PKI – related technologies

Tadej Pukl

head of marketing and sales

SETCCE

Agenda SETCCE’s products and services
 SETCCE’s products in business practice eKeeper – trusted archive service
Copyright SETCCESETCCE Results and partners

delivering trust in e-business SETCCE – short company introductionCompany introduction

 15 people Young team Highly educated, experienced and motivated Over 10 years experience in PKI
Copyright SETCCESETCCE

 Ljubljana, Slovenia, EUdelivering trust in e-business SEcurity Technology Competence CEntre

SETCCE

Copyright SETCCE

delivering trust in e-businessSETCCE

Copyright SETCCE

delivering trust in e-businessSETCCE

Copyright SETCCE

delivering trust in e-businessCompany introduction

 Software: Introduction of digital signature in businessand governmental processes– Objecticve: fully de-materialized business processes– A wide range of technologies and components

 Mission: bridging the gap Æ technology transfer fromresearch projects into industry / commercial sector
Copyright SETCCESETCCE Research: EU-projects in telecommunications security
and privacy protectiondelivering trust in e-business Software development through research projects

Company introduction– Act on value added tax– Accounting standards– (Slovenian) archiving act

Copyright SETCCESETCCE– Act on electronic commerce and electronic
signature (+ revisions).

delivering trust in e-business Legislative environment

Company introduction

Copyright SETCCESETCCE– In force since 2000
– Based on European directives (1999/93/EC,2000/31/EC)– Framework for equalisation of paper and electronic
format of documents– (Qualified) Digital signature– Management of digitally signed electronic
documents

delivering trust in e-business Act on electronic commerce and electronic
signature (+ revisions):

Company introduction– Related to Public Key Infrastructure– Introduction of digital signature (and supportingtechnologies) in current business practice

Copyright SETCCESETCCE– Compliant with EU’s and local legislation– Compliant with global standards– Highest level of security

delivering trust in e-business SETCCE’s products:

Company introduction– Upgrades / add-ons to existing applications andinformation systems– Recognized and used worldwide

Copyright SETCCESETCCE– Specialized components intended for system
integrators and developers...

delivering trust in e-business SETCCE’s products:

SETCCE’s reference list
nCipher
H&S Software AG
S&TSRC.SIZZi
Institute Jozef Stefan
University of Ljubljana, Faculty of electrical engineering
Univeristy of Stuttgart
IAIK, Austria
T-SystemsTelenor, Norway
Slovenian Chamber of Commerce etc.

 ...and still looking for fruitful long-term partnerships...
Copyright SETCCESETCCE














delivering trust in e-business

Some of our partners:

SETCCE’s reference list

Copyright SETCCESETCCE– VeriSign, Inc.
– Halcom (ÆSlovenian banks)– SiOL d.o.o.
– Datalab tehnologije d.d.
– Valmesa Property&Asset Valuations– Slovenian Ministry of Defense– Dafolo S/A– H&S Software AG– Chinese gov’t: tax authority, ZhuHai– Sella bank, Italy– Italian Chamber of Commerce (Infocamere)– Simobil Vodafone, etc.

delivering trust in e-business Most important users of SETCCE’s technology:

Copyright SETCCE

delivering trust in e-business
SETCCESETCCE’s products and services

Copyright SETCCESETCCEproXSign product range

delivering trust in e-business

SETCCE’s products

SETCCE’s products (www.proXSign.com)– Instant integration!
– Widely used in the banking sector, ERP systems,
real-estate companies, telecomm operators,governments, etc.
Copyright SETCCESETCCE– Digital signing (W3C XMLDSig standard, XADESand PKCS7) + verification of signatures– Encryption (asymmetric - W3C XMLEnc),– Timestamping (RFC3161 and XML by Entrust)delivering trust in e-business Components and software development kits
for:

SETCCE’s products (www.proXSign.com)– Timestamp client, encryption tool, W3C-recognized
Copyright SETCCESETCCE– Integration into ERP systems for digital signing ofsingle electronic invoices or any other documents(one by one)
– In ERP systems: verification of incoming digitally
signed electronic invoices– Integration into workflows (non-disputalbe audit-trail)– Digital signing of payment orders in e-banking– Pharmaceutical industry (tracing drugs from theproduction plant to the end-user)delivering trust in e-business Practical examples:Copyright SETCCESETCCE

WebSigndelivering trust in e-business

SETCCE’s products

SETCCE’s products (WebSign)– Based on web-browser technology– Fully configurable (no limits)– Output = digitally signed XML document (optionalstylesheet). No paper!
– Used in governmentnal processes (MoD),employment agencies, telecomm operators
Copyright SETCCESETCCE– Instant generation of XML electronic forms (basedon pre-set templates)– Secure exchange between involved parties– In the process each party can fill in the e-forms andapply digital signaturesdelivering trust in e-business Workflow systems:

SETCCE’s products (WebSign)– Student employment agencies (filling in, signing andexchange of work reports)– Ministry of defense (requests for working tools for
newly employeed, ...)

