4009](见:通信安全账户,通信安全保管人。)

$ confidentiality See: data confidentiality.

$ 机密性见:数据机密性。

$ concealment system (O) "A method of achieving confidentiality in which sensitive information is hidden by embedding it in irrelevant data." [NCS04] (Compare: steganography.)

$ 隐藏系统(O)“一种实现机密性的方法,通过将敏感信息嵌入无关数据中来隐藏它。”[NCS04](比较:隐写术。)

$ configuration control (I) The process of regulating changes to hardware, firmware, software, and documentation throughout the development and operational life of a system. (See: administrative security, harden, trusted distribution.)

$ 配置控制(I)在系统的整个开发和运行寿命期间,对硬件、固件、软件和文档的更改进行调节的过程。(请参阅:管理安全、强化、可信分发。)

Tutorial: Configuration control helps protect against unauthorized or malicious alteration of a system and thus provides assurance of system integrity. (See: malicious logic.)


$ confinement property (N) /formal model/ Property of a system whereby a subject has write access to an object only if the classification of the object dominates the clearance of the subject. (See: *-property, Bell-LaPadula model.)

$ 限制属性(N)/系统的正式模型/属性,根据该系统,仅当对象的分类支配对象的清除时,对象才具有对对象的写访问权限。(见:*-物业,贝尔-拉帕杜拉模型)

$ constraint (I) /access control/ A limitation on the function of an identity, role, or privilege. (See: rule-based access control.)

$ 约束(I)/访问控制/对身份、角色或权限功能的限制。(请参阅:基于规则的访问控制。)

Tutorial: In effect, a constraint is a form of security policy and may be either static or dynamic: - "Static constraint": A constraint that must be satisfied at the time the policy is defined, and then continues to be satisfied until the constraint is removed. - "Dynamic constraint": A constraint that may be defined to apply at various times that the identity, role, or other object of the constraint is active in the system.


$ content filter (I) /World Wide Web/ Application software used to prevent access to certain Web servers, such as by parents who do not want their children to access pornography. (See: filter, guard.)

$ 内容过滤器(I)/万维网/用于阻止访问某些Web服务器的应用程序软件,例如不希望孩子访问色情内容的家长。(请参阅:过滤器、防护装置。)

Tutorial: The filter is usually browser-based, but could be part of an intermediate cache server. The two basic content filtering techniques are (a) to block a specified list of URLs and (b) to block material that contains specified words and phrases.


$ contingency plan (I) A plan for emergency response, backup operations, and post-disaster recovery in a system as part of a security program to ensure availability of critical system resources and facilitate continuity of operations in a crisis. [NCS04] (See: availability.)

$ 应急计划(I)作为安全计划一部分的系统应急响应、备份操作和灾后恢复计划,以确保关键系统资源的可用性,并促进危机中操作的连续性。[NCS04](见:可用性)

$ control zone (O) "The space, expressed in feet of radius, surrounding equipment processing sensitive information, that is under sufficient physical and technical control to preclude an unauthorized entry or compromise." [NCSSG] (Compare: inspectable space, TEMPEST zone.)

$ 控制区(O)“周围处理敏感信息的设备受到充分的物理和技术控制,以防止未经授权的进入或破坏的空间,以英尺半径表示。”[NCSSG](比较:可检查空间,风暴区。)

$ controlled access protection (O) /TCSEC/ The level of evaluation criteria for a C2 computer system.

$ 受控访问保护(O)/TCSEC/指挥与控制计算机系统的评估标准等级。

Tutorial: The major features of the C2 level are individual accountability, audit, access control, and object reuse.


$ controlled cryptographic item (CCI) (O) /U.S. Government/ "Secure telecommunications or information handling equipment, or associated cryptographic component, that is unclassified but governed by a special set of control requirements." [C4009] (Compare: EUCI.)

$ 受控密码项目(CCI)(O)/美国政府/“未分类但受特殊控制要求约束的安全电信或信息处理设备或相关密码组件。”[C4009](比较:EUCI.)

Tutorial: This category of equipment was established in 1985 to promote broad use of secure equipment for protecting both classified and unclassified information in the national interest. CCI equipment uses a classified cryptographic logic, but the hardware or firmware embodiment of that logic is unclassified. Drawings, software implementations, and other descriptions of that logic remain classified. [N4001]


$ controlled interface (I) A mechanism that facilitates the adjudication of the different security policies of interconnected systems. (See: domain, guard.)

$ 受控接口(I)一种有助于判定互联系统不同安全策略的机制。(请参阅:域、保护。)

$ controlled security mode (D) /U.S. DoD/ A mode of system operation wherein (a) two or more security levels of information are allowed to be handled concurrently within the same system when some users having access to the system have neither a security clearance nor need-to-know for some of the data handled by the system, but (b) separation of the users and the classified material on the basis, respectively, of clearance and classification level are not dependent only on operating system control (like they are in multilevel security mode). (See: /system operation/ under "mode", protection level.)

$ 受控安全模式(D)/U.S.DoD/A系统运行模式,其中(A)允许在同一系统内同时处理两个或两个以上的安全级别的信息,当一些访问系统的用户既没有安全许可,也不需要知道系统处理的某些数据时,但是(b)分别基于清除和分类级别的用户和分类材料的分离不仅仅取决于操作系统控制(就像在多级安全模式下一样)。(请参阅:/系统操作/在“模式”下,保护级别。)

Deprecated Term: IDOCs SHOULD NOT use this term. It was defined in a U.S. Government policy regarding system accreditation and was subsumed by "partitioned security mode" in a later policy. Both terms were dropped in still later policies.


Tutorial: Controlled mode was intended to encourage ingenuity in meeting data confidentiality requirements in ways less restrictive than "dedicated security mode" and "system-high security mode", but at a level of risk lower than that generally associated with true "multilevel security mode". This was intended to be accomplished by implementation of explicit augmenting measures to reduce or remove a substantial measure of system software vulnerability together with specific limitation of the security clearance levels of users having concurrent access to the system.


$ controlling authority (O) /U.S. Government/ "Official responsible for directing the operation of a cryptonet and for managing the operational use and control of keying material assigned to the cryptonet." [C4009, N4006]

$ 控制机构(O)/美国政府/“负责指导加密网操作以及管理分配给加密网的密钥材料的操作使用和控制的官员。”[C4009,N4006]

$ cookie 1. (I) /HTTP/ Data exchanged between an HTTP server and a browser (a client of the server) to store state information on the client side and retrieve it later for server use.

$ 曲奇1。(一) /HTTP/HTTP服务器和浏览器(服务器的客户端)之间交换的数据,用于在客户端存储状态信息,并在以后检索以供服务器使用。

Tutorial: An HTTP server, when sending data to a client, may send along a cookie, which the client retains after the HTTP connection closes. A server can use this mechanism to maintain persistent client-side state information for HTTP-based applications, retrieving the state information in later connections. A cookie may include a description of the range of URLs for which the state is valid. Future requests made by the client in that range will also send the current value of the cookie to the server. Cookies can be used to generate profiles of web usage habits, and thus may infringe on personal privacy.


2. (I) /IPsec/ Data objects exchanged by ISAKMP to prevent certain denial-of-service attacks during the establishment of a security association.

2. (一) /IPsec/由ISAKMP交换的数据对象,用于在建立安全关联期间防止某些拒绝服务攻击。

3. (D) /access control/ Synonym for "capability token" or "ticket".

3. (D) /访问控制/同义词“能力令牌”或“票证”。

Deprecated Definition: IDOCs SHOULD NOT use this term with definition 3; that would duplicate the meaning of better-established terms and mix concepts in a potentially misleading way.


$ Coordinated Universal Time (UTC) (N) UTC is derived from International Atomic Time (TAI) by adding a number of leap seconds. The International Bureau of Weights and Measures computes TAI once each month by averaging data from many laboratories. (See: GeneralizedTime, UTCTime.)

$ 协调世界时(UTC)(N)UTC是通过添加闰秒数从国际原子时(TAI)派生出来的。国际度量衡局每月通过对来自多个实验室的数据进行平均来计算TAI。(请参见:一般化时间,UTCTime。)

$ correction (I) /security/ A system change made to eliminate or reduce the risk of reoccurrence of a security violation or threat consequence. (See: secondary definition under "security".)

$ 纠正(I)/安全性/为消除或降低安全违规或威胁后果再次发生的风险而进行的系统变更。(见“安全”下的第二个定义)

$ correctness (I) "The property of a system that is guaranteed as the result of formal verification activities." [Huff] (See: correctness proof, verification.)

$ 正确性(I)“作为正式验证活动的结果而得到保证的系统属性。”[Huff](参见:正确性证明,验证。)

$ correctness integrity (I) The property that the information represented by data is accurate and consistent. (Compare: data integrity, source integrity.)

$ 正确性和完整性(I)数据所代表的信息是准确和一致的。(比较:数据完整性、源完整性。)

Tutorial: IDOCs SHOULD NOT use this term without providing a definition; the term is neither well-known nor precisely defined. Data integrity refers to the constancy of data values, and source integrity refers to confidence in data values. However,


correctness integrity refers to confidence in the underlying information that data values represent, and this property is closely related to issues of accountability and error handling.


$ correctness proof (I) A mathematical proof of consistency between a specification for system security and the implementation of that specification. (See: correctness, formal specification.)

$ 正确性证明(I)系统安全规范与该规范实施之间一致性的数学证明。(参见:正确性,正式规范。)

$ corruption (I) A type of threat action that undesirably alters system operation by adversely modifying system functions or data. (See: disruption.)

$ 腐败(I)一种威胁行为,通过对系统功能或数据进行不利修改,不希望改变系统运行。(见:中断。)

Usage: This type of threat action includes the following subtypes: - "Tampering": /corruption/ Deliberately altering a system's logic, data, or control information to interrupt or prevent correct operation of system functions. (See: misuse, main entry for "tampering".) - "Malicious logic": /corruption/ Any hardware, firmware, or software (e.g., a computer virus) intentionally introduced into a system to modify system functions or data. (See: incapacitation, main entry for "malicious logic", masquerade, misuse.) - "Human error": /corruption/ Human action or inaction that unintentionally results in the alteration of system functions or data. - "Hardware or software error": /corruption/ Error that results in the alteration of system functions or data. - "Natural disaster": /corruption/ Any "act of God" (e.g., power surge caused by lightning) that alters system functions or data. [FP031 Section 2]


$ counter 1. (N) /noun/ See: counter mode.

$ 柜台1。(N) /名词/参见:计数器模式。

2. (I) /verb/ See: countermeasure.

2. (一) /动词/见:对策。

$ counter-countermeasure (I) An action, device, procedure, or technique used by an attacker to offset a defensive countermeasure.

$ 反对策(I)攻击者用来抵消防御对策的行动、设备、程序或技术。

Tutorial: For every countermeasure devised to protect computers and networks, some cracker probably will be able to devise a counter-countermeasure. Thus, systems must use "defense in depth".


$ counter mode (CTR) (N) A block cipher mode that enhances ECB mode by ensuring that each encrypted block is different from every other block encrypted under the same key. [SP38A] (See: block cipher.)

$ 计数器模式(CTR)(N)一种分组密码模式,通过确保每个加密块与在同一密钥下加密的每个其他块不同,从而增强ECB模式。[SP38A](参见:分组密码。)

Tutorial: This mode operates by first encrypting a generated sequence of blocks, called "counters", that are separate from the input sequence of plaintext blocks which the mode is intended to protect. The resulting sequence of encrypted counters is exclusive-ORed with the sequence of plaintext blocks to produce the final ciphertext output blocks. The sequence of counters must have the property that each counter is different from every other counter for all of the plain text that is encrypted under the same key.


$ Counter with Cipher Block Chaining-Message Authentication Code (CCM) (N) A block cipher mode [SP38C] that provides both data confidentiality and data origin authentication, by combining the techniques of CTR and a CBC-based message authentication code. (See: block cipher.)

$ 带有密码分组链接消息认证码(CCM)的计数器(N)通过结合CTR技术和基于CBC的消息认证码,提供数据机密性和数据源认证的分组密码模式[SP38C]。(请参阅:分组密码。)

$ countermeasure (I) An action, device, procedure, or technique that meets or opposes (i.e., counters) a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken.

$ 对策(I)通过消除或防止威胁、漏洞或攻击,通过最小化其可能造成的伤害,或通过发现和报告以采取纠正措施,满足或对抗(即反击)威胁、漏洞或攻击的行动、装置、程序或技术。

Tutorial: In an Internet protocol, a countermeasure may take the form of a protocol feature, a component function, or a usage constraint.


$ country code (I) An identifier that is defined for a nation by ISO. [I3166]

$ 国家代码(I)ISO为国家定义的标识符。[I3166]

Tutorial: For each nation, ISO Standard 3166 defines a unique two-character alphabetic code, a unique three-character alphabetic code, and a three-digit code. Among many uses of these codes, the two-character codes are used as top-level domain names.


$ Courtney's laws (N) Principles for managing system security that were stated by Robert H. Courtney, Jr.

$ 小罗伯特·H·考特尼(Robert H.Courtney,Jr。

      Tutorial: Bill Murray codified Courtney's laws as follows: [Murr]
      -  Courtney's first law: You cannot say anything interesting
         (i.e., significant) about the security of a system except in
         the context of a particular application and environment.
      -  Courtney's second law: Never spend more money eliminating a
         security exposure than tolerating it will cost you. (See:
         acceptable risk, risk analysis.)
         -- First corollary: Perfect security has infinite cost.
         -- Second corollary: There is no such thing as zero risk.
      -  Courtney's third law: There are no technical solutions to
         management problems, but there are management solutions to
         technical problems.
      Tutorial: Bill Murray codified Courtney's laws as follows: [Murr]
      -  Courtney's first law: You cannot say anything interesting
         (i.e., significant) about the security of a system except in
         the context of a particular application and environment.
      -  Courtney's second law: Never spend more money eliminating a
         security exposure than tolerating it will cost you. (See:
         acceptable risk, risk analysis.)
         -- First corollary: Perfect security has infinite cost.
         -- Second corollary: There is no such thing as zero risk.
      -  Courtney's third law: There are no technical solutions to
         management problems, but there are management solutions to
         technical problems.

$ covert action (I) An operation that is planned and executed in a way that conceals the identity of the operator.

$ 隐蔽行动(I)以隐藏操作员身份的方式计划和执行的操作。

$ covert channel 1. (I) An unintended or unauthorized intra-system channel that enables two cooperating entities to transfer information in a way that violates the system's security policy but does not exceed the entities' access authorizations. (See: covert storage channel, covert timing channel, out-of-band, tunnel.)

$ 隐蔽通道1。(一) 一种非故意或未经授权的系统内通道,使两个合作实体能够以违反系统安全策略但不超过实体访问权限的方式传输信息。(请参阅:隐蔽存储通道、隐蔽定时通道、带外通道、通道。)

2. (O) "A communications channel that allows two cooperating processes to transfer information in a manner that violates the system's security policy." [NCS04]

2. (O) “允许两个协作进程以违反系统安全策略的方式传输信息的通信通道。”[NCS04]

Tutorial: The cooperating entities can be either two insiders or an insider and an outsider. Of course, an outsider has no access authorization at all. A covert channel is a system feature that the system architects neither designed nor intended for information transfer.


$ covert storage channel (I) A system feature that enables one system entity to signal information to another entity by directly or indirectly writing a storage location that is later directly or indirectly read by the second entity. (See: covert channel.)

$ 隐蔽存储通道(I)一种系统功能,使一个系统实体能够通过直接或间接写入存储位置向另一个实体发送信息,该存储位置随后由第二个实体直接或间接读取。(请参阅:隐蔽通道。)

$ covert timing channel (I) A system feature that enables one system entity to signal information to another by modulating its own use of a system resource in such a way as to affect system response time observed by the second entity. (See: covert channel.)

$ 隐蔽定时信道(I)一种系统特性,使一个系统实体能够通过调制其自身对系统资源的使用来向另一个系统实体发送信息,从而影响第二实体观察到的系统响应时间。(请参阅:隐蔽通道。)

$ CPS (I) See: certification practice statement.

$ CPS(I)见:认证实践声明。

$ cracker (I) Someone who tries to break the security of, and gain unauthorized access to, someone else's system, often with malicious intent. (See: adversary, intruder, packet monkey, script kiddy. Compare: hacker.)

$ 破解者(I)试图破坏他人系统的安全性并获得未经授权的访问权限的人,通常带有恶意意图。(参见:敌手、入侵者、包猴、脚本小子。比较:黑客。)

Usage: Was sometimes spelled "kracker". [NCSSG]


$ CRAM (I) See: Challenge-Response Authentication Mechanism.

$ CRAM(I)See:质询-响应认证机制。

$ CRC (I) See: cyclic redundancy check.

$ CRC(I)见:循环冗余校验。

$ credential 1. (I) /authentication/ "identifier credential": A data object that is a portable representation of the association between an identifier and a unit of authentication information, and that can be presented for use in verifying an identity claimed by an entity that attempts to access a system. Example: X.509 public-key certificate. (See: anonymous credential.)

$ 凭证1。(一) /authentication/“identifier credential”:一种数据对象,是标识符和身份验证信息单元之间关联的可移植表示,可用于验证试图访问系统的实体声明的身份。示例:X.509公钥证书。(请参阅:匿名凭据。)

2. (I) /access control/ "authorization credential": A data object that is a portable representation of the association between an identifier and one or more access authorizations, and that can be presented for use in verifying those authorizations for an entity that attempts such access. Example: X.509 attribute certificate. (See: capability token, ticket.)

2. (一) /access control/“authorization credential”:一种数据对象,它是标识符与一个或多个访问授权之间关联的可移植表示,可用于验证尝试访问的实体的这些授权。示例:X.509属性证书。(请参阅:功能令牌、票据。)

3. (D) /OSIRM/ "Data that is transferred to establish the claimed identity of an entity." [I7498-2]

3. (D) /OSIRM/“为确定实体的声明身份而传输的数据。”[I7498-2]

Deprecated Definition: IDOCs SHOULD NOT use the term with definition 3. As explained in the tutorial below, an authentication process can involve the transfer of multiple data objects, and not all of those are credentials.


4. (D) /U.S. Government/ "An object that is verified when presented to the verifier in an authentication transaction." [M0404]

4. (D) /U.S.Government/“在身份验证事务中提交给验证者时被验证的对象。”[M0404]

Deprecated Definition: IDOCs SHOULD NOT use the term with definition 4; it mixes concepts in a potentially misleading way. For example, in an authentication process, it is the identity that is "verified", not the credential; the credential is "validated". (See: validate vs. verify.)


Tutorial: In general English, "credentials" are evidence or testimonials that (a) support a claim of identity or authorization and (b) usually are intended to be used more than once (i.e., a credential's life is long compared to the time needed for one use). Some examples are a policeman's badge, an automobile driver's license, and a national passport. An authentication or access control process that uses a badge, license, or passport is outwardly simple: the holder just shows the thing.


The problem with adopting this term in Internet security is that an automated process for authentication or access control usually requires multiple steps using multiple data objects, and it might not be immediately obvious which of those objects should get the name "credential".


For example, if the verification step in a user authentication process employs public-key technology, then the process involves at least three data items: (a) the user's private key, (b) a signed value -- signed with that private key and passed to the system, perhaps in response to a challenge from the system -- and (c) the user's public-key certificate, which is validated by the system and provides the public key needed to verify the signature. - Private key: The private key is *not* a credential, because it is never transferred or presented. Instead, the private key is "authentication information", which is associated with the user's identifier for a specified period of time and can be used in multiple authentications during that time. - Signed value: The signed value is *not* a credential; the signed value is only ephemeral, not long lasting. The OSIRM definition could be interpreted to call the signed value a credential, but that would conflict with general English. - Certificate: The user's certificate *is* a credential. It can be "transferred" or "presented" to any person or process that needs it at any time. A public-key certificate may be used as an "identity credential", and an attribute certificate may be used as an "authorization credential".


$ critical 1. (I) /system resource/ A condition of a system resource such that denial of access to, or lack of availability of, that resource would jeopardize a system user's ability to perform a primary function or would result in other serious consequences, such as human injury or loss of life. (See: availability, precedence. Compare: sensitive.)

$ 关键1。(一) /系统资源/系统资源的一种状况,即拒绝访问或缺少该资源将危及系统用户执行主要功能的能力,或导致其他严重后果,如人身伤害或生命损失。(请参阅:可用性,优先级。比较:敏感。)

2. (N) /extension/ An indication that an application is not permitted to ignore an extension. [X509]

2. (N) /extension/表示不允许应用程序忽略扩展。[X509]

Tutorial: Each extension of an X.509 certificate or CRL is flagged as either "critical" or "non-critical". In a certificate, if a computer program does not recognize an extension's type (i.e., does not implement its semantics), then if the extension is critical, the program is required to treat the certificate as invalid; but if the extension is non-critical, the program is permitted to ignore the extension.


In a CRL, if a program does not recognize a critical extension that is associated with a specific certificate, the program is required to assume that the listed certificate has been revoked and is no longer valid, and then take whatever action is required by local policy.


When a program does not recognize a critical extension that is associated with the CRL as a whole, the program is required to assume that all listed certificates have been revoked and are no longer valid. However, since failing to process the extension may mean that the list has not been completed, the program cannot assume that other certificates are valid, and the program needs to take whatever action is therefore required by local policy.


$ critical information infrastructure (I) Those systems that are so vital to a nation that their incapacity or destruction would have a debilitating effect on national security, the economy, or public health and safety.

$ 关键信息基础设施(I)对一个国家至关重要的系统,这些系统的失效或破坏将对国家安全、经济或公共卫生和安全产生不利影响。

$ CRL (I) See: certificate revocation list.

$ CRL(I)见:证书撤销清单。

$ CRL distribution point (I) See: distribution point.

$ CRL配送点(I)见:配送点。

$ CRL extension (I) See: extension.

$ CRL分机(I)见:分机。

$ cross-certificate (I) A public-key certificate issued by a CA in one PKI to a CA in another PKI. (See: cross-certification.)

$ 交叉证书(I)由一个PKI中的CA向另一个PKI中的CA颁发的公钥证书。(请参阅:交叉认证。)

$ cross-certification (I) The act or process by which a CA in one PKI issues a public-key certificate to a CA in another PKI. [X509] (See: bridge CA.)

$ 交叉认证(I)一个PKI中的CA向另一个PKI中的CA颁发公钥证书的行为或过程。[X509](见:桥梁CA)

Tutorial: X.509 says that a CA (say, CA1) may issue a "cross-certificate" in which the subject is another CA (say, CA2). X.509 calls CA2 the "subject CA" and calls CA1 an "intermediate CA", but


this Glossary deprecates those terms. (See: intermediate CA, subject CA).


Cross-certification of CA2 by CA1 appears similar to certification of a subordinate CA by a superior CA, but cross-certification involves a different concept. The "subordinate CA" concept applies when both CAs are in the same PKI, i.e., when either (a) CA1 and CA2 are under the same root or (b) CA1 is itself a root. The "cross-certification" concept applies in other cases:


First, cross-certification applies when two CAs are in different PKIs, i.e., when CA1 and CA2 are under different roots, or perhaps are both roots themselves. Issuing the cross-certificate enables end entities certified under CA1 in PK1 to construct the certification paths needed to validate the certificates of end entities certified under CA2 in PKI2. Sometimes, a pair of cross-certificates is issued -- by CA1 to CA2, and by CA2 to CA1 -- so that an end entity in either PKI can validate certificates issued in the other PKI.


Second, X.509 says that two CAs in some complex, multi-CA PKI can cross-certify one another to shorten the certification paths constructed by end entities. Whether or not a CA may perform this or any other form of cross-certification, and how such certificates may be used by end entities, should be addressed by the local certificate policy and CPS.

其次,X.509指出,在一些复杂的多CA PKI中,两个CA可以相互交叉认证,以缩短由终端实体构建的认证路径。CA是否可以执行此交叉认证或任何其他形式的交叉认证,以及最终实体如何使用此类证书,应由本地证书政策和CP解决。

$ cross-domain solution 1. (D) Synonym for "guard".

$ 跨域解决方案1。(D) “守卫”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term as a synonym for "guard"; this term unnecessarily (and verbosely) duplicates the meaning of the long-established "guard".


2. (O) /U.S. Government/ A process or subsystem that provides a capability (which could be either manual or automated) to access two or more differing security domains in a system, or to transfer information between such domains. (See: domain, guard.)

2. (O) /U.S.Government/提供访问系统中两个或多个不同安全域或在这些域之间传输信息能力(可手动或自动)的过程或子系统。(请参阅:域、保护。)

$ cryptanalysis 1. (I) The mathematical science that deals with analysis of a cryptographic system to gain knowledge needed to break or circumvent the protection that the system is designed to provide. (See: cryptology, secondary definition under "intrusion".)

$ 密码分析1。(一) 一门数学科学,处理对密码系统的分析,以获得打破或绕过该系统设计提供的保护所需的知识。(参见:密码学,“入侵”下的二级定义。)

2. (O) "The analysis of a cryptographic system and/or its inputs and outputs to derive confidential variables and/or sensitive data including cleartext." [I7498-2]

2. (O) “对密码系统和/或其输入和输出进行分析,以得出机密变量和/或敏感数据,包括明文。”[I7498-2]

Tutorial: Definition 2 states the traditional goal of cryptanalysis, i.e., convert cipher text to plain text (which usually is clear text) without knowing the key; but that definition applies only to encryption systems. Today, the term is used with reference to all kinds of cryptographic algorithms and key management, and definition 1 reflects that. In all cases, however, a cryptanalyst tries to uncover or reproduce someone else's sensitive data, such as clear text, a key, or an algorithm. The basic cryptanalytic attacks on encryption systems are ciphertext-only, known-plaintext, chosen-plaintext, and chosen-ciphertext; and these generalize to the other kinds of cryptography.


$ crypto, CRYPTO 1. (N) A prefix ("crypto-") that means "cryptographic".

$ 加密,加密1。(N) 表示“加密”的前缀(“加密-”)。

Usage: IDOCs MAY use this prefix when it is part of a term listed in this Glossary. Otherwise, IDOCs SHOULD NOT use this prefix; instead, use the unabbreviated adjective, "cryptographic".


2. (D) In lower case, "crypto" is an abbreviation for the adjective "cryptographic", or for the nouns "cryptography" or "cryptographic component".

2. (D) 在小写字母中,“crypto”是形容词“cryptographic”或名词“cryptographic”或“cryptocomponent”的缩写。

Deprecated Abbreviation: IDOCs SHOULD NOT use this abbreviation because it could easily be misunderstood in some technical sense.


3. (O) /U.S. Government/ In upper case, "CRYPTO" is a marking or designator that identifies "COMSEC keying material used to secure or authenticate telecommunications carrying classified or sensitive U.S. Government or U.S. Government-derived information." [C4009] (See: security label, security marking.)

3. (O) /U.S.Government/大写,“CRYPTO”是一个标记或指示符,用于标识“用于保护或认证携带机密或敏感美国政府或美国政府衍生信息的电信的通信安全密钥材料”。[C4009](参见:安全标签,安全标记。)

$ cryptographic (I) An adjective that refers to cryptography.

$ 密码学(I)指密码学的形容词。

$ cryptographic algorithm (I) An algorithm that uses the science of cryptography, including (a) encryption algorithms, (b) cryptographic hash algorithms, (c) digital signature algorithms, and (d) key-agreement algorithms.

$ 加密算法(I)使用密码学的算法,包括(a)加密算法,(b)加密哈希算法,(c)数字签名算法和(d)密钥协商算法。

$ cryptographic application programming interface (CAPI) (I) The source code formats and procedures through which an application program accesses cryptographic services, which are defined abstractly compared to their actual implementation. Example, see: PKCS #11, [R2628].

$ 加密应用程序编程接口(CAPI)(I)应用程序访问加密服务所通过的源代码格式和过程,这些服务是根据实际实现抽象定义的。例如,见:PKCS#11,[R2628]。

$ cryptographic association (I) A security association that involves the use of cryptography to provide security services for data exchanged by the associated entities. (See: ISAKMP.)

$ 加密关联(I)涉及使用加密技术为关联实体交换的数据提供安全服务的安全关联。(见:ISAKMP)

$ cryptographic boundary (I) See: secondary definition under "cryptographic module".

$ 加密边界(I)参见“加密模块”下的二级定义。

$ cryptographic card (I) A cryptographic token in the form of a smart card or a PC card.

$ 加密卡(I)智能卡或PC卡形式的加密令牌。

$ cryptographic component (I) A generic term for any system component that involves cryptography. (See: cryptographic module.)

$ 加密组件(I)涉及加密的任何系统组件的通用术语。(请参阅:加密模块。)

$ cryptographic hash (I) See: secondary definition under "hash function".

$ 加密散列(I)参见“散列函数”下的二级定义。

$ cryptographic ignition key (CIK) 1. (N) A physical (usually electronic) token used to store, transport, and protect cryptographic keys and activation data. (Compare: dongle, fill device.)

$ cryptographic ignition key (CIK) 1. (N) A physical (usually electronic) token used to store, transport, and protect cryptographic keys and activation data. (Compare: dongle, fill device.)translate error, please retry

Tutorial: A key-encrypting key could be divided (see: split key) between a CIK and a cryptographic module, so that it would be necessary to combine the two to regenerate the key, use it to decrypt other keys and data contained in the module, and thus activate the module.


2. (O) "Device or electronic key used to unlock the secure mode of cryptographic equipment." [C4009] Usage: Abbreviated as "crypto-ignition key".

2. (O) “用于解锁加密设备安全模式的设备或电子钥匙。”[C4009]用法:缩写为“加密点火钥匙”。

$ cryptographic key (I) See: key. Usage: Usually shortened to just "key".

$ 加密密钥(I)参见:密钥。用法:通常缩写为“key”。

$ Cryptographic Message Syntax (CMS) (I) An encapsulation syntax (RFC 3852) for digital signatures, hashes, and encryption of arbitrary messages.

$ 加密消息语法(CMS)(I)用于数字签名、哈希和任意消息加密的封装语法(RFC 3852)。

Tutorial: CMS derives from PKCS #7. CMS values are specified with ASN.1 and use BER encoding. The syntax permits multiple encapsulation with nesting, permits arbitrary attributes to be signed along with message content, and supports a variety of architectures for digital certificate-based key management.


$ cryptographic module (I) A set of hardware, software, firmware, or some combination thereof that implements cryptographic logic or processes, including cryptographic algorithms, and is contained within the module's "cryptographic boundary", which is an explicitly defined contiguous perimeter that establishes the physical bounds of the module. [FP140]

$ 加密模块(I)一组硬件、软件、固件或其组合,实现加密逻辑或过程,包括加密算法,并包含在模块的“加密边界”内,该边界是明确定义的连续边界,用于建立模块的物理边界。[FP140]

$ cryptographic system 1. (I) A set of cryptographic algorithms together with the key management processes that support use of the algorithms in some application context.

$ 密码系统1。(一) 一组密码算法和密钥管理过程,支持在某些应用程序上下文中使用这些算法。

Usage: IDOCs SHOULD use definition 1 because it covers a wider range of algorithms than definition 2.


2. (O) "A collection of transformations from plain text into cipher text and vice versa [which would exclude digital signature, cryptographic hash, and key-agreement algorithms], the particular transformation(s) to be used being selected by keys. The transformations are normally defined by a mathematical algorithm." [X509]

2. (O) “从纯文本到密文的转换集合,反之亦然[不包括数字签名、加密哈希和密钥协商算法],要使用的特定转换由密钥选择。这些转换通常由数学算法定义。”[X509]

$ cryptographic token 1. (I) A portable, user-controlled, physical device (e.g., smart card or PCMCIA card) used to store cryptographic information and possibly also perform cryptographic functions. (See: cryptographic card, token.)

$ 加密令牌1。(一) 一种便携式、用户控制的物理设备(如智能卡或PCMCIA卡),用于存储加密信息,并可能执行加密功能。(请参阅:加密卡、令牌。)

Tutorial: A smart token might implement some set of cryptographic algorithms and might incorporate related key management functions, such as a random number generator. A smart cryptographic token may contain a cryptographic module or may not be explicitly designed that way.


$ cryptography 1. (I) The mathematical science that deals with transforming data to render its meaning unintelligible (i.e., to hide its semantic content), prevent its undetected alteration, or prevent its unauthorized use. If the transformation is reversible, cryptography also deals with restoring encrypted data to intelligible form. (See: cryptology, steganography.)

$ 密码学1。(一) 处理转换数据以使其含义无法理解(即隐藏其语义内容)、防止其未被检测到的更改或防止其未经授权的使用的数学科学。如果转换是可逆的,密码学还处理将加密数据恢复为可理解形式的问题。(参见:密码学、隐写术。)

      2. (O) "The discipline which embodies principles, means, and
      methods for the transformation of data in order to hide its
      information content, prevent its undetected modification and/or
      prevent its unauthorized use.... Cryptography determines the
      methods used in encipherment and decipherment." [I7498-2]
      2. (O) "The discipline which embodies principles, means, and
      methods for the transformation of data in order to hide its
      information content, prevent its undetected modification and/or
      prevent its unauthorized use.... Cryptography determines the
      methods used in encipherment and decipherment." [I7498-2]

Tutorial: Comprehensive coverage of applied cryptographic protocols and algorithms is provided by Schneier [Schn]. Businesses and governments use cryptography to make data incomprehensible to outsiders; to make data incomprehensible to both outsiders and insiders, the data is sent to lawyers for a rewrite.


