SIST EN 14615:2005
(Main)Postal services - Digital postage marks - Applications, security and design
Postal services - Digital postage marks - Applications, security and design
This document specifies a recommended procedure for the development of specifications for applications of digital postage marks (DPMs)- i.e. applications linked to the use of digital printing and image data capture technologies in the postal industry, most particularly for the evidencing of postage accounting and/or payment. It is not intended to prescribe or to recommend any particular architecture or design for such applications, only to specify the process through which such an architecture or design should be developed.
NOTE 1 For this reason, the standard includes both normative and informative content. Clauses 1 to 5 and Annex A are normative, whilst the remaining annexes are informative. Non-normative (informative) clauses are indicated as such in the heading.
The process described is based on a cyclic model, involving business planning; systems analysis; security analysis and detailed DPM design.
The defined process is a recommended one only and DPM applications designers are not obligated to follow it. However, its use is intended to ensure both that all relevant aspects are taken into account in the design process and that the resulting specifications have a degree of commonality of structure which make them comparable with similar specifications produced by other parties. It is hoped that this will make them more easily intelligible, and less open to ambiguity, for implementers.
It is assumed that users of the standard are familiar with normal processes involved in the design of computer-based applications and the standard therefore limits itself to aspects which are specific to DPM applications design. In particular, the document covers only requirements and considerations relating to applications that use digital postage marks, on individual postal items, as a means of communicating data (messages). The clause on design covers only the design of the digital postage marks themselves. It does not cover other aspects of design, including the possible u
Postalische Deinstleistungen - Digitale Freimachungsvermerke - Inhalte, Sicherheit und Gestaltung
Dieses Dokument beschreibt ein empfohlenes Verfahren für die Entwicklung der Spezifikation digitaler Freimachungsvermerke (DPMs) - d. h. Inhalte, die mit der digitalen Druck- und Bilddatenerfassungstechnologien in der Postindustrie verknüpft sind, größtenteils für den Nachweis der Portoabrechnung bzw. -bezahlung. Es ist nicht beabsichtigt, bestimmte Architektur bzw. eine bestimmten Entwurf für solche Inhalte vorzuschreiben oder zu empfehlen, sondern nur den Prozess anzugeben, durch den eine Architektur oder ein Entwurf entwickelt werden sollte.
ANMERKUNG 1 Aus diesem Grund sind in dieser Norm sowohl ein normativer als auch ein informativerInhalt berücksichtigt. Die Abschnitte 1 bis 5 sowie Anhang A) weisen normativen Charakter auf, während die übrigen Anhänge informativer Art sind. Alle nicht-normativen (informativen) Abschnitte sind als solche in der Überschrift gekennzeichnet.
Der Prozess beruht auf einem zyklischen Modell, welches die Geschäftsplanung, Systemanalyse, Sicherheitsanalyse sowie eine ausführliche Gestaltung der digitalen Freimachungsvermerke umfasst.
Bei dem festgelegten Verfahren handelt es sich lediglich um eine Empfehlung und die für die Gestaltung der Inhalte digitaler Freimachungsvermerke zuständigen Personen sind nicht verpflichtet, sich daran zu halten. Durch die Verwendung soll jedoch sichergestellt werden, dass alle relevanten Aspekte des Gestaltungsverfahrens berücksichtigt werden und dass die daraus folgende technische Beschreibung so aufgebaut ist, dass sie sich mit einer von Dritten erzeugten technischen Beschreibung vergleichen lässt. Es ist zu hoffen, dass die Anwendung dadurch besser verständlich und weniger zweideutig für die Anwender ist.
Es wird vorausgesetzt, dass die Anwender der Norm mit den normalen Verfahren für die Gestaltung computergestützter Inhalte vertraut sind und die Norm beschränkt sich deshalb auf Aspekte, die spezifisch für die Gestaltung von Inhalten digitaler Freimachungsvermerke sind. Insbesondere enthält das
Services postaux - Marques d'affranchissement digitales - Applications, sécurité et conception
Le présent document précise une procédure recommandée pour l'élaboration des spécifications relatives aux applications de marques d'affranchissement digitales, c'est-a-dire des applications liées a l'utilisation de technologies d'impression digitale et de capture de données d'image dans l'industrie postale, et plus particulierement pour apporter des éléments de preuve de la comptabilité et/ou du paiement de l'affranchissement. Il n'est pas destiné a préconiser ou recommander une architecture ou une conception particuliere mais uniquement a préciser le processus par lequel il est recommandé de les développer pour lesdites applications.
NOTE 1 C'est la raison pour laquelle la norme inclut a la fois un contenu normatif et informatif. Les Articles 1 a 5 et l'Annexe A sont normatifs. Les annexes qui suivent sont quant a elles informatives. Les articles non normatifs (informatifs) sont indiqués en tant que tel dans l'en-tete.
