Iso/Dis 22383

DRAFT INTERNATIONAL STANDARD ISO/DIS 22383

ISO/TC 292 Secretariat: SIS Voting begins on: Voting terminates on: 2019-09-03 2019-11-26

Security and resilience — Authenticity, integrity and trust for products and documents — Guidelines and performance criteria for authentication solutions for material goods

Sécurité et résilience — Authenticité, intégrité et confiance pour les produits et les documents — Lignes directrices et critères de performance relatifs aux solutions d'authentification des biens matériels

W - IE 90 V af ICS: 03.100.01 E 50 ef R i) t/ 3 P a is 38 . /s 2 D eh s -2 R t rd is .i : a d A s d d o- D d r an is N r da st e/ a n g/ c A d ta o c5 T n s al 5 S a ll t 2 t u ca 9 h (s F i/ 7 e a b8 T h. 0 i e -5 .it f s 1a rd -a a 4e nd 8 ta -4 /s e :/ 6 s 68 tp ht

THIS DOCUMENT IS A DRAFT CIRCULATED FOR COMMENT AND APPROVAL. IT IS THEREFORE SUBJECT TO CHANGE AND MAY NOT BE REFERRED TO AS AN INTERNATIONAL STANDARD UNTIL PUBLISHED AS SUCH. IN ADDITION TO THEIR EVALUATION AS BEING ACCEPTABLE FOR INDUSTRIAL, This document is circulated as received from the committee secretariat. TECHNOLOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT INTERNATIONAL STANDARDS MAY ON OCCASION HAVE TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL TO BECOME STANDARDS TO WHICH REFERENCE MAY BE MADE IN Reference number NATIONAL REGULATIONS. ISO/DIS 22383:2019(E) RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT, WITH THEIR COMMENTS, NOTIFICATION OF ANY RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE AND TO PROVIDE SUPPORTING DOCUMENTATION. © ISO 2019 ISO/DIS 22383:2019(E)

W - IE 90 V af E 50 ef R i) t/ 3 P a is 38 . /s 2 D eh s -2 R t rd is .i : a d A s d d o- D d r an is N r da st e/ a n g/ c A d ta o c5 T n s al 5 S a ll t 2 t u ca 9 h (s F i/ 7 e a b8 T h. 0 i e -5 .it f s 1a rd -a a 4e nd 8 ta -4 /s e :/ 6 s 68 tp ht

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address belowCP 401or ISO’s • Ch. member de Blandonnet body in 8 the country of the requester. ISOCH-1214 copyright Vernier, office Geneva Phone: +41 22 749 01 11

Contents Page

Foreword...... iv Introduction...... v 1 Scope...... 1 2 Normative reference...... 1 3 Terms and definitions...... 2 4 General principles...... 4 4.1 Introduction...... 4 ...... 5 4.3 Categorization of authentication solutions...... 6 4.2 Security-by-Design4.3.1 Provision of process knowledge for Authentication...... solutions 7 4.3.2 Inspection...... 7 4.3.3 Categories of authentication elements...... 8 5 Performance criteria specification based on risk analysis...... 9 5.1 Introduction...... 9 W ...... E 0- 9 5.3 Performance criteria categories...... I f9 10 V 0a 5.25.4 RiskCriteria analysis for the elements selection of authenticationE elements...... f5 10 ) /e ...... R i t 3 P a is 38 10 . /s 2 5.4.2 Attack resistance...... D eh s -2 11 R t rd is 5.4.15.4.3 PhysicalIntegration characteristics process...... i : a d 12 A s d d o- 5.5 Attack resistance criteria forD thed selectionr ofan authenticationis tools...... 12 N r da st e/ 5.5.1 General...... a n g/ c 12 A d ta o c5 5.5.2 ObsolescenceT...... n s al 5 13 S a ll t 2 t u ca 9 h (s F i/ 7 ...... 13 e a b8 T h. 0 ...... 13 i e -5 5.7 Criteria5.5.3 forAssessing the selection the vulnerability of authentication.it f and resistance solutions of...... authentication tools 13 s 1a 5.6 Criteria5.7.1 toLocation select authentication / environmentrd - aelements for the authentication and tools’ supply process...... 13 a 4e 5.7.2 Authentication parametersnd 8 ...... 14 ta -4 /s ...... e 14 :/ 6 s ...... 68 14 tp 5.7.3 Life cycleh tcriteria ...... 14 5.7.45.7.6 OperationSecurity policy...... 15 5.7.5 Compliance with regulations, security practices and quality procedures 6 Effectiveness assessment of the authentication solution...... 15 6.1 General...... 15 6.1.1 Authentication solution effectiveness assessment...... 15 6.2 Effectiveness assessment in manufacturing of authentication elements...... 17 ...... 17 6.4 Effectiveness of the application of the authentication elements...... 17 6.36.5 EffectivenessData management of the...... delivery of the authentication elements 18 ...... 18 ...... 18 6.6 Effectiveness measurement in the normal verification/authentication...... situation 19 6.7 Effectiveness assessment in the emergency verification/authentication situation Annex A (informative) Assessment grid...... 20 6.8 Impact of the verification results and corrective actions Annex B (informative) Control means access table...... 25 Bibliography...... 26