$ Cryptoki (N) A CAPI defined in PKCS #11. Pronunciation: "CRYPTO-key". Derivation: Abbreviation of "cryptographic token interface".

$ Cryptoki(N)PKCS#11中定义的CAPI。发音:“加密密钥”。派生词:“加密令牌接口”的缩写。

$ cryptology (I) The science of secret communication, which includes both cryptography and cryptanalysis.

$ 密码学(I)保密通信科学,包括密码学和密码分析。

Tutorial: Sometimes the term is used more broadly to denote activity that includes both rendering signals secure (see: signal security) and extracting information from signals (see: signal intelligence) [Kahn].


$ cryptonet (I) A network (i.e., a communicating set) of system entities that share a secret cryptographic key for a symmetric algorithm. (See: controlling authority.)

$ cryptonet(I)系统实体的网络(即通信集),共享对称算法的密钥。(见:控制机构。)

(O) "Stations holding a common key." [C4009]

(O) “持有公用钥匙的电台。”[C4009]

$ cryptoperiod (I) The time span during which a particular key value is authorized to be used in a cryptographic system. (See: key management.)

$ 密码周期(I)特定密钥值被授权在密码系统中使用的时间跨度。(请参阅:密钥管理。)

Usage: This term is long-established in COMPUSEC usage. In the context of certificates and public keys, "key lifetime" and "validity period" are often used instead.


Tutorial: A cryptoperiod is usually stated in terms of calendar or clock time, but sometimes is stated in terms of the maximum amount of data permitted to be processed by a cryptographic algorithm using the key. Specifying a cryptoperiod involves a tradeoff between the cost of rekeying and the risk of successful cryptoanalysis.


$ cryptosystem (I) Contraction of "cryptographic system".

$ 密码系统(I)“密码系统”的缩写。

$ cryptovariable (D) Synonym for "key".

$ 加密变量(D)是“密钥”的同义词。

Deprecated Usage: In contemporary COMSEC usage, the term "key" has replaced the term "cryptovariable".


$ CSIRT (I) See: computer security incident response team.

$ CSIRT(I)见:计算机安全事件响应小组。

$ CSOR (N) See: Computer Security Objects Register.

$ CSOR(N)参见:计算机安全对象寄存器。

$ CTAK (D) See: ciphertext auto-key.

$ CTAK(D)参见:密文自动密钥。

$ CTR (N) See: counter mode.

$ CTR(N)参见:计数器模式。

$ cut-and-paste attack (I) An active attack on the data integrity of cipher text, effected by replacing sections of cipher text with other cipher text, such that the result appears to decrypt correctly but actually decrypts to plain text that is forged to the satisfaction of the attacker.

$ 剪切粘贴攻击(I)对密文数据完整性的主动攻击,通过将密文部分替换为其他密文来实现,从而使结果看起来正确解密,但实际上解密为伪造的纯文本,使攻击者满意。

$ cyclic redundancy check (CRC) (I) A type of checksum algorithm that is not a cryptographic hash but is used to implement data integrity service where accidental changes to data are expected. Sometimes called "cyclic redundancy code".

$ 循环冗余校验(CRC)(I)一种校验和算法,它不是加密散列,但用于实现数据完整性服务,其中预期会对数据进行意外更改。有时称为“循环冗余码”。

$ DAC (N) See: Data Authentication Code, discretionary access control.

$ DAC(N)参见:数据认证码,自主访问控制。

Deprecated Usage: IDOCs that use this term SHOULD state a definition for it because this abbreviation is ambiguous.


$ daemon (I) A computer program that is not invoked explicitly but waits until a specified condition occurs, and then runs with no associated user (principal), usually for an administrative purpose. (See: zombie.)

$ daemon(I)一种计算机程序,通常出于管理目的,它不被显式调用,而是等待指定的条件发生,然后在没有相关用户(主体)的情况下运行。(见:僵尸。)

$ dangling threat (O) A threat to a system for which there is no corresponding vulnerability and, therefore, no implied risk.

$ 悬空威胁(O)对系统的威胁,该系统没有相应的漏洞,因此没有隐含风险。

$ dangling vulnerability (O) A vulnerability of a system for which there is no corresponding threat and, therefore, no implied risk.

$ 悬空漏洞(O)系统中没有相应威胁,因此没有隐含风险的漏洞。

$ DASS (I) See: Distributed Authentication Security Service.

$ DASS(I)见:分布式身份验证安全服务。

$ data (I) Information in a specific representation, usually as a sequence of symbols that have meaning.

$ 数据(I)特定表示形式的信息,通常作为具有意义的符号序列。

Usage: Refers to both (a) representations that can be recognized, processed, or produced by a computer or other type of machine, and (b) representations that can be handled by a human.


$ Data Authentication Algorithm, data authentication algorithm 1. (N) /capitalized/ The ANSI standard for a keyed hash function that is equivalent to DES cipher block chaining with IV = 0. [A9009]

$ 数据认证算法,数据认证算法1。(N) /capitalized/键控哈希函数的ANSI标准,相当于IV=0的DES密码块链接。[A9009]

2. (D) /not capitalized/ Synonym for some kind of "checksum".

2. (D) /未大写/某种“校验和”的同义词。

Deprecated Term: IDOCs SHOULD NOT use the uncapitalized form "data authentication algorithm" as a synonym for any kind of checksum, regardless of whether or not the checksum is based on a hash. Instead, use "checksum", "Data Authentication Code", "error detection code", "hash", "keyed hash", "Message Authentication Code", "protected checksum", or some other specific term, depending on what is meant.


The uncapitalized term can be confused with the Data Authentication Code and also mixes concepts in a potentially misleading way. The word "authentication" is misleading because the checksum may be used to perform a data integrity function rather than a data origin authentication function.


$ Data Authentication Code, data authentication code 1. (N) /capitalized/ A specific U.S. Government standard [FP113] for a checksum that is computed by the Data Authentication Algorithm. Usage: a.k.a. Message Authentication Code [A9009].) (See: DAC.)

$ 数据认证码,数据认证码1。(N) /capitalized/由数据认证算法计算的校验和的特定美国政府标准[FP113]。用法:a.k.a.消息身份验证代码[A9009]。(请参阅:DAC。)

2. (D) /not capitalized/ Synonym for some kind of "checksum".

2. (D) /未大写/某种“校验和”的同义词。

Deprecated Term: IDOCs SHOULD NOT use the uncapitalized form "data authentication code" as a synonym for any kind of checksum, regardless of whether or not the checksum is based on the Data Authentication Algorithm. The uncapitalized term can be confused with the Data Authentication Code and also mixes concepts in a potentially misleading way (see: authentication code).


$ data compromise 1. (I) A security incident in which information is exposed to potential unauthorized access, such that unauthorized disclosure, alteration, or use of the information might have occurred. (Compare: security compromise, security incident.)

$ 数据泄露1。(一) 一种安全事件,其中信息可能会被未经授权的访问,从而可能会发生未经授权的信息披露、更改或使用。(比较:安全隐患、安全事故。)

2. (O) /U.S. DoD/ A "compromise" is a "communication or physical transfer of information to an unauthorized recipient." [DoD5]

2. (O) /U.S.DoD/A“妥协”是指“向未经授权的接收者通信或物理传输信息。”[DoD5]

3. (O) /U.S. Government/ "Type of [security] incident where information is disclosed to unauthorized individuals or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred." [C4009]

3. (O) /U.S.Government/“向未经授权的个人披露信息或违反系统安全政策的[安全]事件类型,其中可能发生未经授权的故意或无意披露、修改、破坏或丢失对象的事件。”[C4009]

$ data confidentiality 1. (I) The property that data is not disclosed to system entities unless they have been authorized to know the data. (See: Bell-LaPadula model, classification, data confidentiality service, secret. Compare: privacy.)

$ 数据保密1。(一) 不向系统实体披露数据的属性,除非系统实体被授权了解数据。(参见:贝尔-拉帕杜拉模型、分类、数据保密服务、机密。比较:隐私。)

2. (D) "The property that information is not made available or disclosed to unauthorized individuals, entities, or processes [i.e., to any unauthorized system entity]." [I7498-2].

2. (D) “未向未经授权的个人、实体或进程[即任何未经授权的系统实体]提供或披露信息的财产。”[I7498-2]。

Deprecated Definition: The phrase "made available" might be interpreted to mean that the data could be altered, and that would confuse this term with the concept of "data integrity".


$ data confidentiality service (I) A security service that protects data against unauthorized disclosure. (See: access control, data confidentiality, datagram confidentiality service, flow control, inference control.)

$ 数据保密服务(I)保护数据免受未经授权披露的安全服务。(请参阅:访问控制、数据保密、数据报保密服务、流控制、推理控制。)

Deprecated Usage: IDOCs SHOULD NOT use this term as a synonym for "privacy", which is a different concept.


$ Data Encryption Algorithm (DEA) (N) A symmetric block cipher, defined in the U.S. Government's DES. DEA uses a 64-bit key, of which 56 bits are independently chosen and 8 are parity bits, and maps a 64-bit block into another 64-bit block. [FP046] (See: AES, symmetric cryptography.)

$ 数据加密算法(DEA)(N):美国政府DES中定义的对称分组密码。DEA使用一个64位密钥,其中56位是独立选择的,8位是奇偶校验位,并将一个64位块映射到另一个64位块。[FP046](参见:AES,对称加密。)

Usage: This algorithm is usually referred to as "DES". The algorithm has also been adopted in standards outside the Government (e.g., [A3092]).


$ data encryption key (DEK) (I) A cryptographic key that is used to encipher application data. (Compare: key-encrypting key.)

$ 数据加密密钥(DEK)(I)用于加密应用程序数据的加密密钥。(比较:密钥加密密钥。)

$ Data Encryption Standard (DES) (N) A U.S. Government standard [FP046] that specifies the DEA and states policy for using the algorithm to protect unclassified, sensitive data. (See: AES.)

$ 数据加密标准(DES)(N)美国政府标准[FP046],规定了DEA和使用算法保护未分类敏感数据的州政策。(见:AES)

$ data integrity 1. (I) The property that data has not been changed, destroyed, or lost in an unauthorized or accidental manner. (See: data integrity service. Compare: correctness integrity, source integrity.)

$ 数据完整性1。(一) 未经授权或意外地更改、销毁或丢失数据的属性。(请参阅:数据完整性服务。比较:正确性完整性、源完整性。)

2. (O) "The property that information has not been modified or destroyed in an unauthorized manner." [I7498-2]

2. (O) “未以未经授权的方式修改或销毁信息的财产。”[I7498-2]

Usage: Deals with (a) constancy of and confidence in data values, and not with either (b) information that the values represent (see: correctness integrity) or (c) the trustworthiness of the source of the values (see: source integrity).


$ data integrity service (I) A security service that protects against unauthorized changes to data, including both intentional change or destruction and accidental change or loss, by ensuring that changes to data are detectable. (See: data integrity, checksum, datagram integrity service.)

$ 数据完整性服务(I)一种安全服务,通过确保可检测到数据更改,防止未经授权的数据更改,包括故意更改或破坏以及意外更改或丢失。(请参阅:数据完整性、校验和、数据报完整性服务。)

Tutorial: A data integrity service can only detect a change and report it to an appropriate system entity; changes cannot be prevented unless the system is perfect (error-free) and no malicious user has access. However, a system that offers data integrity service might also attempt to correct and recover from changes.


The ability of this service to detect changes is limited by the technology of the mechanisms used to implement the service. For example, if the mechanism were a one-bit parity check across each entire SDU, then changes to an odd number of bits in an SDU would be detected, but changes to an even number of bits would not.


Relationship between data integrity service and authentication services: Although data integrity service is defined separately from data origin authentication service and peer entity authentication service, it is closely related to them. Authentication services depend, by definition, on companion data integrity services. Data origin authentication service provides


verification that the identity of the original source of a received data unit is as claimed; there can be no such verification if the data unit has been altered. Peer entity authentication service provides verification that the identity of a peer entity in a current association is as claimed; there can be no such verification if the claimed identity has been altered.


$ data origin authentication (I) "The corroboration that the source of data received is as claimed." [I7498-2] (See: authentication.)

$ 数据来源认证(I)“所接收数据来源与所声称的一致的确证。”[I7498-2](见:认证。)

$ data origin authentication service (I) A security service that verifies the identity of a system entity that is claimed to be the original source of received data. (See: authentication, authentication service.)

$ 数据源身份验证服务(I)验证声称是接收数据原始源的系统实体身份的安全服务。(请参阅:身份验证、身份验证服务。)

Tutorial: This service is provided to any system entity that receives or holds the data. Unlike peer entity authentication service, this service is independent of any association between the originator and the recipient, and the data in question may have originated at any time in the past.


A digital signature mechanism can be used to provide this service, because someone who does not know the private key cannot forge the correct signature. However, by using the signer's public key, anyone can verify the origin of correctly signed data.


This service is usually bundled with connectionless data integrity service. (See: "relationship between data integrity service and authentication services" under "data integrity service".


$ data owner (N) The organization that has the final statutory and operational authority for specified information.

$ 数据所有者(N):对特定信息拥有最终法定和操作权限的组织。

$ data privacy (D) Synonym for "data confidentiality".

$ 数据隐私(D)“数据机密性”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; it mixes concepts in a potentially misleading way. Instead, use either "data confidentiality" or "privacy" or both, depending on what is meant.


$ data recovery 1. (I) /cryptanalysis/ A process for learning, from some cipher text, the plain text that was previously encrypted to produce the cipher text. (See: recovery.)

$ 数据恢复1。(一) /Cryptoanalysis/Cryptoanalysis从某些密文中学习先前加密以生成密文的纯文本的过程。(见:恢复。)

2. (I) /system integrity/ The process of restoring information following damage or destruction.

2. (一) /系统完整性/损坏或破坏后恢复信息的过程。

$ data security (I) The protection of data from disclosure, alteration, destruction, or loss that either is accidental or is intentional but unauthorized.

$ 数据安全(I)保护数据免受意外或故意但未经授权的披露、更改、破坏或丢失。

Tutorial: Both data confidentiality service and data integrity service are needed to achieve data security.


$ datagram (I) "A self-contained, independent entity of data [i.e., a packet] carrying sufficient information to be routed from the source [computer] to the destination computer without reliance on earlier exchanges between this source and destination computer and the transporting network." [R1983] Example: A PDU of IP.

$ 数据报(I)“一种自包含、独立的数据实体[即,数据包],承载足够的信息,可从源[计算机]路由到目标计算机,而不依赖该源和目标计算机以及传输网络之间的早期交换。”[R1983]示例:IP的PDU。

$ datagram confidentiality service (I) A data confidentiality service that preserves the confidentiality of data in a single, independent, packet; i.e., the service applies to datagrams one-at-a-time. Example: ESP. (See: data confidentiality.)

$ 数据报保密服务(I)一种数据保密服务,在单个独立数据包中保护数据的机密性;i、 例如,该服务一次一个地应用于数据报。示例:ESP(请参阅:数据机密性)

Usage: When a protocol is said to provide data confidentiality service, this is usually understood to mean that only the SDU is protected in each packet. IDOCs that use the term to mean that the entire PDU is protected should include a highlighted definition.


Tutorial: This basic form of network confidentiality service suffices for protecting the data in a stream of packets in both connectionless and connection-oriented protocols. Except perhaps for traffic flow confidentiality, nothing further is needed to protect the confidentiality of data carried by a packet stream. The OSIRM distinguishes between connection confidentiality and connectionless confidentiality. The IPS need not make that distinction, because those services are just instances of the same service (i.e., datagram confidentiality) being offered in two different protocol contexts. (For data integrity service, however, additional effort is needed to protect a stream, and the IPS does need to distinguish between "datagram integrity service" and "stream integrity service".)


$ datagram integrity service (I) A data integrity service that preserves the integrity of data in a single, independent, packet; i.e., the service applies to datagrams one-at-a-time. (See: data integrity. Compare: stream integrity service.)

$ 数据报完整性服务(I)在单个独立数据包中保持数据完整性的数据完整性服务;i、 例如,该服务一次一个地应用于数据报。(请参阅:数据完整性。比较:流完整性服务。)

Tutorial: The ability to provide appropriate data integrity is important in many Internet security situations, and so there are different kinds of data integrity services suited to different applications. This service is the simplest kind; it is suitable for connectionless data transfers.


Datagram integrity service usually is designed only to attempt to detect changes to the SDU in each packet, but it might also attempt to detect changes to some or all of the PCI in each packet (see: selective field integrity). In contrast to this simple, one-at-a-time service, some security situations demand a more complex service that also attempts to detect deleted, inserted, or reordered datagrams within a stream of datagrams (see: stream integrity service).


$ DEA (N) See: Data Encryption Algorithm.

$ DEA(N)参见:数据加密算法。

$ deception (I) A circumstance or event that may result in an authorized entity receiving false data and believing it to be true. (See: authentication.)

$ 欺诈(I)可能导致授权实体接收虚假数据并相信其真实性的情况或事件。(请参阅:身份验证。)

Tutorial: This is a type of threat consequence, and it can be caused by the following types of threat actions: masquerade, falsification, and repudiation.


$ decipher (D) Synonym for "decrypt".

$ 解密(D)“解密”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for "decrypt". However, see usage note under "encryption".


$ decipherment (D) Synonym for "decryption".

$ 解密(D)“解密”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for "decryption". However, see the Usage note under "encryption".


$ declassification (I) An authorized process by which information is declassified. (Compare: classification.)

$ 解密(I)信息解密的授权过程。(比较:分类。)

$ declassify (I) To officially remove the security level designation of a classified information item or information type, such that the information is no longer classified (i.e., becomes unclassified). (See: classified, classify, security level. Compare: downgrade.)

$ 解密(I)正式删除保密信息项或信息类型的安全级别指定,使信息不再保密(即变得不保密)。(请参阅:分类、分类、安全级别。比较:降级。)

$ decode 1. (I) Convert encoded data back to its original form of representation. (Compare: decrypt.)

$ 解码1。(一) 将编码数据转换回其原始表示形式。(比较:解密。)

2. (D) Synonym for "decrypt".

2. (D) “解密”的同义词。

Deprecated Definition: Encoding is not usually meant to conceal meaning. Therefore, IDOCs SHOULD NOT use this term as a synonym for "decrypt", because that would mix concepts in a potentially misleading way.


$ decrypt (I) Cryptographically restore cipher text to the plaintext form it had before encryption.

$ 解密(I)以加密方式将密文恢复为加密前的明文形式。

$ decryption (I) See: secondary definition under "encryption".

$ 解密(I)见“加密”下的第二定义。

$ dedicated security mode (I) A mode of system operation wherein all users having access to the system possess, for all data handled by the system, both (a) all necessary authorizations (i.e., security clearance and formal access approval) and (b) a need-to-know. (See: /system operation/ under "mode", formal access approval, need to know, protection level, security clearance.)

$ 专用安全模式(I)一种系统操作模式,其中所有访问系统的用户都拥有系统处理的所有数据(A)所有必要的授权(即安全许可和正式访问批准)和(b)需要知道。(参见:/系统操作/在“模式”下,正式访问批准,需要知道,保护级别,安全许可。)

Usage: Usually abbreviated as "dedicated mode". This mode was defined in U.S. Government policy on system accreditation, but the term is also used outside the Government. In this mode, the system may handle either (a) a single classification level or category of information or (b) a range of levels and categories.


$ default account (I) A system login account (usually accessed with a user identifier and password) that has been predefined in a manufactured system to permit initial access when the system is first put into service. (See: harden.)

$ 默认帐户(I)在制造系统中预定义的系统登录帐户(通常使用用户标识符和密码访问),以便在系统首次投入使用时允许初始访问。(请参见:硬化。)

Tutorial: A default account becomes a serious vulnerability if not properly administered. Sometimes, the default identifier and password are well-known because they are the same in each copy of the system. In any case, when a system is put into service, any default password should immediately be changed or the default account should be disabled.


$ defense in depth (N) "The siting of mutually supporting defense positions designed to absorb and progressively weaken attack, prevent initial

$ 纵深防御(N)“相互支持的防御阵地的选址,旨在吸收并逐渐削弱攻击,防止初始攻击

observations of the whole position by the enemy, and [enable] the commander to maneuver the reserve." [JP1]


Tutorial: In information systems, defense in depth means constructing a system's security architecture with layered and complementary security mechanisms and countermeasures, so that if one security mechanism is defeated, one or more other mechanisms (which are "behind" or "beneath" the first mechanism) still provide protection.


This architectural concept is appealing because it aligns with traditional warfare doctrine, which applies defense in depth to physical, geospatial structures; but applying the concept to logical, cyberspace structures of computer networks is more difficult. The concept assumes that networks have a spatial or topological representation. It also assumes that there can be implemented -- from the "outer perimeter" of a network, through its various "layers" of components, to its "center" (i.e., to the subscriber application systems supported by the network) -- a varied series of countermeasures that together provide adequate protection. However, it is more difficult to map the topology of networks and make certain that no path exists by which an attacker could bypass all defensive layers.


$ Defense Information Infrastructure (DII) (O) /U.S. DoD/ The U.S. DoD's shared, interconnected system of computers, communications, data, applications, security, people, training, and support structures, serving information needs worldwide. (See: DISN.) Usage: Has evolved to be called the GIG.

$ 国防信息基础设施(DII)(O)/美国国防部/美国国防部的共享互联系统,包括计算机、通信、数据、应用、安全、人员、培训和支持结构,服务于全球信息需求。用法:已演变为GIG。

Tutorial: The DII connects mission support, command and control, and intelligence computers and users through voice, data, imagery, video, and multimedia services, and provides information processing and value-added services to subscribers over the DISN. Users' own data and application software are not considered part of the DII.


$ Defense Information Systems Network (DISN) (O) /U.S. DoD/ The U.S. DoD's consolidated, worldwide, enterprise level telecommunications infrastructure that provides end-to-end information transfer for supporting military operations; a part of the DII. (Compare: GIG.)

$ 国防信息系统网络(DISN)(O)/美国国防部/美国国防部的综合全球企业级电信基础设施,为支持军事行动提供端到端信息传输;DII的一部分。(比较:GIG)

$ degauss 1a. (N) Apply a magnetic field to permanently remove data from a magnetic storage medium, such as a tape or disk [NCS25]. (Compare: erase, purge, sanitize.)

$ 消磁1a。(N) 施加磁场以从磁带或磁盘等磁性存储介质中永久删除数据[NCS25]。(比较:擦除、清除、消毒。)

1b. (N) Reduce magnetic flux density to zero by applying a reversing magnetic field. (See: magnetic remanence.)

1b。(N) 通过施加反向磁场将磁通密度降至零。(参见:剩磁。)

$ degausser (N) An electrical device that can degauss magnetic storage media.

$ 消磁器(N):一种可以对磁性存储介质进行消磁的电气设备。

$ DEK (I) See: data encryption key.

$ DEK(I)见:数据加密密钥。

$ delay (I) /packet/ See: secondary definition under "stream integrity service".

$ 延迟(I)/数据包/见“流完整性服务”下的二级定义。

$ deletion (I) /packet/ See: secondary definition under "stream integrity service".

$ 删除(I)/数据包/见“流完整性服务”下的二级定义。

$ deliberate exposure (I) /threat action/ See: secondary definition under "exposure".

$ 故意暴露(I)/威胁行动/见“暴露”下的二级定义。

$ delta CRL (I) A partial CRL that only contains entries for certificates that have been revoked since the issuance of a prior, base CRL [X509]. This method can be used to partition CRLs that become too large and unwieldy. (Compare: CRL distribution point.)

$ 增量CRL(I)部分CRL,仅包含自发布以前的基本CRL[X509]以来已撤销的证书的条目。此方法可用于对变得过大和不实用的CRL进行分区。(比较:CRL分布点。)

$ demilitarized zone (DMZ) (D) Synonym for "buffer zone".

$ 非军事区(DMZ)(D)是“缓冲区”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term because it mixes concepts in a potentially misleading way. (See: Deprecated Usage under "Green Book".)


$ denial of service (I) The prevention of authorized access to a system resource or the delaying of system operations and functions. (See: availability, critical, flooding.)

$ 拒绝服务(I)阻止对系统资源的授权访问或延迟系统操作和功能。(请参阅:可用性、关键性、泛洪。)

Tutorial: A denial-of-service attack can prevent the normal conduct of business on the Internet. There are four types of solutions to this security problem: - Awareness: Maintaining cognizance of security threats and vulnerabilities. (See: CERT.) - Detection: Finding attacks on end systems and subnetworks. (See: intrusion detection.) - Prevention: Following defensive practices on network-connected systems. (See: [R2827].)

Tutorial: A denial-of-service attack can prevent the normal conduct of business on the Internet. There are four types of solutions to this security problem: - Awareness: Maintaining cognizance of security threats and vulnerabilities. (See: CERT.) - Detection: Finding attacks on end systems and subnetworks. (See: intrusion detection.) - Prevention: Following defensive practices on network-connected systems. (See: [R2827].)translate error, please retry

- Response: Reacting effectively when attacks occur. (See: CSIRT, contingency plan.)

- 响应:在发生攻击时有效地作出反应。(参见:CSIRT,应急计划。)

$ DES (N) See: Data Encryption Standard.

$ DES(N)见:数据加密标准。

$ designated approving authority (DAA) (O) /U.S. Government/ Synonym for "accreditor".

$ 指定审批机构(DAA)(O)/美国政府/同义词“认证人”。

$ detection (I) See: secondary definition under "security".

$ 检测(I)见“安全”下的二级定义。

$ deterrence (I) See: secondary definition under "security".

$ 威慑(一)见“安全”下的第二个定义。

$ dictionary attack (I) An attack that uses a brute-force technique of successively trying all the words in some large, exhaustive list.

$ 字典攻击(I)一种使用蛮力技术的攻击,即连续尝试某个大型、详尽列表中的所有单词。

Examples: Attack an authentication service by trying all possible passwords. Attack an encryption service by encrypting some known plaintext phrase with all possible keys so that the key for any given encrypted message containing that phrase may be obtained by lookup.


$ Diffie-Hellman $ Diffie-Hellman-Merkle (N) A key-agreement algorithm published in 1976 by Whitfield Diffie and Martin Hellman [DH76, R2631].

$ Diffie-Hellman$Diffie-Hellman-Merkle(N)一种密钥协商算法,由Whitfield Diffie和Martin Hellman于1976年发布[DH76,R2631]。

Usage: The algorithm is most often called "Diffie-Hellman". However, in the November 1978 issue of "IEEE Communications Magazine", Hellman wrote that the algorithm "is a public key distribution system, a concept developed by [Ralph C.] Merkle, and hence should be called 'Diffie-Hellman-Merkle' ... to recognize Merkle's equal contribution to the invention of public key cryptography."

用法:该算法通常被称为“Diffie-Hellman”。然而,在1978年11月发行的《IEEE通信杂志》中,Hellman写道,该算法“是一个公钥分发系统,是由[Ralph C.]Merkle提出的一个概念,因此应称为“Diffie Hellman Merkle”……以承认Merkle对公钥密码术的发明做出了同等贡献。”

Tutorial: Diffie-Hellman-Merkle does key establishment, not encryption. However, the key that it produces may be used for encryption, for further key management operations, or for any other cryptography.

教程:Diffie Hellman Merkle负责密钥建立,而不是加密。但是,它生成的密钥可用于加密、进一步的密钥管理操作或任何其他加密。

The algorithm is described in [R2631] and [Schn]. In brief, Alice and Bob together pick large integers that satisfy certain mathematical conditions, and then use the integers to each separately compute a public-private key pair. They send each other their public key. Each person uses their own private key and the


other person's public key to compute a key, k, that, because of the mathematics of the algorithm, is the same for each of them. Passive wiretapping cannot learn the shared k, because k is not transmitted, and neither are the private keys needed to compute k.


The difficulty of breaking Diffie-Hellman-Merkle is considered to be equal to the difficulty of computing discrete logarithms modulo a large prime. However, without additional mechanisms to authenticate each party to the other, a protocol based on the algorithm may be vulnerable to a man-in-the-middle attack.


$ digest See: message digest.

$ 摘要请参阅:消息摘要。

$ digital certificate (I) A certificate document in the form of a digital data object (a data object used by a computer) to which is appended a computed digital signature value that depends on the data object. (See: attribute certificate, public-key certificate.)

$ 数字证书(I)数字数据对象(计算机使用的数据对象)形式的证书文档,其附加了依赖于该数据对象的计算数字签名值。(请参阅:属性证书、公钥证书。)

Deprecated Usage: IDOCs SHOULD NOT use this term to refer to a signed CRL or CKL. Although the recommended definition can be interpreted to include other signed items, the security community does not use the term with those meanings.


$ digital certification (D) Synonym for "certification".

$ 数字认证(D)“认证”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this definition unless the context is not sufficient to distinguish between digital certification and another kind of certification, in which case it would be better to use "public-key certification" or another phrase that indicates what is being certified.


$ digital document (I) An electronic data object that represents information originally written in a non-electronic, non-magnetic medium (usually ink on paper) or is an analogue of a document of that type.

$ 数字文档(I)一种电子数据对象,表示最初在非电子、非磁性介质(通常为纸张上的墨水)中写入的信息,或类似于该类型文档的信息。

$ digital envelope (I) A combination of (a) encrypted content data (of any kind) intended for a recipient and (b) the content encryption key in an encrypted form that has been prepared for the use of the recipient.

$ 数字信封(I)(A)为收件人准备的加密内容数据(任何类型)和(b)为收件人准备的加密形式的内容加密密钥的组合。

Usage: In IDOCs, the term SHOULD be defined at the point of first use because, although the term is defined in PKCS #7 and used in S/MIME, it is not widely known.


Tutorial: Digital enveloping is not simply a synonym for implementing data confidentiality with encryption; digital enveloping is a hybrid encryption scheme to "seal" a message or other data, by encrypting the data and sending both it and a protected form of the key to the intended recipient, so that no one other than the intended recipient can "open" the message. In PKCS #7, it means first encrypting the data using a symmetric encryption algorithm and a secret key, and then encrypting the secret key using an asymmetric encryption algorithm and the public key of the intended recipient. In S/MIME, additional methods are defined for encrypting the content encryption key.


$ Digital ID(service mark) (D) Synonym for "digital certificate".

$ 数字标识(服务标志)(D)“数字证书”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term. It is a service mark of a commercial firm, and it unnecessarily duplicates the meaning of a better-established term. (See: credential.)


$ digital key (D) Synonym for an input parameter of a cryptographic algorithm or other process. (See: key.)

$ 数字密钥(D)是密码算法或其他过程的输入参数的同义词。(请参阅:键。)

Deprecated Usage: The adjective "digital" need not be used with "key" or "cryptographic key", unless the context is insufficient to distinguish the digital key from another kind of key, such as a metal key for a door lock.

不推荐使用:形容词“digital”不必与“key”或“cryptographic key”一起使用,除非上下文不足以区分数字钥匙和其他钥匙,例如门锁的金属钥匙。

$ digital notary (I) An electronic functionary analogous to a notary public. Provides a trusted timestamp for a digital document, so that someone can later prove that the document existed at that point in time; verifies the signature(s) on a signed document before applying the stamp. (See: notarization.)

$ 数字公证人(I)类似于公证人的电子工作人员。为数字文档提供可信的时间戳,以便稍后有人可以证明该文档在该时间点存在;在加盖印章之前,验证已签名文档上的签名。(见:公证)

$ digital signature 1. (I) A value computed with a cryptographic algorithm and associated with a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity. (See: data origin authentication service, data integrity service, signer. Compare: digitized signature, electronic signature.)

$ 数字签名1。(一) 用加密算法计算的一种值,它与数据对象相关联,数据的任何接收者都可以使用签名来验证数据的来源和完整性。(请参阅:数据源身份验证服务、数据完整性服务、签名者。比较:数字签名、电子签名。)

2. (O) "Data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery, e.g. by the recipient." [I7498-2]

2. (O) “附加到数据单元的数据或数据单元的加密转换,允许数据单元的接收者证明数据单元的来源和完整性,并防止伪造(例如由接收者伪造)。[I7498-2]

Tutorial: A digital signature should have these properties: - Be capable of being verified. (See: validate vs. verify.) - Be bound to the signed data object in such a way that if the data is changed, then when an attempt is made to verify the signature, it will be seen as not authentic. (In some schemes, the signature is appended to the signed object as stated by definition 2, but in other it, schemes is not.) - Uniquely identify a system entity as being the signer. - Be under the signer's sole control, so that it cannot be created by any other entity.


To achieve these properties, the data object is first input to a hash function, and then the hash result is cryptographically transformed using a private key of the signer. The final resulting value is called the digital signature of the data object. The signature value is a protected checksum, because the properties of a cryptographic hash ensure that if the data object is changed, the digital signature will no longer match it. The digital signature is unforgeable because one cannot be certain of correctly creating or changing the signature without knowing the private key of the supposed signer.


Some digital signature schemes use an asymmetric encryption algorithm (e.g., "RSA") to transform the hash result. Thus, when Alice needs to sign a message to send to Bob, she can use her private key to encrypt the hash result. Bob receives both the message and the digital signature. Bob can use Alice's public key to decrypt the signature, and then compare the plaintext result to the hash result that he computes by hashing the message himself. If the values are equal, Bob accepts the message because he is certain that it is from Alice and has arrived unchanged. If the values are not equal, Bob rejects the message because either the message or the signature was altered in transit.