Le processus décrit repose sur un modele cyclique, impliquant une planification commerciale, une analyse des systemes, une analyse de la sécurité et une conception détaillée de la marque d'affranchissement digitale.
Le processus défini est simplement recommandé, et les concepteurs d'applications de marques d'affranchissement digitales ne sont pas obligés de s'y conformer. Toutefois, le recours a ce processus permet de s'assurer que tous les aspects pertinents du processus de conception ont été respectés et que le degré de similitude de la structure rend les spécifications qui en résultent comparables aux spécifications similaires produites par d'autres parties. Il a pour vocation de les rendre plus intelligibles et moins ambigus pour les responsables de la mise en application.
Poštne storitve – Digitalne poštne označbe – Uporaba, varnost in oblikovanje
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
SIST EN 14615:2005
01-maj-2005
3RãWQHVWRULWYH±'LJLWDOQHSRãWQHR]QDþEH±8SRUDEDYDUQRVWLQREOLNRYDQMH
Postal services - Digital postage marks - Applications, security and design
Postalische Deinstleistungen - Digitale Freimachungsvermerke - Inhalte, Sicherheit und
Gestaltung
Services postaux - Marques d'affranchissement digitales - Applications, sécurité et
conception
Ta slovenski standard je istoveten z: EN 14615:2005
ICS:
03.240 Poštne storitve Postal services
SIST EN 14615:2005 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST EN 14615:2005
---------------------- Page: 2 ----------------------
SIST EN 14615:2005
EUROPEAN STANDARD
EN 14615
NORME EUROPÉENNE
EUROPÄISCHE NORM
January 2005
ICS 03.240
English version
Postal services - Digital postage marks - Applications, security
and design
Services postaux - Marques d'affranchissement digitales - Postalische Deinstleistungen - Digitale
Applications, sécurité et design Freimachungsvermerke - Inhalte, Sicherheit und
Gestaltung
This European Standard was approved by CEN on 26 August 2004.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the Central Secretariat or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the Central Secretariat has the same status as the official
versions.
CEN members are the national standards bodies of Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Finland, France,
Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia,
Slovenia, Spain, Sweden, Switzerland and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: rue de Stassart, 36 B-1050 Brussels
© 2005 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 14615:2005: E
worldwide for CEN national Members.
---------------------- Page: 3 ----------------------
SIST EN 14615:2005
EN 14615:2005 (E)
Contents
page
Foreword.6
1 Scope .8
2 Normative references .8
3 Terms and definitions .9
4 Symbols and abbreviations.11
5 DPM applications and design process.12
5.1 Introduction.12
5.2 DPM business planning .13
5.3 DPM systems analysis .14
5.4 DPM security analysis.14
5.5 DPM design .15
Annex A (normative) Specification checklists.16
A.1 DPM applications specifications.16
A.2 System specification .16
A.3 Security specification.16
A.4 DPM specification.16
Annex B (informative) Business planning considerations .17
B.1 Possible applications .17
B.2 Market segmentation.18
B.2.1 Approach .18
B.2.2 Mailer segmentation .18
B.2.3 Postal access and induction .19
B.2.4 Payment.19
B.3 Applications selection.20
B.3.1 Approach .20
B.3.2 Infrastructure requirements and constraints.20
B.3.3 Other factors .21
Annex C (informative) Security analysis considerations .22
C.1 Context.22
C.2 Security objectives, policy and economics .23
C.3 Threats and vulnerabilities .24
C.3.1 Introduction.24
C.3.2 Environmental context.24
C.3.3 General threats to DPM systems .25
C.4 Applications and message level security .27
C.5 Security services and message level countermeasures.29
C.6 Applications level countermeasures .31
C.6.1 Introduction.31
C.6.2 Access and usage controls .31
C.6.3 Duplicate detection.34
C.6.4 Induction control .36
C.6.5 Inspection & forensic analysis.37
C.6.6 Investigation.37
C.6.7 Postal item verification .38
C.6.8 Obliteration countermeasures .40
C.6.9 Security service management.40
C.6.10 Volume and revenue controls .40
C.7 Countermeasure selection.41
2
---------------------- Page: 4 ----------------------
SIST EN 14615:2005
EN 14615:2005 (E)
C.8 Application of countermeasures.42
C.9 Message security implementation options.43
C.9.1 Introduction.43
C.9.2 Digital signatures.43
C.9.3 Message authentication codes .44
C.9.4 Exchange validation codes .45
C.9.5 Selection of message security techniques.47
C.9.6 Application of verification techniques .47
Annex D (informative) Systems analysis considerations .48
