ASTM E1985-98(2005)
(Guide)Standard Guide for User Authentication and Authorization
Standard Guide for User Authentication and Authorization
SIGNIFICANCE AND USE
This guide has three purposes:
4.1.1 To serve as a guide for developers of computer software that provides or makes use of authentication and authorization processes,
4.1.2 To serve as a guide to healthcare providers who are implementing authentication and authorization mechanisms, and
4.1.3 To be a consensus standard on the design, implementation, and use of authentication and authorization mechanisms.
Additional standards will define interoperable protocols and message formats that can be used to implement these mechanisms in a distributed environment, using specific commercial technologies such as digital signatures.
SCOPE
1.1 This guide covers mechanisms that may be used to authenticate healthcare information (both administrative and clinical) users to computer systems, as well as mechanisms to authorize particular actions by users. These actions may include access to healthcare information documents, as well as, specific operations on those documents (for example, review by a physician).
1.2 This guide addresses both centralized and distributed environments, by defining the requirements that a single system shall meet and the kinds of information which shall be transmitted between systems to provide distributed authentication and authorization services.
1.3 This guide addresses the technical specifications for how to perform user authentication and authorization. The actual definition of who can access what is based on organizational policy.
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: E1985 − 98(Reapproved 2005) An American National Standard
Standard Guide for
1
User Authentication and Authorization
This standard is issued under the fixed designation E1985; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
5
1. Scope FIPS PUB 112 Password Usage
1.1 This guide covers mechanisms that may be used to
3. Terminology
authenticate healthcare information (both administrative and
3.1 Definitions:
clinical) users to computer systems, as well as mechanisms to
3.1.1 access control list—a piece of access control
authorize particular actions by users. These actions may
information, associated with a target, that specifies the initia-
include access to healthcare information documents, as well as
tors who may access the target.
specific operations on those documents (for example, review
3.1.2 capability—a piece of access control information,
by a physician).
associated with an initiator, which authorizes the holder to
1.2 This guide addresses both centralized and distributed
access some target.
environments, by defining the requirements that a single
3.1.3 claimant—party requesting authentication; may be a
system shall meet and the kinds of information which shall be
person or a device.
transmitted between systems to provide distributed authentica-
tion and authorization services. 3.1.4 initiator—an entity (for example, a user) who requests
access to some object.
1.3 This guide addresses the technical specifications for
3.1.5 principal—legitimate owner of an identity.
how to perform user authentication and authorization. The
actual definition of who can access what is based on organi-
3.1.6 security label—access control information bound to
zational policy.
initiators and targets. The initiator and target labels are com-
pared to determine if access is allowed.
2. Referenced Documents
3.1.7 target—anentity(forexample,afileordocument)that
2
2.1 ASTM Standards:
may be accessed by an initiator.
E1762 Guide for Electronic Authentication of Health Care
3.1.8 verifier—another party seeking to authenticate princi-
Information
pal.
PS100 Provisional Specification for Authentication of
3.2 Acronyms:
Healthcare Information Using Digital Signatures
3.2.1 ACI—Access Control Information
2.2 ANSI Standard:
3.2.2 ACL—Access Control List
X9.45 Enhanced Management Controls Using Digital Sig-
3
natures and Attribute Certificates
3.2.3 ADF—Access Control Decision Function
2.3 Other Standards:
3.2.4 ADI—Access Control Decision Information
ECMA1-219 AuthenticationandPrivilegeAttributeSecurity
3.2.5 AEF—Access Control Enforcement Function
4
Applications with Related Key Distribution Functions
3.2.6 PIN—Personal Identification Number
4. Significance and Use
1
This guide is under the jurisdiction of ASTM Committee E31 on Healthcare
4.1 This guide has three purposes:
Informatics and is the direct responsibility of Subcommittee E31.25 on Healthcare
4.1.1 To serve as a guide for developers of computer
Data Management, Security, Confidentiality, and Privacy.
Current edition approved July 17, 2006. Published January 2006. Originally
software that provides or makes use of authentication and
approved in 1998. Last previous edition approved in 1998 as E1985 – 98. DOI:
authorization processes,
10.1520/E1985-98R05.
4.1.2 To serve as a guide to healthcare providers who are
2
For referenced ASTM standards, visit the ASTM website, www.astm.org, or
implementing authentication and authorization mechanisms,
contact ASTM Customer Service at service@astm.org. For Annual Book of ASTM
Standards volume information, refer to the standard’s Document Summary page on
and
the ASTM website.
3
Available from American National Standards Institute, 11 W. 42nd St., 13th
5
Floor, New York, NY 10036. Available from National Technical Information Service, U.S. Department of
4
Available from ECMA International, Rue du Rhone 114, CH, 1204, Geneva. Commerce, Springfield, VA. http://csrc.nist.gov or www.ntis.gov.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1
---------------------- Page: 1 ----------------------
E1985 − 98 (2005)
4.1.3 To be a consensus standard on the design, implemen- claimant. The token shall contain information unique to the
tation, and use of authentication and authorization mecha- principal or claimant. The claimant shall present the token as
nisms. proof of identity. A password or PIN may be used to access
informationontoken.Theverifiershallthenverifythetokenof
4.2 Additional standards will define interoperable protocols
the claimant.
and message formats that ca
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.