Time Authentication Infrastructure
Guideline(Digest Edition)

September 2003

Time Business ForumForeword
In our modern clock-ruled culture, it is not too much to say that no society can exist unlessbased on “time”. Computers, which are the key device of an information society, are equippedwith high precision clocks to synchronize their entire circuit function. In an electronic
environment or digital society built on computers, recordkeeping relates inevitably to thetime that is ticked away by the clocks embedded in the computers.
Time is thus the infrastructure of this information society. However, the importance of
securing evidential authority of electronically determined time, and synchronizing clocks ofmultiple computers working in cooperation are not recognized enough.
To save the situation, a notion of time for the digital society should be properly definedand popularized, specifying the way and conditions of using it safely. Time Business Forumwas established to diffuse the time notion for the digital society. As part of Technology
Committee of the Forum, the Guideline Subcommittee is responsible for presenting a
guideline on this issue to users and providers.
The scope of discussion here focuses on some specific industries and applications fortime-stamping technologies. Also, emphasis is put on releasing this guideline as quickly as
possible to the public. We focused mainly on time-stamp use by national and local
governments to produce a general guideline for both users and providers. The guideline will
be further refined step by step as their validity is verified in actual use. Meanwhile, we areplanning to work on guidelines for standard time distribution, which is as important as
time-stamp to time business.
We hope that our effort to prepare the guideline for time-stamp use, application andprovision will expand introduction of time-related technology and enhance relevant
regulatory reforms, and contribute to building reliable infrastructure of electronic society
through establishing such time businesses as standard time distribution and timeauthentication.
March 2003
Time Business ForumCONTENTS
Foreword
Ch. 1 Outline·····································································································3
Ch. 2 Digital Information Problems ······································································7
Ch. 3 Role of Time-stamp ·················································································· 12
Ch. 4 Mechanism of Time Authentication Infrastructure ······································· 18
Ch. 5 Time-stamp User Guideline······································································· 23
5.1 Framework ····························································································· 23
5.2 Guideline for Use in E-bidding ··································································· 24
5.2.1 Timing and Purposes ···································································· 24
5.2.2 Requirements for Time-stamp ························································ 31
5.2.3 Management and Verification of Acquired Time-stamp ······················ 32
5.3

Guideline for Use in E-application [Deleted]··············································· 33
5.3.1 Timing and Purposes [Deleted]······················································· 33
5.3.2 Requirements for Time-stamp [Deleted]··········································· 33
5.3.3 Management and Verification of Acquired Time-stamp [Deleted]········· 33

5.4 Time-stamp Acquisition for Internal Log ····················································· 33
Ch. 6 Time-stamp Provider Guideline ································································· 35
6.1 Technical Guidelines················································································· 35
6.1.1 Standard-time Distribution Service·················································· 35
6.1.2 Time-stamping Service ·································································· 37(1) Simple Protocol ················································································· 37(2) Linking Protocol ················································································ 40
6.1.3 Time-stamp Verification Service ······················································· 41(1) Simple Protocol ················································································· 41(2) Linking Protocol ················································································ 42
6.2 Operational Guidelines ············································································· 42
6.2.1 Common Items············································································· 42
6.2.2 Simple Protocol ············································································ 47
6.2.3 Linking Protocol ··········································································· 48
6.3 Infrastructure ························································································· 50
6.3.1 Facility ······················································································· 50
6.3.2 Network ······················································································ 52
6.3.3 Server Storage ············································································· 53
Appendix 1 Terminology [Deleted]
Appendix 2 References [Deleted]2