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodiescommittee (ISO hasmember been bodies).established The haswork the of rightpreparing to be International represented Standardson that committee. is normally International carried out throughorganizations, ISO technical governmental committees. and non-governmental, Each member body in interestedliaison with in ISO, a subject also take for whichpart in a the technical work.

electrotechnical standardization. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of technical committees is to prepare International Standards. Draft International

Standardscasting a vote. adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies

Attention is drawn to the possibility that some of the elements Wof this document may be the subject of Security and resilience- . patent rights. ISO should not be held responsible for identifyingIE any or all such9 0patent rights. V af E 50 ISO 22383 was prepared by Project committee ISO/TC 292, ef R i) t/ 3 revised. The main changes compared to the previous editionP a are as follows:is 38 . /s 2 This second edition cancels and replaces the first editionD e(ISOh 12931:2012)s -2 which has been technically — new ISO number and title, now included in the ISOR 22300-t series;rd is .i : a d A s d d o- D d r an is N r da st e/ a n g/ c A d ta o c5 T n s al 5 — edited content. S a ll t 2 — terminology mirrors ISO 22300 (freely available);t u ca 9 h (s F i/ 7 e a b8 T h. 0 i e -5 .it f s 1a rd -a a 4e nd 8 ta -4 /s e :/ 6 s 68 tp ht

Introduction

Since the issuance of the first standard in 2012, the quantity and range of material goods, which arecountries counterfeited and is becomingor otherwise more subject common to product in the fraud, developed continues world. to expand,Individual and manufacturers now affects many and consumer goods and spare parts. The sale of counterfeit goods is prevalent in many developing

rights holders are experiencing an increase in the number of counterfeiting attacks on their material goods. The internet is compounding the problem. These counterfeit goods do not necessarily offer the same guarantees in terms of safety and compliance with environmental measures and regulatory requirements, generating risk for consumers, patients, users and the distribution chain. They cause loss of earnings, job losses, and brand value damage for the companies and targeted rights holders as well as tax losses for governments. Counterfeiting increases the potential for false material goods claims and litigationand smuggling. for companies and distribution supply chains. Counterfeiting of material goods has become one of the major activities of organized crime, both within domestic markets and international trade

In order to prevent counterfeiting and other types of product fraud, rights owners, institutions and governmental regulators are increasingly demandingW and implementing- authentication solutions IE 90 geared to specific needs. It is important to specifyV the performanceaf requirements for the solutions designedpublic authorities to support devise the and fight implement against counterfeiting preventive,E deterrent at both nationaland 5law0 enforcement and international policies. levels. Also This the ef R i) t/ 3 will promote greater confidence among consumers,P supporta thei ssecurity38 of the supply chain, and help . /s 2 counterfeited products in circulation. This standardD eh will contributes -2 to further strengthen such controls R t rd is growth of global trade and the reduction of physical.i controls: a atd borders has increased the risk of more A s d d o- D d r an is Product fraud includes, but is not limitedN rto counterfeiting,da st e/ adulteration, tampering, substitution, by enabling faster and more reliable evidencea of then authenticityg/ c and integrity of material goods. A d ta o c5 simulation. T n s al 5 S a ll t 2 t u ca 9 h (s F i/ 7 Counterfeiting can include but ise not limited to: a b8 T h. 0 i e -5 .it f — deceit of the consumer; s 1a rd -a a 4e — deceit of the purchasers of new goodsnd or8 replacement parts; ta -4 /s e :/ 6 s 68 tp ht — violationinfringement of national, of intellectual regional property or international rights; and laws. Counterfeiting can include false claims regarding:

— intellectualdetails of manufacture; property rights; — trade, origin details; and

— identification codes and/or authentication elements. The problem of counterfeiting is aggravated by the following factors: — the market is increasingly global, and the material goods are more complex; and —Counterfeiting the global movementneeds to be of kept material separate goods from is increasing diversion. and may use non-traditional channels.

the characteristics of a given authentic material good. It may be difficult for an inspector, be it a dedicated professional or any citizen or consumer, to recognize designed to enable professionals to release safe material goods into the market in fair competition. Counterfeiting seeks to bypass legal provisions, including guarantees of conformity and quality, ISO 2019 – All rights reserved v © ISO/DIS 22383:2019(E)

Buyers do not necessarily pay all necessary attention to the material goods they are examining, particularlyreliable method because of determining of trust, lack if the of itemtime, is the genuine temptation or a counterfeit of attractive good. prices, or simply because they are unfamiliar with the material good itself. The authentication element provides a specific and more