Other digital signature schemes (e.g., "DSS") transform the hash result with an algorithm (e.g., "DSA", "El Gamal") that cannot be directly used to encrypt data. Such a scheme creates a signature value from the hash and provides a way to verify the signature value, but does not provide a way to recover the hash result from the signature value. In some countries, such a scheme may improve exportability and avoid other legal constraints on usage. Alice sends the signature value to Bob along with both the message and its hash result. The algorithm enables Bob to use Alice's public

其他数字签名方案(例如,“DSS”)使用无法直接用于加密数据的算法(例如,“DSA”、“El Gamal”)转换哈希结果。这样的方案从散列创建签名值,并提供验证签名值的方法,但不提供从签名值恢复散列结果的方法。在一些国家,这样的计划可以提高出口能力,并避免对使用的其他法律限制。Alice将签名值连同消息及其哈希结果一起发送给Bob。该算法使Bob能够使用Alice的公共

signature key and the signature value to verify the hash result he receives. Then, as before, he compares that hash result she sent to the one that he computes by hashing the message himself.


$ Digital Signature Algorithm (DSA) (N) An asymmetric cryptographic algorithm for a digital signature in the form of a pair of large numbers. The signature is computed using rules and parameters such that the identity of the signer and the integrity of the signed data can be verified. (See: DSS.)

$ 数字签名算法(DSA)(N)以一对大数字的形式对数字签名进行非对称加密的算法。签名使用规则和参数进行计算,以便验证签名者的身份和签名数据的完整性。(见:DSS)

$ Digital Signature Standard (DSS) (N) The U.S. Government standard [FP186] that specifies the DSA.

$ 数字签名标准(DSS)(N)规定数字签名的美国政府标准[FP186]。

$ digital watermarking (I) Computing techniques for inseparably embedding unobtrusive marks or labels as bits in digital data -- text, graphics, images, video, or audio -- and for detecting or extracting the marks later.

$ 数字水印(I)在数字数据(文本、图形、图像、视频或音频)中以位的形式不可分割地嵌入不引人注目的标记或标签,并在以后检测或提取标记的计算技术。

Tutorial: A "digital watermark", i.e., the set of embedded bits, is sometimes hidden, usually imperceptible, and always intended to be unobtrusive. Depending on the particular technique that is used, digital watermarking can assist in proving ownership, controlling duplication, tracing distribution, ensuring data integrity, and performing other functions to protect intellectual property rights. [ACM]


$ digitized signature (D) Denotes various forms of digitized images of handwritten signatures. (Compare: digital signature).

$ 数字签名(D)表示手写签名的各种形式的数字化图像。(比较:数字签名)。

Deprecated Term: IDOCs SHOULD NOT use this term without including this definition. This term suggests careless use of "digital signature", which is the term standardized by [I7498-2]. (See: electronic signature.)


$ DII (O) See: Defense Information Infrastructure.

$ DII(O)见:国防信息基础设施。

$ direct attack (I) See: secondary definition under "attack". (Compare: indirect attack.)

$ 直接攻击(I)见“攻击”下的二级定义。(比较:间接攻击。)

$ directory, Directory 1. (I) /not capitalized/ Refers generically to a database server or other system that stores and provides access to values of descriptive or operational data items that are associated with the components of a system. (Compare: repository.)

$ 目录,目录1。(一) /未大写/泛指存储并提供对与系统组件相关的描述性或操作性数据项值的访问的数据库服务器或其他系统。(比较:存储库。)

2. (N) /capitalized/ Refers specifically to the X.500 Directory. (See: DN, X.500.)

2. (N) /capitalized/专门指X.500目录。(见:DN,X.500)

$ Directory Access Protocol (DAP) (N) An OSI protocol [X519] for communication between a Directory User Agent (a type of X.500 client) and a Directory System Agent (a type of X.500 server). (See: LDAP.)

$ 目录访问协议(DAP)(N)用于目录用户代理(一种X.500客户端)和目录系统代理(一种X.500服务器)之间通信的OSI协议[X519]。(请参阅:LDAP。)

$ disaster plan (O) Synonym for "contingency plan".

$ 灾难计划(O)是“应急计划”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; instead, for consistency and neutrality of language, IDOCs SHOULD use "contingency plan".


$ disclosure See: unauthorized disclosure. Compare: exposure.

$ 披露见:未经授权的披露。比较:曝光。

$ discretionary access control 1a. (I) An access control service that (a) enforces a security policy based on the identity of system entities and the authorizations associated with the identities and (b) incorporates a concept of ownership in which access rights for a system resource may be granted and revoked by the entity that owns the resource. (See: access control list, DAC, identity-based security policy, mandatory access control.)

$ 自主访问控制1a。(一) 一种访问控制服务,其(a)基于系统实体的身份和与该身份相关联的授权强制执行安全策略,以及(b)包含所有权概念,其中系统资源的访问权可由拥有该资源的实体授予和撤销。(请参阅:访问控制列表、DAC、基于身份的安全策略、强制访问控制。)

Derivation: This service is termed "discretionary" because an entity can be granted access rights to a resource such that the entity can by its own volition enable other entities to access the resource.


1b. (O) /formal model/ "A means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject." [DoD1]

1b。(O) /formal model/“一种基于对象和/或对象所属群体的身份限制对象访问的方法。控制是自由裁量的,即具有特定访问权限的对象能够将该权限(可能间接)传递给任何其他主体。”[DoD1]

$ DISN (O) See: Defense Information Systems Network (DISN).

$ 国防信息系统网络(DISN)见:国防信息系统网络(DISN)。

$ disruption (I) A circumstance or event that interrupts or prevents the correct operation of system services and functions. (See: availability, critical, system integrity, threat consequence.)

$ 中断(I)中断或阻止系统服务和功能正确运行的情况或事件。(请参阅:可用性、关键性、系统完整性、威胁后果。)

Tutorial: Disruption is a type of threat consequence; it can be caused by the following types of threat actions: incapacitation, corruption, and obstruction.


$ Distinguished Encoding Rules (DER) (N) A subset of the Basic Encoding Rules that always provides only one way to encode any data structure defined by ASN.1. [X690].

$ 可分辨编码规则(DER)(N)基本编码规则的子集,它始终只提供一种方法来编码ASN.1定义的任何数据结构。[X690]。

Tutorial: For a data structure defined abstractly in ASN.1, BER often provides for encoding the structure into an octet string in more than one way, so that two separate BER implementations can legitimately produce different octet strings for the same ASN.1 definition. However, some applications require all encodings of a structure to be the same, so that encodings can be compared for equality. Therefore, DER is used in applications in which unique encoding is needed, such as when a digital signature is computed on a structure defined by ASN.1.


$ distinguished name (DN) (N) An identifier that uniquely represents an object in the X.500 Directory Information Tree (DIT) [X501]. (Compare: domain name, identity, naming authority.)

$ 可分辨名称(DN)(N)唯一表示X.500目录信息树(DIT)中对象的标识符[X501]。(比较:域名、身份、命名机构。)

Tutorial: A DN is a set of attribute values that identify the path leading from the base of the DIT to the object that is named. An X.509 public-key certificate or CRL contains a DN that identifies its issuer, and an X.509 attribute certificate contains a DN or other form of name that identifies its subject.


$ distributed attack 1a. (I) An attack that is implemented with distributed computing. (See: zombie.)

$ 分布式攻击1a。(一) 一种通过分布式计算实现的攻击。(见:僵尸。)

1b. (I) An attack that deploys multiple threat agents.

1b。(一) 部署多个威胁代理的攻击。

$ Distributed Authentication Security Service (DASS) (I) An experimental Internet protocol [R1507] that uses cryptographic mechanisms to provide strong, mutual authentication services in a distributed environment.

$ 分布式身份验证安全服务(DASS)(I)一种实验性互联网协议[R1507],它使用加密机制在分布式环境中提供强大的相互身份验证服务。

$ distributed computing (I) A technique that disperses a single, logically related set of tasks among a group of geographically separate yet cooperating computers. (See: distributed attack.)

$ 分布式计算(I)一种技术,它将一组逻辑上相关的任务分散在一组地理上独立但相互协作的计算机中。(请参阅:分布式攻击。)

$ distribution point (I) An X.500 Directory entry or other information source that is named in a v3 X.509 public-key certificate extension as a location from which to obtain a CRL that may list the certificate.

$ 分发点(I)v3 X.509公钥证书扩展名中指定的X.500目录项或其他信息源,作为获取可能列出证书的CRL的位置。

Tutorial: A v3 X.509 public-key certificate may have a "cRLDistributionPoints" extension that names places to get CRLs on which the certificate might be listed. (See: certificate profile.) A CRL obtained from a distribution point may (a) cover either all reasons for which a certificate might be revoked or only some of the reasons, (b) be issued by either the authority that signed the certificate or some other authority, and (c) contain revocation entries for only a subset of the full set of certificates issued by one CA or (d) contain revocation entries for multiple CAs.

教程:v3 X.509公钥证书可能有一个“cRLDistributionPoints”扩展名,该扩展名指定了获取证书可能列出的CRL的位置。(参见:证书简介。)从分发点获得的CRL可能(A)涵盖证书可能被撤销的所有原因,或仅包括部分原因,(b)由签署证书的机构或其他机构颁发,以及(c)仅包含一个CA颁发的全套证书的子集的吊销条目,或(d)包含多个CA的吊销条目。

$ DKIM (I) See: Domain Keys Identified Mail.

$ DKIM(I)见:域密钥识别邮件。

$ DMZ (D) See: demilitarized zone.

$ 非军事区(D)见:非军事区。

$ DN (N) See: distinguished name.

$ DN(N)参见:可分辨名称。

$ DNS (I) See: Domain Name System.

$ DNS(一)见:域名系统。

$ doctrine See: security doctrine.

$ 原则见:安全原则。

$ DoD (N) Department of Defense.

$ 国防部(N)国防部。

Usage: To avoid international misunderstanding, IDOCs SHOULD use this abbreviation only with a national qualifier (e.g., U.S. DoD).


$ DOI (I) See: Domain of Interpretation.

$ 内政部(一)见:解释领域。

$ domain 1a. (I) /general security/ An environment or context that (a) includes a set of system resources and a set of system entities that have the right to access the resources and (b) usually is defined by a security policy, security model, or security architecture. (See: CA domain, domain of interpretation, security perimeter. Compare: COI, enclave.)

$ 域1a。(一) /通用安全性/一种环境或上下文(a)包括一组系统资源和一组有权访问资源的系统实体,以及(b)通常由安全策略、安全模型或安全体系结构定义。(参见:CA域、解释域、安全周界。比较:COI、enclave。)

Tutorial: A "controlled interface" or "guard" is required to transfer information between network domains that operate under different security policies.


1b. (O) /security policy/ A set of users, their information objects, and a common security policy. [DoD6, SP33]

1b。(O) /security policy/一组用户、他们的信息对象和通用安全策略。[DoD6,SP33]

1c. (O) /security policy/ A system or collection of systems that (a) belongs to a community of interest that implements a consistent security policy and (b) is administered by a single authority.

1c。(O) /security policy/A系统或系统集合,其(A)属于实施一致安全策略的利益团体,且(b)由单一机构管理。

2. (O) /COMPUSEC/ An operating state or mode of a set of computer hardware.

2. (O) /COMPUSEC/一组计算机硬件的操作状态或模式。

Tutorial: Most computers have at least two hardware operating modes [Gass]: - "Privileged" mode: a.k.a. "executive", "master", "system", "kernel", or "supervisor" mode. In this mode, software can execute all machine instructions and access all storage locations. - "Unprivileged" mode: a.k.a. "user", "application", or "problem" mode. In this mode, software is restricted to a subset of the instructions and a subset of the storage locations.


3. (O) "A distinct scope within which certain common characteristics are exhibited and common rules are observed." [CORBA]

3. (O) “展示某些共同特征和遵守共同规则的独特范围。”[CORBA]

4. (O) /MISSI/ The domain of a MISSI CA is the set of MISSI users whose certificates are signed by the CA.

4. (O) /MISSI/MISSI CA的域是其证书由CA签名的一组MISSI用户。

5. (I) /Internet/ That part of the tree-structured name space of the DNS that is at or below the name that specifies the domain. A domain is a subdomain of another domain if it is contained within that domain. For example, D.C.B.A is a subdomain of C.B.A

5. (一) /Internet/DNS的树状结构名称空间中位于或低于指定域的名称的部分。如果一个域包含在另一个域中,则该域是该域的子域。例如,D.C.B.A是C.B.A的子域

6. (O) /OSI/ An administrative partition of a complex distributed OSI system.

6. (O) /OSI/复杂分布式OSI系统的管理分区。

$ Domain Keys Identified Mail (DKIM) (I) A protocol, which is being specified by the IETF working group of the same name, to provide data integrity and domain-level (see: DNS, domain name) data origin authentication for Internet mail messages. (Compare: PEM.)

$ 域密钥识别邮件(DKIM)(I)IETF同名工作组指定的一种协议,用于为Internet邮件消息提供数据完整性和域级(请参阅:DNS,域名)数据源身份验证。(比较:PEM)

Tutorial: DKIM employs asymmetric cryptography to create a digital signature for an Internet email message's body and selected


headers (see RFC 1822), and the signature is then carried in a header of the message. A recipient of the message can verify the signature and, thereby, authenticate the identity of the originating domain and the integrity of the signed content, by using a public key belonging to the domain. The key can be obtained from the DNS.


$ domain name (I) The style of identifier that is defined for subtrees in the Internet DNS -- i.e., a sequence of case-insensitive ASCII labels separated by dots (e.g., "") -- and also is used in other types of Internet identifiers, such as host names (e.g., ""), mailbox names (e.g., "") and URLs (e.g., ""). (See: domain. Compare: DN.)

$ 域名(I)为Internet DNS中的子树定义的标识符样式——即,由点分隔的不区分大小写的ASCII标签序列(例如,“”)——也用于其他类型的Internet标识符,如主机名(例如,“”)、邮箱名(例如和URL(例如。,"请参阅:域。比较:DN。)

Tutorial: The name space of the DNS is a tree structure in which each node and leaf holds records describing a resource. Each node has a label. The domain name of a node is the list of labels on the path from the node to the root of the tree. The labels in a domain name are printed or read left to right, from the most specific (lowest, farthest from the root) to the least specific (highest, closest to the root), but the root's label is the null string. (See: country code.)


$ Domain Name System (DNS) (I) The main Internet operations database, which is distributed over a collection of servers and used by client software for purposes such as (a) translating a domain name-style host name into an IP address (e.g., "" translates to "") and (b) locating a host that accepts mail for a given mailbox address. (RFC 1034) (See: domain name.)

$ 域名系统(DNS)(I)主要的互联网操作数据库,分布在一组服务器上,由客户端软件用于(a)将域名样式的主机名转换为IP地址(例如,“”转换为“”)和(b)查找接受给定邮箱地址邮件的主机。(RFC1034)(见:域名)

Tutorial: The DNS has three major components: - Domain name space and resource records: Specifications for the tree-structured domain name space, and data associated with the names. - Name servers: Programs that hold information about a subset of the tree's structure and data holdings, and also hold pointers to other name servers that can provide information from any part of the tree. - Resolvers: Programs that extract information from name servers in response to client requests; typically, system routines directly accessible to user programs.


Extensions to the DNS [R4033, R4034, R4035] support (a) key distribution for public keys needed for the DNS and for other protocols, (b) data origin authentication service and data


integrity service for resource records, (c) data origin authentication service for transactions between resolvers and servers, and (d) access control of records.


$ domain of interpretation (DOI) (I) /IPsec/ A DOI for ISAKMP or IKE defines payload formats, exchange types, and conventions for naming security-relevant information such as security policies or cryptographic algorithms and modes. Example: See [R2407].

$ ISAKMP或IKE的解释域(DOI)(I)/IPsec/A DOI定义了有效负载格式、交换类型和命名安全相关信息(如安全策略或加密算法和模式)的约定。示例:请参见[R2407]。

Derivation: The DOI concept is based on work by the TSIG's CIPSO Working Group.


$ dominate (I) Security level A is said to "dominate" security level B if the (hierarchical) classification level of A is greater (higher) than or equal to that of B, and A's (nonhierarchical) categories include (as a subset) all of B's categories. (See: lattice, lattice model.)

$ 主导(I)如果A的(分层)分类级别大于(高于)或等于B的分类级别,且A的(非分层)类别包括(作为子集)B的所有类别,则称A的安全级别为“主导”安全级别B。(请参见:晶格,晶格模型。)

$ dongle (I) A portable, physical, usually electronic device that is required to be attached to a computer to enable a particular software program to run. (See: token.)

$ 加密狗(I):一种便携式物理设备,通常是电子设备,需要连接到计算机上才能运行特定的软件程序。(请参阅:令牌。)

Tutorial: A dongle is essentially a physical key used for copy protection of software; that is, the program will not run unless the matching dongle is attached. When the software runs, it periodically queries the dongle and quits if the dongle does not reply with the proper authentication information. Dongles were originally constructed as an EPROM (erasable programmable read-only memory) to be connected to a serial input-output port of a personal computer.


$ downgrade (I) /data security/ Reduce the security level of data (especially the classification level) without changing the information content of the data. (Compare: downgrade.)

$ 降级(I)/数据安全性/在不改变数据信息内容的情况下降低数据的安全级别(尤其是分类级别)。(比较:降级。)

$ downgrade attack (I) A type of man-in-the-middle attack in which the attacker can cause two parties, at the time they negotiate a security association, to agree on a lower level of protection than the highest level that could have been supported by both of them. (Compare: downgrade.)

$ 降级攻击(I)一种中间人攻击类型,在这种攻击中,攻击者可以使双方在协商安全关联时,就低于双方可能支持的最高级别的保护级别达成一致。(比较:降级。)

$ draft RFC (D) A preliminary, temporary version of a document that is intended to become an RFC. (Compare: Internet-Draft.)

$ RFC草案(D):旨在成为RFC的文件的初步、临时版本。(比较:互联网草稿。)

Deprecated Term: IDOCs SHOULD NOT use this term. The RFC series is archival in nature and consists only of documents in permanent form. A document that is intended to become an RFC usually needs to be published first as an Internet-Draft (RFC 2026). (See: "Draft Standard" under "Internet Standard".)

不推荐使用的术语:IDOCs不应使用此术语。RFC系列本质上是存档的,只包含永久形式的文档。打算成为RFC的文件通常需要首先作为互联网草案(RFC 2026)发布。(参见“互联网标准”下的“标准草案”。)

$ Draft Standard (I) See: secondary definition under "Internet Standard".

$ 标准草案(I)见“互联网标准”下的二级定义。

$ DSA (N) See: Digital Signature Algorithm.

$ DSA(N)参见:数字签名算法。

$ DSS (N) See: Digital Signature Standard.

$ DSS(N)参见:数字签名标准。

$ dual control (I) A procedure that uses two or more entities (usually persons) operating in concert to protect a system resource, such that no single entity acting alone can access that resource. (See: no-lone zone, separation of duties, split knowledge.)

$ 双重控制(I)一种程序,使用两个或多个实体(通常是人员)协同工作来保护系统资源,这样,任何单独行动的实体都无法访问该资源。(参见:无单独区域、职责分离、知识分离。)

$ dual signature (O) /SET/ A single digital signature that protects two separate messages by including the hash results for both sets in a single encrypted value. [SET2]

$ 双重签名(O)/SET/一种单一数字签名,通过在单个加密值中包含两个集合的哈希结果来保护两个单独的消息。[SET2]

Deprecated Usage: IDOCs SHOULD NOT use this term except when qualified as "SET(trademark) dual signature" with this definition.


Tutorial: Generated by hashing each message separately, concatenating the two hash results, and then hashing that value and encrypting the result with the signer's private key. Done to reduce the number of encryption operations and to enable verification of data integrity without complete disclosure of the data.


$ dual-use certificate (O) A certificate that is intended for use with both digital signature and data encryption services. [SP32]

$ 两用证书(O)用于数字签名和数据加密服务的证书。[SP32]

Usage: IDOCs that use this term SHOULD state a definition for it by identifying the intended uses of the certificate, because there are more than just these two uses mentioned in the NIST publication. A v3 X.509 public-key certificate may have a "key

用法:使用该术语的IDOC应通过确定证书的预期用途来说明其定义,因为NIST出版物中提到的不仅仅是这两种用途。v3 X.509公钥证书可能具有“密钥”

Usage" extension, which indicates the purposes for which the public key may be used. (See: certificate profile.)


$ duty (I) An attribute of a role that obligates an entity playing the role to perform one or more tasks, which usually are essential for the functioning of the system. [Sand] (Compare authorization, privilege. See: role, billet.)

$ 职责(I)角色的一种属性,该属性要求扮演角色的实体执行一项或多项任务,这些任务通常对系统的运行至关重要。[Sand](比较授权和特权。请参阅:角色和权限。)

$ e-cash (O) Electronic cash; money that is in the form of data and can be used as a payment mechanism on the Internet. (See: IOTP.)

$ 电子现金(O)电子现金;以数据形式存在并可在互联网上用作支付机制的货币。(见:IOTP)

Usage: IDOCs that use this term SHOULD state a definition for it because many different types of electronic cash have been devised with a variety of security mechanisms.


$ EAP (I) See: Extensible Authentication Protocol.

$ EAP(I)见:可扩展认证协议。

$ EAL (O) See: evaluation assurance level.

$ EAL(O)见:评估保证水平。

$ Easter egg (O) "Hidden functionality within an application program, which becomes activated when an undocumented, and often convoluted, set of commands and keystrokes is entered. Easter eggs are typically used to display the credits for the development team and [are] intended to be non-threatening" [SP28], but Easter eggs have the potential to contain malicious code.

$ 复活节彩蛋(O)“应用程序中的隐藏功能,当输入一组未记录且通常复杂的命令和击键时,该功能将被激活。复活节彩蛋通常用于显示开发团队的积分,[被]设计为非威胁性”[SP28],但是复活节彩蛋有可能包含恶意代码。

Deprecated Usage: It is likely that other cultures use different metaphors for this concept. Therefore, to avoid international misunderstanding, IDOCs SHOULD NOT use this term. (See: Deprecated Usage under "Green Book".)


$ eavesdropping (I) Passive wiretapping done secretly, i.e., without the knowledge of the originator or the intended recipients of the communication.

$ 窃听(I)秘密进行的被动窃听,即在通信发端人或预期接收人不知情的情况下进行。

$ ECB (N) See: electronic codebook.

$ 欧洲央行(N)见:电子码本。

$ ECDSA (N) See: Elliptic Curve Digital Signature Algorithm.

$ ECDSA(N)参见:椭圆曲线数字签名算法。

$ economy of alternatives (I) The principle that a security mechanism should be designed to minimize the number of alternative ways of achieving a service. (Compare: economy of mechanism.)

$ 替代方案的经济性(I)安全机制的设计原则应尽量减少实现服务的替代方法的数量。(比较:机制的经济性。)

$ economy of mechanism (I) The principle that a security mechanism should be designed to be as simple as possible, so that (a) the mechanism can be correctly implemented and (b) it can be verified that the operation of the mechanism enforces the system's security policy. (Compare: economy of alternatives, least privilege.)

$ 机制的经济性(I)安全机制应设计为尽可能简单的原则,以便(a)机制能够正确实施,以及(b)能够验证机制的运行是否强制执行系统的安全策略。(比较:替代方案的经济性,最低特权。)

$ ECU (N) See: end cryptographic unit.

$ ECU(N)参见:结束加密单元。

$ EDI (I) See: electronic data interchange.

$ 电子数据交换(一)见:电子数据交换。

$ EDIFACT (N) See: secondary definition under "electronic data interchange".

$ EDIFACT(N)见“电子数据交换”下的二级定义。

$ EE (D) Abbreviation of "end entity" and other terms.

$ EE(D)“最终实体”和其他术语的缩写。

Deprecated Abbreviation: IDOCs SHOULD NOT use this abbreviation; there could be confusion among "end entity", "end-to-end encryption", "escrowed encryption standard", and other terms.


$ EES (O) See: Escrowed Encryption Standard.

$ EES(O)参见:托管加密标准。

$ effective key length (O) "A measure of strength of a cryptographic algorithm, regardless of actual key length." [IATF] (See: work factor.)

$ 有效密钥长度(O)“密码算法强度的度量,与实际密钥长度无关。”[IATF](参见:工作系数。)

$ effectiveness (O) /ITSEC/ A property of a TOE representing how well it provides security in the context of its actual or proposed operational use.

$ 有效性(O)/ITSEC/TOE的一种属性,表示TOE在实际或拟议的操作使用中提供安全性的程度。

$ El Gamal algorithm (N) An algorithm for asymmetric cryptography, invented in 1985 by Taher El Gamal, that is based on the difficulty of calculating discrete logarithms and can be used for both encryption and digital signatures. [ElGa]

$ El-Gamal算法(N):Taher El-Gamal于1985年发明的一种非对称加密算法,该算法基于计算离散对数的困难,可用于加密和数字签名。[ElGa]

$ electronic codebook (ECB) (N) A block cipher mode in which a plaintext block is used directly as input to the encryption algorithm and the resultant output block is used directly as cipher text [FP081]. (See: block cipher, [SP38A].)

$ 电子码本(ECB)(N)一种分组密码模式,其中明文块直接用作加密算法的输入,而生成的输出块直接用作密文[FP081]。(参见:分组密码[SP38A]。)

$ electronic commerce 1. (I) Business conducted through paperless exchanges of information, using electronic data interchange, electronic funds transfer (EFT), electronic mail, computer bulletin boards, facsimile, and other paperless technologies.

$ 电子商务1。(一) 通过无纸信息交换、电子数据交换、电子资金转账(EFT)、电子邮件、计算机公告板、传真和其他无纸技术开展的业务。

2. (O) /SET/ "The exchange of goods and services for payment between the cardholder and merchant when some or all of the transaction is performed via electronic communication." [SET2]

2. (O) /SET/“当部分或全部交易通过电子通信进行时,持卡人和商户之间为支付而交换商品和服务。”[SET2]

$ electronic data interchange (EDI) (I) Computer-to-computer exchange, between trading partners, of business data in standardized document formats.

$ 电子数据交换(EDI)(I)贸易伙伴之间以标准文件格式进行的商业数据的计算机对计算机交换。

Tutorial: EDI formats have been standardized primarily by ANSI X12 and by EDIFACT (EDI for Administration, Commerce, and Transportation), which is an international, UN-sponsored standard primarily used in Europe and Asia. X12 and EDIFACT are aligning to create a single, global EDI standard.

教程:EDI格式主要由ANSI X12和EDIFACT(用于行政、商业和运输的EDI)标准化,这是一种主要在欧洲和亚洲使用的联合国赞助的国际标准。X12和EDIFACT正在联合起来创建一个单一的全球EDI标准。

$ Electronic Key Management System (EKMS) (O) "Interoperable collection of systems developed by ... the U.S. Government to automate the planning, ordering, generating, distributing, storing, filling, using, and destroying of electronic keying material and the management of other types of COMSEC material." [C4009]

$ 电子钥匙管理系统(EKMS)(O)“……美国政府开发的可互操作的系统集合,用于自动规划、订购、生成、分发、存储、填充、使用和销毁电子钥匙材料以及管理其他类型的通信安全材料。”[C4009]

$ electronic signature (D) Synonym for "digital signature" or "digitized signature".

$ 电子签名(D)“数字签名”或“数字签名”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; there is no current consensus on its definition. Instead, use "digital signature", if that is what was intended


$ electronic wallet (D) A secure container to hold, in digitized form, some sensitive data objects that belong to the owner, such as electronic money, authentication material, and various types of personal information. (See: IOTP.)

$ 电子钱包(D):一种安全的容器,以数字化形式存放属于所有者的一些敏感数据对象,如电子货币、身份验证材料和各种类型的个人信息。(见:IOTP)

Deprecated Term: IDOCs SHOULD NOT use this term. There is no current consensus on its definition; and some uses and definitions


may be proprietary. Meanings range from virtual wallets implemented by data structures to physical wallets implemented by cryptographic tokens. (See: Deprecated Usage under "Green Book".)


$ elliptic curve cryptography (ECC) (I) A type of asymmetric cryptography based on mathematics of groups that are defined by the points on a curve, where the curve is defined by a quadratic equation in a finite field. [Schn]

$ 椭圆曲线密码术(ECC)(I)一种基于由曲线上的点定义的群的数学的非对称密码术,其中曲线由有限域中的二次方程定义。[施恩]

Tutorial: ECC is based on mathematics different than that originally used to define the Diffie-Hellman-Merkle algorithm and the DSA, but ECC can be used to define an algorithm for key agreement that is an analog of Diffie-Hellman-Merkle [A9063] and an algorithm for digital signature that is an analog of DSA [A9062]. The mathematical problem upon which ECC is based is believed to be more difficult than the problem upon which Diffie-Hellman-Merkle is based and, therefore, that keys for ECC can be shorter for a comparable level of security. (See: ECDSA.)


$ Elliptic Curve Digital Signature Algorithm (ECDSA) (N) A standard [A9062] that is the analog, in elliptic curve cryptography, of the Digital Signature Algorithm.

$ 椭圆曲线数字签名算法(ECDSA)(N)标准[A9062],在椭圆曲线密码学中模拟数字签名算法。

$ emanation (I) A signal (e.g., electromagnetic or acoustic) that is emitted by a system (e.g., through radiation or conductance) as a consequence (i.e., byproduct) of the system's operation, and that may contain information. (See: emanations security.)

$ 发射(I)系统(例如通过辐射或电导)作为系统运行的结果(即副产品)发射的信号(例如电磁或声学),可能包含信息。(见:放射安全。)

$ emanations analysis (I) /threat action/ See: secondary definition under "interception".

$ 辐射分析(I)/威胁行动/见“拦截”下的二级定义。

$ emanations security (EMSEC) (I) Physical security measures to protect against data compromise that could occur because of emanations that might be received and read by an unauthorized party. (See: emanation, TEMPEST.)

$ 放射安全(EMSEC)(I)物理安全措施,以防止因未经授权方接收和读取放射而可能发生的数据泄露。(见:放射,暴风雨。)

Usage: Refers either to preventing or limiting emanations from a system and to preventing or limiting the ability of unauthorized parties to receive the emissions.


$ embedded cryptography (N) "Cryptography engineered into an equipment or system whose basic function is not cryptographic." [C4009]

$ 嵌入式加密技术(N)“设计成基本功能不是加密的设备或系统的加密技术。”[C4009]

$ emergency plan (D) Synonym for "contingency plan".

$ 应急计划(D)“应急计划”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term. Instead, for neutrality and consistency of language, use "contingency plan".


$ emergency response (O) An urgent response to a fire, flood, civil commotion, natural disaster, bomb threat, or other serious situation, with the intent of protecting lives, limiting damage to property, and minimizing disruption of system operations. [FP087] (See: availability, CERT, emergency plan.)

$ 应急响应(O)对火灾、洪水、内乱、自然灾害、炸弹威胁或其他严重情况的紧急响应,旨在保护生命、限制财产损失并最大限度地减少系统运行中断。[FP087](见:可用性、证书、应急计划)

$ EMSEC (I) See: emanations security.

$ EMSEC(I)见:辐射安全。

$ EMV (N) Abbreviation of "Europay, MasterCard, Visa". Refers to a specification for smart cards that are used as payment cards, and for related terminals and applications. [EMV1, EMV2, EMV3]

$ EMV(N)“Europay、万事达卡、Visa”的缩写。指用作支付卡的智能卡以及相关终端和应用程序的规范。[EMV1、EMV2、EMV3]

$ Encapsulating Security Payload (ESP) (I) An Internet protocol [R2406, R4303] designed to provide data confidentiality service and other security services for IP datagrams. (See: IPsec. Compare: AH.)

$ 封装安全有效载荷(ESP)(I)互联网协议[R2406,R4303],旨在为IP数据报提供数据保密服务和其他安全服务。(请参阅:IPsec。比较:AH)

Tutorial: ESP may be used alone, or in combination with AH, or in a nested fashion with tunneling. Security services can be provided between a pair of communicating hosts, between a pair of communicating security gateways, or between a host and a gateway. The ESP header is encapsulated by the IP header, and the ESP header encapsulates either the upper-layer protocol header (transport mode) or an IP header (tunnel mode). ESP can provide data confidentiality service, data origin authentication service, connectionless data integrity service, an anti-replay service, and limited traffic-flow confidentiality. The set of services depends on the placement of the implementation and on options selected when the security association is established.


$ encipher (D) Synonym for "encrypt".

$ Encrypher(D)“encrypt”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for "encrypt". However, see Usage note under "encryption".


$ encipherment (D) Synonym for "encryption".

$ 加密(D)“加密”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for "encryption". However, see Usage note under "encryption".


$ enclave 1. (I) A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter. (Compare: domain.)

$ 飞地1。(一) 在同一安全域中运行的一组系统资源,它们共享单个、公共、连续安全外围的保护。(比较:域。)

2. (D) /U.S. Government/ "Collection of computing environments connected by one or more internal networks under the control of a single authority and security policy, including personnel and physical security." [C4009]

2. (D) /U.S.Government/“由一个或多个内部网络连接的计算环境的集合,在单一机构和安全政策的控制下,包括人员和物理安全。”[C4009]

Deprecated Definition: IDOCs SHOULD NOT use this term with definition 2 because the definition applies to what is usually called a "security domain". That is, a security domain is a set of one or more security enclaves.


$ encode 1. (I) Use a system of symbols to represent information, which might originally have some other representation. Example: Morse code. (See: ASCII, BER.) (See: code, decode.)