Chapter 1. Outline
1.1 Background and Objective(1) Importance of Digital Trace of TimeIn transactions, applications, personal promises or whatever we experience daily, notion oftime is of the essence, whether or not we are aware of it. And physicochemically or sociallyobtained trace of time is recorded on paper. In other words, we are recording analog trace oftime in terms of media, methods and forms.
Recent progress of information technology has rapidly promoted document digitization.
Unfortunately, digital data or documents, unlike paper documents, are essentially
impossible to distinguish a copy from the original. This raises problems such as securing
originality and preventing alteration of information. Securing authenticity of trace of time isalso one of the biggest problems.
To activities in the society, completing digital data in an electronic environment meansthat digital trace of time independent of any medium must be realized. This means that
trace of time must be a piece of digital data that is digitally documented. Technical methods
for this have been proposed and applied to practical tools, with some of them introduced into
actual operation. However, the electronic trace of time has not yet obtained a high standing
as the traditional one, which is supported by the time-honored custom and rules rooted
deeply and widely in the society.
(2) Objective of the Guideline
To become widely approved in society, the time notion for an electronic environment needs
to win public awareness, trust and daily opportunity as well as technical support. Given thatthe modern world is based on “time”, an electronic/digital world can be based on an integral
structure that authorizes “digital trace of time”. We call the whole such structure as “timeauthentication infrastructure”, establishment of which is the objective of this guideline.
Through describing the feature, importance and effects of time-stamp as a trace of time
given to digital documents/data stored for future use, we will provide users with atime-stamp user guideline and providers with time-stamp offer guideline. Consequently,
time-stamp users will know business application standards for appropriate time,
documents/data and trace of time, while providers will be suggested service quality
standards such as type and reliability of time-stamp they offer.

1.2 Policies of Guideline Study3

We studied the guideline, keeping the following in mind.
(a) Placing importance on time-stamp use and application
As a group of “time” specialists, we particularly tried to ensure the security aspect of ourguideline for users’ trust. Technical studies of time-stamp have been actively carried out bymany domestic and foreign organizations concerned. However, like other technologies,
time-stamp needs clear definition of its use and application in order to be fully utilized.
Therefore, we took up a use-and-application point of view instead of the technology itself, sothat our guideline could be helpful to both users and providers.
(b) Placing importance on practical use
Time-stamp technology standardization is being pushed forward by IETF and ISO/IEC.
And as for digital documents (digital documents), time-stamping policy is defined in XML,the key standards for digital document exchange. At present, these standards are open tofurther improvement, as they are inadequately applied to practical tools or too specialized incertain types of business. While primarily based on domestic and international technicalstandards now existing, we designed this guideline to be practical taking into consideration
the state of tools and services currently offered.
(c) Being neutral
Time-stamping system types will be discussed along with relevant systems whose
standard requisites to fulfill are clarified. As detailed in later discussion, there are several
types of time-stamping systems. It is difficult at this moment to select one from those withdifferent characteristics. This guideline for users, therefore, focuses on the conditions
necessary for using time-stamp service, not depending on or emphasizing any specific system.
Similarly, this guideline for providers is designed exclusively to identify appropriate service
operation, carefully avoiding inclination to any specific business type.
(d) Versatility and generality
Most technologies are developed for general uses, and introduced to practical use bydefining the purpose and range of their application. This guideline defines individual
business application purpose and range of the time-stamping technology. However, the more
precise the definition is, the more exclusive the guideline may become, leaving out manybusinesses as irrelevant. On the other hand, if extremely generalized, the guideline may not
be more helpful than a technical explanatory. We carefully made our guideline balanced
between the individualization and generalization of the technology use.
(e) Start from electronic government services

4

Among many government services in which time-stamp may be effective, we selected
e-application and e-tender to deal with in our guideline. Both have a pressing need oftime-stamp introduction, as these new services will be instituted on a full scale under thee-Japan project. With workflows different from each other, the two services will be dealt withseparately when pairing user’s guideline and provider’s guideline.

1.3 Guideline Composition
This guideline is composed mainly of three parts: Explanatory in Chap. 2-4, User
Guideline in Chap. 5, and Provider Guideline in Chap. 6.
(1) Explanatory
In the explanatory part, problems peculiar to digital documents, time-stamp as a solution
to the problems, and time authentication infrastructure to realize time-stamping system will
be explained, thus clarifying the importance and effects of time-stamp introduction, which isone of the guideline’s purposes.
In Chapter 2, “Digital Information Problems”, the reason for time authentication’s
importance will be discussed. Digital documents are essentially impossible to be
distinguished between originals and copies. This provides opportunities for alteration,
spoofing and other document authenticity problems, causing troubles such as contract
rupture by repudiation. Digital signature system is not perfect in terms of proving theexistence, integrity and sequentiality of digital documents.
The technology to solve these problems is time-stamp, whose importance, requirements,
and technological types and trends will be also described in the explanatory part for better
understanding of the guideline parts.
In Chapter 4, named “Mechanism of Time Authentication Infrastructure”, the importanceof time authentication will be stressed, referring to structure and reliability of the system.
Time authentication business players and their roles, flow of time-stamp issuance andverification, and time traceability will be also discussed in the chapter.
(2) User Guideline
This is a time-stamping guideline for client service providers and local public service
authorities. The guideline will be specified on tender service and application service to beprovided under the electronic government (“e-government”). General guideline shared
among various services will be left out here except for its basic idea and framework.
The guideline will clarify the workflow first, and then, based on it, identify the documents
and timing that need time-stamping. It will also clarify the reason or purpose of time-stamp5

