ISO 25023 divides the authenticity into authentication protocols and establishment of authentication rules. I understand that the authentication protocols aim to authenticate the user using different methods such as ID/password.

I hope that someone explain to me the difference between authentication rules and protocols.


The two notions may indeed be confusing since by definition a protocol is itself a set of rules. But in case of ISO/IEC 25023 the meanings are different and I think the best definition could be a tangible example:

Suppose you use any authentication protocol that uses ID/Password method as you said: the authentication rules could be, for example, a set f these ones:

  • The password must be hashed
  • The inputs must be sanitized to prevent SQL injections
  • The ID must be number
  • The ID must not exceed 25 digits
  • ...

An authentication rule is a set of measures taken to deploy the authentication protocol in practice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.