CEN/TS 419241:2014
(Main)Security Requirements for Trustworthy Systems Supporting Server Signing
Security Requirements for Trustworthy Systems Supporting Server Signing
1.1 General
This document specifies security requirements and recommendations for Trustworthy System Supporting Server Signing (TW4S) that generate advanced electronic signatures as defined in Directive 1999/93/EC. This document may also be applied to electronic signatures complying to Article 5(1) of Directive 1999/93/EC employing a Secure Signature Creation Device (SSCD) compliant with Annex III and supported by a qualified electronic signature.
The Server Signing Application (SSA) runs on a networked server supporting one or more signatories to remotely sign electronic documents using centralized signature keys held on the signing server under sole control of the signatory.
An SSA is intended to deliver to the user or to some other application process in a form specified by the user, an Advanced- or where applicable a Qualified - Electronic Signature associated with a Signer's Document as a Signed Data Object.
This document:
- provides commonly recognized functional models of TW4S;
- specifies overall requirements that apply across all of the services identified in the functional model;
- specifies security requirements for each of the services identified in the SSA.
- specifies security requirements for sensitive system components which may be used by the SSA (e.g. Signature Creation Device (SCDev)).
This document does not specify technologies and protocols, but rather identifies requirements on the security on technologies to be employed.
1.2 Out of scope
The following aspects are considered to be out of scope:
- other trusted services that may be used alongside this service such as signature validation service, time-stamping service and information preservation service,
- any application or system outside of the SSA,
- the legal interpretation of any form of signature (e.g. the implications of countersignatures, of multiple signatures and of signatures covering complex information structures containing other signatures).
1.3 Audience
This document specifies security requirements that are intended to be followed by:
- providers of SSA systems.
- Trust Service Providers (TSP) offering signature generation service.
Sicherheitsanforderungen für Vertrauenswürdige Systeme, die Serversignaturen unterstützen
Exigences de sécurité pour des systèmes fiables de serveur de signature électronique
Varnostne zahteve za zaupanja vredne sisteme, ki podpirajo strežniško podpisovanje
CEN/TS 419241 podaja varnostne zahteve in priporočila za zaupanja vredne sisteme, ki podpirajo strežniško podpisovanje (TW4S) in ki ustvarijo napredne elektronske podpise v skladu z opredelitvijo v Direktivi 1999/93/ES. Ta dokument se lahko uporablja tudi za elektronske podpise v skladu s prvim odstavkom člena 5 Direktive 1999/93/ES, pri katerih se uporabi sredstvo za varno elektronsko podpisovanje (SSCD), skladno z Dodatkom III in podprto s kvalificiranim elektronskih podpisom. Strežniška aplikacija za podpisovanje (SSA) deluje v omrežnem strežniku, ki podpira oddaljeno elektronsko podpisovanje enega ali več podpisnikov z uporabo centraliziranih podpisniških ključev, hranjenih v strežniku za podpisovanje pod izključnim nadzorom podpisnika. Strežniška aplikacija za podpisovanje je namenjena za zagotavljanje naprednega ali, kjer je primerno, kvalificiranega elektronskega podpisa, povezanega z dokumentom kot predmetom podpisnih podatkov podpisnika uporabniku ali drugim aplikacijskim postopkom v obliki, ki jo navede uporabnik. Ta dokument: – podaja splošno priznane funkcionalne modele za zaupanja vredne sisteme, ki podpirajo strežniško podpisovanje; – določa splošne zahteve, ki veljajo za vse storitve, določene v funkcionalnem modelu; – določa varnostne zahteve za vsako od storitev, opredeljeno v strežniški aplikaciji za podpisovanje; – določa varnostne zahteve za občutljive sistemske komponente, ki jih lahko uporabi strežniška aplikacija za podpisovanje (npr. sredstvo za elektronsko podpisovanje (SCDev)). Ta dokument ne določa tehnologij in protokolov, temveč identificira zahteve glede varnosti za tehnologije, ki se uporabijo.
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
SIST-TS CEN/TS 419241:2014
01-julij-2014
Varnostne zahteve za zaupanja vredne sisteme, ki podpirajo strežniško
podpisovanje
Security Requirements for Trustworthy Systems Supporting Server Signing
Sicherheitsanforderungen für Vertrauenswürdige Systeme, die Serversignaturen
unterstützen
Exigences de sécurité pour des systèmes fiables de serveur de signature électronique
Ta slovenski standard je istoveten z: CEN/TS 419241:2014
ICS:
35.240.99 8SRUDEQLãNHUHãLWYH,7QD IT applications in other fields
GUXJLKSRGURþMLK
SIST-TS CEN/TS 419241:2014 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST-TS CEN/TS 419241:2014
---------------------- Page: 2 ----------------------
SIST-TS CEN/TS 419241:2014
TECHNICAL SPECIFICATION
CEN/TS 419241
SPÉCIFICATION TECHNIQUE
TECHNISCHE SPEZIFIKATION
March 2014
ICS 35.240.99
English Version
Security Requirements for Trustworthy Systems Supporting
Server Signing
Exigences de sécurité pour des systèmes fiables de Sicherheitsanforderungen für Vertrauenswürdige Systeme,
serveur de signature électronique die Serversignaturen unterstützen
This Technical Specification (CEN/TS) was approved by CEN on 14 October 2013 for provisional application.
The period of validity of this CEN/TS is limited initially to three years. After two years the members of CEN will be requested to submit their
comments, particularly on the question whether the CEN/TS can be converted into a European Standard.
CEN members are required to announce the existence of this CEN/TS in the same way as for an EN and to make the CEN/TS available
promptly at national level in an appropriate form. It is permissible to keep conflicting national standards in force (in parallel to the CEN/TS)
until the final decision about the possible conversion of the CEN/TS into an EN is reached.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United
Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2014 CEN All rights of exploitation in any form and by any means reserved Ref. No. CEN/TS 419241:2014 E
worldwide for CEN national Members.
---------------------- Page: 3 ----------------------
SIST-TS CEN/TS 419241:2014
CEN/TS 419241:2014 (E)
Contents Page
Foreword .3
Introduction .4
1 Scope .5
1.1 General .5
1.2 Out of scope .5
1.3 Audience .5
2 Normative references .6
3 Terms and definitions .6
4 Symbols and abbreviations .9
5 Description of Trustworthy Systems Supporting Server Signing . 10
5.1 General . 10
5.2 Signature Creation and Server Signing Objectives . 10
5.3 AdES bound to a natural or legal person . 10
5.4 Levels of sole control . 10
5.5 Batch Server Signing .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.