$ 编码1。(一) 使用符号系统来表示信息,这些信息最初可能具有其他表示形式。例子:摩尔斯电码。(参见:ASCII,BER。)(参见:编码,解码。)

2. (D) Synonym for "encrypt".

2. (D) “加密”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term as a synonym for "encrypt"; encoding is not always meant to conceal meaning.


$ encrypt (I) Cryptographically transform data to produce cipher text. (See: encryption. Compare: seal.)

$ 加密(I)以加密方式转换数据以生成密文。(请参见:加密。比较:密封。)

$ encryption 1. (I) Cryptographic transformation of data (called "plain text") into a different form (called "cipher text") that conceals the data's original meaning and prevents the original form from being used. The corresponding reverse process is "decryption", a transformation that restores encrypted data to its original form. (See: cryptography.)

$ 加密1。(一) 将数据(称为“纯文本”)加密转换为另一种形式(称为“密文”),以隐藏数据的原始含义并防止原始形式被使用。相应的反向过程是“解密”,一种将加密数据恢复为原始形式的转换。(请参阅:密码学。)

2. (O) "The cryptographic transformation of data to produce ciphertext." [I7498-2]

2. (O) “对数据进行加密转换以产生密文。”[I7498-2]

Usage: For this concept, IDOCs SHOULD use the verb "to encrypt" (and related variations: encryption, decrypt, and decryption). However, because of cultural biases involving human burial, some international documents (particularly ISO and CCITT standards) avoid "to encrypt" and instead use the verb "to encipher" (and related variations: encipherment, decipher, decipherment).

用法:对于这个概念,idoc应该使用动词“to encrypt”(以及相关变体:encrypt、decrypt和decryption)。然而,由于涉及人类埋葬的文化偏见,一些国际文件(特别是ISO和CCITT标准)避免使用“加密”,而是使用动词“加密”(以及相关变体:加密、解密、解密)。

Tutorial: Usually, the plaintext input to an encryption operation is clear text. But in some cases, the plain text may be cipher text that was output from another encryption operation. (See: superencryption.)


Encryption and decryption involve a mathematical algorithm for transforming data. Besides the data to be transformed, the algorithm has one or more inputs that are control parameters: (a) a key that varies the transformation and, in some cases, (b) an IV that establishes the starting state of the algorithm.


$ encryption certificate (I) A public-key certificate that contains a public key that is intended to be used for encrypting data, rather than for verifying digital signatures or performing other cryptographic functions.

$ 加密证书(I)包含公钥的公钥证书,用于加密数据,而不是验证数字签名或执行其他加密功能。

Tutorial: A v3 X.509 public-key certificate may have a "keyUsage" extension that indicates the purpose for which the certified public key is intended. (See: certificate profile.)

教程:v3 X.509公钥证书可能有一个“keyUsage”扩展名,用于指示认证公钥的用途。(请参阅:证书配置文件。)

$ end cryptographic unit (ECU) 1. (N) Final destination device into which a key is loaded for operational use.

$ 结束加密单元(ECU)1。(N) 将密钥加载到其中以供操作使用的最终目标设备。

2. (N) A device that (a) performs cryptographic functions, (b) typically is part of a larger system for which the device provides security services, and (c), from the viewpoint of a supporting security infrastructure such as a key management system, is the lowest level of identifiable component with which a management transaction can be conducted

2. (N) 设备(A)执行加密功能,(b)通常是设备提供安全服务的较大系统的一部分,并且(c)从诸如密钥管理系统之类的支持安全基础设施的观点来看,是可用于执行管理事务的最低级别的可识别组件

$ end entity 1. (I) A system entity that is the subject of a public-key certificate and that is using, or is permitted and able to use, the matching private key only for purposes other than signing a digital certificate; i.e., an entity that is not a CA.

$ 结束实体1。(一) 作为公钥证书主体的系统实体,且仅出于签署数字证书以外的目的使用或允许并能够使用匹配私钥;i、 例如,不是CA的实体。

2. (O) "A certificate subject [that] uses its public [sic] key for purposes other than signing certificates." [X509]

2. (O) “将其公钥[sic]用于证书签名以外的目的的证书主体。”[X509]

Deprecated Definition: IDOCs SHOULD NOT use definition 2, which is misleading and incomplete. First, that definition should have said "private key" rather than "public key" because certificates are not usefully signed with a public key. Second, the X.509 definition is ambiguous regarding whether an end entity may or may not use the private key to sign a certificate, i.e., whether the subject may be a CA. The intent of X.509's authors was that an end entity certificate is not valid for use in verifying a signature


on an X.509 certificate or X.509 CRL. Thus, it would have been better for the X.509 definition to have said "only for purposes other than signing certificates".

在X.509证书或X.509 CRL上。因此,如果X.509定义中说“仅用于签署证书以外的目的”,则更好。

Usage: Despite the problems in the X.509 definition, the term itself is useful in describing applications of asymmetric cryptography. The way the term is used in X.509 implies that it was meant to be defined, as we have done here, relative to roles that an entity (which is associated with an OSI end system) is playing or is permitted to play in applications of asymmetric cryptography other than the PKI that supports applications.


Tutorial: Whether a subject can play both CA and non-CA roles, with either the same or different certificates, is a matter of policy. (See: CPS.) A v3 X.509 public-key certificate may have a "basicConstraints" extension containing a "cA" value that specifically "indicates whether or not the public key may be used to verify certificate signatures". (See: certificate profile.)

教程:主题是否可以使用相同或不同的证书同时扮演CA和非CA角色是一个政策问题。(请参阅:CPS。)v3 X.509公钥证书可能有一个“basicConstraints”扩展,其中包含一个“cA”值,该值专门“指示公钥是否可用于验证证书签名”。(请参阅:证书配置文件。)

$ end system (N) /OSIRM/ A computer that implements all seven layers of the OSIRM and may attach to a subnetwork. Usage: In the IPS context, an end system is called a "host".

$ 终端系统(N)/OSIRM/实现所有七层OSIRM并可连接到子网络的计算机。用法:在IPS上下文中,终端系统称为“主机”。

$ end-to-end encryption (I) Continuous protection of data that flows between two points in a network, effected by encrypting data when it leaves its source, keeping it encrypted while it passes through any intermediate computers (such as routers), and decrypting it only when it arrives at the intended final destination. (See: wiretapping. Compare: link encryption.)

$ 端到端加密(I)对网络中两点之间流动的数据的连续保护,通过在数据离开源时加密数据、在数据通过任何中间计算机(如路由器)时保持加密以及仅在数据到达预定最终目的地时解密来实现。(请参见:窃听。比较:链接加密。)



Tutorial: When two points are separated by multiple communication links that are connected by one or more intermediate relays, end-to-end encryption enables the source and destination systems to protect their communications without depending on the intermediate systems to provide the protection.


$ end user 1. (I) /information system/ A system entity, usually a human individual, that makes use of system resources, primarily for application purposes as opposed to system management purposes.

$ 最终用户1。(一) /信息系统/利用系统资源的系统实体,通常是个人,主要用于应用目的而非系统管理目的。

2. (D) /PKI/ Synonym for "end entity".

2. (D) /PKI/是“最终实体”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use "end user" as a synonym for "end entity", because that would mix concepts in a potentially misleading way.


$ endorsed-for-unclassified cryptographic item (EUCI) (O) /U.S. Government/ "Unclassified cryptographic equipment that embodies a U.S. Government classified cryptographic logic and is endorsed by NSA for the protection of national security information." [C4009] (Compare: CCI, type 2 product.)

$ 为非保密密码项目(EUCI)(O)/美国政府/背书“包含美国政府保密密码逻辑并由NSA背书用于保护国家安全信息的非保密密码设备”。[C4009](比较:CCI,2类产品。)

$ entity See: system entity.

$ 实体请参见:系统实体。

$ entrapment (I) "The deliberate planting of apparent flaws in a system for the purpose of detecting attempted penetrations or confusing an intruder about which flaws to exploit." [FP039] (See: honey pot.)

$ 诱捕(I)“故意在系统中植入明显的缺陷,以检测企图的渗透或混淆入侵者利用哪些缺陷。”[FP039](见:蜜罐)

$ entropy 1. (I) An information-theoretic measure (usually stated as a number of bits) of the amount of uncertainty that an attacker faces to determine the value of a secret. [SP63] (See: strength.)

$ 熵1。(一) 攻击者在确定秘密价值时所面临的不确定性量的信息论度量(通常以位数表示)。[SP63](见:强度)

Example: If a password is said to contain at least 20 bits of entropy, that means that it must be as hard to find the password as to guess a 20-bit random number.


2. (I) An information-theoretic measure (usually stated as a number of bits) of the amount of information in a message; i.e., the minimum number of bits needed to encode all possible meanings of that message. [Schn] (See: uncertainty.)

2. (一) 消息中信息量的信息论度量(通常表示为位数);i、 例如,对该消息的所有可能含义进行编码所需的最小位数。[Schn](见:不确定性)

$ ephemeral (I) /adjective/ Refers to a cryptographic key or other cryptographic parameter or data object that is short-lived, temporary, or used one time. (See: session key. Compare: static.)

$ 短暂的(I)/形容词/指的是一个密码密钥或其他密码参数或数据对象,它是短暂的、临时的或一次性使用的。(请参阅:会话密钥。比较:静态。)

$ erase 1. (I) Delete stored data. (See: sanitize, zeroize.)

$ 删除1。(一) 删除存储的数据。(请参见:消毒、归零。)

2. (O) /U.S. Government/ Delete magnetically stored data in such a way that the data cannot be recovered by ordinary means, but might be recoverable by laboratory methods. [C4009] (Compare: /U.S. Government/ purge.)

2. (O) /U.S.Government/删除磁存储数据时,应确保数据无法通过普通方式恢复,但可以通过实验室方法恢复。[C4009](比较:/清除)

$ error detection code (I) A checksum designed to detect, but not correct, accidental (i.e., unintentional) changes in data.

$ 错误检测代码(I)一种校验和,用于检测但不纠正数据中的意外(即无意)更改。

$ Escrowed Encryption Standard (EES) (N) A U.S. Government standard [FP185] that specifies how to use a symmetric encryption algorithm (SKIPJACK) and create a Law Enforcement Access Field (LEAF) for implementing part of a key escrow system that enables decryption of telecommunications when interception is lawfully authorized.

$ 托管加密标准(EES)(N)美国政府标准[FP185],规定如何使用对称加密算法(SKIPJACK)并创建执法访问字段(LEAF),以实现密钥托管系统的一部分,该系统在合法授权拦截时能够对电信进行解密。

Tutorial: Both SKIPJACK and the LEAF are intended for use in equipment used to encrypt and decrypt sensitive, unclassified, telecommunications data.


$ ESP (I) See: Encapsulating Security Payload.

$ ESP(I)见:封装安全有效负载。

$ Estelle (N) A language (ISO 9074-1989) for formal specification of computer network protocols.

$ Estelle(N):一种用于计算机网络协议形式规范的语言(ISO 9074-1989)。

$ ETSI (N) See: European Telecommunication Standards Institute.

$ ETSI(N)见:欧洲电信标准协会。

$ EUCI (O) See: endorsed-for-unclassified cryptographic item.

$ EUCI(O)见:未分类密码项目背书。

$ European Telecommunication Standards Institute (ETSI) (N) An independent, non-profit organization, based in France, that is officially recognized by the European Commission and responsible for standardization of information and communication technologies within Europe.

$ 欧洲电信标准协会(ETSI)(N):一个独立的非营利组织,总部设在法国,经欧盟委员会正式认可,负责欧洲内部信息和通信技术的标准化。

Tutorial: ETSI maintains the standards for a number of security algorithms, including encryption algorithms for mobile telephone systems in Europe.


$ evaluated system (I) A system that has been evaluated against security criteria (for example, against the TCSEC or against a profile based on the Common Criteria).

$ 评估系统(I)根据安全标准(例如,根据TCSEC或基于通用标准的概要文件)进行评估的系统。

$ evaluation (I) Assessment of an information system against defined security criteria (for example, against the TCSEC or against a profile based on the Common Criteria). (Compare: certification.)

$ 评估(I)根据定义的安全标准(例如,根据TCSEC或基于通用标准的概要文件)对信息系统进行评估。(比较:认证。)

$ evaluation assurance level (EAL) (N) A predefined package of assurance components that represents a point on the Common Criteria's scale for rating confidence in the security of information technology products and systems.

$ 评估保证级别(EAL)(N)一个预定义的保证组件包,代表信息技术产品和系统安全性的通用标准等级上的一个点。

Tutorial: The Common Criteria defines a scale of seven, hierarchically ordered EALs for rating a TOE. From highest to lowest, they are as follows: - EAL7. Formally verified design and tested. - EAL6. Semiformally verified design and tested. - EAL5. Semiformally designed and tested. - EAL4. Methodically designed, tested, and reviewed. - EAL3. Methodically tested and checked. - EAL2. Structurally tested. - EAL1. Functionally tested.


An EAL is a consistent, baseline set of requirements. The increase in assurance from EAL to EAL is accomplished by substituting higher assurance components (i.e., criteria of increasing rigor, scope, or depth) from seven assurance classes: (a) configuration management, (b) delivery and operation, (c) development, (d) guidance documents, (e) lifecycle support, (f) tests, and (g) vulnerability assessment.


The EALs were developed with the goal of preserving concepts of assurance that were adopted from earlier criteria, so that results of previous evaluations would remain relevant. For example, EALs levels 2-7 are generally equivalent to the assurance portions of the TCSEC C2-A1 scale. However, this equivalency should be used with caution. The levels do not derive assurance in the same manner, and exact mappings do not exist.

制定EAL的目的是保留从早期标准中采用的保证概念,以便先前评估的结果保持相关性。例如,EALs等级2-7通常相当于TCSEC C2-A1等级的保证部分。但是,应谨慎使用这种等效性。级别不以相同的方式派生保证,并且不存在精确的映射。

$ expire (I) /credential/ Cease to be valid (i.e., change from being valid to being invalid) because its assigned lifetime has been exceeded. (See: certificate expiration.)

$ 过期(I)/凭证/不再有效(即从有效更改为无效),因为已超过其分配的生存期。(请参阅:证书到期。)

$ exposure (I) A type of threat action whereby sensitive data is directly released to an unauthorized entity. (See: unauthorized disclosure.)

$ 暴露(I)一种威胁行为,即敏感数据直接发布给未经授权的实体。(请参阅:未经授权的披露。)

Usage: This type of threat action includes the following subtypes: - "Deliberate Exposure": Intentional release of sensitive data to an unauthorized entity. - "Scavenging": Searching through data residue in a system to gain unauthorized knowledge of sensitive data. - "Human error": /exposure/ Human action or inaction that unintentionally results in an entity gaining unauthorized knowledge of sensitive data. (Compare: corruption, incapacitation.) - "Hardware or software error": /exposure/ System failure that unintentionally results in an entity gaining unauthorized


knowledge of sensitive data. (Compare: corruption, incapacitation.)


$ Extended Security Option (I) See: secondary definition under "IPSO".

$ 扩展安全选项(I)见“IPSO”下的二级定义。

$ Extensible Authentication Protocol (EAP) (I) An extension framework for PPP that supports multiple, optional authentication mechanisms, including cleartext passwords, challenge-response, and arbitrary dialog sequences. [R3748] (Compare: GSS-API, SASL.)

$ 可扩展身份验证协议(EAP)(I)PPP的扩展框架,支持多种可选身份验证机制,包括明文密码、质询响应和任意对话序列。[R3748](比较:GSS-API和SASL。)

Tutorial: EAP typically runs directly over IPS data link protocols or OSIRM Layer 2 protocols, i.e., without requiring IP. Originally, EAP was developed for use in PPP, by a host or router that connects to a network server via switched circuits or dial-up lines. Today, EAP's domain of applicability includes other areas of network access control; it is used in wired and wireless LANs with IEEE 802.1X, and in IPsec with IKEv2. EAP is conceptually related to other authentication mechanism frameworks, such as SASL and GSS-API.

教程:EAP通常直接在IPS数据链路协议或OSIRM第2层协议上运行,即不需要IP。最初,EAP是为PPP开发的,由主机或路由器通过交换电路或拨号线路连接到网络服务器。今天,EAP的适用范围包括网络访问控制的其他领域;它用于具有IEEE 802.1X的有线和无线局域网,以及具有IKEv2的IPsec。EAP在概念上与其他身份验证机制框架相关,如SASL和GSS-API。

$ Extensible Markup Language (XML) (N) A version of Standard Generalized Markup Language (ISO 8879) that separately represents a document's content and its structure. XML was designed by W3C for use on the World Wide Web.

$ 可扩展标记语言(XML)(N):标准通用标记语言(ISO 8879)的一个版本,分别表示文档的内容及其结构。XML由W3C设计用于万维网。

$ extension (I) /protocol/ A data item or a mechanism that is defined in a protocol to extend the protocol's basic or original functionality.

$ 扩展(I)/协议/协议中定义的数据项或机制,用于扩展协议的基本或原始功能。

Tutorial: Many protocols have extension mechanisms, and the use of these extension is usually optional. IP and X.509 are two examples of protocols that have optional extensions. In IP version 4, extensions are called "options", and some of the options have security purposes (see: IPSO).


In X.509, certificate and CRL formats can be extended to provide methods for associating additional attributes with subjects and public keys and for managing a certification hierarchy: - A "certificate extension": X.509 defines standard extensions that may be included in v3 certificates to provide additional key and security policy information, subject and issuer attributes, and certification path constraints. - A "CRL extension": X.509 defines extensions that may be included in v2 CRLs to provide additional issuer key and name information, revocation reasons and constraints, and information about distribution points and delta CRLs.

在X.509中,可以扩展证书和CRL格式,以提供将附加属性与主题和公钥关联以及管理证书层次结构的方法:-“证书扩展”:X.509定义了v3证书中可能包含的标准扩展,以提供附加密钥和安全策略信息,主题和颁发者属性,以及认证路径约束。-“CRL扩展”:X.509定义了可能包含在v2 CRL中的扩展,以提供额外的颁发者密钥和名称信息、撤销原因和约束,以及有关分发点和增量CRL的信息。

- A "private extension": Additional extensions, each named by an OID, can be locally defined as needed by applications or communities. (See: Authority Information Access extension, SET private extensions.)

- “私有扩展”:附加扩展,每个扩展由OID命名,可以根据应用程序或社区的需要在本地定义。(请参见:权限信息访问扩展,设置专用扩展。)

$ external controls (I) /COMPUSEC/ Refers to administrative security, personnel security, and physical security. (Compare: internal controls.)

$ 外部控制(I)/COMPUSEC/指管理安全、人员安全和物理安全。(比较:内部控制。)

$ extranet (I) A computer network that an organization uses for application data traffic between the organization and its business partners. (Compare: intranet.)

$ 外部网(I)一个组织用于组织与其业务伙伴之间的应用程序数据通信的计算机网络。(比较:内部网。)

Tutorial: An extranet can be implemented securely, either on the Internet or using Internet technology, by constructing the extranet as a VPN.


$ extraction resistance (O) Ability of cryptographic equipment to resist efforts to extract keying material directly from the equipment (as opposed to gaining knowledge of keying material by cryptanalysis). [C4009]

$ 抗提取能力(O):加密设备抵抗直接从设备中提取密钥材料的能力(与通过密码分析获取密钥材料的知识相反)。[C4009]

$ extrusion detection (I) Monitoring for unauthorized transfers of sensitive information and other communications that originate inside a system's security perimeter and are directed toward the outside; i.e., roughly the opposite of "intrusion detection".

$ 挤出检测(I)监控敏感信息和其他通信的未经授权传输,这些信息和通信源自系统的安全周界内部,并指向外部;i、 与“入侵检测”大致相反。

$ fail-safe 1. (I) Synonym for "fail-secure".

$ 故障安全1。(一) “故障保护”的同义词。

2. (I) A mode of termination of system functions that prevents damage to specified system resources and system entities (i.e., specified data, property, and life) when a failure occurs or is detected in the system (but the failure still might cause a security compromise). (See: failure control.)

2. (一) 系统功能的一种终止模式,当系统发生故障或检测到故障(但故障仍可能导致安全隐患)时,可防止对指定的系统资源和系统实体(即指定的数据、属性和寿命)造成损坏。(请参阅:故障控制。)

Tutorial: Definitions 1 and 2 are opposing design alternatives. Therefore, IDOCs SHOULD NOT use this term without providing a definition for it. If definition 1 is intended, IDOCs can avoid ambiguity by using "fail-secure" instead.


$ fail-secure (I) A mode of termination of system functions that prevents loss of secure state when a failure occurs or is detected in the system (but the failure still might cause damage to some system resource or system entity). (See: failure control. Compare: fail-safe.)

$ 故障保护(I)当系统发生故障或检测到故障时(但故障仍可能导致某些系统资源或系统实体损坏),系统功能终止的一种模式,可防止失去安全状态。(请参阅:故障控制。比较:故障安全。)

$ fail-soft (I) Selective termination of affected, non-essential system functions when a failure occurs or is detected in the system. (See: failure control.)

$ 故障软(I)当系统发生故障或检测到故障时,选择性终止受影响的非必要系统功能。(请参阅:故障控制。)

$ failure control (I) A methodology used to provide fail-safe, fail-secure or fail-soft termination and recovery of system functions. [FP039]

$ 故障控制(I)用于提供系统功能的故障安全、故障安全或故障软终止和恢复的方法。[FP039]

$ fairness (I) A property of an access protocol for a system resource whereby the resource is made equitably or impartially available to all eligible users. (RFC 3753)

$ 公平性(I)系统资源访问协议的一种属性,通过该属性,所有合格用户都可以公平或公正地使用该资源。(RFC 3753)

Tutorial: Fairness can be used to defend against some types of denial-of-service attacks on a system connected to a network. However, this technique assumes that the system can properly receive and process inputs from the network. Therefore, the technique can mitigate flooding but is ineffective against jamming.


$ falsification (I) A type of threat action whereby false data deceives an authorized entity. (See: active wiretapping, deception.)

$ 伪造(I)虚假数据欺骗授权实体的一种威胁行为。(参见:主动窃听、欺骗。)

Usage: This type of threat action includes the following subtypes: - "Substitution": Altering or replacing valid data with false data that serves to deceive an authorized entity. - "Insertion": Introducing false data that serves to deceive an authorized entity.


$ fault tree (I) A branching, hierarchical data structure that is used to represent events and to determine the various combinations of component failures and human acts that could result in a specified undesirable system event. (See: attack tree, flaw hypothesis methodology.)

$ 故障树(I)一种分支、分层数据结构,用于表示事件,并确定可能导致特定不良系统事件的组件故障和人为行为的各种组合。(参见:攻击树,缺陷假设方法。)

Tutorial: "Fault-tree analysis" is a technique in which an undesired state of a system is specified and the system is studied in the context of its environment and operation to find all credible ways in which the event could occur. The specified fault event is represented as the root of the tree. The remainder of the tree represents AND or OR combinations of subevents, and sequential combinations of subevents, that could cause the root event to occur. The main purpose of a fault-tree analysis is to calculate the probability of the root event, using statistics or other analytical methods and incorporating actual or predicted


quantitative reliability and maintainability data. When the root event is a security violation, and some of the subevents are deliberate acts intended to achieve the root event, then the fault tree is an attack tree.


$ FEAL (O) A family of symmetric block ciphers that was developed in Japan; uses a 64-bit block, keys of either 64 or 128 bits, and a variable number of rounds; and has been successfully attacked by cryptanalysts. [Schn]

$ FEAL(O)一个在日本发展起来的对称分组密码家族;使用64位块、64位或128位密钥以及可变轮数;并且被密码分析人员成功攻击。[施恩]

$ Federal Information Processing Standards (FIPS) (N) The Federal Information Processing Standards Publication (FIPS PUB) series issued by NIST under the provisions of Section 111(d) of the Federal Property and Administrative Services Act of 1949 as amended by the Computer Security Act of 1987 (Public Law 100-235) as technical guidelines for U.S. Government procurements of information processing system equipment and services. (See: "[FPxxx]" items in Section 7, Informative References.)

$ 联邦信息处理标准(FIPS)(N)NIST根据《1949年联邦财产和行政服务法》第111(d)节的规定发布的联邦信息处理标准出版物(FIPS PUB)系列,经1987年《计算机安全法》(公法100-235)修订作为美国政府采购信息处理系统设备和服务的技术指南。(见第7节“参考资料”中的“[FPxxx]”项。)

$ Federal Public-key Infrastructure (FPKI) (O) A PKI being planned to establish facilities, specifications, and policies needed by the U.S. Government to use public-key certificates in systems involving unclassified but sensitive applications and interactions between Federal agencies as well as with entities of state and local governments, the business community, and the public. [FPKI]

$ 联邦公钥基础设施(FPKI)(O)计划建立美国政府所需的设施、规范和政策的PKI,以在涉及非保密但敏感应用程序的系统中使用公钥证书,以及联邦机构之间以及与州和地方政府实体之间的交互,商界和公众。[FPKI]

$ Federal Standard 1027 (N) An U.S. Government document defining emanation, anti-tamper, security fault analysis, and manual key management criteria for DES encryption devices, primary for OSIRM Layer 2. Was renamed "FIPS PUB 140" when responsibility for protecting unclassified, sensitive information was transferred from NSA to NIST, and has since been superseded by newer versions of that standard [FP140].

$ 联邦标准1027(N)美国政府文件,定义DES加密设备的发射、防篡改、安全故障分析和手动密钥管理标准,主要用于OSIRM第2层。当保护非机密敏感信息的责任从NSA转移到NIST时,更名为“FIPS PUB 140”,此后被该标准的更新版本取代[FP140]。

$ File Transfer Protocol (FTP) (I) A TCP-based, Application-Layer, Internet Standard protocol (RFC 959) for moving data files from one computer to another.

$ 文件传输协议(FTP)(I)基于TCP的应用层互联网标准协议(RFC 959),用于将数据文件从一台计算机移动到另一台计算机。

$ fill device (N) /COMSEC/ A device used to transfer or store keying material in electronic form or to insert keying material into cryptographic equipment.

$ 填充装置(N)/COMSEC/用于以电子形式传输或存储密钥材料或将密钥材料插入加密设备的装置。

$ filter 1. (I) /noun/ Synonym for "guard". (Compare: content filter, filtering router.)

$ 过滤器1。(一) /名词/同义词“警卫”。(比较:内容过滤器、过滤路由器。)

2. (I) /verb/ To process a flow of data and selectively block passage or permit passage of individual data items according to a security policy.

2. (一) /verb/处理数据流,并根据安全策略有选择地阻止或允许单个数据项的通过。

$ filtering router (I) An internetwork router that selectively prevents the passage of data packets according to a security policy. (See: guard.)

$ 过滤路由器(I)根据安全策略有选择地防止数据包通过的网络间路由器。(请参阅:防护罩。)

Tutorial: A router usually has two or more physical connections to networks or other systems; and when the router receives a packet on one of those connections, it forwards the packet on a second connection. A filtering router does the same; but it first decides, according to some security policy, whether the packet should be forwarded at all. The policy is implemented by rules (packet filters) loaded into the router. The rules mostly involve values of data packet control fields (especially IP source and destination addresses and TCP port numbers) [R2179]. A filtering router may be used alone as a simple firewall or be used as a component of a more complex firewall.


$ financial institution (N) "An establishment responsible for facilitating customer-initiated transactions or transmission of funds for the extension of credit or the custody, loan, exchange, or issuance of money." [SET2]

$ 金融机构(N)“负责促进客户发起的交易或资金传输的机构,用于扩展信贷或保管、贷款、交换或发行货币。”[SET2]

$ fingerprint 1. (I) A pattern of curves formed by the ridges on a fingertip. (See: biometric authentication. Compare: thumbprint.)

$ 指纹1。(一) 由指尖上的脊线形成的曲线图案。(请参阅:生物特征认证。比较:指纹。)

2. (D) /PGP/ A hash result ("key fingerprint") used to authenticate a public key or other data. [PGP]

2. (D) /PGP/用于验证公钥或其他数据的哈希结果(“密钥指纹”)。[PGP]

Deprecated Definition: IDOCs SHOULD NOT use this term with definition 2, and SHOULD NOT use this term as a synonym for "hash result" of *any* kind. Either use would mix concepts in a potentially misleading way.


$ FIPS (N) See: Federal Information Processing Standards.

$ FIPS(N)参见:联邦信息处理标准。

$ FIPS PUB 140 (N) The U.S. Government standard [FP140] for security requirements to be met by a cryptographic module when the module is used to protect unclassified information in computer and communication systems. (See: Common Criteria, FIPS, Federal Standard 1027.)

$ FIPS PUB 140(N)美国政府标准[FP140],当密码模块用于保护计算机和通信系统中的非保密信息时,密码模块应满足安全要求。(见:通用标准、FIPS、联邦标准1027。)

Tutorial: The standard specifies four increasing levels (from "Level 1" to "Level 4") of requirements to cover a wide range of potential applications and environments. The requirements address basic design and documentation, module interfaces, authorized roles and services, physical security, software security, operating system security, key management, cryptographic algorithms, electromagnetic interference and electromagnetic compatibility (EMI/EMC), and self-testing. NIST and the Canadian Communication Security Establishment jointly certify modules.


$ FIREFLY (O) /U.S. Government/ "Key management protocol based on public-key cryptography." [C4009]

$ FIREFLY(O)/美国政府/“基于公钥加密的密钥管理协议。”[C4009]

$ firewall 1. (I) An internetwork gateway that restricts data communication traffic to and from one of the connected networks (the one said to be "inside" the firewall) and thus protects that network's system resources against threats from the other network (the one that is said to be "outside" the firewall). (See: guard, security gateway.)

$ 防火墙1。(一) 一种网络间网关,用于限制与一个已连接网络(称为“防火墙内”的网络)之间的数据通信流量,从而保护该网络的系统资源免受来自另一个网络(称为“防火墙外”的网络)的威胁。(请参阅:警卫,安全网关。)

2. (O) A device or system that controls the flow of traffic between networks using differing security postures. [SP41]

2. (O) 一种设备或系统,使用不同的安全姿态控制网络之间的流量。[SP41]

Tutorial: A firewall typically protects a smaller, secure network (such as a corporate LAN, or even just one host) from a larger network (such as the Internet). The firewall is installed at the point where the networks connect, and the firewall applies policy rules to control traffic that flows in and out of the protected network.


A firewall is not always a single computer. For example, a firewall may consist of a pair of filtering routers and one or more proxy servers running on one or more bastion hosts, all connected to a small, dedicated LAN (see: buffer zone) between the two routers. The external router blocks attacks that use IP to break security (IP address spoofing, source routing, packet fragments), while proxy servers block attacks that would exploit a vulnerability in a higher-layer protocol or service. The internal router blocks traffic from leaving the protected network except through the proxy servers. The difficult part is defining criteria by which packets are denied passage through the firewall, because a firewall not only needs to keep unauthorized traffic (i.e., intruders) out, but usually also needs to let authorized traffic pass both in and out.


$ firmware (I) Computer programs and data stored in hardware -- typically in read-only memory (ROM) or programmable read-only memory (PROM) -- such that the programs and data cannot be dynamically written or modified during execution of the programs. (See: hardware, software.)

$ 固件(I)存储在硬件中的计算机程序和数据——通常存储在只读存储器(ROM)或可编程只读存储器(PROM)中——使得程序和数据在程序执行期间不能动态写入或修改。(请参阅:硬件、软件。)

$ FIRST (N) See: Forum of Incident Response and Security Teams.

$ 第一(N)见:事件响应和安全团队论坛。

$ flaw 1. (I) An error in the design, implementation, or operation of an information system. A flaw may result in a vulnerability. (Compare: vulnerability.)

$ 缺陷1。(一) 信息系统设计、实施或操作中的错误。缺陷可能会导致漏洞。(比较:漏洞。)

2. (D) "An error of commission, omission, or oversight in a system that allows protection mechanisms to be bypassed." [NCSSG] (Compare: vulnerability. See: brain-damaged.)

2. (D) “在允许绕过保护机制的系统中,由于疏忽、疏忽或疏忽造成的错误。”[NCSSG](比较:脆弱性。参见:大脑受损。)

Deprecated Definition: IDOCs SHOULD NOT use this term with definition 2; not every flaw is a vulnerability.


$ flaw hypothesis methodology (I) An evaluation or attack technique in which specifications and documentation for a system are analyzed to hypothesize flaws in the system. The list of hypothetical flaws is prioritized on the basis of the estimated probability that a flaw exists and, assuming it does, on the ease of exploiting it and the extent of control or compromise it would provide. The prioritized list is used to direct a penetration test or attack against the system. [NCS04] (See: fault tree, flaw.)

$ 缺陷假设方法(I)一种评估或攻击技术,其中对系统的规范和文档进行分析,以假设系统中存在缺陷。假设缺陷列表根据缺陷存在的估计概率和(假设存在)利用缺陷的难易程度以及控制或妥协的程度进行优先排序。优先列表用于指导针对系统的渗透测试或攻击。[NCS04](参见:故障树、缺陷)

$ flooding 1. (I) An attack that attempts to cause a failure in a system by providing more input than the system can process properly. (See: denial of service, fairness. Compare: jamming.)

$ 洪水1。(一) 试图通过提供超出系统正常处理范围的输入而导致系统故障的一种攻击。(请参阅:拒绝服务,公平性。比较:干扰。)

Tutorial: Flooding uses "overload" as a type of "obstruction" intended to cause "disruption".