D.1 Requirements analysis.48
D.2 Functional description .49
D.2.1 Approach .49
D.2.2 Postal item production.49
D.2.3 Rating.49
D.2.4 Accounting .50
D.2.5 DPM generation .50
D.2.6 DPM printing .50
D.2.7 Payment.50
D.2.8 Induction.50
D.2.9 Mail processing: sorting, transportation and delivery .50
D.2.10 Component management.51
D.2.11 Security management .51
D.2.12 Audit.51
D.2.13 Application services.51
D.3 Function allocation and architecture design.51
D.4 Other detailed design aspects .52
D.4.1 Introduction.52
D.4.2 Data requirements and sourcing .52
D.4.3 DPM printing .53
D.4.4 DPM data capture .54
D.4.5 Applications processing.55
D.4.6 Security analysis .56
D.4.7 Exception handling.56
Annex E (informative) DPM design considerations .57
E.1 Data content .57
E.2 Data entry .58
E.3 Data construct mapping.58
E.4 Symbology .59
E.5 Human readable information.60
E.6 Layout, facing & aesthetics .61
E.7 Performance and test criteria.62
Annex F (informative) Statistical analysis of DPM verification.63
F.1 Introduction.63
F.2 Purpose and scope of postal item verification.63
F.3 Detection of DPMs with invalid validation code.64
F.3.1 Introduction.64
F.3.2 Parameters .64
F.3.3 Possible Outcomes .65
F.3.4 Analysis of Outcomes.65
F.3.5 Calculation of Fraud Incidence .66
F.4 Influence of CVC length on fraud detection.68
F.5 Detection of duplicate DPMs .69
Annex G (informative) Message security algorithms .71
G.1 Introduction.71
G.2 Hash functions used in message security services .71
G.3 Asymmetric (public key) cryptographic algorithms .71
G.3.1 DSA .71
G.3.2 RSA .72
G.3.3 ECDSA .72
3
---------------------- Page: 5 ----------------------
SIST EN 14615:2005
EN 14615:2005 (E)
G.3.4 Hybrid digital signatures with partial message recovery.73
G.3.5 Other digital signature methods .74
G.4 Message authentication code (MAC) algorithms .74
G.4.1 CBC DES.74
G.4.2 Advanced Encryption Standard (AES) .75
G.4.3 HMAC .75
G.4.4 MAC truncation and CVC size .76
G.5 Exchange validation code generation .77
G.6 Selection of algorithms for CVC implementation.78
G.6.1 Introduction.78
G.6.2 Cryptographic strength of commonly used algorithms .78
G.6.3 Validation code size and size inflation .80
G.6.4 Generation and verification complexity .81
G.6.5 Key generation complexity.82
G.6.6 Key management infrastructure .82
G.6.7 Intellectual property rights .82
G.6.8 Legality of use; export and import approval.83
Annex H (informative) CVC generation and verification data.84
H.1 Introduction.84
H.2 Sources of data for verification.84
H.2.1 Introduction.84
H.2.2 Data encoded on the item.85
H.2.3 Data accessed by database look up .85
H.3 Selection of data used in the verification process.85
H.3.1 Introduction.85
H.3.2 Acceptance control code.87
H.3.3 Batch identifier and item number; licence plate .87
H.3.4 CVC .88
H.3.5 Date / time.88
H.3.6 Delivery security code.88
H.3.7 Device identifier, customer identifier or licence number .89
H.3.8 Postage value.89
H.3.9 Public key certificate identifier.89
H.3.10 Rating parameter(s), including service indicator.89
Annex I (informative) Architecture examples .91
I.1 Introduction.91
I.2 The REMPI architecture .91
I.2.1 Introduction.91
I.2.2 Mailer systems .91
I.2.3 Mail finishing system .91
I.2.4 Mail finishing print subsystem.91
I.2.5 Secure accounting system .92
I.2.6 Announcement system .93
I.2.7 Acceptance system .93
I.2.8 Postal item verification system.93
I.2.9 Reconciliation & support systems.94
I.2.10 Bank .94
I.2.11 Post systems.94
I.2.12 Mail handling infrastructure .94
I.2.13 Customer information system.94
I.2.14 Enquiry & data system .94
I.3 USPS IBIP configurations.95
I.3.1 Introduction.95
I.3.2 System components.96
I.3.3 Configuration A.96
I.3.4 Configuration B.98
Annex J (informative) Examples of digital postage marks (not to scale).99
J.1 Australia Post.99
J.2 Canada Post .99
J.3 Deutsche Post.100
4
---------------------- Page: 6 ----------------------
SIST EN 14615:2005
EN 14615:2005 (E)
J.4 Die Post, Switzerland .101
J.5 Royal Mail .102
J.6 United States Postal Service (USPS).102
Annex K (informative) Relevant intellectual property rights (IPR) .104
K.1 Introduction.104
K.2 Massachusetts Institute of Technology .104
K.3 Neopost.104
K.4 Pitney Bowes Inc .104
K.5 Pitney Bowes Inc, together with Certicom Corp .105
K.6 United States Department of Commerce.105
K.7 United States Postal Service .105
Annex L (informative) DPM design charts .106
L.1 Applicability of countermeasures against identified threats.106
Application Countermeasure.107
L.2 Data elements used by typical applications & countermeasures .108
L.3 Mapping data elements onto data sour
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.