Copyright SETCCESETCCE– Signing of electronic contracts (ISPs) over theinternet, signing of annexes, self-provisioning, etc.

delivering trust in e-business Practical examples:Copyright SETCCESETCCEeBiller

delivering trust in e-business

SETCCE’s products

SETCCE’s products (eBiller)– Automated generation of documents (XML, TXT,...,e-invoices or any other documents)– Multiple controls and checkpoints are integrated– Automated digital signing of generated documents– Automated generation of messages (S/MIME,SOAP, HTTP)– Automated distributiondelivering trust in e-business Electronic mass-“invocing” systems:

Copyright SETCCESETCCE– Used by ISPs, telecomms, banking industry

SETCCE’s products (eBiller)– Monthly banking acount statements

Copyright SETCCESETCCE– Mass generation and distribution of monthly invoices
for users of mobile telephony and internet services

delivering trust in e-business Practical examples:Copyright SETCCESETCCEeKeeperdelivering trust in e-business

SETCCE’s products

SETCCE’s products (eKeeper)– Used in governmental processes, telecomm
operators, ISPs, banking sector
Copyright SETCCESETCCE– Storage of digitally signed and non-signed electroniccontent– According to the legislation– Not really an archive, but rather en electronic
notary– An upgrade for existing DMSs, or as an independent
instance on top of a FS or existing e-archive– Also available as a DMS-bundledelivering trust in e-business Trusted electronic archive service:SETCCE’s products (eKeeper) Practical examples:

Copyright SETCCESETCCEdelivering trust in e-business...to be continued later

SETCCE’s products
 Certification authorities:– No business case in Slovenia– Experimental and demonstration purposes

Copyright SETCCESETCCE– Set-up of the first CA in Slovenia in 1995
– Part of EuroPKI– Still functioning

delivering trust in e-business

WWW.SI-CA.ORG

SETCCE’s products– Integration of SETCCE’s technologies intocusomers’ applications– Custom development of new applications– Consultancy and educational projects

Copyright SETCCESETCCE– For large end-customers

delivering trust in e-business Custom-projects: Total elimination of paper documents from abusiness process!
 Questions:– how do we store/archive the output?
– how do we manage the output?
...electronic documents have “some” limitations!
Copyright SETCCESETCCE Conclusion: output/result is always adigitally signed document!

delivering trust in e-business

Bottom-line

Copyright SETCCEeKeeper

SETCCE

 Answer = ...

delivering trust in e-business

Bottom-line

Copyright SETCCESETCCE– General definitions– Formal requirements (integrated in eKeeper)– Functional requirements– What is eKeeper?
– What does eKeeper do?
– How eKeeper works– Infrastructure / implementation– Extra features– Technology

delivering trust in e-business

SETCCE eKeeperGeneral definitions

 An archive is a collection of records and documentsthat have historical, cultural, scientific or business value
and are stored on physical media.

delivering trust in e-business

Copyright SETCCESETCCE Archiving is a set of procedures of submission,
retrieval, preservation, maintenance, professional
management and usage of documentary and archival
material, which is not used for current businessanymore. Such procedures need to be performed overperiods defined by formal and legislative requirements.
(i.e. archiving is much more than storage)

Formal requirements for eKeeper– ...see next page
Copyright SETCCESETCCE– Data or content is accessible and usable at any time,– Archived content is preserved in its original form orin any other form that undeniably represents theoriginal data,– The origin, time, location and the “owner” of anelectronic record or message are undeniably
identifiable

delivering trust in e-business Electronic records must be kept so that:

Formal requirements for eKeeper

Copyright SETCCESETCCE– Technology and procedures used must prevent any
sort of modification, alteration or deletion of record,
data or content – integrity is guaranteed at any time,– Complementary data and means for security
attributes (e.g. digital signatures) are preserved forthe same archiving period as records– Procedures and means for extending the validity ofelectronic attributes are accordingly implemented.