2. (I) The process of delivering data or control messages to every node of a network. (RFC 3753)

2. (一) 向网络的每个节点传送数据或控制信息的过程。(RFC 3753)

$ flow analysis (I) An analysis performed on a nonprocedural, formal, system specification that locates potential flows of information between system variables. By assigning security levels to the variables, the analysis can find some types of covert channels. [Huff]

$ 流程分析(I)对非程序、正式的系统规范进行的分析,确定系统变量之间的潜在信息流。通过为变量分配安全级别,分析可以发现某些类型的隐蔽通道。[怒火]

$ flow control 1. (I) /data security/ A procedure or technique to ensure that information transfers within a system are not made from one security level to another security level, and especially not from a higher level to a lower level. [Denns] (See: covert channel, confinement property, information flow policy, simple security property.)

$ 流量控制1。(一) /数据安全性/确保系统内的信息传输不会从一个安全级别传输到另一个安全级别,特别是不会从较高级别传输到较低级别的程序或技术。[Denns](请参阅:隐蔽通道、限制属性、信息流策略、简单安全属性。)

2. (O) /data security/ "A concept requiring that information transfers within a system be controlled so that information in certain types of objects cannot, via any channel within the system, flow to certain other types of objects." [NCSSG]

2. (O) /data security/“一种概念,要求控制系统内的信息传输,使某些类型对象中的信息不能通过系统内的任何通道流向某些其他类型的对象。”[NCSSG]

$ For Official Use Only (FOUO) (O) /U.S. DoD/ A U.S. Government designation for information that has not been given a security classification pursuant to the criteria of an Executive Order dealing with national security, but which may be withheld from the public because disclosure would cause a foreseeable harm to an interest protected by one of the exemptions stated in the Freedom of Information Act (Section 552 of title 5, United States Code). (See: security label, security marking. Compare: classified.)

$ 仅供官方使用(FOUO)(O)/美国国防部/美国政府指定,用于未根据涉及国家安全的行政命令标准进行安全分类的信息,但由于披露会对受《信息自由法》(美国法典第5编第552节)所述豁免之一保护的利益造成可预见的损害,因此可能会对公众隐瞒。(参见:安全标签、安全标记。比较:分类。)

$ formal (I) Expressed in a restricted syntax language with defined semantics based on well-established mathematical concepts. [CCIB] (Compare: informal, semiformal.)

$ 形式(I)用受限语法语言表示,语义定义基于成熟的数学概念。[CCIB](比较:非正式、半正式。)

$ formal access approval (O) /U.S. Government/ Documented approval by a data owner to allow access to a particular category of information in a system. (See: category.)

$ 正式访问批准(O)/美国政府/数据所有者书面批准,允许访问系统中特定类别的信息。(请参阅:类别。)

$ Formal Development Methodology (O) See: Ina Jo.

$ 正式开发方法(O)见:Ina Jo。

$ formal model (I) A security model that is formal. Example: Bell-LaPadula model. [Land] (See: formal, security model.)

$ 形式模型(I)形式化的安全模型。示例:贝尔-拉帕杜拉模型。[土地](见:正式的安全模型。)

$ formal proof (I) "A complete and convincing mathematical argument, presenting the full logical justification for each step in the proof, for the truth of a theorem or set of theorems." [NCSSG]

$ 形式证明(I)“一个完整且令人信服的数学论证,为证明中的每一步提供完整的逻辑证明,证明一个定理或一组定理的真理。”[NCSSG]

$ formal specification (I) A precise description of the (intended) behavior of a system, usually written in a mathematical language, sometimes for the

$ 形式规范(I)系统(预期)行为的精确描述,通常用数学语言编写,有时用于

purpose of supporting formal verification through a correctness proof. [Huff] (See: Affirm, Gypsy, HDM, Ina Jo.) (See: formal.)

通过正确性证明支持形式验证的目的。[Huff](参见:确认、吉普赛、HDM、Ina Jo)(参见:正式)

Tutorial: A formal specification can be written at any level of detail but is usually a top-level specification.


$ formal top-level specification (I) "A top-level specification that is written in a formal mathematical language to allow theorems showing the correspondence of the system specification to its formal requirements to be hypothesized and formally proven." [NCS04] (See: formal specification.)

$ 正式顶层规范(I)“以正式数学语言编写的顶层规范,允许假设和正式证明表明系统规范与其正式需求对应关系的定理。”[NCS04](见:正式规范。)

$ formulary (I) A technique for enabling a decision to grant or deny access to be made dynamically at the time the access is attempted, rather than earlier when an access control list or ticket is created.

$ 公式集(I)一种技术,用于在尝试访问时,而不是在创建访问控制列表或票证之前,动态做出授予或拒绝访问的决定。

$ FORTEZZA(trademark) (O) A registered trademark of NSA, used for a family of interoperable security products that implement a NIST/NSA-approved suite of cryptographic algorithms for digital signature, hash, encryption, and key exchange. The products include a PC card (which contains a CAPSTONE chip), and compatible serial port modems, server boards, and software implementations.

$ FORTEZZA(商标)(O)NSA的注册商标,用于实现NIST/NSA批准的用于数字签名、哈希、加密和密钥交换的加密算法套件的可互操作安全产品系列。这些产品包括一个PC卡(包含一个CAPSTONE芯片)、兼容的串行端口调制解调器、服务器板和软件实现。

$ Forum of Incident Response and Security Teams (FIRST) (N) An international consortium of CSIRTs (e.g., CIAC) that work together to handle computer security incidents and promote preventive activities. (See: CSIRT, security incident.)

$ 事件响应和安全团队论坛(第一)(N)CSIRT的国际联盟(如CIAC),共同处理计算机安全事件并促进预防活动。(参见:CSIRT,安全事件)

Tutorial: FIRST was founded in 1990 and, as of July 2004, had more than 100 members spanning the globe. Its mission includes: - Provide members with technical information, tools, methods, assistance, and guidance. - Coordinate proactive liaison activities and analytical support. - Encourage development of quality products and services. - Improve national and international information security for governments, private industry, academia, and the individual. - Enhance the image and status of the CSIRT community.


$ forward secrecy (I) See: perfect forward secrecy.

$ 前向保密(I)见:完美前向保密。

$ FOUO (O) See: For Official Use Only.

$ FOUO(O)见:仅供官方使用。

$ FPKI (O) See: Federal Public-Key Infrastructure.

$ FPKI(O)见:联邦公钥基础设施。

$ fraggle attack (D) /slang/ A synonym for "smurf attack".

$ 脆弱攻击(D)/俚语/蓝精灵攻击的同义词。

Deprecated Term: It is likely that other cultures use different metaphors for this concept. Therefore, to avoid international misunderstanding, IDOCs SHOULD NOT use this term.


Derivation: The Fraggles are a fictional race of small humanoids (represented as hand puppets in a children's television series, "Fraggle Rock") that live underground.

起源:Fraggles是一个虚构的小型人形种族(在儿童电视剧《Fraggle Rock》中表现为手木偶),生活在地下。

$ frequency hopping (N) Repeated switching of frequencies during radio transmission according to a specified algorithm. [C4009] (See: spread spectrum.)

$ 跳频(N):根据指定的算法在无线电传输过程中重复切换频率。[C4009](参见:扩频。)

Tutorial: Frequency hopping is a TRANSEC technique to minimize the potential for unauthorized interception or jamming.


$ fresh (I) Recently generated; not replayed from some earlier interaction of the protocol.

$ 新的(I)最近产生的;未从协议的某些早期交互中重播。

Usage: Describes data contained in a PDU that is received and processed for the first time. (See: liveness, nonce, replay attack.)


$ FTP (I) See: File Transfer Protocol.

$ FTP(I)见:文件传输协议。

$ gateway (I) An intermediate system (interface, relay) that attaches to two (or more) computer networks that have similar functions but dissimilar implementations and that enables either one-way or two-way communication between the networks. (See: bridge, firewall, guard, internetwork, proxy server, router, and subnetwork.)

$ 网关(I)连接到两个(或多个)功能相似但实现方式不同的计算机网络的中间系统(接口、中继),可实现网络之间的单向或双向通信。(请参阅:网桥、防火墙、防护、互联网、代理服务器、路由器和子网络。)

Tutorial: The networks may differ in any of several aspects, including protocols and security mechanisms. When two computer networks differ in the protocol by which they offer service to hosts, a gateway may translate one protocol into the other or otherwise facilitate interoperation of hosts (see: Internet Protocol). In theory, gateways between computer networks are conceivable at any OSIRM layer. In practice, they usually operate


at OSIRM Layer 2 (see: bridge), 3 (see: router), or 7 (see: proxy server).


$ GCA (O) See: geopolitical certificate authority.

$ GCA(O)见:地缘政治证书管理局。

$ GDOI (O) See: Group Domain of Interpretation.

$ GDOI(O)见:集团解释领域。

$ GeldKarte (O) A smartcard-based, electronic money system that is maintained by the German banking industry, incorporates cryptography, and can be used to make payments via the Internet. (See: IOTP.)

$ Geldkart(O)是一种基于智能卡的电子货币系统,由德国银行业维护,采用加密技术,可用于通过互联网进行支付。(见:IOTP)

$ GeneralizedTime (N) The ASN.1 data type "GeneralizedTime" (ISO 8601) contains a calendar date (YYYYMMDD) and a time of day, which is either (a) the local time, (b) the Coordinated Universal Time, or (c) both the local time and an offset that enables Coordinated Universal Time to be calculated. (See: Coordinated Universal Time. Compare: UTCTime.)

$ 泛化时间(N)ASN.1数据类型“泛化时间”(ISO 8601)包含日历日期(YYYYMMDD)和一天中的某个时间,即(a)本地时间,(b)协调世界时间,或(c)本地时间和允许计算协调世界时间的偏移量。(参见:协调世界时。比较:UTCTime。)

$ Generic Security Service Application Program Interface (GSS-API) (I) An Internet Standard protocol [R2743] that specifies calling conventions by which an application (typically another communication protocol) can obtain authentication, integrity, and confidentiality security services independently of the underlying security mechanisms and technologies, thus enabling the application source code to be ported to different environments. (Compare: EAP, SASL.)

$ 通用安全服务应用程序接口(GSS-API)(I)一种互联网标准协议[R2743],规定了应用程序(通常是另一种通信协议)可通过其获得身份验证、完整性、,保密性和安全性服务独立于底层安全机制和技术,从而使应用程序源代码能够移植到不同的环境。(比较:EAP、SASL)

Tutorial: "A GSS-API caller accepts tokens provided to it by its local GSS-API implementation and transfers the tokens to a peer on a remote system; that peer passes the received tokens to its local GSS-API implementation for processing. The security services available through GSS-API in this fashion are implementable (and have been implemented) over a range of underlying mechanisms based on [symmetric] and [asymmetric cryptography]." [R2743]


$ geopolitical certificate authority (GCA) (O) /SET/ In a SET certification hierarchy, an optional level that is certified by a BCA and that may certify cardholder CAs, merchant CAs, and payment gateway CAs. Using GCAs enables a brand to distribute responsibility for managing certificates to geographic or political regions, so that brand policies can vary between regions as needed.

$ 地缘政治证书颁发机构(GCA)(O)/SET/在SET认证层次结构中,由BCA认证的可选级别,可认证持卡人CA、商户CA和支付网关CA。使用GCAs使品牌能够将管理证书的责任分配给地理或政治区域,以便品牌策略可以根据需要在不同区域之间变化。

$ GIG (O) See: Global Information Grid.

$ 全球信息栅格(GIG)见:全球信息栅格。

$ Global Information Grid (GIG) (O) /U.S. DoD/ The GIG is "a globally interconnected, end-to-end set of information capabilities, associated processes and personnel for collecting, processing, storing, disseminating, and managing information on demand to war fighters, policy makers, and support personnel." [IATF] Usage: Formerly referred to as the DII.

$ 全球信息网格(GIG)(O)/美国国防部/全球信息网格是“一组全球互联、端到端的信息能力、相关流程和人员,用于收集、处理、存储、传播和管理作战人员、决策者和支持人员所需的信息。”[IATF]用法:以前称为DII。

$ good engineering practice(s) (N) A term used to specify or characterize design, implementation, installation, or operating practices for an information system, when a more explicit specification is not possible. Generally understood to refer to the state of the engineering art for commercial systems that have problems and solutions equivalent to the system in question.

$ 良好工程实践(N):当无法制定更明确的规范时,用于指定或描述信息系统的设计、实施、安装或操作实践的术语。一般理解为指商业系统的工程技术水平,其问题和解决方案相当于所讨论的系统。

$ granularity 1. (N) /access control/ Relative fineness to which an access control mechanism can be adjusted.

$ 粒度1。(N) /访问控制/访问控制机制可调整的相对精细度。

2. (N) /data security/ "The size of the smallest protectable unit of information" in a trusted system. [Huff]

2. (N) /data security/“受信任系统中可保护的最小信息单元的大小”。[怒火]

$ Green Book (D) /slang/ Synonym for "Defense Password Management Guideline" [CSC2].

$ 绿皮书(D)/俚语/同义词“国防密码管理指南”[CSC2]。

Deprecated Term: Except as an explanatory appositive, IDOCs SHOULD NOT use this term, regardless of the associated definition. Instead, use the full proper name of the document or, in subsequent references, a conventional abbreviation. (See: Rainbow Series.)


Deprecated Usage: To improve international comprehensibility of Internet Standards and the Internet Standards Process, IDOCs SHOULD NOT use "cute" synonyms. No matter how clearly understood or popular a nickname may be in one community, it is likely to cause confusion or offense in others. For example, several other information system standards also are called "the Green Book"; the following are some examples: - Each volume of 1992 ITU-T (known at that time as CCITT) standards. - "PostScript Language Program Design", Adobe Systems, Addison-Wesley, 1988. - IEEE 1003.1 POSIX Operating Systems Interface.

不推荐使用:为了提高互联网标准和互联网标准过程的国际可理解性,IDOC不应使用“可爱”同义词。无论一个昵称在一个社区中被理解得多么清楚或多么流行,它都有可能在其他社区引起混乱或冒犯。例如,其他一些信息系统标准也被称为“绿皮书”;以下是一些示例:-1992年ITU-T(当时称为CCITT)标准的每一卷。-“PostScript语言程序设计”,AdobeSystems,Addison-Wesley,1988年IEEE 1003.1 POSIX操作系统接口。

- "Smalltalk-80: Bits of History, Words of Advice", Glenn Krasner, Addison-Wesley, 1983. - "X/Open Compatibility Guide". - A particular CD-ROM format developed by Phillips.

- “Smalltalk-80:历史的点滴,忠告的话语”,格伦·克拉斯纳,艾迪生·韦斯利,1983年“X/Open兼容性指南”——菲利普斯开发的一种特殊的CD-ROM格式。

$ Group Domain of Interpretation (GDOI) (I) An ISAKMP/IKE domain of interpretation for group key management; i.e., a phase 2 protocol in ISAKMP. [R3547] (See: secure multicast.)

$ 集团解释域(GDOI)(I)用于集团密钥管理的ISAKMP/IKE解释域;i、 例如,ISAKMP中的第2阶段协议。[R3547](请参阅:安全多播。)

Tutorial: In this group key management model that extends the ISAKMP standard, the protocol is run between a group member and a "group controller/key server", which establishes security associations [R4301] among authorized group members. The GDOI protocol is itself protected by an ISAKMP phase 1 association.


For example, multicast applications may use ESP to protect their data traffic. GDOI carries the needed security association parameters for ESP. In this way, GDOI supports multicast ESP with group authentication of ESP packets using a shared, group key.


$ group identity (I) See: secondary definition under "identity".

$ 集团标识(I)见“标识”下的二级定义。

$ group security association (I) "A bundling of [security associations] (SAs) that together define how a group communicates securely. The [group SA] may include a registration protocol SA, a rekey protocol SA, and one or more data security protocol SAs." [R3740]

$ 组安全关联(I)“[安全关联](SA)的捆绑,共同定义组如何安全通信。[组SA]可能包括注册协议SA、密钥更新协议SA和一个或多个数据安全协议SA。”[R3740]

$ GSS-API (I) See: Generic Security Service Application Program Interface.

$ GSS-API(I)见:通用安全服务应用程序接口。

$ guard (I) A computer system that (a) acts as gateway between two information systems operating under different security policies and (b) is trusted to mediate information data transfers between the two. (See: controlled interface, cross-domain solution, domain, filter. Compare: firewall.)

$ guard(I)一种计算机系统,它(A)充当两个在不同安全策略下运行的信息系统之间的网关,并且(b)受信任在两个系统之间进行信息数据传输。(请参阅:受控接口、跨域解决方案、域、筛选器。比较:防火墙。)

Usage: Frequently understood to mean that one system is operating at a higher security level than the other, and that the gateway's purpose is to prevent unauthorized disclosure of data from the higher system to the lower. However, the purpose might also be to protect the data integrity, availability, or general system integrity of one system from threats posed by connecting to the other system. The mediation may be entirely automated or may involve "reliable human review".


$ guest login (I) See: anonymous login.

$ 来宾登录(I)见:匿名登录。

$ GULS (I) Generic Upper Layer Security service element (ISO 11586), a five-part standard for the exchange of security information and security-transformation functions that protect confidentiality and integrity of application data.

$ GULS(I)通用上层安全服务元素(ISO 11586),由五部分组成的标准,用于交换安全信息和安全转换功能,以保护应用程序数据的机密性和完整性。

$ Gypsy verification environment (O) A methodology, language, and integrated set of software tools developed at the University of Texas for specifying, coding, and verifying software to produce correct and reliable programs. [Cheh]

$ 吉普赛验证环境(O)一种在德克萨斯大学开发的方法、语言和成套软件工具,用于指定、编码和验证软件以产生正确和可靠的程序。[车]

$ H field (D) See: Deprecated Usage under "Handling Restrictions field".

$ H字段(D)请参阅“处理限制字段”下的不推荐使用。

$ hack 1a. (I) /verb/ To work on something, especially to program a computer. (See: hacker.)

$ 黑客1a。(一) /动词/做某事,尤指为计算机编程。(见:黑客)

1b. (I) /verb/ To do some kind of mischief, especially to play a prank on, or penetrate, a system. (See: hacker, cracker.)

1b。(一) 做某种恶作剧,尤指恶作剧或渗透系统。(请参阅:黑客、黑客。)

2. (I) /noun/ An item of completed work, or a solution for a problem, that is non-generalizable, i.e., is very specific to the application area or problem being solved.

2. (一) /noon/完成的工作项目或问题的解决方案,不可概括,即非常特定于所解决的应用领域或问题。

Tutorial: Often, the application area or problem involves computer programming or other use of a computer. Characterizing something as a hack can be a compliment, such as when the solution is minimal and elegant; or it can be derogatory, such as when the solution fixes the problem but leaves the system in an unmaintainable state.


See [Raym] for several other meanings of this term and also definitions of several derivative terms.


$ hacker 1. (I) Someone with a strong interest in computers, who enjoys learning about them, programming them, and experimenting and otherwise working with them. (See: hack. Compare: adversary, cracker, intruder.)

$ 黑客1。(一) 对计算机有浓厚兴趣的人,他们喜欢学习计算机、编程、实验和使用计算机。(参见:黑客。比较:敌手、黑客、入侵者。)

Usage: This first definition is the original meaning of the term (circa 1960); it then had a neutral or positive connotation of "someone who figures things out and makes something cool happen".


2. (O) "An individual who spends an inordinate amount of time working on computer systems for other than professional purposes." [NCSSG]

2. (O) “在计算机系统上花费过多时间而非出于专业目的的个人。”[NCSSG]

3. (D) Synonym for "cracker".

3. (D) “饼干”的同义词。

Deprecated Usage: Today, the term is frequently (mis)used (especially by journalists) with definition 3.


$ handle 1. (I) /verb/ Perform processing operations on data, such as receive and transmit, collect and disseminate, create and delete, store and retrieve, read and write, and compare. (See: access.)

$ 处理1。(一) /verb/对数据执行处理操作,如接收和发送、收集和分发、创建和删除、存储和检索、读和写以及比较。(请参阅:访问。)

2. (I) /noun/ An online pseudonym, particularly one used by a cracker; derived from citizens' band radio culture.

2. (一) /名词/网上的笔名,尤指黑客使用的;源自市民的波段无线电文化。

$ handling restriction (I) A type of access control other than (a) the rule-based protections of mandatory access control and (b) the identity-based protections of discretionary access control; usually involves administrative security.

$ 处理限制(I)除(A)基于规则的强制访问控制保护和(b)基于身份的自主访问控制保护以外的一种访问控制;通常涉及管理安全。

$ Handling Restrictions field (I) A 16-bit field that specifies a control and release marking in the security option (option type 130) of IP's datagram header format. The valid field values are alphanumeric digraphs assigned by the U.S. Government, as specified in RFC 791.

$ 处理限制字段(I)一个16位字段,指定IP数据报报头格式的安全选项(选项类型130)中的控制和释放标记。根据RFC 791的规定,有效字段值为美国政府指定的字母数字有向图。

Deprecated Abbreviation: IDOCs SHOULD NOT use the abbreviation "H field" because it is potentially ambiguous. Instead, use "Handling Restrictions field".


$ handshake (I) Protocol dialogue between two systems for identifying and authenticating themselves to each other, or for synchronizing their operations with each other.

$ 握手(I)两个系统之间的协议对话,用于相互识别和验证自身,或用于使其操作同步。

$ Handshake Protocol (I) /TLS/ The TLS Handshake Protocol consists of three parts (i.e., subprotocols) that enable peer entities to agree upon security parameters for the record layer, authenticate themselves to each other, instantiate negotiated security parameters, and report error conditions to each other. [R4346]

$ 握手协议(I)/TLS/TLS握手协议由三个部分(即子协议)组成,使对等实体能够就记录层的安全参数达成一致,彼此进行身份验证,实例化协商的安全参数,并相互报告错误情况。[R4346]

$ harden (I) To protect a system by configuring it to operate in a way that eliminates or mitigates known vulnerabilities. Example: [RSCG]. (See: default account.)

$ 强化(I)通过配置系统以消除或缓解已知漏洞的方式运行来保护系统。示例:[RSCG]。(请参阅:默认帐户。)

$ hardware (I) The material physical components of an information system. (See: firmware, software.)

$ 硬件(I)信息系统的重要物理组件。(请参阅:固件、软件。)

$ hardware error (I) /threat action/ See: secondary definitions under "corruption", "exposure", and "incapacitation".

$ 硬件错误(I)/威胁行动/见“腐败”、“暴露”和“丧失能力”下的二级定义。

$ hardware token See: token.

$ 硬件令牌请参阅:令牌。

$ hash code (D) Synonym for "hash result" or "hash function".

$ 哈希代码(D)“哈希结果”或“哈希函数”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; it mixes concepts in a potentially misleading way. A hash result is not a "code", and a hash function does not "encode" in any sense defined by this glossary. (See: hash value, message digest.)


$ hash function 1. (I) A function H that maps an arbitrary, variable-length bit string, s, into a fixed-length string, h = H(s) (called the "hash result"). For most computing applications, it is desirable that given a string s with H(s) = h, any change to s that creates a different string s' will result in an unpredictable hash result H(s') that is, with high probability, not equal to H(s).

$ 散列函数1。(一) 一种函数H,它将任意可变长度的位字符串s映射为固定长度的字符串H=H(s)(称为“哈希结果”)。对于大多数计算应用程序,理想的情况是给定一个H(s)=H的字符串s,对s的任何更改都会产生一个不可预测的散列结果H(s'),即高概率不等于H(s)。

2. (O) "A (mathematical) function which maps values from a large (possibly very large) domain into a smaller range. A 'good' hash function is such that the results of applying the function to a (large) set of values in the domain will be evenly distributed (and apparently at random) over the range." [X509]

2. (O) “将大(可能非常大)域中的值映射到较小范围的(数学)函数。“良好”哈希函数是指将函数应用于域中的(大)值集的结果将均匀分布(显然是随机分布)在该范围内。”[X509]

Tutorial: A hash function operates on variable-length input (e.g., a message or a file) and outputs a fixed-length output, which typically is much shorter than most input values. If the algorithm is "good" as described in the "O" definition, then the hash function may be a candidate for use in a security mechanism to detect accidental changes in data, but not necessarily for a mechanism to detect changes made by active wiretapping. (See: Tutorial under "checksum".)


Security mechanisms require a "cryptographic hash function" (e.g., MD2, MD4, MD5, SHA-1, Snefru), i.e., a good hash function that also has the one-way property and one of the two collision-free properties: - "One-way property": Given H and a hash result h = H(s), it is hard (i.e., computationally infeasible, "impossible") to find s. (Of course, given H and an input s, it must be relatively easy to compute the hash result H(s).) - "Weakly collision-free property": Given H and an input s, it is hard (i.e., computationally infeasible, "impossible") to find a different input, s', such that H(s) = H(s'). - "Strongly collision-free property": Given H, it is hard to find any pair of inputs s and s' such that H(s) = H(s').


If H produces a hash result N bits long, then to find an s' where H(s') = H(s) for a specific given s, the amount of computation required is O(2**n); i.e., it is necessary to try on the order of 2 to the power n values of s' before finding a collision. However, to simply find any pair of values s and s' that collide, the amount of computation required is only O(2**(n/2)); i.e., after computing H(s) for 2 to the power n/2 randomly chosen values of s, the probability is greater than 1/2 that two of those values have the same hash result. (See: birthday attack.)

如果H产生一个N比特长的散列结果,那么为了找到一个s',其中H(s')=H(s),对于特定的给定s,所需的计算量是O(2**N);i、 例如,在发现碰撞之前,有必要尝试s'的幂n值的2阶。然而,为了简单地找到碰撞的任何一对值s和s’,所需的计算量仅为O(2**(n/2));i、 例如,在将2的H(s)计算为随机选择的s的n/2的幂之后,这些值中的两个具有相同散列结果的概率大于1/2。(见:生日攻击。)

$ hash result 1. (I) The output of a hash function. (See: hash code, hash value. Compare: hash value.)

$ 散列结果1。(一) 散列函数的输出。(请参阅:哈希代码、哈希值。比较:哈希值。)

2. (O) "The output produced by a hash function upon processing a message" (where "message" is broadly defined as "a digital representation of data"). [DSG]

2. (O) “哈希函数在处理消息时产生的输出”(其中“消息”广义上定义为“数据的数字表示”)。[DSG]

Usage: IDOCs SHOULD avoid the unusual usage of "message" that is seen in the "O" definition.


$ hash value (D) Synonym for "hash result".

$ 哈希值(D)是“哈希结果”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term for the output of a hash function; the term could easily be confused with "hashed value", which means the input to a hash function. (See: hash code, hash result, message digest.)


$ HDM (O) See: Hierarchical Development Methodology.

$ HDM(O)参见:分层开发方法。

$ Hierarchical Development Methodology (HDM) (O) A methodology, language, and integrated set of software tools developed at SRI International for specifying, coding, and verifying software to produce correct and reliable programs. [Cheh]

$ 分层开发方法(HDM)(O)SRI International开发的一套方法、语言和综合软件工具,用于指定、编码和验证软件,以生成正确可靠的程序。[车]

$ hierarchical PKI (I) A PKI architecture based on a certification hierarchy. (Compare: mesh PKI, trust-file PKI.)

$ 层次式PKI(I)基于证书层次结构的PKI体系结构。(比较:网状PKI、信任文件PKI。)

$ hierarchy management (I) The process of generating configuration data and issuing public-key certificates to build and operate a certification hierarchy. (See: certificate management.)

$ 层次结构管理(I)生成配置数据和颁发公钥证书以建立和运行证书层次结构的过程。(请参阅:证书管理。)

$ hierarchy of trust (D) Synonym for "certification hierarchy".

$ 信任层次结构(D)“认证层次结构”的同义词。

Deprecated Term: IDOCs SHOULD NOT use this term; it mixes concepts in a potentially misleading way. (See: certification hierarchy, trust, web of trust.)


$ high-assurance guard (O) "An oxymoron," said Lt. Gen. William H. Campbell, former U.S. Army chief information officer, speaking at an Armed Forces Communications and Electronics Association conference.

$ 前美国陆军首席信息官威廉·H·坎贝尔中将在美国武装部队通信和电子协会的一次会议上说:“这是一个自相矛盾的说法。”。

Usage: IDOCs that use this term SHOULD state a definition for it because the term mixes concepts and could easily be misunderstood.


$ hijack attack (I) A form of active wiretapping in which the attacker seizes control of a previously established communication association. (See: man-in-the-middle attack, pagejacking, piggyback attack.)

$ 劫持攻击(I)一种主动窃听形式,其中攻击者夺取了先前建立的通信关联的控制权。(参见:中间人攻击、页面劫持、背驮攻击。)

$ HIPAA (N) Health Information Portability and Accountability Act of 1996, a U.S. law (Public Law 104-191) that is intended to protect the privacy of patients' medical records and other health information in all forms, and mandates security for that information, including for its electronic storage and transmission.

$ 《1996年HIPAA(N)健康信息可移植性和责任法案》,一项美国法律(公法104-191),旨在保护患者医疗记录和其他各种形式健康信息的隐私,并要求对该信息进行安全保护,包括其电子存储和传输。

$ HMAC (I) A keyed hash [R2104] that can be based on any iterated cryptographic hash (e.g., MD5 or SHA-1), so that the cryptographic strength of HMAC depends on the properties of the selected cryptographic hash. (See: [R2202, R2403, R2404].)

$ HMAC(I)可基于任何迭代加密散列(例如,MD5或SHA-1)的键控散列[R2104],因此HMAC的加密强度取决于所选加密散列的属性。(参见:[R2202、R2403、R2404])

Derivation: Hash-based MAC. (Compare: CMAC.)


Tutorial: Assume that H is a generic cryptographic hash in which a function is iterated on data blocks of length B bytes. L is the length of the of hash result of H. K is a secret key of length L <= K <= B. The values IPAD and OPAD are fixed strings used as inner and outer padding and defined as follows: IPAD = the byte 0x36 repeated B times, and OPAD = the byte 0x5C repeated B times. HMAC is computed by H(K XOR OPAD, H(K XOR IPAD, inputdata)).

教程:假设H是一个通用加密哈希,其中函数在长度为B字节的数据块上迭代。L是H的散列结果的长度。K是长度为L<=K<=B的密钥。值IPAD和OPAD是用作内部和外部填充的固定字符串,定义如下:IPAD=字节0x36重复B次,OPAD=字节0x5C重复B次。HMAC由H(kxor OPAD,H(kxor IPAD,inputdata))计算。

HMAC has the following goals: - To use available cryptographic hash functions without modification, particularly functions that perform well in software and for which software is freely and widely available. - To preserve the original performance of the selected hash without significant degradation. - To use and handle keys in a simple way. - To have a well-understood cryptographic analysis of the strength of the mechanism based on reasonable assumptions about the underlying hash function. - To enable easy replacement of the hash function in case a faster or stronger hash is found or required.


$ honey pot (N) A system (e.g., a web server) or system resource (e.g., a file on a server) that is designed to be attractive to potential crackers and intruders, like honey is attractive to bears. (See: entrapment.)

$ 蜜罐(honey pot)(N)一种系统(如web服务器)或系统资源(如服务器上的文件),旨在吸引潜在的黑客和入侵者,如蜂蜜吸引熊。(见:诱捕。)

Usage: It is likely that other cultures use different metaphors for this concept. Therefore, to avoid international misunderstanding, an IDOC SHOULD NOT use this term without providing a definition for it. (See: Deprecated Usage under "Green Book".)


$ host 1. (I) /general/ A computer that is attached to a communication subnetwork or internetwork and can use services provided by the network to exchange data with other attached systems. (See: end system. Compare: server.)

$ 主持人1。(一) /general/连接到通信子网或互联网络的计算机,可以使用网络提供的服务与其他连接的系统交换数据。(请参见:结束系统。比较:服务器。)

2. (I) /IPS/ A networked computer that does not forward IP packets that are not addressed to the computer itself. (Compare: router.)

2. (一) /IPS/不转发未寻址到计算机本身的IP数据包的网络计算机。(比较:路由器。)

Derivation: As viewed by its users, a host "entertains" them, providing Application-Layer services or access to other computers attached to the network. However, even though some traditional peripheral service devices, such as printers, can now be


independently connected to networks, they are not usually called hosts.


$ HTML (I) See: Hypertext Markup Language.

$ HTML(I)见:超文本标记语言。

$ HTTP (I) See: Hypertext Transfer Protocol.

$ HTTP(I)参见:超文本传输协议。

$ https (I) When used in the first part of a URL (the part that precedes the colon and specifies an access scheme or protocol), this term specifies the use of HTTP enhanced by a security mechanism, which is usually SSL. (Compare: S-HTTP.)

$ https(I)当用于URL的第一部分(冒号之前的部分并指定访问方案或协议)时,该术语指定使用通过安全机制(通常为SSL)增强的HTTP。(比较:S-HTTP。)

$ human error (I) /threat action/ See: secondary definitions under "corruption", "exposure", and "incapacitation".

$ 人为错误(I)/威胁行动/见“腐败”、“暴露”和“丧失行为能力”下的二级定义。

$ hybrid encryption (I) An application of cryptography that combines two or more encryption algorithms, particularly a combination of symmetric and asymmetric encryption. Examples: digital envelope, MSP, PEM, PGP. (Compare: superencryption.)

