(高清版)GBT 28826.4-2022 信息技術(shù) 公用生物特征識別交換格式框架 第4部分：安全塊格式規(guī)范

公用生物特征識別交換格式框架第4部分：安全塊格式規(guī)范國家市場監(jiān)督管理總局國家標(biāo)準(zhǔn)化管理委員會I Ⅲ V 1 1 24縮略語 4 46只包含簽名的安全塊格式 7國內(nèi)商用密碼通用安全塊格式 附錄A(規(guī)范性)通用安全塊格式的ASN.1代碼 附錄B(規(guī)范性)國內(nèi)商用密碼通用安全塊格式的ASN.1代碼 26Ⅲ 第4部分：安全塊格式規(guī)范。本文件修改采用ISO/IEC19785-4:2010《信息技術(shù)公用生物特征識別交換格式框架第4部全稱和中文釋義，以便于對本文件的理解和應(yīng)用(見第4章),因此不再引用ISO/IECh)用規(guī)范性引用的GB/T16263.4替換了ISO/IEC8825-3(見5.4、6.4、7.4),以修改i)用規(guī)范性引用的GB/T28826.1替換了ISO/IEC19785-1(見),以適應(yīng)我國的技術(shù)1)增加了規(guī)范性引用文件GB/Ta)將ISO/IEC19785-4:2010/CORR1:2013《信息技術(shù)公用生物特征識別交換格式框架第4V定義的其中一種安全塊格式或者其他安全塊格式，或者可以包含CBEFF數(shù)據(jù)元素CBEFF_SB_V特征的系統(tǒng)的安全級別?？蛇x擇使用ACBio實例是提供遠(yuǎn)程生物認(rèn)證基礎(chǔ)設(shè)施(TAI)的重要組成第三種安全塊格式是采用國內(nèi)商用密碼消息語法定義的國內(nèi)商用密碼通用安全塊格式，包含了用1GB/T16263.4信息技術(shù)ASN.1編碼規(guī)則第4部分：XML編碼規(guī)則(XER)(GB/T16263.4—GB/T28826.1信息技術(shù)公用生物特征識別交換格式框架第1部分：數(shù)據(jù)元素規(guī)范(GB/T28826.1—2012,GB/T28826.2—2020信息技術(shù)公用生物特征識別交換格式框架第2部分：生物特征識別注2GB/T33560—2017信息安全技術(shù)密碼應(yīng)用標(biāo)識規(guī)范GB/T38635.2信息安全技術(shù)SM9標(biāo)識密碼算法第2部分：算法ISO/IEC19785-2信息技術(shù)公用生物特征識別交換格式框架第2部分：生物特征識別注冊機(jī)構(gòu)(Informationtechnology—CommonbioISO/IEC24761信息技術(shù)安全技術(shù)生物特征識別鑒別上下文(Informationtechnology-RFC5911加密消息語法(CMS)和S/MIME的新ASN.1模塊[NewtographicMessageSyntax(CMS)3在符合GB/T28826.2—2020的生物特征識別登記機(jī)構(gòu)登記時，分配給CBEFF生物特征信息記錄(3.4)中具有已定義格式的、包括生物特征信息記錄(3.4)中生物特征數(shù)據(jù)塊BioAPI單元BioAPIunit由生物特征識別服務(wù)供方或BioAPI功能供方直接管理的軟件或硬件資源單元。由符合ISO/IEC24761—2009的生物特征處理單元(3.16)生成的報告，以顯示在生4CBEFF公用生物特征識別交換格式框架(CommonBiometricExchangeFormatsFrame-5{isoregistration-authoritycbefgeneral-purpose(0)der-en{isoregistration-authoritycbefgeneral-purpose(0)per-en{isoregistration-authoritycbefgeneral-purpose(0)xer-en{isoregistration-authoritycbeff(19785)organizations(0)jtcpurpose(0)ber-encoding(76它是一個ASN.1類型CBEFFSecCBEFFSecurityBlock::=SEQUENCEOFCBEFFSecurityBlockElementaccumulatedACBioInstancesAcontentTypeCONTENT-TYPE.&id({ContentTypeCBEFF}),({ContentTypeCBEFF}{}類型ContentInfoCBEFFSB由兩個組件組成：contentType和content。第一個組件contentType}7encryptionRelatedDataCONTENT-TYPE::={}}authenticationRelatAuthenticationRelatIDENTIFIEDBYid-auth}id-envelopeRelatedDataOBJECTIDENTIFIER::iso(1)standard(0)cbeff(19785)contentType(1)envelopeR}id-encryptionRelatedDataOBJiso(1)standard(0)cbeff(19785)contentType(1)encryptionR}id-signatureRelatedDataOBJECTIDENTIFIER::={iso(1)standard(0)cbeff(19785)contentType(1)signatureR}id-authenticationRelaiso(1)standard(0)cbeff(19785)contentType(1)authenticationR}字段contentType應(yīng)取值id-envelopeRelatedData或id-encryptionRelatedData。