PoSC termbase

AD

active directory

Windows OS directory service that facilitates working with interconnected, complex and different network resources in a unified manner

AIA

link to the CA certificate of the certificate issuer

ARL

CRL with revocation information regarding CA certificates

assymetric encryption

public-key cryptography

krypteringssystem där olika nycklar används för kryptering respektive dekryptering

CA

certification authority

certificate authority

certifies the ownership of a public key by the named subject of the certificate

class driver

intermediate driver designed to provide a simple interface between a vendor-written minidriver and the operating system

CP

document that describes the conditions under which a digital certificate may be issued and managed by a CA

State what are the different entities involved in the issuing, their roles, and their duties.

CPS

document from a CA which describes their practice for issuing and managing certificates according to the conditions in a CP 

CRL

signed list of certificate serial numbers of digital certificates that have been revoked by the issuing CA before their scheduled expiration date and should no longer be trusted

CRL distribution point

CDP

location where revocation list can be retrieved

CRS

certificate signing request (also CSR or certification request) is a message sent from an applicant to a registration

DFA

delegated forms authentication

protocol that allows generation and processing of authentication forms, including credential validation, to be delegated to another component

NetScaler delegates its authentication to StoreFront, which then interacts with a third party authentication server or service.

Agency for Digital Government

Myndigheten för digital förvaltning

Swedish authority responsible for the digitalisation of Sweden to achieve a sustainable welfare society together with the entire public administration

digital certificate

certificate

electronic attachment that allows a person, computer or organization to exchange information securely over computer networks using the public key infrastructure (PKI)

digital signature

digital code, generated and authenticated by public key encryption, which is attached to an electronically transmitted document to verify its contents and the sender’s identity

Somewhat simplified, the digital signature can be considered as an electronic signature. The digital signature is a hash code.

electronic identity

eID

e-id
eid
e-ID

identifier that comprises a country code, the register identifier, the registration number, and possibly a verification digit to enable the identification of companies and their branches in EU member states in the Business Registers Interconnection System

FAS

federated authentication service

privileged component designed to integrate with Active Directory Certificate Services by dynamically issuing certificates for users, allowing them to log on to an Active Directory environment as if they had a smart card

This allows StoreFront to use a broader range of authentication options, such as SAML assertions.

GUI

graphical user interface

form of user interface that allows users to interact with electronic devices through graphical icons and audio indicator such as primary notation, instead of text-based user interfaces, typed command labels or text navigation

HSM

physical computing device that safeguards and manages digital keys, performs encryption and decryption functions for digital signatures, strong authentication, and other cryptographic functions

IdP

identity provider

system entity that creates, maintains, and manages identity information for principals while providing authentication services to relying applications within a federation or distributed network

IETF

open standards organization, which develops and promotes voluntary Internet standards

technical standards issued by a joint technical committee (JTC) of ISO and IEC.

LoA

identity level of assurance

certainty with which a claim to a particular identity during authentication can be trusted to actually be the claimant's true identity

There are four, 1–4, levels of identity assurance. DIGG defines the levels 2–4 for Sweden.

minidriver

hardware-specific DLL that uses a Microsoft-provided class driver to accomplish most actions through function calls, and provides only device-specific controls

NTP

networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks

Used to synchronize the time in the PoSC Net iD.

OCSP

internet protocol used to get the revocation status of an X.509 digital certificate

To check that the token is valid and not withdrawn.

OID

identifier mechanism standardized by the International Telecommunications Union (ITU) and ISO/IEC for naming any object, concept, or "thing" with a globally unambiguous persistent name

 http://www.oid-info.com/

OTP

one time password

password that is valid for only one login session or transaction, on a computer system or other digital device

PIN

numeric passcode used by the subscriber to unlock the use of the private key within a token for the purpose of authentication, signing, or encryption

PKCS #7

public key cryptography standard #7

standard that signs and encrypts messages under a PKI

Often used for single sign-on.

PKI

public key infrastructure

set of roles, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption

PKI allows users of the internet and other public networks to engage in secure communication, data exchange, and money exchange through public and private cryptographic key pairs provided by a certificate authority.

Pointsharp eID

-subscriber certificate issued by PoSC Net iD

PUK

code used to reset a PIN that has been lost or forgotten

RA

registration authority

RA is responsible for the following certification functions:

• the identification and authentication of certificate applicants
• the approval or rejection of certificate applications
• initiating certificate revocations
• processing subscriber requests to revoke or suspend their certificates.

Refers to customer organizations that perform enrollment procedures for subscriber certificate applications within their RA domain. RAs operate under the terms and conditions of the customer agreement and this CP and CPS,

RA officer

individual at an RA that administers subscribers, key bearers, and certificates

relying party

RA organization with a valid customer agreement for the PoSC Net iD, or any other organization, person, application, or device that uses subscriber certificates issued by PoSC Net iD

event that may indicate that an organization's systems or data have been compromised or that measures put in place to protect them have failed

separation of duties

segregation of duties

SOD

multi-person control

duality

internal control designed to prevent error and fraud by ensuring that at least two individuals are responsible for the separate parts of any task

At least two people are required to perform the action. This is for security reasons.  Separation of duties may be enforced electronically or by manual procedures or both.

Sensitive tasks require the collaboration of multiple persons in Trusted roles. At least the tasks will only be allowed to be performed with multi-person control ("n" out of "m"), where "n" needs to be at least 2 persons.

Service RA

central RA function within PoSC Net iD

Operated by Pointsharp.

smart card

chip card

integrated circuit card (ICC)

card with a built-in microprocessor that can be used to protect private keys of a subscriber

smart card reader

card reader

device used for communication with a smart card or a memory card

SMS

short message service

text messaging service component of most telephone, internet, and mobile-device systems

soft token

software token

two-factor authentication security device that may be used to authorize the use of computer services

SPAR

Swedish tax authority’s national register of citizens and other residents with a Swedish personal identification number or a Swedish coordination number

SSO

single sign-on

authentication process that allows a user to access multiple applications with one set of login credentials

subscriber

individual applying for or using an e-identity (certificate)

subscriber terms and conditions

symmetric encryption

encryption where the same encryption key is used both to encrypt and decrypt data

UPS

electrical apparatus that provides emergency power to a load when the input power source or mains power fails

WSDL

web services description language

XML format for describing network services as a set of endpoints operating on messages containing either document-oriented or procedure-oriented information

The operations and messages are described abstractly, and then bound to a concrete network protocol and message format to define an endpoint. Related concrete endpoints are combined into abstract endpoints (services). WSDL is extensible to allow description of endpoints and their messages regardless of what message formats or network protocols are used to communicate. However, the only bindings described in this document describe how to use WSDL in conjunction with SOAP 1.1, HTTP GET/POST, and MIME.

YubiKey

hardware token from Yubico

The part used for the e-identity is based on PIV standards.