$ 混合加密(I)结合两种或两种以上加密算法的加密应用,尤其是对称和非对称加密的组合。示例:数字信封、MSP、PEM、PGP。(比较:超级加密。)

Tutorial: Asymmetric algorithms require more computation than equivalently strong symmetric ones. Thus, asymmetric encryption is not normally used for data confidentiality except to distribute a symmetric key in a hybrid encryption scheme, where the symmetric key is usually very short (in terms of bits) compared to the data file it protects. (See: bulk key.)


$ hyperlink (I) In hypertext or hypermedia, an information object (such as a word, a phrase, or an image, which usually is highlighted by color or underscoring) that points (i.e., indicates how to connect) to related information that is located elsewhere and can be retrieved by activating the link (e.g., by selecting the object with a mouse pointer and then clicking).

$ 超链接(I)在超文本或超媒体中,一种信息对象(如单词、短语或图像,通常以颜色或下划线突出显示),它指向(即指示如何连接)位于别处的相关信息,并可通过激活链接检索(例如,用鼠标指针选择对象,然后单击)。

$ hypermedia (I) A generalization of hypertext; any media that contain hyperlinks that point to material in the same or another data object.

$ 超媒体(I)超文本的泛化;包含指向同一或另一数据对象中的材质的超链接的任何媒体。

$ hypertext (I) A computer document, or part of a document, that contains hyperlinks to other documents; i.e., text that contains active pointers to other text. Usually written in HTML and accessed using a web browser. (See: hypermedia.)

$ 超文本(I)包含指向其他文件超链接的计算机文件或文件的一部分;i、 例如,包含指向其他文本的活动指针的文本。通常用HTML编写并使用web浏览器访问。(请参阅:超媒体。)

$ Hypertext Markup Language (HTML) (I) A platform-independent system of syntax and semantics (RFC 1866) for adding characters to data files (particularly text files) to represent the data's structure and to point to related data, thus creating hypertext for use in the World Wide Web and other applications. (Compare: XML.)

$ 超文本标记语言(HTML)(I)一种独立于平台的语法和语义系统(RFC 1866),用于向数据文件(尤其是文本文件)添加字符,以表示数据的结构并指向相关数据,从而创建超文本,供万维网和其他应用程序使用。(比较:XML。)

$ Hypertext Transfer Protocol (HTTP) (I) A TCP-based, Application-Layer, client-server, Internet protocol (RFC 2616) that is used to carry data requests and responses in the World Wide Web. (See: hypertext.)

$ 超文本传输协议(HTTP)(I)基于TCP的应用层、客户机-服务器、互联网协议(RFC 2616),用于在万维网中传输数据请求和响应。(请参阅:超文本。)

$ IAB (I) See: Internet Architecture Board.

$ IAB(I)见:互联网架构委员会。

$ IANA (I) See: Internet Assigned Numbers Authority.

$ IANA(I)见:互联网分配号码管理局。

$ IATF (O) See: Information Assurance Technical Framework.

$ IATF(O)见:信息保障技术框架。

$ ICANN (I) See: Internet Corporation for Assigned Names and Numbers.

$ ICANN(I)见:互联网名称和号码分配公司。

$ ICMP (I) See: Internet Control Message Protocol.

$ ICMP(I)见:互联网控制消息协议。

$ ICMP flood (I) A denial-of-service attack that sends a host more ICMP echo request ("ping") packets than the protocol implementation can handle. (See: flooding, smurf.)

$ ICMP洪泛(I)一种拒绝服务攻击,它向主机发送的ICMP回显请求(“ping”)数据包超过协议实现所能处理的数量。(见:洪水,蓝精灵)

$ ICRL (N) See: indirect certificate revocation list.

$ ICRL(N)参见:间接证书撤销列表。

$ IDEA (N) See: International Data Encryption Algorithm.

$ IDEA(N)见:国际数据加密算法。

$ identification (I) An act or process that presents an identifier to a system so that the system can recognize a system entity and distinguish it from other entities. (See: authentication.)

$ 识别(I)向系统提供标识符的行为或过程,以便系统能够识别系统实体并将其与其他实体区分开来。(请参阅:身份验证。)

$ identification information (D) Synonym for "identifier"; synonym for "authentication information". (See: authentication, identifying information.)

$ 识别信息(D)“标识符”的同义词;“身份验证信息”的同义词。(请参阅:身份验证,识别信息。)

Deprecated Term: IDOCs SHOULD NOT use this term as a synonym for either of those terms; this term (a) is not as precise as they are and (b) mixes concepts in a potentially misleading way. Instead, use "identifier" or "authentication information", depending on what is meant.


$ Identification Protocol (I) A client-server Internet protocol [R1413] for learning the identity of a user of a particular TCP connection.

$ 识别协议(I)用于了解特定TCP连接用户身份的客户机-服务器互联网协议[R1413]。

Tutorial: Given a TCP port number pair, the server returns a character string that identifies the owner of that connection on the server's system. The protocol does not provide an authentication service and is not intended for authorization or access control. At best, it provides additional auditing information with respect to TCP.


$ identifier (I) A data object -- often, a printable, non-blank character string -- that definitively represents a specific identity of a system entity, distinguishing that identity from all others. (Compare: identity.)

$ 标识符(I)一个数据对象——通常是一个可打印的非空字符串——它最终表示系统实体的特定标识,将该标识与所有其他标识区分开来。(比较:标识。)

Tutorial: Identifiers for system entities must be assigned very carefully, because authenticated identities are the basis for other security services, such as access control service.


$ identifier credential 1. (I) See: /authentication/ under "credential".

$ 标识符凭据1。(一) 请参阅“凭证”下的:/authentication/。

2. (D) Synonym for "signature certificate".

2. (D) “签名证书”的同义词。

Usage: IDOCs that use this term SHOULD state a definition for it because the term is used in many ways and could easily be misunderstood.


$ identifying information (D) Synonym for "identifier"; synonym for "authentication information". (See: authentication, identification information.)

$ 识别信息(D)“标识符”的同义词;“身份验证信息”的同义词。(请参阅:身份验证、标识信息。)

Deprecated Term: IDOCs SHOULD NOT use this term as a synonym for either of those terms; this term (a) is not as precise as they are and (b) mixes concepts in a potentially misleading way. Instead,


use "identifier" or "authentication information", depending on what is meant.


$ identity (I) The collective aspect of a set of attribute values (i.e., a set of characteristics) by which a system user or other system entity is recognizable or known. (See: authenticate, registration. Compare: identifier.)

$ 标识(I)一组属性值(即一组特征)的集合方面,通过该集合,系统用户或其他系统实体是可识别或已知的。(请参阅:验证、注册。比较:标识符。)

Usage: An IDOC MAY apply this term to either a single entity or a set of entities. If an IDOC involves both meanings, the IDOC SHOULD use the following terms and definitions to avoid ambiguity: - "Singular identity": An identity that is registered for an entity that is one person or one process. - "Shared identity": An identity that is registered for an entity that is a set of singular entities (1) in which each member is authorized to assume the identity individually and (2) for which the registering system maintains a record of the singular entities that comprise the set. In this case, we would expect each member entity to be registered with a singular identity before becoming associated with the shared identity. - "Group identity": An identity that is registered for an entity (1) that is a set of entities (2) for which the registering system does not maintain a record of singular entities that comprise the set.


Tutorial: When security services are based on identities, two properties are desirable for the set of attributes used to define identities: - The set should be sufficient to distinguish each entity from all other entities, i.e., to represent each entity uniquely. - The set should be sufficient to distinguish each identity from any other identities of the same entity.


The second property is needed if a system permits an entity to register two or more concurrent identities. Having two or more identities for the same entity implies that the entity has two separate justifications for registration. In that case, the set of attributes used for identities must be sufficient to represent multiple identities for a single entity.


Having two or more identities registered for the same entity is different from concurrently associating two different identifiers with the same identity, and also is different from a single identity concurrently accessing the system in two different roles. (See: principal, role-based access control.)


When an identity of a user is being registered in a system, the system may require presentation of evidence that proves the identity's authenticity (i.e., that the user has the right to claim or use the identity) and its eligibility (i.e., that the identity is qualified to be registered and needs to be registered).


The following diagram illustrates how this term relates to some other terms in a PKI system: authentication information, identifier, identifier credential, registration, registered user, subscriber, and user.


      Relationships:  === one-to-one, ==> one-to-many, <=> many-to-many.
                  +- - - - - - - - - - - - - - - - - - - - - - - - - - +
                  |                      PKI System                    |
      + - - - - + | +------------------+   +-------------------------+ |
      |  User,  | | |Subscriber, i.e., |   | Identity of Subscriber  | |
      |i.e., one| | | Registered User, |   |    is system-unique     | |
      | of the  | | | is system-unique |   | +---------------------+ | |
      |following| | | +--------------+ |   | |     Subscriber      | | |
      |         | | | | User's core  | |   | |     Identity's      | | |
      | +-----+ |===| | Registration | |==>| |  Registration data  | | |
      | |human| | | | | data, i.e.,  | |   | |+-------------------+| | |
      | |being| | | | | an entity's  | |   | ||  same core data   || | |
      | +-----+ | | | |distinguishing|========|for all Identities || | |
      |   or    | | | |  attribute   | |   | || of the same User  || | |
      | +-----+ | | | |   values     | | +===|+-------------------+| | |
      | |auto-| | | | +--------------+ | | | +---------------------+ | |
      | |mated| | | +------------------+ | +------------|------------+ |
      | |pro- | | |         |    +=======+              |              |
      | |cess | | | +-------v----|----------------------|------------+ |
      | +-----+ | | | +----------v---+     +------------v----------+ | |
      |   or    | | | |Authentication|<===>|Identifier of Identity | | |
      |+-------+| | | | Information  |     |    is system-unique   | | |
      || a set || | | +--------------+     +-----------------------+ | |
      ||  of   || | | Identifier Credential that associates unit of  | |
      || either|| | | Authentication Information with the Identifier | |
      |+-------+| | +------------------------------------------------+ |
      + - - - - + + - - - - - - - - - - - - - - - - - - - - - - - - - -+
      Relationships:  === one-to-one, ==> one-to-many, <=> many-to-many.
                  +- - - - - - - - - - - - - - - - - - - - - - - - - - +
                  |                      PKI System                    |
      + - - - - + | +------------------+   +-------------------------+ |
      |  User,  | | |Subscriber, i.e., |   | Identity of Subscriber  | |
      |i.e., one| | | Registered User, |   |    is system-unique     | |
      | of the  | | | is system-unique |   | +---------------------+ | |
      |following| | | +--------------+ |   | |     Subscriber      | | |
      |         | | | | User's core  | |   | |     Identity's      | | |
      | +-----+ |===| | Registration | |==>| |  Registration data  | | |
      | |human| | | | | data, i.e.,  | |   | |+-------------------+| | |
      | |being| | | | | an entity's  | |   | ||  same core data   || | |
      | +-----+ | | | |distinguishing|========|for all Identities || | |
      |   or    | | | |  attribute   | |   | || of the same User  || | |
      | +-----+ | | | |   values     | | +===|+-------------------+| | |
      | |auto-| | | | +--------------+ | | | +---------------------+ | |
      | |mated| | | +------------------+ | +------------|------------+ |
      | |pro- | | |         |    +=======+              |              |
      | |cess | | | +-------v----|----------------------|------------+ |
      | +-----+ | | | +----------v---+     +------------v----------+ | |
      |   or    | | | |Authentication|<===>|Identifier of Identity | | |
      |+-------+| | | | Information  |     |    is system-unique   | | |
      || a set || | | +--------------+     +-----------------------+ | |
      ||  of   || | | Identifier Credential that associates unit of  | |
      || either|| | | Authentication Information with the Identifier | |
      |+-------+| | +------------------------------------------------+ |
      + - - - - + + - - - - - - - - - - - - - - - - - - - - - - - - - -+

$ identity-based security policy (I) "A security policy based on the identities and/or attributes of users, a group of users, or entities acting on behalf of the users and the resources/objects being accessed." [I7498-2] (See: rule-based security policy.)

$ 基于身份的安全策略(I)“基于用户、一组用户或代表用户和被访问资源/对象的实体的身份和/或属性的安全策略。”[I7498-2](请参阅:基于规则的安全策略。)

$ identity proofing (I) A process that vets and verifies the information that is used to establish the identity of a system entity. (See: registration.)

$ 身份验证(I)审查和验证用于确定系统实体身份的信息的过程。(见:注册。)

$ IDOC (I) An abbreviation used in this Glossary to refer to a document or other item of written material that is generated in the Internet Standards Process (RFC 2026), i.e., an RFC, an Internet-Draft, or some other item of discourse.

$ IDOC(I)本词汇表中使用的缩写词,指在互联网标准过程(RFC 2026)中生成的文件或其他书面材料,即RFC、互联网草案或其他一些论述项目。

Deprecated Usage: This abbreviation SHOULD NOT be used in an IDOC unless it is first defined in the IDOC because the abbreviation was invented for this Glossary and is not widely known.


$ IDS (I) See: intrusion detection system.

$ IDS(一)见:入侵检测系统。

$ IEEE (N) See: Institute of Electrical and Electronics Engineers, Inc.

$ IEEE(N)见:电气和电子工程师协会。

$ IEEE 802.10 (N) An IEEE committee developing security standards for LANs. (See: SILS.)

$ IEEE 802.10(N)IEEE为局域网制定安全标准的委员会。(见:SILS)

$ IEEE P1363 (N) An IEEE working group, Standard for Public-Key Cryptography, engaged in developing a comprehensive reference standard for asymmetric cryptography. Covers discrete logarithm (e.g., DSA), elliptic curve, and integer factorization (e.g., RSA); and covers key agreement, digital signature, and encryption.

$ IEEE P1363(N)IEEE公开密钥加密标准工作组,致力于开发非对称加密的综合参考标准。包括离散对数(如DSA)、椭圆曲线和整数因式分解(如RSA);包括密钥协议、数字签名和加密。

$ IESG (I) See: Internet Engineering Steering Group.

$ IESG(I)见:互联网工程指导小组。

$ IETF (I) See: Internet Engineering Task Force.

$ IETF(I)见:互联网工程任务组。

$ IKE (I) See: IPsec Key Exchange.

$ IKE(I)参见:IPsec密钥交换。

$ IMAP4 (I) See: Internet Message Access Protocol, version 4.

$ IMAP4(I)见:互联网信息访问协议,第4版。

$ IMAP4 AUTHENTICATE (I) An IMAP4 command (better described as a transaction type, or subprotocol) by which an IMAP4 client optionally proposes a mechanism to an IMAP4 server to authenticate the client to the server and provide other security services. (See: POP3.)

$ IMAP4 AUTHENTICATE(I)IMAP4命令(更好地描述为事务类型或子程序),通过该命令,IMAP4客户端可选地向IMAP4服务器提出一种机制,以向服务器验证客户端并提供其他安全服务。(见:POP3。)

Tutorial: If the server accepts the proposal, the command is followed by performing a challenge-response authentication protocol and, optionally, negotiating a protection mechanism for subsequent POP3 interactions. The security mechanisms that are used by IMAP4 AUTHENTICATE -- including Kerberos, GSS-API, and S/Key -- are described in [R1731].


$ impossible (O) Cannot be done in any reasonable amount of time. (See: break, brute force, strength, work factor.)

$ 不可能(O)不能在任何合理的时间内完成。(参见:断裂、强力、强度、功系数。)

$ in the clear (I) Not encrypted. (See: clear text.)

$ 在clear(I)中,未加密。(请参阅:明文。)

$ Ina Jo (O) A methodology, language, and integrated set of software tools developed at the System Development Corporation for specifying, coding, and verifying software to produce correct and reliable programs. Usage: a.k.a. the Formal Development Methodology. [Cheh]

$ Ina Jo(O):由系统开发公司开发的一套方法、语言和集成的软件工具,用于指定、编码和验证软件,以生成正确可靠的程序。用法:又称正式开发方法。[车]

$ incapacitation (I) A type of threat action that prevents or interrupts system operation by disabling a system component. (See: disruption.)

$ 失效(I)一种通过禁用系统组件来阻止或中断系统运行的威胁行为。(见:中断。)

Usage: This type of threat action includes the following subtypes: - "Malicious logic": In context of incapacitation, any hardware, firmware, or software (e.g., logic bomb) intentionally introduced into a system to destroy system functions or resources. (See: corruption, main entry for "malicious logic", masquerade, misuse.) - "Physical destruction": Deliberate destruction of a system component to interrupt or prevent system operation. - "Human error": /incapacitation/ Action or inaction that unintentionally disables a system component. (See: corruption, exposure.) - "Hardware or software error": /incapacitation/ Error that unintentionally causes failure of a system component and leads to disruption of system operation. (See: corruption, exposure.) - "Natural disaster": /incapacitation/ Any "act of God" (e.g., fire, flood, earthquake, lightning, or wind) that disables a system component. [FP031 Section 2]


$ incident See: security incident.

$ 事件见:安全事件。

$ INCITS (N) See: "International Committee for Information Technology Standardization" under "ANSI".

$ INCITS(N)见“ANSI”下的“国际信息技术标准化委员会”。

$ indicator (N) An action -- either specific, generalized, or theoretical -- that an adversary might be expected to take in preparation for an attack. [C4009] (See: "attack sensing, warning, and response". Compare: message indicator.)

$ 指标(N)一种行动——具体的、概括的或理论上的——对手为准备攻击而可能采取的行动。[C4009](请参阅:“攻击感知、警告和响应”。比较:消息指示器。)

$ indirect attack (I) See: secondary definition under "attack". Compare: direct attack.

$ 间接攻击(I)见“攻击”下的第二定义。比较:直接攻击。

$ indirect certificate revocation list (ICRL) (N) In X.509, a CRL that may contain certificate revocation notifications for certificates issued by CAs other than the issuer (i.e., signer) of the ICRL.

$ 间接证书撤销列表(ICRL)(N)X.509中的一种CRL,其中可能包含由CA(而非ICRL的颁发者(即签名者))颁发的证书的证书撤销通知。

$ indistinguishability (I) An attribute of an encryption algorithm that is a formalization of the notion that the encryption of some string is indistinguishable from the encryption of an equal-length string of nonsense. (Compare: semantic security.)

$ 不可区分性(I)加密算法的一个属性,它是某种字符串加密与等长无意义字符串加密不可区分这一概念的形式化。(比较:语义安全性。)

$ inference 1. (I) A type of threat action that reasons from characteristics or byproducts of communication and thereby indirectly accesses sensitive data, but not necessarily the data contained in the communication. (See: traffic analysis, signal analysis.)

$ 推论1。(一) 一种威胁行为,由通信的特征或副产品引起,从而间接访问敏感数据,但不一定访问通信中包含的数据。(参见:交通分析、信号分析。)

2. (I) A type of threat action that indirectly gains unauthorized access to sensitive information in a database management system by correlating query responses with information that is already known.

2. (一) 一种威胁行为,通过将查询响应与已知信息关联起来,间接获得对数据库管理系统中敏感信息的未经授权访问。

$ inference control (I) Protection of data confidentiality against inference attack. (See: traffic-flow confidentiality.)

$ 推理控制(I)针对推理攻击保护数据机密性。(请参阅:交通流保密。)

Tutorial: A database management system containing N records about individuals may be required to provide statistical summaries about subsets of the population, while not revealing sensitive information about a single individual. An attacker may try to obtain sensitive information about an individual by isolating a desired record at the intersection of a set of overlapping queries. A system can attempt to prevent this by restricting the size and overlap of query sets, distorting responses by rounding or otherwise perturbing database values, and limiting queries to random samples. However, these techniques may be impractical to implement or use, and no technique is totally effective. For example, restricting the minimum size of a query set -- that is,


not responding to queries for which there are fewer than K or more than N-K records that satisfy the query -- usually cannot prevent unauthorized disclosure. An attacker can pad small query sets with extra records, and then remove the effect of the extra records. The formula for identifying the extra records is called the "tracker". [Denns]


$ INFOCON (O) See: information operations condition

$ 信息大会(O)见:信息操作条件

$ informal (N) Expressed in natural language. [CCIB] (Compare: formal, semiformal.)

$ 非正式的(N)用自然语言表达。[CCIB](比较:正式、半正式。)

$ information 1. (I) Facts and ideas, which can be represented (encoded) as various forms of data.

$ 信息1。(一) 事实和想法,可以表示(编码)为各种形式的数据。

2. (I) Knowledge -- e.g., data, instructions -- in any medium or form that can be communicated between system entities.

2. (一) 系统实体之间可以交流的任何媒介或形式的知识,例如数据、指令。

Tutorial: Internet security could be defined simply as protecting information in the Internet. However, the perceived need to use different protective measures for different types of information (e.g., authentication information, classified information, collateral information, national security information, personal information, protocol control information, sensitive compartmented information, sensitive information) has led to the diversity of terminology listed in this Glossary.


$ information assurance (N) /U.S. Government/ "Measures that protect and defend information and information systems by ensuring their availability integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities." [C4009]

$ 信息保证(N)/美国政府/“通过确保信息和信息系统的可用性、完整性、身份验证、机密性和不可否认性来保护和保护信息和信息系统的措施。这些措施包括通过整合保护、检测和反应能力来恢复信息系统。”[C4009]

$ Information Assurance Technical Framework (IATF) (O) A publicly available document [IATF], developed through a collaborative effort by organizations in the U.S. Government and industry, and issued by NSA. Intended for security managers and system security engineers as a tutorial and reference document about security problems in information systems and networks, to improve awareness of tradeoffs among available technology solutions and of desired characteristics of security approaches for particular problems. (See: ISO 17799, [SP14].)

$ 信息保障技术框架(IATF)(O):一份公开的文件[IATF],由美国政府和行业组织合作开发,由NSA发布。面向安全管理人员和系统安全工程师,作为信息系统和网络安全问题的教程和参考文件,以提高对可用技术解决方案之间的权衡以及对特定问题的安全方法所需特性的认识。(见:ISO 17799[SP14]。)

$ information domain (O) See: secondary definition under "domain".

$ 信息领域(O)见“领域”下的二级定义。

$ information domain security policy (O) See: secondary definition under "domain".

$ 信息域安全策略(O)请参阅“域”下的二级定义。

$ information flow policy (N) /formal model/ A triple consisting of a set of security levels (or their equivalent security labels), a binary operator that maps each pair of security levels into a security level, and a binary relation on the set that selects a set of pairs of levels such that information is permitted to flow from an object of the first level to an object of the second level. (See: flow control, lattice model.)

$ 信息流策略(N)/正式模型/由一组安全级别(或其等效安全标签)组成的三元组,一个将每对安全级别映射到一个安全级别的二进制运算符,以及所述集合上的二元关系,所述二元关系选择一组成对的层级,从而允许信息从第一层级的对象流向第二层级的对象。(请参见:流控制,晶格模型。)

$ information operations condition (INFOCON) (O) /U.S. DoD/ A comprehensive defense posture and response based on the status of information systems, military operations, and intelligence assessments of adversary capabilities and intent. (See: threat)

$ 信息作战条件(INFOCON)(O)/美国国防部/基于信息系统状态、军事行动和敌方能力和意图的情报评估的综合防御态势和反应。(见:威胁)

Derivation: From DEFCON, i.e., defense condition.


Tutorial: The U.S. DoD defines five INFOCON levels: NORMAL (normal activity), ALPHA (increased risk of attack), BRAVO (specific risk of attack), CHARLIE (limited attack), and DELTA (general attack).


$ information security (INFOSEC) (N) Measures that implement and assure security services in information systems, including in computer systems (see: COMPUSEC) and in communication systems (see: COMSEC).

$ 信息安全(INFOSEC)(N)在信息系统中实施和确保安全服务的措施,包括在计算机系统(见:COMPUSEC)和通信系统(见:COMSEC)中。

$ information system (I) An organized assembly of computing and communication resources and procedures -- i.e., equipment and services, together with their supporting infrastructure, facilities, and personnel -- that create, collect, record, process, store, transport, retrieve, display, disseminate, control, or dispose of information to accomplish a specified set of functions. (See: system entity, system resource. Compare: computer platform.)

$ 信息系统(I)计算和通信资源和程序的有组织的集合,即设备和服务及其支持基础设施、设施和人员,用于创建、收集、记录、处理、存储、运输、检索、显示、传播、控制、,或处理信息以完成指定的一组功能。(请参阅:系统实体、系统资源。比较:计算机平台。)

$ Information Technology Security Evaluation Criteria (ITSEC) (N) A Standard [ITSEC] jointly developed by France, Germany, the Netherlands, and the United Kingdom for use in the European Union; accommodates a wider range of security assurance and functionality combinations than the TCSEC. Superseded by the Common Criteria.

$ 信息技术安全评估标准(ITSEC)(N)由法国、德国、荷兰和英国联合制定的供欧盟使用的标准[ITSEC];与TCSEC相比,它提供了更广泛的安全保证和功能组合。被共同标准取代。

$ INFOSEC (I) See: information security.

$ 信息安全(一)见:信息安全。

$ ingress filtering (I) A method [R2827] for countering attacks that use packets with false IP source addresses, by blocking such packets at the boundary between connected networks.

$ 入口过滤(I)一种方法[R2827],用于通过在连接的网络之间的边界处阻止使用具有虚假IP源地址的数据包的攻击。

Tutorial: Suppose network A of an internet service provider (ISP) includes a filtering router that is connected to customer network B, and an attacker in B at IP source address "foo" attempts to send packets with false source address "bar" into A. The false address may be either fixed or randomly changing, and it may either be unreachable or be a forged address that legitimately exists within either B or some other network C. In ingress filtering, the ISP's router blocks all inbound packet that arrive from B with a source address that is not within the range of legitimately advertised addresses for B. This method does not prevent all attacks that can originate from B, but the actual source of such attacks can be more easily traced because the originating network is known.


$ initialization value (IV) (I) /cryptography/ An input parameter that sets the starting state of a cryptographic algorithm or mode. (Compare: activation data.)

$ 初始化值(IV)(I)/加密/设置加密算法或模式的启动状态的输入参数。(比较:激活数据。)

Tutorial: An IV can be used to synchronize one cryptographic process with another; e.g., CBC, CFB, and OFB use IVs. An IV also can be used to introduce cryptographic variance (see: salt) besides that provided by a key.

教程:IV可用于同步一个加密进程与另一个加密进程;e、 g、CBC、CFB和OFB使用IVs。除了密钥提供的密码差异外,IV还可以用于引入密码差异(参见:salt)。

$ initialization vector (D) /cryptography/ Synonym for "initialization value".

$ 初始化向量(D)/密码学/同义词“初始化值”。

Deprecated Term: To avoid international misunderstanding, IDOCs SHOULD NOT use this term in the context of cryptography because most dictionary definitions of "vector" includes a concept of direction or magnitude, which are irrelevant to cryptographic use.


$ insertion 1. (I) /packet/ See: secondary definition under "stream integrity service".

$ 插入1。(一) /packet/请参阅“流完整性服务”下的二级定义。

2. (I) /threat action/ See: secondary definition under "falsification".

2. (一) /威胁行动/见“伪造”下的二级定义。

$ inside attack (I) See: secondary definition under "attack". Compare: insider.

$ 内部攻击(I)见“攻击”下的二级定义。比较:内幕人士。

$ insider 1. (I) A user (usually a person) that accesses a system from a position that is inside the system's security perimeter. (Compare: authorized user, outsider, unauthorized user.)

$ 内幕人士1。(一) 从系统安全边界内的位置访问系统的用户(通常是个人)。(比较:授权用户、外部用户、未授权用户。)

Tutorial: An insider has been assigned a role that has more privileges to access system resources than do some other types of users, or can access those resources without being constrained by some access controls that are applied to outside users. For example, a salesclerk is an insider who has access to the cash register, but a store customer is an outsider.


The actions performed by an insider in accessing the system may be either authorized or unauthorized; i.e., an insider may act either as an authorized user or as an unauthorized user.

内幕人士在访问系统时所采取的行动可能是授权的,也可能是未经授权的;i、 例如,内幕人士可以作为授权用户或未授权用户。

2. (O) A person with authorized physical access to the system. Example: In this sense, an office janitor is an insider, but a burglar or casual visitor is not. [NRC98]

2. (O) 有权实际访问系统的人员。从这个意义上讲,办公室清洁工是内幕人士,而窃贼或临时访客则不是。[NRC98]

3. (O) A person with an organizational status that causes the system or members of the organization to view access requests as being authorized. Example: In this sense, a purchasing agent is an insider but a vendor is not. [NRC98]

3. (O) 具有组织状态的人员,使系统或组织成员将访问请求视为已授权。从这个意义上讲,采购代理是内部人,而供应商不是。[NRC98]

$ inspectable space (O) /EMSEC/ "Three-dimensional space surrounding equipment that process classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and/or remove a potential TEMPEST exploitation exists." [C4009] (Compare: control zone, TEMPEST zone.)

$ 可检查空间(O)/EMSEC/“处理机密和/或敏感信息的设备周围的三维空间,在这些信息中,TEMPEST利用被认为是不可行的,或者存在识别和/或消除潜在TEMPEST利用的法律授权。”[C4009](比较:控制区、TEMPEST区。)

$ Institute of Electrical and Electronics Engineers, Inc. (IEEE) (N) The IEEE is a not-for-profit association of approximately 300,000 individual members in 150 countries. The IEEE produces nearly one third of the world's published literature in electrical engineering, computers, and control technology; holds hundreds of major, annual conferences; and maintains more than 800 active standards, with many more under development. (See: SILS.)

$ 电气和电子工程师协会(IEEE)(N)IEEE是一个非营利协会,在150个国家拥有约300000名个人会员。IEEE出版的电气工程、计算机和控制技术文献占世界出版文献的近三分之一;举办数百场大型年会;并保持800多个现行标准,还有更多标准正在开发中。(见:SILS)

$ integrity See: data integrity, datagram integrity service, correctness integrity, source integrity, stream integrity service, system integrity.

$ 完整性请参阅:数据完整性、数据报完整性服务、正确性完整性、源完整性、流完整性服务、系统完整性。

$ integrity check (D) A computation that is part of a mechanism to provide data integrity service or data origin authentication service. (Compare: checksum.)

$ 完整性检查(D)作为提供数据完整性服务或数据源身份验证服务的机制的一部分的计算。(比较:校验和。)

Deprecated Term: IDOCs SHOULD NOT use this term as a synonym for "cryptographic hash" or "protected checksum". This term unnecessarily duplicates the meaning of other, well-established terms; this term only mentions integrity, even though the intended service may be data origin authentication; and not every checksum is cryptographically protected.


$ integrity label (I) A security label that tells the degree of confidence that may be placed in the data, and may also tell what countermeasures are required to be applied to protect the data from alteration and destruction. (See: integrity. Compare: classification label.)

$ 完整性标签(I)一种安全标签,说明数据中可能存在的置信度,还可以说明需要采取哪些措施来保护数据不受更改和破坏。(请参阅:完整性。比较:分类标签。)

$ intelligent threat (I) A circumstance in which an adversary has the technical and operational ability to detect and exploit a vulnerability and also has the demonstrated, presumed, or inferred intent to do so. (See: threat.)

$ 智能威胁(I)对手具有检测和利用漏洞的技术和操作能力,并且具有已证明、假定或推断的意图的情况。(见:威胁。)

$ interception (I) A type of threat action whereby an unauthorized entity directly accesses sensitive data while the data is traveling between authorized sources and destinations. (See: unauthorized disclosure.)

$ 拦截(I)一种威胁行为,未经授权的实体在数据在授权源和目标之间传输时直接访问敏感数据。(请参阅:未经授权的披露。)

Usage: This type of threat action includes the following subtypes: - "Theft": Gaining access to sensitive data by stealing a shipment of a physical medium, such as a magnetic tape or disk, that holds the data. - "Wiretapping (passive)": Monitoring and recording data that is flowing between two points in a communication system. (See: wiretapping.) - "Emanations analysis": Gaining direct knowledge of communicated data by monitoring and resolving a signal that is emitted by a system and that contains the data but was not intended to communicate the data. (See: emanation.)


$ interference (I) /threat action/ See: secondary definition under "obstruction".

$ 干扰(I)/威胁行动/见“障碍”下的二级定义。

$ intermediate CA (D) The CA that issues a cross-certificate to another CA. [X509] (See: cross-certification.)

$ 中间CA(D)向另一CA颁发交叉证书的CA。[X509](请参阅:交叉证书。)

Deprecated Term: IDOCs SHOULD NOT use this term because it is not widely known and mixes concepts in a potentially misleading way. For example, suppose that end entity 1 ("EE1) is in one PKI ("PKI1"), end entity 2 ("EE2) is in another PKI ("PKI2"), and the root in PKI1 ("CA1") cross-certifies the root CA in PKI2 ("CA2"). Then, if EE1 constructs the certification path CA1-to-CA2-to-EE2 to validate a certificate of EE2, conventional English usage would describe CA2 as being in the "intermediate" position in that path, not CA1.


$ internal controls (I) /COMPUSEC/ Functions, features, and technical characteristics of computer hardware and software, especially of operating systems. Includes mechanisms to regulate the operation of a computer system with regard to access control, flow control, and inference control. (Compare: external controls.)

$ 内部控制(I)/COMPUSEC/计算机硬件和软件的功能、特征和技术特征,尤其是操作系统。包括在访问控制、流控制和推理控制方面调节计算机系统操作的机制。(比较:外部控件。)

$ International Data Encryption Algorithm (IDEA) (N) A patented, symmetric block cipher that uses a 128-bit key and operates on 64-bit blocks. [Schn] (See: symmetric cryptography.)

