ISO/IEC TR 14516:2002 PDF

Overview

ISO/IEC TR 14516:2002 - "Information technology - Security techniques - Guidelines for the use and management of Trusted Third Party services" - is a Technical Report that provides practical guidance on the provision, operation and management of Trusted Third Party (TTP) services. Published jointly by ISO/IEC and identical to ITU‑T Recommendation X.842, the report clarifies TTP roles, duties, service categories and the security, legal and operational issues that businesses, developers and TTP operators should consider. It is intended for system managers, developers, TTP operators and enterprise users seeking to select and manage TTP services; it is not intended as a formal assessment or comparison framework for TTPs.

Key topics and technical requirements

The report covers both conceptual and operational aspects, including:

• Roles, positions and relationships between TTPs and entities using services.
• Generic security requirements and guidance on who should provide specific protections.
• Management and operational aspects: legal issues, contractual obligations, responsibilities, and ethics.
• Security policy elements: standards, directives, procedures, risk management, safeguards (physical, organizational and IT-specific), awareness and training.
• Assurance and trust: trustworthiness, accreditation of certification bodies, audits, incident handling, contingency planning and quality of service.
• Interworking: TTP–user, user–user, TTP–TTP and interfaces with law enforcement.
• Major categories of TTP services:
  • Time stamping
  • Non‑repudiation
  • Key management (generation, registration, certification, distribution, storage, archiving, revocation, destruction)
  • Certificate management (public key certificates, attribute/privilege services, revocation)
  • Electronic notary public (evidence generation, storage, arbitration)
  • Digital archiving, directories, identification & authentication, recovery, personalisation, access control, alert management
• Annexes: security requirements for TTP management and aspects of Certification Authority (CA) management (registration, CPS examples).

Applications and who uses it

ISO/IEC TR 14516:2002 is practical for organizations that need to design, procure or operate TTP-enabled services, including:

• Enterprise security architects selecting key management, certificate or timestamping services
• TTP operators and Certification Authorities developing operational security policies and procedures
• System and network managers implementing non‑repudiation, authentication or electronic notary workflows
• Developers integrating TTP services into applications and digital transaction systems
• Legal and compliance teams assessing contractual and legal considerations for outsourced trust services

Related standards

• Identical text: ITU‑T Recommendation X.842
• Relevant to the work of ISO/IEC JTC 1/SC 27 (IT security techniques) and interoperates conceptually with standards addressing PKI, CA practices and information security management.

Keywords: ISO/IEC TR 14516:2002, Trusted Third Party, TTP services, time stamping, non‑repudiation, key management, certificate management, electronic notary, security policy, IT security.