Establishingthe essential thecharacteristics authenticity of and the integrity authentic of materiala material good, good, to in help other establish words whetherrecognizing or not whether there ithas is genuinebeen an infringement.or fake or otherwise subject to fraudulent activities, requires checking whether it reproduces

Ifwhether there is these any doubt characteristics as to the authenticity match those of aof material the authentic good, it materialis the inspectors’ good and/or role, onceauthentication they have observed the characteristics of the suspect material good and/or authentication element, to verify elements, authentication tools or a combination of these methods. element. The process involved is an essentially technical analysis using experience, authentication wide and services-wide application. This International Standard sets out the performance criteria for Thispurpose- document built authentication has been drafted solutions. to pinpoint the objectives and boundaries required for industry- These solutions are designed to provide reliable evidence, making it easier to assess whether material W - IE 90 V af E 50 ef goods are authentic, and have not been counterfeited, altered,R imimicked,) treplaced,/ 3 refilled, tampered or P a is 38 have been subject to other types of product fraud. . /s 2 D eh s -2 R t rd is goods often concentrates on packaging, authentication.i solutions: a of dmaterial goods with longer life This document aims to integrate the performanceA requirementss d d foro- authentication solutions. The D d r an is material good’s life cycle needs to be considered.N Whereasr da authenticationst e/ of fast moving consumer a n g/ c A d ta o c5 This document is part of a wider frameworkT ofn related s standards.al 5 It was not drafted or designed to cycles rather aim at the material good itself,S throughouta ll itst life2 cycle. t u ca 9 h (s F i/ 7 e a b8 T h. 0 i e -5 define any exclusive means of authentication. .it f s 1a to counterfeiters and their counterfeited productsrd new-a possibilities to be less detectable. At the same a 4e Finally, new technologies (material, digital andnd combined)8 are continuously emerging: these may give ta -4 /s e :/ 6 time, other new technologies may give laws 6 enforcement8 inspectors, legitimate economic operators tp andfraudsters. consumers better means to detecth tcounterfeits and act accordingly. This revision of the standard is needed to consider emerging technologies, so the standard can recommend ways to stay ahead of The aim of this document is therefore to: — establish common categorization of authentication solutions; — establish an understanding of how an authentication solution can constitute a more robust solution

— whenestablish layered and andunderstand therefore theindividual role of authentication tamper resistance elements and should tamper be usedevidence in combination; as part of an authentication solution;

scenarios; — provide criteria for which type of solution can be used to authenticate in different verification

— enable material good verifications in all intended locations, circumstances and conditions of use; — define requirements and evaluation criteria on security for their authentication solution; and clause 2 Normative Reference. — consider standards of relevance published since its first edition (ISO 12931) and mentioned in

Figure 1 — Sequence of the main topics

ISO 2019 – All rights reserved vii © W - IE 90 V af E 50 ef R i) t/ 3 P a is 38 . /s 2 D eh s -2 R t rd is .i : a d A s d d o- D d r an is N r da st e/ a n g/ c A d ta o c5 T n s al 5 S a ll t 2 t u ca 9 h (s F i/ 7 e a b8 T h. 0 i e -5 .it f s 1a rd -a a 4e nd 8 ta -4 /s e :/ 6 s 68 tp ht DRAFT INTERNATIONAL STANDARD ISO/DIS 22383:2019(E)

Security and resilience — Authenticity, integrity and trust for products and documents — Guidelines and performance criteria for authentication solutions for material goods

1 Scope

This document provides guidelines, specifies performance criteria and evaluation methodology for authenticationif appropriate, itssolutions components which / aim parts to unambiguously/ related data: establish material good authenticity and integrity throughout the entire material good’s life cycle. It focusses on the authentication of material goods and,

W — covered by intellectual property rights; E 0- I f9 — with counterfeiting-related implications; V 0a — covered by relevant international, regional or nationalE regulation;5 ef R i) t/ 3 P a is 38 . /s 2 D eh s -2 R t rd is .i : a d — otherwise with a distinctive identity. A s d d o- D d r an is N r da st e/ This document is intended for all types anda sizes nof organizationsg/ c that require the ability to validate A d ta o c5 risks, and the criteria for selection ofT authenticationn s a lelements,5 having undertaken a counterfeiting risk the authenticity and integrity of S materiala goods.ll t It is2 intended to guide such organizations in the t u ca 9 determinationassessment. of the categories hof authentication(s F i/ elements7 they need to combat counterfeiting-related e a b8 T h. 0 i e -5 Authentication solutions can be used in areas.it likef anti-counterfeiting, prevention of product fraud, and s 1a prevention of diversion. rd -a a 4e nd 8 ta -4 /s e need, and the criteria for selection :of/ authentication6 elements, having undertaken a counterfeiting or a s 68 It is intended to guide organizationstp in the determination of categories of authentication elements they ht product fraud risk analysis as required. authentication solutions. This standard does not specify economic criteria aiming to correlate performance and costs of the 2 Normative reference