$ 国际数据加密算法(IDEA)(N):一种获得专利的对称分组密码,使用128位密钥,在64位块上运行。[Schn](请参阅:对称加密。)

$ International Standard (N) See: secondary definition under "ISO".

$ 国际标准(N)见“ISO”下的二级定义。

$ International Traffic in Arms Regulations (ITAR) (O) Rules issued by the U.S. State Department, by authority of the Arms Export Control Act (22 U.S.C. 2778), to control export and import of defense articles and defense services, including information security systems, such as cryptographic systems, and TEMPEST suppression technology. (See: type 1 product, Wassenaar Arrangement.)

$ 美国国务院根据《武器出口管制法》(22 U.S.C.2778)的授权发布的《国际武器贸易条例》(ITAR)(O)规则,用于控制国防用品和国防服务的进出口,包括信息安全系统,如密码系统和风暴抑制技术。(见:1类产品,瓦森纳安排)

$ internet, Internet 1. (I) /not capitalized/ Abbreviation of "internetwork".

$ 互联网,互联网1。(一) /未大写/是“internetwork”的缩写。

2. (I) /capitalized/ The Internet is the single, interconnected, worldwide system of commercial, governmental, educational, and other computer networks that share (a) the protocol suite specified by the IAB (RFC 2026) and (b) the name and address spaces managed by the ICANN. (See: Internet Layer, Internet Protocol Suite.)

2. (一) /capitalized/互联网是由商业、政府、教育和其他计算机网络组成的单一、互联的全球系统,共享(a)IAB(RFC 2026)指定的协议套件和(b)ICANN管理的名称和地址空间。(请参阅:Internet层,Internet协议套件。)

Usage: Use with definite article ("the") when using as a noun. For example, say "My LAN is small, but the Internet is large." Don't say "My LAN is small, but Internet is large."


$ Internet Architecture Board (IAB) (I) A technical advisory group of the ISOC, chartered by the ISOC Trustees to provide oversight of Internet architecture and protocols and, in the context of Internet Standards, a body to which decisions of the IESG may be appealed. Responsible for approving appointments to the IESG from among nominees submitted by the IETF nominating committee. (RFC 2026)

$ 互联网体系结构委员会(IAB)(I)互联网体系结构委员会的一个技术咨询小组,由互联网体系结构委员会受托人特许,负责监督互联网体系结构和协议,并在互联网标准的背景下,对互联网体系结构和协议进行监督。互联网体系结构委员会是一个可以对IESG的决定提出上诉的机构。负责从IETF提名委员会提交的提名人中批准IESG的任命。(RFC 2026)

$ Internet Assigned Numbers Authority (IANA) (I) From the early days of the Internet, the IANA was chartered by the ISOC and the U.S. Government's Federal Network Council to be the central coordination, allocation, and registration body for parameters for Internet protocols. Superseded by ICANN.

$ 互联网分配号码管理局(IANA)(I)从互联网诞生之初,IANA就被ISOC和美国政府联邦网络委员会特许成为互联网协议参数的中央协调、分配和注册机构。被ICANN取代。

$ Internet Control Message Protocol (ICMP) (I) An Internet Standard protocol (RFC 792) that is used to report error conditions during IP datagram processing and to exchange other information concerning the state of the IP network.

$ Internet控制消息协议(ICMP)(I)一种Internet标准协议(RFC 792),用于报告IP数据报处理期间的错误情况,并交换有关IP网络状态的其他信息。

$ Internet Corporation for Assigned Names and Numbers (ICANN) (I) The non-profit, private corporation that has assumed responsibility for the IP address space allocation, protocol parameter assignment, DNS management, and root server system management functions formerly performed under U.S. Government contract by IANA and other entities.

$ 互联网名称和号码分配公司(ICANN)(I)负责IP地址空间分配、协议参数分配、DNS管理和根服务器系统管理功能的非营利私人公司,以前由IANA和其他实体根据美国政府合同执行。

Tutorial: The IPS, as defined by the IETF and the IESG, contains numerous parameters, such as Internet addresses, domain names, autonomous system numbers, protocol numbers, port numbers, management information base OIDs, including private enterprise numbers, and many others. The Internet community requires that the values used in these parameter fields be assigned uniquely. ICANN makes those assignments as requested and maintains a registry of the current values.


ICANN was formed in October 1998, by a coalition of the Internet's business, technical, and academic communities. The U.S. Government designated ICANN to serve as the global consensus entity with responsibility for coordinating four key functions for the Internet: allocation of IP address space, assignment of protocol parameters, management of the DNS, and management of the DNS root server system.


$ Internet-Draft (I) A working document of the IETF, its areas, and its working groups. (RFC 2026) (Compare: RFC.)

$ 互联网草案(I)IETF及其领域和工作组的工作文件。(RFC 2026)(比较:RFC.)

Usage: The term is customarily hyphenated when used either as a adjective or a noun, even though the latter is not standard English punctuation.


Tutorial: An Internet-Draft is not an archival document like an RFC is. Instead, an Internet-Draft is a preliminary or working document that is valid for a maximum of six months and may be updated, replaced, or made obsolete by other documents at any time. It is inappropriate to use an Internet-Draft as reference material or to cite it other than as a "work in progress". Although most of the Internet-Drafts are produced by the IETF, any interested organization may request to have its working documents published as Internet-Drafts.


$ Internet Engineering Steering Group (IESG) (I) The part of the ISOC responsible for technical management of IETF activities and administration of the Internet Standards Process according to procedures approved by the ISOC Trustees. Directly responsible for actions along the "standards track", including final approval of specifications as Internet Standards. Composed of IETF Area Directors and the IETF chairperson, who also chairs the IESG. (RFC 2026)

$ 互联网工程指导小组(IESG)(I)ISOC的一部分,负责IETF活动的技术管理,并根据ISOC受托人批准的程序管理互联网标准过程。直接负责“标准轨道”上的行动,包括最终批准作为互联网标准的规范。由IETF区域总监和IETF主席组成,IETF主席也担任IESG主席。(RFC 2026)

$ Internet Engineering Task Force (IETF) (I) A self-organized group of people who make contributions to the development of Internet technology. The principal body engaged in developing Internet Standards, although not itself a part of the ISOC. Composed of Working Groups, which are arranged into Areas (such as the Security Area), each coordinated by one or more Area Directors. Nominations to the IAB and the IESG are made by a committee selected at random from regular IETF meeting attendees who have volunteered. (RFCs 2026, 3935) [R2323]

$ 互联网工程任务组(IETF)(I)为互联网技术的发展做出贡献的自组织团队。参与制定互联网标准的主体机构,尽管其本身不是ISOC的一部分。由工作组组成,工作组分为多个区域(如安全区域),每个区域由一名或多名区域主管协调。IAB和IESG的提名由一个委员会进行,该委员会从自愿参加IETF定期会议的与会者中随机选出。(RFCs 20263935)[R2323]

$ Internet Key Exchange (IKE) (I) An Internet, IPsec, key-establishment protocol [R4306] for putting in place authenticated keying material (a) for use with ISAKMP and (b) for other security associations, such as in AH and ESP.

$ 互联网密钥交换(IKE)(I)互联网、IPsec、密钥建立协议[R4306],用于放置经过身份验证的密钥材料(a)用于ISAKMP,以及(b)用于其他安全关联,如AH和ESP。

Tutorial: IKE is based on three earlier protocol designs: ISAKMP, OAKLEY, and SKEME.


$ Internet Layer (I) See: Internet Protocol Suite.

$ 互联网层(I)见:互联网协议套件。

$ Internet Message Access Protocol, version 4 (IMAP4) (I) An Internet protocol (RFC 2060) by which a client workstation can dynamically access a mailbox on a server host to manipulate

$ Internet消息访问协议,版本4(IMAP4)(I)一种Internet协议(RFC 2060),通过该协议,客户端工作站可以动态访问服务器主机上的邮箱以进行操作

and retrieve mail messages that the server has received and is holding for the client. (See: POP3.)


Tutorial: IMAP4 has mechanisms for optionally authenticating a client to a server and providing other security services. (See: IMAP4 AUTHENTICATE.)


$ Internet Open Trading Protocol (IOTP) (I) An Internet protocol [R2801] proposed as a general framework for Internet commerce, able to encapsulate transactions of various proprietary payment systems (e.g., GeldKarte, Mondex, SET, Visa Cash). Provides optional security services by incorporating various Internet security mechanisms (e.g., MD5) and protocols (e.g., TLS).

$ 互联网开放交易协议(IOTP)(I)互联网协议[R2801]被提议作为互联网商务的通用框架,能够封装各种专有支付系统(如Geldkart、Mondex、SET、Visa Cash)的交易。通过整合各种互联网安全机制(如MD5)和协议(如TLS),提供可选的安全服务。

$ Internet Policy Registration Authority (IPRA) (I) An X.509-compliant CA that is the top CA of the Internet certification hierarchy operated under the auspices of the ISOC [R1422]. (See: /PEM/ under "certification hierarchy".)

$ 互联网政策注册机构(IPRA)(I)一个符合X.509标准的CA,它是在ISOC[R1422]主持下运行的互联网认证体系的顶级CA。(请参阅“认证层次结构”下的:/PEM/。)

$ Internet Private Line Interface (IPLI) (O) A successor to the PLI, updated to use TCP/IP and newer military-grade COMSEC equipment (TSEC/KG-84). The IPLI was a portable, modular system that was developed for use in tactical, packet-radio networks. (See: end-to-end encryption.)

$ 互联网专用线路接口(IPLI)(O)是PLI的继任者,更新为使用TCP/IP和更新的军用级通信安全设备(TSEC/KG-84)。IPLI是一种便携式模块化系统,开发用于战术分组无线电网络。(请参阅:端到端加密。)

$ Internet Protocol (IP) (I) An Internet Standard, Internet-Layer protocol that moves datagrams (discrete sets of bits) from one computer to another across an internetwork but does not provide reliable delivery, flow control, sequencing, or other end-to-end services that TCP provides. IP version 4 (IPv4) is specified in RFC 791, and IP version 6 (IPv6) is specified in RFC 2460. (See: IP address, TCP/IP.)

$ 互联网协议(IP)(I)一种互联网标准、互联网层协议,通过互联网将数据报(离散的比特集)从一台计算机移动到另一台计算机,但不提供可靠的传输、流量控制、排序或TCP提供的其他端到端服务。RFC 791中指定了IP版本4(IPv4),RFC 2460中指定了IP版本6(IPv6)。(请参阅:IP地址,TCP/IP。)

Tutorial: If IP were used in an OSIRM stack, IP would be placed at the top of Layer 3, above other Layer 3 protocols in the stack.


In any IPS stack, IP is always present in the Internet Layer and is always placed at the top of that layer, on top of any other protocols that are used in that layer. In some sense, IP is the only protocol specified for the IPS Internet Layer; other protocols used there, such as AH and ESP, are just IP variations.

在任何IP协议栈中,IP始终存在于Internet层中,并且始终位于该层的顶部,位于该层中使用的任何其他协议的顶部。在某种意义上,IP是为IPS Internet层指定的唯一协议;那里使用的其他协议,如AH和ESP,只是IP的变体。

$ Internet Protocol security See: IP Security Protocol.

$ Internet协议安全请参阅:IP安全协议。

$ Internet Protocol Security Option (IPSO) (I) Refers to one of three types of IP security options, which are fields that may be added to an IP datagram for carrying security information about the datagram. (Compare: IPsec.)

$ 互联网协议安全选项(IPSO)(I)是指三种类型的IP安全选项之一,它们是可添加到IP数据报的字段,用于承载关于数据报的安全信息。(比较:IPsec。)

      Deprecated Usage: IDOCs SHOULD NOT use this term without a
      modifier to indicate which of the following three types is meant:
      -  "DoD Basic Security Option" (IP option type 130): Defined for
         use on U.S. DoD common-use data networks. Identifies the DoD
         classification level at which the datagram is to be protected
         and the protection authorities whose rules apply to the
         datagram. (A "protection authority" is a National Access
         Program (e.g., GENSER, SIOP-ESI, SCI, NSA, Department of
         Energy) or Special Access Program that specifies protection
         rules for transmission and processing of the information
         contained in the datagram.) [R1108]
      -  "DoD Extended Security Option" (IP option type 133): Permits
         additional security labeling information, beyond that present
         in the Basic Security Option, to be supplied in the datagram to
         meet the needs of registered authorities. [R1108]
      -  "Common IP Security Option" (CIPSO) (IP option type 134):
         Designed by TSIG to carry hierarchic and non-hierarchic
         security labels. (Formerly called "Commercial IP Security
         Option"; a version 2.3 draft was published 9 March 1993 as an
         Internet-Draft but did not advance to RFC form.) [CIPSO]
      Deprecated Usage: IDOCs SHOULD NOT use this term without a
      modifier to indicate which of the following three types is meant:
      -  "DoD Basic Security Option" (IP option type 130): Defined for
         use on U.S. DoD common-use data networks. Identifies the DoD
         classification level at which the datagram is to be protected
         and the protection authorities whose rules apply to the
         datagram. (A "protection authority" is a National Access
         Program (e.g., GENSER, SIOP-ESI, SCI, NSA, Department of
         Energy) or Special Access Program that specifies protection
         rules for transmission and processing of the information
         contained in the datagram.) [R1108]
      -  "DoD Extended Security Option" (IP option type 133): Permits
         additional security labeling information, beyond that present
         in the Basic Security Option, to be supplied in the datagram to
         meet the needs of registered authorities. [R1108]
      -  "Common IP Security Option" (CIPSO) (IP option type 134):
         Designed by TSIG to carry hierarchic and non-hierarchic
         security labels. (Formerly called "Commercial IP Security
         Option"; a version 2.3 draft was published 9 March 1993 as an
         Internet-Draft but did not advance to RFC form.) [CIPSO]

$ Internet Protocol Suite (IPS) (I) The set of network communication protocols that are specified by the IETF, and approved as Internet Standards by the IESG, within the oversight of the IAB. (See: OSIRM Security Architecture. Compare: OSIRM.)

$ 互联网协议套件(IPS)(I)由IETF指定并由IESG批准为互联网标准的一组网络通信协议,由IAB监督。(请参阅:OSIRM安全体系结构。比较:OSIRM。)

Usage: This set of protocols is popularly known as "TCP/IP" because TCP and IP are its most basic and important components.


For clarity, this Glossary refers to IPS protocol layers by name and capitalizes those names, and refers to OSIRM protocol layers by number.


Tutorial: The IPS does have architectural principles [R1958], but there is no Internet Standard that defines a layered IPS reference model like the OSIRM. Still, Internet community literature has referred (inconsistently) to IPS layers since early in the Internet's development [Padl].


This Glossary treats the IPS as having five protocol layers -- Application, Transport, Internet, Network Interface, and Network Hardware (or Network Substrate) -- which are illustrated in the following diagram:


      OSIRM Layers       Examples          IPS Layers     Examples
      ------------------ ---------------  --------------- --------------
      Message Format:    P2   [X420]      Message Format: ARPA (RFC 822)
      +----------------+                  +-------------+
      |7.Application   | P1   [X419]      | Application | SMTP (RFC 821)
      +----------------+ -  -  -  -  -  - |             |
      |6.Presentation  |      [I8823]     |             |
      +----------------+ -  -  -  -  -  - |             |
      |5.Session       |      [I8327]     +-------------+
      +----------------+ -  -  -  -  -  - |  Transport  | TCP  (RFC 793)
      |4.Transport     | TP4  [I8073]     |             |
      +----------------+ -  -  -  -  -  - +-------------+
      |3.Network       | CLNP [I8473]     |  Internet   | IP   (RFC 791)
      |                |                  +-------------+
      |                |                  |   Network   | IP over IEEE
      +----------------+ -  -  -  -  -  - |  Interface  | 802 (RFC 1042)
      |2.Data Link     |                  +-------------+
      |                | LLC  [I8802-2]   -   Network   - The IPS does
      |                | MAC  [I8802-3]   -  Hardware   - not include
      +----------------+                  - (or Network - standards for
      |1.Physical      | Baseband         -  Substrate) - this layer.
      +----------------+ Signaling [Stal] + - - - - - - +
      OSIRM Layers       Examples          IPS Layers     Examples
      ------------------ ---------------  --------------- --------------
      Message Format:    P2   [X420]      Message Format: ARPA (RFC 822)
      +----------------+                  +-------------+
      |7.Application   | P1   [X419]      | Application | SMTP (RFC 821)
      +----------------+ -  -  -  -  -  - |             |
      |6.Presentation  |      [I8823]     |             |
      +----------------+ -  -  -  -  -  - |             |
      |5.Session       |      [I8327]     +-------------+
      +----------------+ -  -  -  -  -  - |  Transport  | TCP  (RFC 793)
      |4.Transport     | TP4  [I8073]     |             |
      +----------------+ -  -  -  -  -  - +-------------+
      |3.Network       | CLNP [I8473]     |  Internet   | IP   (RFC 791)
      |                |                  +-------------+
      |                |                  |   Network   | IP over IEEE
      +----------------+ -  -  -  -  -  - |  Interface  | 802 (RFC 1042)
      |2.Data Link     |                  +-------------+
      |                | LLC  [I8802-2]   -   Network   - The IPS does
      |                | MAC  [I8802-3]   -  Hardware   - not include
      +----------------+                  - (or Network - standards for
      |1.Physical      | Baseband         -  Substrate) - this layer.
      +----------------+ Signaling [Stal] + - - - - - - +

The diagram approximates how the five IPS layers align with the seven OSIRM layers, and it offers examples of protocol stacks that provide roughly equivalent electronic mail service over a private LAN that uses baseband signaling.


- IPS Application Layer: The user runs an application program. The program selects the data transport service it needs -- either a sequence of data messages or a continuous stream of data -- and hands application data to the Transport Layer for delivery.

- IPS应用层:用户运行应用程序。程序选择它需要的数据传输服务——一系列数据消息或连续的数据流——并将应用程序数据交给传输层进行传输。

- IPS Transport Layer: This layer divides application data into packets, adds a destination address to each, and communicates them end-to-end -- from one application program to another -- optionally regulating the flow and ensuring reliable (error-free and sequenced) delivery.

- IPS传输层:该层将应用程序数据分为多个数据包,为每个数据包添加一个目的地地址,并端到端地进行通信(从一个应用程序到另一个应用程序),可以选择调节流量并确保可靠(无错误且有序)交付。

- IPS Internet Layer: This layer carries transport packets in IP datagrams. It moves each datagram independently, from its source computer to its addressed destination computer, routing

- IPS互联网层:该层承载IP数据报中的传输包。它独立地将每个数据报从其源计算机移动到其寻址的目标计算机(路由)

the datagram through a sequence of networks and relays and selecting appropriate network interfaces en route.


- IPS Network Interface Layer: This layer accepts datagrams for transmission over a specific network. This layer specifies interface conventions for carrying IP over OSIRM Layer 3 protocols and over Media Access Control sublayer protocols of OSIRM Layer 2. An example is IP over IEEE 802 (RFD 1042).

- IPS网络接口层:该层接受通过特定网络传输的数据报。该层指定通过OSIRM第3层协议和OSIRM第2层的媒体访问控制子层协议承载IP的接口约定。一个例子是IEEE802上的IP(RFD1042)。

- IPS Network Hardware Layer: This layer consists of specific, physical communication media. However, the IPS does not specify its own peer-to-peer protocols in this layer. Instead, the layering conventions specified by the Network Interface Layer use Layer 2 and Layer 3 protocols that are specified by bodies other than the IETF. That is, the IPS addresses *inter*-network functions and does not address *intra*-network functions.

- IPS网络硬件层:该层由特定的物理通信媒体组成。但是,IPS在此层中没有指定自己的对等协议。相反,网络接口层指定的分层约定使用IETF以外的机构指定的第2层和第3层协议。也就是说,IP地址*内部*网络功能,而不地址*内部*网络功能。

The two models are most dissimilar in the upper layers, where the IPS model does not include Session and Presentation layers. However, this omission causes fewer functional differences between the models than might be imagined, and the differences have relatively few security implications:


- Formal separation of OSIRM Layers 5, 6, and 7 is not needed in implementations; the functions of these layers sometimes are mixed in a single software unit, even in protocols in the OSI suite.

- 实现中不需要OSIRM第5、6和7层的正式分离;这些层的功能有时混合在单个软件单元中,甚至在OSI套件中的协议中也是如此。

- Some OSIRM Layer 5 services -- for example, connection termination -- are built into TCP, and the remaining Layer 5 and 6 functions are built into IPS Application-Layer protocols where needed.

- 一些OSIRM第5层服务(例如,连接终止)内置于TCP中,其余第5层和第6层功能在需要时内置于IPS应用层协议中。

- The OSIRM does not place any security services in Layer 5 (see: OSIRM Security Architecture).

- OSIRM没有在第5层中放置任何安全服务(请参阅:OSIRM安全体系结构)。

- The lack of an explicit Presentation Layer in the IPS sometimes makes it simpler to implement security in IPS applications. For example, a primary function of Layer 6 is to convert data between internal and external forms, using a transfer syntax to unambiguously encode data for transmission. If an OSIRM application encrypts data to protect against disclosure during transmission, the transfer encoding must be done before the encryption. If an application does encryption, as is done in OSI message handling and directory service protocols, then Layer 6 functions must be replicated in Layer 7. [X400, X500].

- IPS中缺乏明确的表示层,这使得在IPS应用程序中实现安全性变得更加简单。例如,第6层的主要功能是在内部和外部表单之间转换数据,使用传输语法对数据进行明确编码以进行传输。如果OSIRM应用程序对数据进行加密以防止传输过程中的泄露,则必须在加密之前进行传输编码。如果应用程序进行加密,就像OSI消息处理和目录服务协议中所做的那样,那么第6层功能必须在第7层中复制。[X400,X500]。

The two models are most alike at the top of OSIRM Layer 3, where the OSI Connectionless Network Layer Protocol (CLNP) and the IPS IP are quite similar. Connection-oriented security services offered in OSIRM Layer 3 are inapplicable in the IPS, because the IPS Internet Layer lacks the explicit, connection-oriented service offered in the OSIRM.

这两个模型在OSIRM第3层的顶部最为相似,OSI无连接网络层协议(CLNP)和IPS IP非常相似。OSIRM第3层中提供的面向连接的安全服务不适用于IPS,因为IPS Internet层缺少OSIRM中提供的明确的、面向连接的服务。

$ Internet Security Association and Key Management Protocol (ISAKMP) (I) An Internet IPsec protocol [R2408] to negotiate, establish, modify, and delete security associations, and to exchange key generation and authentication data, independent of the details of any specific key generation technique, key establishment protocol, encryption algorithm, or authentication mechanism.

$ 互联网安全关联和密钥管理协议(ISAKMP)(I)互联网IPsec协议[R2408],用于协商、建立、修改和删除安全关联,以及交换密钥生成和认证数据,与任何特定密钥生成技术、密钥建立协议、加密算法的细节无关,或身份验证机制。

Tutorial: ISAKMP supports negotiation of security associations for protocols at all IPS layers. By centralizing management of security associations, ISAKMP reduces duplicated functionality within each protocol. ISAKMP can also reduce connection setup time, by negotiating a whole stack of services at once. Strong authentication is required on ISAKMP exchanges, and a digital signature algorithm based on asymmetric cryptography is used within ISAKMP's authentication component.


ISAKMP negotiations are conducted in two "phases": - "Phase 1 negotiation". A phase 1 negotiation establishes a security association to be used by ISAKMP to protect its own protocol operations. - "Phase 2 negotiation". A phase 2 negotiation (which is protected by a security association that was established by a phase 1 negotiation) establishes a security association to be used to protect the operations of a protocol other than ISAKMP, such as ESP.


$ Internet Society (ISOC) (I) A professional society concerned with Internet development (including technical Internet Standards); with how the Internet is and can be used; and with social, political, and technical issues that result. The ISOC Board of Trustees approves appointments to the IAB from among nominees submitted by the IETF nominating committee. (RFC 2026)

$ 互联网协会(ISOC)(I)一个关注互联网发展(包括互联网技术标准)的专业协会;互联网是如何使用的;以及由此产生的社会、政治和技术问题。ISOC董事会从IETF提名委员会提交的提名人中批准IAB的任命。(RFC 2026)

$ Internet Standard (I) A specification, approved by the IESG and published as an RFC, that is stable and well-understood, is technically competent, has multiple, independent, and interoperable implementations with substantial operational experience, enjoys significant public support, and is recognizably useful in some or all parts of the Internet. (RFC 2026) (Compare: RFC.)

$ 互联网标准(I)由IESG批准并作为RFC发布的规范,其稳定且易于理解,具有技术能力,具有多个独立且可互操作的实施方案,具有丰富的运营经验,得到了公众的大力支持,并且在互联网的部分或所有部分都非常有用。(RFC 2026)(比较:RFC.)

Tutorial: The "Internet Standards Process" is an activity of the ISOC and is organized and managed by the IAB and the IESG. The process is concerned with all protocols, procedures, and conventions used in or by the Internet, whether or not they are part of the IPS. The "Internet Standards Track" has three levels of increasing maturity: Proposed Standard, Draft Standard, and Standard. (Compare: ISO, W3C.)


$ internetwork (I) A system of interconnected networks; a network of networks. Usually shortened to "internet". (See: internet, Internet.)

$ 互联网络(I)互联网络系统;网络的网络。通常简称为“互联网”。(请参阅:internet,internet。)

Tutorial: An internet can be built using OSIRM Layer 3 gateways to implement connections between a set of similar subnetworks. With dissimilar subnetworks, i.e., subnetworks that differ in the Layer 3 protocol service they offer, an internet can be built by implementing a uniform internetwork protocol (e.g., IP) that operates at the top of Layer 3 and hides the underlying subnetworks' heterogeneity from hosts that use communication services provided by the internet. (See: router.)


$ intranet (I) A computer network, especially one based on Internet technology, that an organization uses for its own internal (and usually private) purposes and that is closed to outsiders. (See: extranet, VPN.)

$ 内联网(I)一种计算机网络,特别是基于互联网技术的网络,一个组织为了自己的内部(通常是私人)目的而使用,并且对外部开放。(请参阅:外部网、VPN。)

$ intruder (I) An entity that gains or attempts to gain access to a system or system resource without having authorization to do so. (See: intrusion. Compare: adversary, cracker, hacker.)

$ 入侵者(I)未经授权而获取或试图获取对系统或系统资源访问权限的实体。(请参阅:入侵。比较:敌手、黑客、黑客。)

$ intrusion 1. (I) A security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system or system resource without having authorization to do so. (See: IDS.)

$ 入侵1。(一) 构成安全事件的一种安全事件或多个安全事件的组合,其中入侵者未经授权获取或试图获取对系统或系统资源的访问权。(请参阅:IDS。)

2. (I) A type of threat action whereby an unauthorized entity gains access to sensitive data by circumventing a system's security protections. (See: unauthorized disclosure.)

2. (一) 一种威胁行为,未经授权的实体通过绕过系统的安全保护来访问敏感数据。(请参阅:未经授权的披露。)

Usage: This type of threat action includes the following subtypes: - "Trespass": Gaining physical access to sensitive data by circumventing a system's protections. - "Penetration": Gaining logical access to sensitive data by circumventing a system's protections.


- "Reverse engineering": Acquiring sensitive data by disassembling and analyzing the design of a system component. - "Cryptanalysis": Transforming encrypted data into plain text without having prior knowledge of encryption parameters or processes. (See: main entry for "cryptanalysis".)

- “逆向工程”:通过分解和分析系统组件的设计来获取敏感数据。-“密码分析”:将加密数据转换为纯文本,而无需事先了解加密参数或过程。(请参阅“密码分析”的主条目。)

$ intrusion detection (I) Sensing and analyzing system events for the purpose of noticing (i.e., becoming aware of) attempts to access system resources in an unauthorized manner. (See: anomaly detection, IDS, misuse detection. Compare: extrusion detection.) [IDSAN, IDSSC, IDSSE, IDSSY]

$ 入侵检测(I)感应和分析系统事件,以发现(即意识到)以未经授权的方式访问系统资源的企图。(请参阅:异常检测、IDS、误用检测。比较:挤出检测。)[IDSAN、IDSSC、IDSSE、IDSSY]

Usage: This includes the following subtypes: - "Active detection": Real-time or near-real-time analysis of system event data to detect current intrusions, which result in an immediate protective response. - "Passive detection": Off-line analysis of audit data to detect past intrusions, which are reported to the system security officer for corrective action. (Compare: security audit.)


$ intrusion detection system (IDS) 1. (N) A process or subsystem, implemented in software or hardware, that automates the tasks of (a) monitoring events that occur in a computer network and (b) analyzing them for signs of security problems. [SP31] (See: intrusion detection.)

$ 入侵检测系统(IDS)1。(N) 一种用软件或硬件实现的过程或子系统,它自动执行以下任务:(A)监视计算机网络中发生的事件,以及(b)分析这些事件是否有安全问题的迹象。[SP31](请参阅:入侵检测。)

2. (N) A security alarm system to detect unauthorized entry. [DC6/9].

2. (N) 用于检测未经授权进入的安全报警系统。[DC6/9]。

Tutorial: Active intrusion detection processes can be either host-based or network-based: - "Host-based": Intrusion detection components -- traffic sensors and analyzers -- run directly on the hosts that they are intended to protect. - "Network-based": Sensors are placed on subnetwork components, and analysis components run either on subnetwork components or hosts.


$ invalidity date (N) An X.509 CRL entry extension that "indicates the date at which it is known or suspected that the [revoked certificate's private key] was compromised or that the certificate should otherwise be considered invalid." [X509].

$ 无效日期(N)X.509 CRL条目扩展,“表示已知或怀疑[已撤销证书的私钥]被泄露的日期,或该证书应被视为无效的日期。”[X509]。

Tutorial: This date may be earlier than the revocation date in the CRL entry, and may even be earlier than the date of issue of earlier CRLs. However, the invalidity date is not, by itself,


sufficient for purposes of non-repudiation service. For example, to fraudulently repudiate a validly generated signature, a private key holder may falsely claim that the key was compromised at some time in the past.


$ IOTP (I) See: Internet Open Trading Protocol.

$ IOTP(I)见:互联网开放交易协议。

$ IP (I) See: Internet Protocol.

$ IP(I)见:互联网协议。

$ IP address (I) A computer's internetwork address that is assigned for use by IP and other protocols.

$ IP地址(I)分配给IP和其他协议使用的计算机网络间地址。

Tutorial: An IP version 4 address (RFC 791) has four 8-bit parts and is written as a series of four decimal numbers separated by periods. Example: The address of the host named "" is

教程:IP版本4地址(RFC 791)有四个8位部分,由四个小数点组成,以句点分隔。示例:名为“”的主机的地址是192.1.7.10。

An IP version 6 address (RFC 2373) has eight 16-bit parts and is written as eight hexadecimal numbers separated by colons. Examples: 1080:0:0:0:8:800:200C:417A and FEDC:BA98:7654:3210:FEDC:BA98:7654:3210.

IP版本6地址(RFC 2373)有八个16位部分,由八个十六进制数字组成,用冒号分隔。示例:1080:0:0:0:8:800:200C:417A和FEDC:BA98:7654:3210:FEDC:BA98:7654:3210。

$ IP Security Option (I) See: Internet Protocol Security Option.

$ IP安全选项(I)请参阅:Internet协议安全选项。

$ IP Security Protocol (IPsec) 1a. (I) The name of the IETF working group that is specifying an architecture [R2401, R4301] and set of protocols to provide security services for IP traffic. (See: AH, ESP, IKE, SAD, SPD. Compare: IPSO.)

$ IP安全协议(IPsec)1a。(一) 指定体系结构[R2401,R4301]和协议集以提供IP通信安全服务的IETF工作组的名称。(参见:啊,ESP,IKE,SAD,SPD。比较:IPSO。)

1b. (I) A collective name for the IP security architecture [R4301] and associated set of protocols (primarily AH, ESP, and IKE).

1b。(一) IP安全体系结构[R4301]和相关协议集(主要是AH、ESP和IKE)的统称。

Usage: In IDOCs that use the abbreviation "IPsec", the letters "IP" SHOULD be in uppercase, and the letters "sec" SHOULD NOT.


Tutorial: The security services provided by IPsec include access control service, connectionless data integrity service, data origin authentication service, protection against replays (detection of the arrival of duplicate datagrams, within a constrained window), data confidentiality service, and limited traffic-flow confidentiality. IPsec specifies (a) security protocols (AH and ESP), (b) security associations (what they are, how they work, how they are managed, and associated processing),


(c) key management (IKE), and (d) algorithms for authentication and encryption. Implementation of IPsec is optional for IP version 4, but mandatory for IP version 6. (See: transport mode, tunnel mode.)

(c) 密钥管理(IKE)和(d)认证和加密算法。IPsec的实现对于IP版本4是可选的,但是对于IP版本6是强制性的。(请参见:传输模式、隧道模式。)

$ IPLI (I) See: Internet Private Line Interface.

$ IPLI(I)见:互联网专线接口。

$ IPRA (I) See: Internet Policy Registration Authority.

$ IPRA(I)见:互联网政策注册机构。

$ IPS (I) See: Internet Protocol Suite.

$ IPS(I)见:互联网协议套件。

$ IPsec (I) See: IP Security Protocol.

$ IPsec(I)见:IP安全协议。

$ IPSO (I) See: Internet Protocol Security Option.