BlockForACBio字段。該數(shù)據(jù)應(yīng)交換給BioAPI單元的連續(xù)BPU。類型SubBlockForACBio定義bpuIOIndexINTEGER,}作為第二個BPU的輸入。第二個組件是由第一個BPU生成的ACBio實例。詳細(xì)信息見ISO/類型ACBioInstances的accumulatedACBioInstances字段應(yīng)用于記錄除最新實例之外的8即，對于id-envelopeRelatedData采用EnvelopeRelatedData,對于id-en.2類型EnvelopeRelatedData定義如下：EnvelopeRelatedData::originatorInfo[0]IMPLICITOriginatorInfoOPrecipientInfosRecipiencryptedContentRelatedInfoEncryptedContentRelatedInfo}CBEFFSBVersion::=INTEGER{vb)類型OriginatorInfo的originatorInfo字段視需要提供有關(guān)發(fā)起者的信息。僅在密鑰管理算法要求時才存在。它可以包含證書和CRLs。有關(guān)類型OriginatorInfo的詳細(xì)信息，見素。類型RecipientInfos是一套RecipientInfo。有關(guān)類型RecipientInfo的詳細(xì)信息，見9EncryptedContentRelatedInfo::=SEQUENCE{contentTypeIdentifierEncryptecontentEncryptionAlgorithmContentEncryptionAlgorithmIdentifier}IdentifierEncryptedContentOBJECTIDENTIFIER::={id-cbeffBDB}內(nèi)容類型encryptionRelatedData關(guān)符id-encryptionRelatedData。EncryptionRelatedData::encryptedContentRelatedInfoEncrypte}如果SBH中存在CBEFF_BIR_integritSBH和可能加密的BDB編碼組成的數(shù)據(jù)。和RFC3852和RFC5911中定義的內(nèi)容類型3)對于每個簽名者，簽名值(圖1中的DS)和該簽名者的其他信息被收集到signerInfo值編碼組成數(shù)據(jù)的消息摘要(圖1中的MD′)。此消息摘要和簽名者的公鑰(圖1中的PbK)通過比較驗證器(圖1中的MD′)計算的消息摘要和簽名者(圖1中的MD')計算的消息摘要驗證簽名值(圖1中的DS);簽名者計算的消息摘要使用簽名者特定的簽名算法(圖1中的DS)二.2類型SignaturSignatureRelatedDatadigestAlgorithmsDigestAlgorencapContentRelatedInfoEncapsulatedConcrls[1]IMPLICITRevocation}e)signerInfos是每個簽名者信息的集合。集合中可以包含任意數(shù)量的元素。有關(guān)類型EncapsulatedContentReeContentTypeIdentifierEncapsulatedConteIdentifierEncapsulatedContentOBJECTIDENTIFIER::={id-cbeffSBHAndBD.1內(nèi)容類型authenticationRelatedData與中描述的ASN.1類型AuthenticationR3)對于每個接收者，鑒別密鑰密文和其他特定接收者的信息被收集到RecipientInAuthenticationRelatedData::=SoriginatorInfo[0]IMPLICITrecipientInfosRecipientInfomacAlgorithmMessageAuthenticationCodeAlgorithm,encapContentRelatedInfoEncapsulatemacMessageAuthentic當(dāng)采用符合GB/T16263.1規(guī)定的非典型編碼規(guī)則(DER)編碼時，標(biāo)識符為4(0004Hex),該安全塊格式已經(jīng)根據(jù)ISO/IEC19785-2進(jìn)行了登記；當(dāng)采用符合GB/T16263.2規(guī)定的緊縮編碼規(guī)則(PER)編碼時，標(biāo)識符為5(0005Hex),該安全塊格式已經(jīng)根據(jù)ISO/IEC19785-2進(jìn)行了登記；當(dāng)采用符合GB/T16263.4規(guī)定的XML編碼規(guī)則(XER)編碼時，標(biāo)識符為6(0006Hex),該安全塊格式已經(jīng)根據(jù)ISO/IEC19785-2進(jìn)行了登記；當(dāng)采用符合GB/T16263.1規(guī)定的基本編碼規(guī)則(BER)編碼時，標(biāo)識符為8(0008Hex),該安全塊格式已經(jīng)根據(jù)ISO/IEC19785-2進(jìn)行了登記。