use, in order to help users decide what they need for their time-stamping system. As
time-stamp requirements differ by service type, requirements for the period of validity, time
precision, and verification will be defined for each service type.
The guideline will cover handling and verifying acquired time-stamps, as time-stampacquisition may not necessarily guarantee the authenticity of digital documents.
(3) Provider Guideline
This is a guideline for time-stamp-related service providers. It will define technical andoperational standards of different service types: standard time distribution, time-stamp
issuance, and time-stamp verification. It will also include the standards of facility, networkand server, which are common to the three service types. Time-stamp issuance is roughly
divided into two systems distinct from each other: Simple Protocol and Linking Protocol.
Each service type will be described based on the two systems.

1.4 Instructions for Guideline Use [Deleted]6

Chapter 2. Digital Information Problems
Importance of digital information in the advanced network society is steadily growing.
Information network infrastructure that guarantees security of transaction is vital to thegrowing opportunity of e-commerce. Secrecy of channel, authentication of document
correspondent, and authenticity of exchanged documents are indispensable to security oftransaction. Especially, securing digital documents’ authenticity is a serious agenda, as they
are distributed easily and rapidly, and copied without difficulty.

2.1 Possible Threats
The following threats are possible in digital information distribution:
Spoofing①

This means an act done by some ill-intentioned person in the disguise of the right person.
On e-commerce network, one may incur damage from some unknown transaction unlesspersonal identification is strictly conducted. This can be avoided by digital signature that
secures personal authenticity.
Alteration②

Some ill-intentioned person may alter important information in a digital document. If thealteration is easy to make but hard to detect, one may incur damage from false informationin, for instance, an electronic application form. Alteration can be detected through securing
document authenticity with digital signature.
Repudiation③

This means that someone denies or contradicts the fact of having done something. Thiscan be a denial of the fact of having received or submitted an electronic application form, ora contradiction of the fact of having signed a contract. It is likely that these will happen
frequently in network activities unless evidence of certain facts is recorded. Repudiation can
be avoided by digital signature that secures personal authenticity.

2.2 Digital Signature Technology(1) Authenticity of Digital document
In traditional paper society, a document is regarded to be “an authentically produced
document” or “an authentic document” 1 when it has been produced truly by the one

1

Takahito Natsui: The Digital Signature Law. Ric Telecom.

7presenting him/herself as the author. In addition, a document with the professed author’s
seal allows a presumption of the contents’ authenticity. Enforced in 2001, the Digital
Signature Law (the Law concerning Digital Signature and Certification Services) gave
digital documents (electromagnetic records) the effect of presumptive authenticity of private
documents, which is provided in 228-4 of the Civil Proceedings Act. Since then, digital
document authenticity can be legally recognized if signed with a key secured under a Public
Key Certificate, which is issued from a well-trusted Certification Authority based on the
Public Key technology (or PKI: Public Key Infrastructure). The Digital Signature Law also
defines the service requirements for trusted Certification Authorities.
(2) Digital Signature Technology
Digital signature is a technology to secure authenticity of digital document author andcontents. PKI enables identification of a digital document’s signer, producer, and risk of
having been altered, by using Public Key Certificate information issued by a trusted
Certification Authority.
Figure 2-1 outlines PKI-based digital signature system. In traditional paper society,authenticity of a sealed document is verified by identifying the imprint of a registered seal,
which can be generated only by its genuine owner. An interested party in a transaction
examines the identity of the other’s seal imprint on the document with that on a registeredseal certificate issued from a municipal office. In PKI-based digital signature system, incontrast, a trusted Certification Authority issues a public key certificate to the key pair(public key and private key) after implementing a strict personal verification of its owner. An
interested party in a transaction uses the private key of its exclusive possession whengenerating its digital signature, and can view digital document contents only by using the
public key that matches the private key.