delivering trust in e-business Electronic records must be kept so that:

Functional requirements for eKeeper

Copyright SETCCESETCCE– Submit data objects to archive– Retrieve archived data objects– Delete archived data objects– Specify an archive period for submitted data objects– Extend or shorten the archive period for an archived
data object– Specify metadata associated with an archived dataobject– Specify an archive policy under which the submitted
data should be handled

delivering trust in e-business Trusted archive service must have the following
basic operations:

Functional requirements for eKeeper

Copyright SETCCESETCCE– Raw data
– Digitally signed data
– Time stamped data
– Encrypted datadelivering trust in e-business Trusted archive service accepts

What is eKeeper?

– An upgrade of existing DMSs
– Provides long term stability of• Documents• Digital signatures– Designed for critical and heavy loaded environments
Copyright SETCCESETCCE– Based on national and international legislation and directives
for long term documents preservation– Based on global technical directions and standardization
initiatives (IETF LTAP Protocol, encryption and hashingalgorithms...)delivering trust in e-business A solution for long-term electronic archiving
 A replacement for costly hardware solutions (Centera)What does eKeeper do?

 In other words: eKeeper can demonstrate inegrity andlegal validity of archived digital content for the complete
archival periodCopyright SETCCESETCCE– existed at a certain (clearly defined) time in the past– has not been compromised since it was digitally signed (orsince it was submitted to the archive if it was not signed)– is still legally valid and will remain so for the whole archival
period– still bears a valid digital signature (if applied). Validity of thesignature will be maintained throughout the whole archival
period!

delivering trust in e-business It provides evidence that an archived document:Copyright SETCCE

delivering trust in e-business

C.A.=conservationattributes!

SETCCE

Archival period (time)

How eKeeper works Documents’ validity is assured

Copyright SETCCESETCCE Archived documents are left intact!
 Conservation Attributes are created upon entry
 Conservation Attributes are used todemonstrate documents’ validity and integrity
 Conservation Attributes are refreshedperiodically Timestamping is used (DSE!)

delivering trust in e-businessHow eKeeper works

Infrastructure

Copyright SETCCESETCCE– Communication network (and PKI)
– Security mechanisms– Time stamping service– Data storage or document management system– Application systems and services

delivering trust in e-business Supporting infrastructure of trusted archiveservice

nCipher
DSE(internal or outsourced)

DMS / Data storage

Copyright SETCCESETCCE

Certification
authorities

delivering trust in e-business

Infrastructure De-grouping without re-timestamping
 Privacy protection upon verification ofdocuments

eKeeper is a substitute for dedicated hardware archiving solutions
Copyright SETCCESETCCE Grouping of archived documents to minimize
the cost of timestamping!

delivering trust in e-business

Extra features (competitive advantage)!

Platform• Conservation attributes generation and storage• Conservation attributes generation and storage + document
storage– Application programming interface included

Copyright SETCCESETCCE– C++ / Java based– Integrated LTAP (long-term archive protocol)– Supported modes

delivering trust in e-business eKeeper ClientPlatform• Conservation attributes generation and storage• Conservation attributes generation and storage + document
storage– Interfaces• DB interface (Oracle, mySQL, MSSQL…)• HSM interface (nCipher)• TCP/IP or SOAP interface

Copyright SETCCESETCCE– Java based– Integrated LTAP– Supported modes

delivering trust in e-business eKeeper ServerOperation requirements
 Platforms– Oracle, mySQL, MSSQL, DB2…

 Supported document management
systems/environments– IBM Lotus Domino/Notes, EMC Documentum, H&S
PAM Storage…
– SAP R/3, Navision…

Copyright SETCCESETCCE Databases (conservation attributes)delivering trust in e-business– Microsoft Windows, Linux, Solaris, HP-UX, AIX…

Standards
 Implemented standards– Data structures• IETF LTAP
• W3C SOAP

– Integrity evidence• SHA1, SHA256, SHA384, SHA512• RIPEMD160– Signatures• RSA PKCS#7• W3C XMLDSig• ETSI/W3C XAdES– Evidence record• IETF RFC3161• Entrust XMLTS

Copyright SETCCESETCCE– Interactiondelivering trust in e-business• W3C XML

Jamova 39
1000 Ljubljana
Slovenia, EU++386 (0)1 477 3861
info@setcce.org
www.setcce.org

Copyright SETCCESETCCESETCCEdelivering trust in e-businessContact