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undatedISO 15408-1:2009, references, Information the latest edition Technology of the - Securityreferenced techniques document - Evaluation (including criteria any amendments) for IT Security applies: - Part 1: introduction and general model ISO 16678:2014, Guidelines for interoperable object identification and related authentication systems to deter counterfeiting and illicit trade ISO 22300:2018, Security and resilience — Vocabulary ISO 22380:2018, Security and resilience — Authenticity, integrity and trust for products and documents — General principles for product fraud risk and countermeasures

ISO 22381:2018, Security and resilience — Authenticity, integrity and trust for products and documents — Guidelines for establishing interoperability among object identification systems to deter counterfeiting and illicit trade ISO 27002:2013, Information technology - Security techniques - Code of practice for information security controls ISO 31000:2018, Risk management — Guidelines

3 Terms and definitions

ForISO theand purposes IEC maintain of this terminological document, the databases terms and for definitions use in standardization given in ISO 22300 at the and following the following addresses: apply. — ISO Online browsing platform: available at http://www.iso.org/obp — IEC Electropedia: available at http://www.electropedia.org/

W E 0- Editors’ note: Modified definitions from ISO 22300 are includedI here for informationf9 at this DIS stage. 3.1 V a They will be transferred to the revision of ISO 22300 in theE next stage. 50 ef attack R i) t/ 3 P a is 38 successful or unsuccessful attempt(s) to circumvent an authentication. /s solution,2 including attempts to D eh s -2 imitate, produce or reproduce the authentication elementsR t rd is .i : a d A s d d o- [SOURCE: ISO 12931:2012] D d r an is N r da st e/ a n g/ c A d ta o c5 3.2 T n s al 5 S a ll t 2 t u ca 9 authentication h (s F i/ 7 e a b8 act of establishing whether a materialT good is genuineh or. not0 i e -5 .it f s 1a rd -a a 4e nd 8 [SOURCE:3.3 ISO 22300:2018, 3.16 modified] ta -4 /s e covert authentication element :/ 86 ps 6 tt person reveals it to their senses or elseh allows automated interpretation of the element authentication element which is hidden from the human senses until the use of a tool by an informed

[SOURCE:3.4 ISO 22300:2018, 3.58 modified] inspector

anyone who uses the authentication solution with the aim of authenticating a material good [SOURCE:3.5 ISO 22300:2018, 3.120 modified] integrity

property of safeguarding the accuracy and completeness of assets Note 1 to entry: assets relate to material goods and its primary packaging. its processing. Note 2 to entry: integrity concerns also the associated data, the information or the elements and the means for

[SOURCE: ISO 22300:2018, 3.123 modified]

3.6 interoperability degree to which an authentication solution is able to work together with other different tools

[SOURCE:3.7 ISO 22300:2018, 3.128 modified] on-line authentication tool

interpret the authentication element authentication tool which requires permanent or periodical connection to a network to be able to

[SOURCE:3.8 ISO 22300:2018, 3.156, modified] raw material

any3.9 element, constituent, part of a material good rights holder

W - physical person or legal entity either holding or authorizedIE to use one or more90 intellectual property rights V af 3.10 E 50 [SOURCE: ISO 22300:2018, 3.198 modified] ef security R i) t/ 3 P a is 38 state of being free from danger or threats where procedures. are/s followed2 or after taking appropriate D eh s -2 measures R t rd is .i : a d A s d d o- D d r an is N r da st e/ a n g/ c A d ta o c5 T n s al 5 3.11 S a ll t 2 [SOURCE: ISO 22300:2018, 3.223 modified] t u ca 9 h (s F i/ 7 simulation e a b8 T h. 0 i e -5 .it f of another s 1a rd -a the imitative representation of the functioninga 4e of one system or process by means of the functioning 3.12 nd 8 ta -4 specifier /s e :/ 6 s 68 tp particular material good ht person or entity who defines the requirements for an authentication solution to be applied to a

[SOURCE:3.13 ISO 22300:2018, 3.246 modified] tamper evidence

been compromised ability of the authentication solution or the authentication element to show that the material good has

[SOURCE:3.14 ISO 22300:2018, 3.254 modified] track and trace

means of identifying every individual material good or lot(s) or batch in order to know where it is at a given time (track) and where it has been (trace) in the supply chain [SOURCE:3.15 ISO 22300:2018, 3.264 modified] verification

confirmation, through the provision of evidence, that specified requirements have been fulfilled Note 1 to entry: this may include checking that a unique identifier exists and is valid within an object identification system. ISO 2019 – All rights reserved 3 ©