$ IPSO(I)见:互联网协议安全选项。

$ ISAKMP (I) See: Internet Security Association and Key Management Protocol.

$ ISAKMP(I)参见:互联网安全关联和密钥管理协议。

$ ISO (I) International Organization for Standardization, a voluntary, non-treaty, non-governmental organization, established in 1947, with voting members that are designated standards bodies of participating nations and non-voting observer organizations. (Compare: ANSI, IETF, ITU-T, W3C.)

$ ISO(I)国际标准化组织,一个自愿、非条约、非政府组织,成立于1947年,有投票权的成员是参与国的指定标准机构和无投票权的观察员组织。(比较:ANSI、IETF、ITU-T、W3C。)

Tutorial: Legally, ISO is a Swiss, non-profit, private organization. ISO and the IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in developing international standards through ISO and IEC technical committees that deal with particular fields of activity. Other international governmental and non-governmental organizations, in liaison with ISO and IEC, also take part. (ANSI is the U.S. voting member of ISO. ISO is a class D member of ITU-T.)


The ISO standards development process has four levels of increasing maturity: Working Draft (WD), Committee Draft (CD), Draft International Standard (DIS), and International Standard (IS). (Compare: "Internet Standards Track" under "Internet Standard".) In information technology, ISO and IEC have a joint technical committee, ISO/IEC JTC 1. DISs adopted by JTC 1 are

ISO标准开发过程有四个日益成熟的层次:工作草案(WD)、委员会草案(CD)、国际标准草案(DIS)和国际标准(IS)。(比较“互联网标准”下的“互联网标准轨道”。)在信息技术领域,ISO和IEC有一个联合技术委员会,即ISO/IEC JTC 1。JTC 1采用的DIS为

circulated to national bodies for voting, and publication as an IS requires approval by at least 75% of the national bodies casting a vote.


$ ISO 17799 (N) An International Standard that is a code of practice, derived from Part 1 of British Standard 7799, for managing the security of information systems in an organization. This standard does not provide definitive or specific material on any security topic. It provides general guidance on a wide variety of topics, but typically does not go into depth. (See: IATF, [SP14].)

$ ISO 17799(N)源自英国标准7799第1部分的一种国际标准,是一种实践规范,用于管理组织中信息系统的安全性。本标准不提供任何安全主题的最终或特定材料。它提供了广泛主题的一般指导,但通常不深入。(参见:IATF,[SP14]。)

$ ISOC (I) See: Internet Society.

$ ISOC(I)见:互联网协会。

$ issue (I) /PKI/ Generate and sign a digital certificate (or a CRL) and, usually, distribute it and make it available to potential certificate users (or CRL users). (See: certificate creation.)

$ 颁发(I)/PKI/生成并签署数字证书(或CRL),通常分发该证书并将其提供给潜在的证书用户(或CRL用户)。(请参阅:证书创建。)

Usage: The term "issuing" is usually understood to refer not only to creating a digital certificate (or a CRL) but also to making it available to potential users, such as by storing it in a repository or other directory or otherwise publishing it. However, the ABA [DSG] explicitly limits this term to the creation process and excludes any related publishing or distribution process.


$ issuer 1. (I) /certificate, CRL/ The CA that signs a digital certificate or CRL.

$ 发行人1。(一) /certificate,CRL/签署数字证书或CRL的CA。

Tutorial: An X.509 certificate always includes the issuer's name. The name may include a common name value.


2. (O) /payment card, SET/ "The financial institution or its agent that issues the unique primary account number to the cardholder for the payment card brand." [SET2]

2. (O) /支付卡,SET/“为支付卡品牌向持卡人发放唯一主账号的金融机构或其代理机构。”[SET2]

Tutorial: The institution that establishes the account for a cardholder and issues the payment card also guarantees payment for authorized transactions that use the card in accordance with card brand regulations and local legislation. [SET1]


$ ITAR (O) See: International Traffic in Arms Regulations.

$ ITAR(O)见:国际武器贩运条例。

$ ITSEC (N) See: Information Technology System Evaluation Criteria.

$ ITSEC(N)见:信息技术系统评估标准。

$ ITU-T (N) International Telecommunications Union, Telecommunication Standardization Sector (formerly "CCITT"), a United Nations treaty organization that is composed mainly of postal, telephone, and telegraph authorities of the member countries and that publishes standards called "Recommendations". (See: X.400, X.500.)

$ ITU-T(N)国际电信联盟,电信标准化部门(前身为“CCITT”),一个联合国条约组织,主要由成员国的邮政、电话和电报部门组成,发布称为“建议”的标准。(见:X.400、X.500)

Tutorial: The Department of State represents the United States. ITU-T works on many kinds of communication systems. ITU-T cooperates with ISO on communication protocol standards, and many Recommendations in that area are also published as an ISO standard with an ISO name and number.


$ IV (I) See: initialization value.

$ IV(I)见:初始化值。

$ jamming (N) An attack that attempts to interfere with the reception of broadcast communications. (See: anti-jam, denial of service. Compare: flooding.)

$ 干扰(N)试图干扰广播通信接收的攻击。(请参阅:抗干扰、拒绝服务。比较:泛洪。)

Tutorial: Jamming uses "interference" as a type of "obstruction" intended to cause "disruption". Jamming a broadcast signal is typically done by broadcasting a second signal that receivers cannot separate from the first one. Jamming is mainly thought of in the context of wireless communication, but also can be done in some wired technologies, such as LANs that use contention techniques to share a broadcast medium.


$ KAK (D) See: key-auto-key. (Compare: KEK.)

$ KAK(D)参见:钥匙自动钥匙。(比较:KEK)

$ KDC (I) See: Key Distribution Center.

$ KDC(一)见:钥匙配送中心。

$ KEA (N) See: Key Exchange Algorithm.

$ KEA(N)参见:密钥交换算法。

$ KEK (I) See: key-encrypting key. (Compare: KAK.)

$ KEK(I)参见:密钥加密密钥。(比较:KAK。)

$ Kerberos (I) A system developed at the Massachusetts Institute of Technology that depends on passwords and symmetric cryptography (DES) to implement ticket-based, peer entity authentication service and access control service distributed in a client-server network environment. [R4120, Stei] (See: realm.)

$ Kerberos(I)麻省理工学院开发的一种系统,依靠密码和对称加密(DES)实现分布在客户机-服务器网络环境中的基于票据的对等实体身份验证服务和访问控制服务。[R4120,Stei](参见:领域)

Tutorial: Kerberos was originally developed by Project Athena and is named for the mythical three-headed dog that guards Hades. The system architecture includes authentication servers and ticket-granting servers that function as an ACC and a KDC.


RFC 4556 describes extensions to the Kerberos specification that modify the initial authentication exchange between a client and the KDC. The extensions employ public-key cryptography to enable the client and KDC to mutually authenticate and establish shared, symmetric keys that are used to complete the exchange. (See: PKINIT.)


$ kernel (I) A small, trusted part of a system that provides services on which the other parts of the system depend. (See: security kernel.)

$ 内核(I)系统的一个小的、可信任的部分,它提供系统其他部分所依赖的服务。(请参阅:安全内核。)

$ Kernelized Secure Operating System (KSOS) (O) An MLS computer operating system, designed to be a provably secure replacement for UNIX Version 6, and consisting of a security kernel, non-kernel security-related utility programs, and optional UNIX application development and support environments. [Perr]

$ 内核化安全操作系统(KSOS)(O):一种MLS计算机操作系统,旨在作为UNIX版本6的可证明安全的替代品,由安全内核、非内核安全相关实用程序以及可选的UNIX应用程序开发和支持环境组成。[佩尔]

Tutorial: KSOS-6 was the implementation on a SCOMP. KSOS-11 was the implementation by Ford Aerospace and Communications Corporation on the DEC PDP-11/45 and PDP-11/70 computers.

教程:KSOS-6是SCOMP上的实现。KSOS-11是福特航空航天通信公司在DEC PDP-11/45和PDP-11/70计算机上实施的。

$ key 1a. (I) /cryptography/ An input parameter used to vary a transformation function performed by a cryptographic algorithm. (See: private key, public key, storage key, symmetric key, traffic key. Compare: initialization value.)

$ 图例1a。(一) /cryptography/用于改变加密算法执行的转换函数的输入参数。(请参阅:私钥、公钥、存储密钥、对称密钥、流量密钥。比较:初始化值。)

1b. (O) /cryptography/ Used in singular form as a collective noun referring to keys or keying material. Example: A fill device can be used transfer key between two cryptographic devices.

1b。(O) /cryptography/以单数形式用作一个集合名词,指密钥或密钥材料。示例:可以使用填充设备在两个加密设备之间传输密钥。

2. (I) /anti-jam/ An input parameter used to vary a process that determines patterns for an anti-jam measure. (See: frequency hopping, spread spectrum.)

2. (一) /anti-jam/一个输入参数,用于改变确定防干扰措施模式的流程。(参见:跳频、扩频。)

Tutorial: A key is usually specified as a sequence of bits or other symbols. If a key value needs to be kept secret, the sequence of symbols that comprise it should be random, or at least pseudorandom, because that makes the key harder for an adversary to guess. (See: brute-force attack, cryptanalysis, strength.)


$ key agreement (algorithm or protocol) 1. (I) A key establishment method (especially one involving asymmetric cryptography) by which two or more entities, without prior arrangement except a public exchange of data (such as public keys), each can generate the same key value. That is, the method does not send a secret from one entity to the other; instead, both entities, without prior arrangement except a public exchange of data, can compute the same secret value, but that value cannot be computed by other, unauthorized entities. (See: Diffie-Hellman-Merkle, key establishment, KEA, MQV. Compare: key transport.)

$ 密钥协议(算法或协议)1。(一) 一种密钥建立方法(特别是涉及非对称加密的方法),通过这种方法,两个或多个实体,除公开数据交换(如公钥)外,无需事先安排,都可以生成相同的密钥值。即,该方法不将秘密从一个实体发送到另一个实体;相反,两个实体在没有事先安排的情况下(除了公开数据交换),都可以计算相同的秘密值,但该值不能由其他未经授权的实体计算。(参见:Diffie Hellman Merkle,密钥建立,KEA,MQV。比较:密钥传输。)

2. (O) "A method for negotiating a key value on line without transferring the key, even in an encrypted form, e.g., the Diffie-Hellman technique." [X509] (See: Diffie-Hellman-Merkle.)

2. (O) “一种在线协商密钥值而不传输密钥的方法,即使是加密形式,例如Diffie-Hellman技术。”[X509](参见:Diffie-Hellman-Merkle。)

3. (O) "The procedure whereby two different parties generate shared symmetric keys such that any of the shared symmetric keys is a function of the information contributed by all legitimate participants, so that no party [alone] can predetermine the value of the key." [A9042]

3. (O) “两个不同方生成共享对称密钥的过程,使得任何共享对称密钥都是所有合法参与者提供的信息的函数,因此任何一方[单独]都不能预先确定密钥的值。”[A9042]

Example: A message originator and the intended recipient can each use their own private key and the other's public key with the Diffie-Hellman-Merkle algorithm to first compute a shared secret value and, from that value, derive a session key to encrypt the message.


$ key authentication (N) "The assurance of the legitimate participants in a key agreement [i.e., in a key-agreement protocol] that no non-legitimate party possesses the shared symmetric key." [A9042]

$ 密钥认证(N)“密钥协议[即密钥协议协议]的合法参与者保证非合法方不拥有共享对称密钥。”[A9042]

$ key-auto-key (KAK) (D) "Cryptographic logic [i.e., a mode of operation] using previous key to produce key." [C4009, A1523] (See: CTAK, /cryptographic operation/ under "mode".)

$ 密钥自动密钥(KAK)(D)“使用先前密钥生成密钥的加密逻辑[即操作模式]”[C4009,A1523](参见:CTAK,/Cryptographic operation/在“模式”下)

Deprecated Term: IDOCs SHOULD NOT use this term; it is neither well-known nor precisely defined. Instead, use terms associated with modes that are defined in standards, such as CBC, CFB, and OFB.


$ key center (I) A centralized, key-distribution process (used in symmetric cryptography), usually a separate computer system, that uses master keys (i.e., KEKs) to encrypt and distribute session keys needed by a community of users.

$ 密钥中心(I):一个集中的密钥分发过程(用于对称加密),通常是一个独立的计算机系统,使用主密钥(即KEK)加密和分发用户社区所需的会话密钥。

Tutorial: An ANSI standard [A9017] defines two types of key center: "key distribution center" and "key translation center".


$ key confirmation (N) "The assurance [provided to] the legitimate participants in a key establishment protocol that the [parties that are intended to share] the symmetric key actually possess the shared symmetric key." [A9042]

$ 密钥确认(N)“向密钥建立协议的合法参与者提供的保证,即[打算共享]对称密钥的各方实际拥有共享对称密钥。”[A9042]

$ key distribution (I) A process that delivers a cryptographic key from the location where it is generated to the locations where it is used in a cryptographic algorithm. (See: key establishment, key management.)

$ 密钥分发(I)将加密密钥从生成位置传递到加密算法中使用的位置的过程。(参见:密钥建立、密钥管理。)

$ key distribution center (KDC) 1. (I) A type of key center (used in symmetric cryptography) that implements a key-distribution protocol to provide keys (usually, session keys) to two (or more) entities that wish to communicate securely. (Compare: key translation center.)

$ 密钥分发中心(KDC)1。(一) 一种密钥中心(用于对称加密),它实现密钥分发协议,为两个(或更多)希望安全通信的实体提供密钥(通常是会话密钥)。(比较:关键翻译中心。)

2. (N) "COMSEC facility generating and distributing key in electrical form." [C4009]

2. (N) “通信安全设施以电子形式生成和分配密钥。”[C4009]

Tutorial: A KDC distributes keys to Alice and Bob, who (a) wish to communicate with each other but do not currently share keys, (b) each share a KEK with the KDC, and (c) may not be able to generate or acquire keys by themselves. Alice requests the keys from the KDC. The KDC generates or acquires the keys and makes two identical sets. The KDC encrypts one set in the KEK it shares with Alice, and sends that encrypted set to Alice. The KDC encrypts the second set in the KEK it shares with Bob, and either (a) sends that encrypted set to Alice for her to forward to Bob or (b) sends it directly to Bob (although the latter option is not supported in the ANSI standard [A9017]).


$ key encapsulation (N) A key recovery technique for storing knowledge of a cryptographic key by encrypting it with another key and ensuring that only certain third parties called "recovery agents" can perform the decryption operation to retrieve the stored key. Key encapsulation typically permits direct retrieval of a secret key used to provide data confidentiality. (Compare: key escrow.)

$ 密钥封装(N)一种密钥恢复技术,用于通过使用另一密钥对加密密钥进行加密并确保只有称为“恢复代理”的特定第三方可以执行解密操作以检索存储的密钥来存储加密密钥的知识。密钥封装通常允许直接检索用于提供数据机密性的密钥。(比较:密钥托管。)

$ key-encrypting key (KEK) (I) A cryptographic key that (a) is used to encrypt other keys (either DEKs or other TEKs) for transmission or storage but (b) (usually) is not used to encrypt application data. Usage: Sometimes called "key-encryption key".

$ 密钥加密密钥(KEK)(I)(A)用于加密用于传输或存储的其他密钥(DEK或其他TEK),但(b)(通常)不用于加密应用程序数据的加密密钥。用法:有时称为“密钥加密密钥”。

$ key escrow (N) A key recovery technique for storing knowledge of a cryptographic key or parts thereof in the custody of one or more third parties called "escrow agents", so that the key can be recovered and used in specified circumstances. (Compare: key encapsulation.)

$ 密钥托管(N)一种密钥恢复技术,用于将加密密钥或其部分的知识存储在一个或多个第三方(称为“托管代理”)的托管下,以便在特定情况下恢复和使用密钥。(比较:键封装。)

Tutorial: Key escrow is typically implemented with split knowledge techniques. For example, the Escrowed Encryption Standard [FP185] entrusts two components of a device-unique split key to separate escrow agents. The agents provide the components only to someone legally authorized to conduct electronic surveillance of telecommunications encrypted by that specific device. The components are used to reconstruct the device-unique key, and it is used to obtain the session key needed to decrypt communications.


$ key establishment (algorithm or protocol) 1. (I) A procedure that combines the key-generation and key-distribution steps needed to set up or install a secure communication association.

$ 密钥建立(算法或协议)1。(一) 一种结合密钥生成和密钥分发步骤的过程,用于建立或安装安全通信关联。

2. (I) A procedure that results in keying material being shared among two or more system entities. [A9042, SP56]

2. (一) 导致在两个或多个系统实体之间共享关键帧材质的过程。[A9042,SP56]

Tutorial: The two basic techniques for key establishment are "key agreement" and "key transport".


$ Key Exchange Algorithm (KEA) (N) A key-agreement method [SKIP, R2773] that is based on the Diffie-Hellman-Merkle algorithm and uses 1024-bit asymmetric keys. (See: CAPSTONE, CLIPPER, FORTEZZA, SKIPJACK.)

$ 密钥交换算法(KEA)(N)一种基于Diffie-Hellman-Merkle算法并使用1024位非对称密钥的密钥协商方法[SKIP,R2773]。(见:顶石、克利伯、福特扎、SKIPJACK)

Tutorial: KEA was developed by NSA and formerly classified at the U.S. DoD "Secret" level. On 23 June 1998, the NSA announced that KEA had been declassified.


$ key generation (I) A process that creates the sequence of symbols that comprise a cryptographic key. (See: key management.)

$ 密钥生成(I)创建包含加密密钥的符号序列的过程。(请参阅:密钥管理。)

$ key generator 1. (I) An algorithm that uses mathematical rules to deterministically produce a pseudorandom sequence of cryptographic key values.

$ 钥匙生成器1。(一) 一种算法,它使用数学规则来确定地产生密码键值的伪随机序列。

2. (I) An encryption device that incorporates a key-generation mechanism and applies the key to plain text to produce cipher text

2. (一) 一种加密装置,包含密钥生成机制,并将密钥应用于纯文本以生成密文

(e.g., by exclusive OR-ing (a) a bit-string representation of the key with (b) a bit-string representation of the plaintext).


$ key length (I) The number of symbols (usually stated as a number of bits) needed to be able to represent any of the possible values of a cryptographic key. (See: key space.)

$ 密钥长度(I)能够表示加密密钥的任何可能值所需的符号数(通常表示为比特数)。(请参见:键空间。)

$ key lifetime 1. (D) Synonym for "cryptoperiod".

$ 密钥生命周期1。(D) “加密周期”的同义词。

Deprecated Definition: IDOCs SHOULD NOT use this term with definition 1 because a key's cryptoperiod may be only a part of the key's lifetime. A key could be generated at some time prior to when its cryptoperiod begins and might not be destroyed (i.e., zeroized) until some time after its cryptoperiod ends.


2. (O) /MISSI/ An attribute of a MISSI key pair that specifies a time span that bounds the validity period of any MISSI X.509 public-key certificate that contains the public component of the pair. (See: cryptoperiod.)

2. (O) /misi/misi密钥对的一种属性,指定一个时间跨度,该时间跨度限定了包含该密钥对的公共组件的任何misi X.509公钥证书的有效期。(请参阅:加密周期。)

$ key loader (N) Synonym for "fill device".

$ 钥匙加载器(N)是“加注装置”的同义词。

$ key loading and initialization facility (KLIF) (N) A place where ECU hardware is activated after being fabricated. (Compare: CLEF.)

$ 钥匙加载和初始化设施(KLIF)(N)制造后激活ECU硬件的地方。(比较:谱号。)

Tutorial: Before going to its KLIF, an ECU is not ready to be fielded, usually because it is not yet able to receive DEKs. The KLIF employs trusted processes to complete the ECU by installing needed data such as KEKs, seed values, and, in some cases, cryptographic software. After KLIF processing, the ECU is ready for deployment.


$ key management 1a. (I) The process of handling keying material during its life cycle in a cryptographic system; and the supervision and control of that process. (See: key distribution, key escrow, keying material, public-key infrastructure.)

$ 密钥管理1a。(一) 在密码系统的生命周期内处理密钥材料的过程;以及对该过程的监督和控制。(请参阅:密钥分发、密钥托管、密钥材料、公钥基础设施。)

Usage: Usually understood to include ordering, generating, storing, archiving, escrowing, distributing, loading, destroying, auditing, and accounting for the material.


1b. (O) /NIST/ "The activities involving the handling of cryptographic keys and other related security parameters (e.g.,

1b。(O) /NIST/“涉及处理加密密钥和其他相关安全参数的活动(例如。,

IVs, counters) during the entire life cycle of the keys, including their generation, storage, distribution, entry and use, deletion or destruction, and archiving." [FP140, SP57]


2. (O) /OSIRM/ "The generation, storage, distribution, deletion, archiving and application of keys in accordance with a security policy." [I7498-2]

2. (O) /OSIRM/“根据安全策略生成、存储、分发、删除、存档和应用密钥。”[I7498-2]

$ Key Management Protocol (KMP) (N) A protocol to establish a shared symmetric key between a pair (or a group) of users. (One version of KMP was developed by SDNS, and another by SILS.) Superseded by ISAKMP and IKE.

$ 密钥管理协议(KMP)(N)在一对(或一组)用户之间建立共享对称密钥的协议。(一个版本的KMP由SDNS开发,另一个由SILS开发)被ISAKMP和IKE取代。

$ key material (D) Synonym for "keying material".

$ 关键材料(D)“关键材料”的同义词。

Deprecated Usage: IDOCs SHOULD NOT use this term as a synonym for "keying material".


$ key pair (I) A set of mathematically related keys -- a public key and a private key -- that are used for asymmetric cryptography and are generated in a way that makes it computationally infeasible to derive the private key from knowledge of the public key. (See: Diffie-Hellman-Merkle, RSA.)

$ 密钥对(I)一组数学上相关的密钥——公钥和私钥——用于非对称加密,其生成方式使得从公钥知识中导出私钥在计算上不可行。(见:Diffie Hellman Merkle,RSA)

Tutorial: A key pair's owner discloses the public key to other system entities so they can use the key to (a) encrypt data, (b) verify a digital signature, or (c) generate a key with a key-agreement algorithm. The matching private key is kept secret by the owner, who uses it to (a') decrypt data, (b') generate a digital signature, or (c') generate a key with a key-agreement algorithm.


$ key recovery 1. (I) /cryptanalysis/ A process for learning the value of a cryptographic key that was previously used to perform some cryptographic operation. (See: cryptanalysis, recovery.)

$ 密钥恢复1。(一) /CryptoAnalysis/CryptoAnalysis用于学习以前用于执行某些加密操作的加密密钥的值的过程。(请参阅:密码分析,恢复。)

2. (I) /backup/ Techniques that provide an intentional, alternate means to access the key used for data confidentiality service in an encrypted association. [DoD4] (Compare: recovery.)

2. (一) /backup/提供一种有意的替代方法来访问加密关联中用于数据保密服务的密钥的技术。[DoD4](比较:恢复。)

Tutorial: It is assumed that the cryptographic system includes a primary means of obtaining the key through a key-establishment algorithm or protocol. For the secondary means, there are two classes of key recovery techniques: key encapsulation and key escrow.


$ key space (I) The range of possible values of a cryptographic key; or the number of distinct transformations supported by a particular cryptographic algorithm. (See: key length.)

$ 密钥空间(I)加密密钥的可能值的范围;或者特定加密算法支持的不同转换的数量。(请参见:键长度。)

$ key translation center (I) A type of key center that implements a key-distribution protocol (based on symmetric cryptography) to convey keys between two (or more) parties who wish to communicate securely. (Compare: key distribution center.)

$ 密钥转换中心(I)一种密钥中心,它实现密钥分发协议(基于对称密码),以便在希望安全通信的两(或更多)方之间传输密钥。(比较:关键配送中心。)

Tutorial: A key translation center transfers keys for future communication between Bob and Alice, who (a) wish to communicate with each other but do not currently share keys, (b) each share a KEK with the center, and (c) have the ability to generate or acquire keys by themselves. Alice generates or acquires a set of keys for communication with Bob. Alice encrypts the set in the KEK she shares with the center and sends the encrypted set to the center. The center decrypts the set, reencrypts the set in the KEK it shares with Bob, and either (a) sends that reencrypted set to Alice for her to forward to Bob or (b) sends it directly to Bob (although direct distribution is not supported in the ANSI standard [A9017]).


$ key transport (algorithm or protocol) 1. (I) A key establishment method by which a secret key is generated by a system entity in a communication association and securely sent to another entity in the association. (Compare: key agreement.)

$ 密钥传输(算法或协议)1。(一) 一种密钥建立方法,通过该方法,保密密钥由通信关联中的系统实体生成,并安全地发送给该关联中的另一实体。(比较:关键协议。)

Tutorial: Either (a) one entity generates a secret key and securely sends it to the other entity, or (b) each entity generates a secret value and securely sends it to the other entity, where the two values are combined to form a secret key. For example, a message originator can generate a random session key and then use the RSA algorithm to encrypt that key with the public key of the intended recipient.


2. (O) "The procedure to send a symmetric key from one party to other parties. As a result, all legitimate participants share a common symmetric key in such a way that the symmetric key is determined entirely by one party." [A9042]

2. (O) “从一方向另一方发送对称密钥的过程。因此,所有合法参与者共享一个公共对称密钥,使得对称密钥完全由一方确定。”[A9042]

$ key update 1. (I) Derive a new key from an existing key. (Compare: rekey.)

$ 密钥更新1。(一) 从现有密钥派生新密钥。(比较:重新设置。)

2. (O) Irreversible cryptographic process that modifies a key to produce a new key. [C4009]

2. (O) 修改密钥以产生新密钥的不可逆加密过程。[C4009]

$ key validation 1. (I) "The procedure for the receiver of a public key to check that the key conforms to the arithmetic requirements for such a key in order to thwart certain types of attacks." [A9042] (See: weak key)

$ 关键验证1。(一) “公钥接收者检查密钥是否符合该密钥的算术要求,以阻止某些类型的攻击的过程。”[A9042](参见:弱密钥)

2. (D) Synonym for "certificate validation".

2. (D) “证书验证”的同义词。

Deprecated Usage: IDOCs SHOULD NOT use the term as a synonym for "certificate validation"; that would unnecessarily duplicate the meaning of the latter term and mix concepts in a potentially misleading way. In validating an X.509 public-key certificate, the public key contained in the certificate is normally treated as an opaque data object.


$ keyed hash (I) A cryptographic hash (e.g., [R1828]) in which the mapping to a hash result is varied by a second input parameter that is a cryptographic key. (See: checksum.)

$ 键控散列(I)加密散列(例如,[R1828]),其中到散列结果的映射由作为加密密钥的第二输入参数改变。(请参阅:校验和。)

Tutorial: If the input data object is changed, a new, corresponding hash result cannot be correctly computed without knowledge of the secret key. Thus, the secret key protects the hash result so it can be used as a checksum even when there is a threat of an active attack on the data. There are two basic types of keyed hash: - A function based on a keyed encryption algorithm. Example: Data Authentication Code. - A function based on a keyless hash that is enhanced by combining (e.g., by concatenating) the input data object parameter with a key parameter before mapping to the hash result. Example: HMAC.


$ keying material 1. (I) Data that is needed to establish and maintain a cryptographic security association, such as keys, key pairs, and IVs.

$ 键控材料1。(一) 建立和维护加密安全关联所需的数据,如密钥、密钥对和IVs。

2. (O) "Key, code, or authentication information in physical or magnetic form." [C4009] (Compare: COMSEC material.)

2. (O) “物理或磁性形式的密钥、代码或身份验证信息。”[C4009](比较:通信安全资料。)

$ keying material identifier (KMID) 1. (I) An identifier assigned to an item of keying material.

$ 键入物料标识符(KMID)1。(一) 分配给键控材料项的标识符。

2. (O) /MISSI/ A 64-bit identifier that is assigned to a key pair when the public key is bound in a MISSI X.509 public-key certificate.

2. (O) /misi/当公钥绑定到misi X.509公钥证书中时分配给密钥对的64位标识符。

$ Khafre (N) A patented, symmetric block cipher designed by Ralph C. Merkle as a plug-in replacement for DES. [Schn]

$ Khafre(N):一种获得专利的对称分组密码,由Ralph C.Merkle设计,作为DES的插件替代。[施恩]

Tutorial: Khafre was designed for efficient encryption of small amounts of data. However, because Khafre does not precompute tables used for encryption, it is slower than Khufu for large amounts of data.


$ Khufu (N) A patented, symmetric block cipher designed by Ralph C. Merkle as a plug-in replacement for DES. [Schn]

$ Khufu(N):一种获得专利的对称分组密码,由Ralph C.Merkle设计,作为DES的插件替代。[施恩]

Tutorial: Khufu was designed for fast encryption of large amounts of data. However, because Khufu precomputes tables used in encryption, it is less efficient than Khafre for small amounts of data.


$ KLIF (N) See: key loading and initialization facility.

$ KLIF(N)参见:密钥加载和初始化设施。

$ KMID (I) See: keying material identifier.

$ KMID(I)见:键入材料标识符。

$ known-plaintext attack (I) A cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs (although the analyst may also have other clues, such as knowing the cryptographic algorithm).

$ 已知明文攻击(I)一种密码分析技术,分析员试图根据一些明文-密文对的知识确定密钥(尽管分析员也可能有其他线索,例如知道密码算法)。

$ kracker (O) Old spelling for "cracker".

$ 克拉克(O)是“饼干”的老拼法。

$ KSOS, KSOS-6, KSOS-11 (O) See: Kernelized Secure Operating System.

$ KSOS,KSOS-6,KSOS-11(O)参见:内核化安全操作系统。

$ L2F (N) See: Layer 2 Forwarding Protocol.

$ L2F(N)参见:第2层转发协议。

$ L2TP (N) See: Layer 2 Tunneling Protocol.

$ L2TP(N)参见:第2层隧道协议。

$ label See: time stamp, security label.

$ 标签见:时间戳、安全标签。

$ laboratory attack (O) "Use of sophisticated signal recovery equipment in a laboratory environment to recover information from data storage media." [C4009]

$ 实验室攻击(O)“在实验室环境中使用复杂的信号恢复设备从数据存储介质中恢复信息。”[C4009]

$ LAN (I) Abbreviation for "local area network" [R1983]. (See: [FP191].)

$ LAN(I)“局域网”的缩写[R1983]。(见:[FP191])

$ land attack (I) A denial-of-service attack that sends an IP packet that (a) has the same address in both the Source Address and Destination Address fields and (b) contains a TCP SYN packet that has the same port number in both the Source Port and Destination Port fields.

$ 陆地攻击(I)一种拒绝服务攻击,它发送一个IP数据包,该IP数据包(A)在源地址和目标地址字段中具有相同的地址,并且(b)包含一个在源端口和目标端口字段中具有相同端口号的TCP SYN数据包。

Derivation: This single-packet attack was named for "land", the program originally published by the cracker who invented this exploit. Perhaps that name was chosen because the inventor thought of multi-packet (i.e., flooding) attacks as arriving by sea.


$ Language of Temporal Ordering Specification (LOTOS) (N) A language (ISO 8807-1990) for formal specification of computer network protocols; describes the order in which events occur.

$ 时间顺序规范语言(LOTOS)(N)计算机网络协议形式规范的语言(ISO 8807-1990);描述事件发生的顺序。

$ lattice (I) A finite set together with a partial ordering on its elements such that for every pair of elements there is a least upper bound and a greatest lower bound.

$ 格(I)有限集及其元素上的偏序,使得每对元素都有一个最小上界和一个最大下界。

Example: A lattice is formed by a finite set S of security levels -- i.e., a set S of all ordered pairs (x,c), where x is one of a finite set X of hierarchically ordered classification levels X(1), non-hierarchical categories C(1), ..., C(M) -- together with the "dominate" relation. Security level (x,c) is said to "dominate" (x',c') if and only if (a) x is greater (higher) than or equal to x' and (b) c includes at least all of the elements of c'. (See: dominate, lattice model.)


Tutorial: Lattices are used in some branches of cryptography, both as a basis for hard computational problems upon which cryptographic algorithms can be defined, and also as a basis for attacks on cryptographic algorithms.


$ lattice model 1. (I) A description of the semantic structure formed by a finite set of security levels, such as those used in military organizations. (See: dominate, lattice, security model.)

$ 晶格模型1。(一) 由一组有限的安全级别(如军事组织中使用的安全级别)形成的语义结构的描述。(请参见:支配、晶格、安全模型。)

2. (I) /formal model/ A model for flow control in a system, based on the lattice that is formed by the finite security levels in a system and their partial ordering. [Denn]

2. (一) /形式模型/系统中的流量控制模型,基于由系统中的有限安全级别及其偏序形成的晶格。[丹尼]

$ Law Enforcement Access Field (LEAF) (N) A data item that is automatically embedded in data encrypted by devices (e.g., CLIPPER chip) that implement the Escrowed Encryption Standard.

$ 执法访问字段(LEAF)(N)自动嵌入由实施托管加密标准的设备(如CLIPPER芯片)加密的数据中的数据项。

$ Layer 1, 2, 3, 4, 5, 6, 7 (N) See: OSIRM.

$ 第1、2、3、4、5、6、7(N)层见:OSIRM。

$ Layer 2 Forwarding Protocol (L2F) (N) An Internet protocol (originally developed by Cisco Corporation) that uses tunneling of PPP over IP to create a virtual extension of a dial-up link across a network, initiated by the dial-up server and transparent to the dial-up