{isoregistration-authoritycbeff(19785)biometric-organization(0)jtcl-sc37(2nature-only(2)der-encoding{isoregistration-authoritycbeff(19785)biometric-organization(0signature-only(2)pe6.5.3當(dāng)采用XML編碼規(guī)則(XER){isoregistration-authoritycbeff(19785)biometric-organization(0)jtcl-sc37(2nature-only(2)xer-encoding{isoregistration-authoritycbeff(19785)biometric-organization(0signature-only(2)be只包含簽名的安全塊適用于使用國際RFC系列密碼消息語法進(jìn)行完整性校驗而不進(jìn)行數(shù)據(jù)加密本安全塊格式規(guī)范的版本標(biāo)識符為(Major0,Minor0)。ISO/IECJTC1/SC37signature-onlysecurityblockformat應(yīng)為RFC3852中指定的編碼或該RFC中指定的ASN.1數(shù)據(jù)類型SignedData。a)CMSVersion應(yīng)為v3;b)encapcontentInfo應(yīng)省略eContent字段；{iso,member-bodycnbiometrics-registr{isomember-bodycnbiometrics-regi{isomember-bodycnbiometrics-registration-centerorganizations(0)<0001Hex>mult{isomember-bodycnbiometrics-registration-centerorganizations(0)<0001Hex>multCBEFFSecurityBlockCN::=SEQUENCEOFCBEFFSecurityBlockElementCNCBEFFSecurityBlockElementCN::=SEQUENCE{contentTypeCONTENT-TYPE.&id({ContentTypeCBEFFCN}),GB/T28826.4—2022({ContentTypeCBEFFCN}{}類型CBEFFSecurityBlockElementCN由兩個組件組成：contentType和content。第一個組件CBEFFSecurityBlockEleenvelopeRelatedDataCNIencryptionRelatedDataCNIsignatureRelatedDataCNtionRelatedDataCN}}IDENTIFIEDBY}IDENTIFIEDBYid-signatureRelatedDa}authenticationRelatedDataCNCONTENT-TYPE::={AuthenticationRelatedIDENTIFIEDBYid-authenticationRelatedDataCN}以上三種類型EnvelopedData、EncryptedData、SignedData及其對象標(biāo)識符完全引用GB/T35275—2017的定義。三個對象標(biāo)識符的定義說明如下：id-envelopeRelatedDataCNOBJECTIDENTIFIER::={iso(1)member-body(2)cn(156)ccstc(10197)standardclass(6)security}id-encryptionRelatedDataCNOBJECTIDENTIFIERiso(1)member-body(2)cn(156)ccstc(10197)standardclass(6)security}在XML值表示法中可表示為：id-signatureRelatedDataCNOBJECTIDENTIFIER::={iso(1)member-body(2)cn(156)ccstc(10197)standardclass(6)securitymechanism(1)}tionRelatedDataCNOBJECT}如果數(shù)據(jù)元素CBEFF_BDB_encryption_options(生物特征數(shù)據(jù)塊加密選項)存在并包含EN-entType應(yīng)取值id-envelopeRelatedDataCN或entType應(yīng)取值id-signatureRelatedDataCN或id-signat如果SBH中的CBEFF_BDB_encryption_opvelopeRelatedDataCN或id-encryptionRela中所見；第二組件的類型由第一組件的值確定，即，對于id-envelopeRelatedDataCN采用EnvelopedData,對于id-encryptionRelatedDataCN采用EncryptedData。BDB包含加密形式的生物特數(shù)據(jù))。signatureRelatedDataCN或id-authenticationRelaAuthenticationRelatedDataCN用于id-authenticationRelatedDataCN。當(dāng)使用數(shù).1內(nèi)容類型authenticationRelatedDataCN與中描述的ASN2017的RecipientInfo值中；.2類型AuthenticationRelAuthenticationRelatedDataCN::=SrecipientInfosRecipientInfomacAlgorithmMessageAuthenticationCoencapContentRelatedInfoEncapsulatedContentRelatemacMessageAuthenticRecipientInfos::=SETOFRecipientInfoEncapsulatedContentRelatedInfo:eContentTypeIdentifierEncapsulatedContIdentifierEncapsulatedContentOBJECTIDENTIFIER::={id-cbeid-cbeffSBHAndBDBOBJECTIDENTIFIER::={iso(1)standard(0)cbeff(19785)contentType(1)sb}c)附錄B中規(guī)定的CBEFFSecurityBlockCN的編碼應(yīng)符合7.5的規(guī)CBEFF-GENERAL-PURPOSE-SECContentEncryptionAlgoritDigestAlgorithmIdentifiers,SignerInfos,MessageAuthenticationCodDigestAlgorithmldentifier,AuthAttributes,MessageAuthentiFROMCryptographicMesiso(1)member-body(2)us(840)rsadspkcs(1)pkcs-9(9)smime(16)modules(0)cms—2004(2—ISO/IEC24761AuthenticaACBioInstance,CertificateSet,RevocationInFROMAuthenticationContextForiso(1)standard(0)acbio(24761)module(1)acbioCONTENT-TYPE::=TYPE-CBEFFSecurityBlock::=SEQUENCEOFCBEFFSecuritelementCBEFFSBContenaccumulatedACBioInstances}contentTypeCONTENT-TYPE.&id({ContentTcontent[0]EXPLI({ContentTypeCBEFF}{}ContentTypeCBEFFCONTENT-TYPE::={envelopeRelatedData|encryptionRelaEnvelopeRelatedData::originatorInfo[0]IMPLICITOriginatorecipientInfosRecipientInfoencryptedContentRelatedInfoEncrypte}CBEFFSBVersion::=INTEGER{vEncryptedContentRelatedInfo::contentTypeIdentifierEncryptedContent,contentEncryptionAlgorithmContentEncryptionAlgori}IdentifierEncryptedContentOBJECTIDENTIFIER::={id-cbeffBDB}EncryptionRelatedDatencryptedContentRelatedInfoEncrypte}digestAlgorithmsDigestAlgorithmIdentifiers,encapContentRelatedInfoEncapsulatedContentRelatedInfo,}EncapsulatedContentRelatedeContentTypeIdentifier}IdentifierEncapsulatedContentOBJECTIDENTIFIER::={id-cbeAuthenticationRelatedData::=SoriginatorInfo[0]IMPLICITOriginatorInforecipientInfosRecipientInfos,macAlgorithmMessageAuthenticationCoencapContentRelatedInfoEncapsulate}bpulOIndexINTEGER,}ACBioInstances::=SEQU—contentTypeobjectidentifiersiso(1)standard(0)cbeff(19785)contentType(1)envelopeR}id-encryptionRelatedDataiso(1)standard(0)cbeff(19785)contentType(1)encryptionRe}id-signatureRelatedDataOBJiso(1)standard(0)cbeff(19785)contentType(1)signatureR}id-authenticationRelatedDataOBJECTiso(1)standard(0)cbeff(19785)contentType(1)authenticationR}iso(1)standard(0)cbeff(19785)contentTyp}iso(1)standard(0)cbeff(19785)contentType(1)sb}envelopeRelatedData}encryptionRelatedDataCONTENT-TYIDENTIFIEDBYid-encryptionR}signatureRelatedDataCONTENT-TYPE::={IDENTIFIEDBYid-signatureRelatedauthenticationRelatedDataAuthenticationRelatIDENTIFIEDBYid-authentiNATIONAL-GENERAL-PURPOSE-SECURITY-BLOCKDEFINITIONSAUTOMATICCONTENT-TYPE::=TYPE-CBEFFSecurityBlockCN::=SEQUENCEOFCBEFFSecurityBloCBEFFSecurityBlockElementcontentTypeCONTENT-TYPE.&id({ContentTypeCBEFFCN}),({ContentTypeCBEFFCN}}CBEFFSecurityBlockElementCNenvelopeRelatedDataCNIencauthenticationRelated