8

Paper Society

Registered Seal
Certificate

Public Office

Registered imprint
Verify imprint and seal owner(No alternation confirmed)

Registered seal(of her exclusive use)

Hash function＋

MessagedigestPrivate key(of her exclusive possession)＝Comparison
Text Hash function Message
data
digest

Text
data
Digitalsignature

Digital ＋＝
signature
Public key

MessagedigestPublic key issuance (public key certificate)Public key(paired with private key)
Issue public key certificate
after owner verification

・ Verify that document sender’s publickey certificate has been issued by atrusted CA
Certification Authority ・ With the sender’s public key capableof decoding, alternation detection and(CA)
personal verification become possible

Digital Society

Figure 2-1 PKI Structure

In the digital signature system to secure digital document authenticity, a digital document
producer degenerates the document to a message digest by hash function, and encodes itwith the private key unique to him/her. The recipient of a digitally signed document acquires
both the document producer’s public key certificate and Certification Authority’s public key
certificate in order to verify that the certificate has been validly issued by a trusted CA.
Then, using the producer’s public key, the recipient verifies authenticity of the received
electrically signed document. Damage from transmission to or alteration of the
one-directional message digest can be detected during the digital signature verification.
(3) Limitations of Digital Signature
Digital signature has been adopted by national and local e-government infrastructure as atechnology to verify authenticity of documents, which is essential for Internet uses such as
electronic application. However, documents with digital signature based on PKI have thefollowing limitations.
•With an absence of time-related information in itself, digital signature does not provide
evidence that a document existed at the time when it is supposed to have. (Accuracy of
the time axis of Figure 2-2 cannot be verified.)•A PKI-based CA’s guarantee for a digitally signed document does not last beyond the
public key certificate’s period of validity, which represents the period that the relevant

9private key is valid. In the case that the certificate’s validity is lost before the period isover, the guarantee expires when the revocation notice has been accepted and settled by
the CA. (Figure 2-2)•

PKI-based digital signature system to secure document authenticity can eliminate
alteration by third parties, but it cannot prevent mala fide alteration by the document
producer in person.

Generation of signature

Revocation of PKC

Period of validity indicated on PKC
Period to keep revocation notice
Period of signature validity
Period that authenticity of digital document is securedby time-stamp and long storage
Store in a safe area
the information on
signature generation
time and signaturevalidity at that time.

Digitaldocument

Securetime- stamp

Signature

Information stored in secure area
confirms certificate’s validity at thetime of signature generation and,
therefore signature’s validity.

Verification
Secure area
information(CRL, etc.) Area secure from illegal
commitment of physicalor logical access

Reference : The Interim Reporton Long-term Storage of Digitalｌｙ
Signed Documents
ECOM H13 Authentication/Notary WG

Figure 2-2 Period that Authenticity of Document is Guaranteed

To solve these problems, existence of a digital document at a specific point of time must be
proved by time-stamp. This is the time-stamping technology, which realizes existential
evidence of digital information.

2.3 Time-stamp
As already mentioned, digital signature is a means to enable personal verification andcontent authenticity of digital documents, which are involved in transactions and procedures
to be secured.

For security of transactions and procedures taking place on the digital

network, evidence of the existence of relevant facts and proof of document delivery are also

10

necessary. Therefore, along with digital signature, time-stamp is essential to authenticate(guarantee) that a digital document existed at a certain time.
It is expected that time-stamp will be effective in the following functions and services:•

Evidence of the existence
To guarantee that a digital document existed at a certain point of time.

•

Proof of delivery
To prove that a transmitted document has reached the recipient, as well as that therecipient have received the document. Also known as “delivery evidence” which is equivalent
to delivery certificate used in existing postal service. This contributes to avoiding
repudiation threat.
•

Long storage of electrically signed documents
To secure authenticity of a digital document over time by providing existential evidence.

The proper time of document verification information is authenticated in order to cope withdigital documents exceeding the PKC validity period or key algorithm compromised.

11

Chapter 3. Role of Time-stamp
While contributing to securing digital document authenticity, digital signature technology
has the following problems as mentioned in Chapter 2. To solve these problems, there needs
to be a service to prove existence of digital information at a certain point of time.
Time of digital signature generation is left unproved
Digital signature verifies the person who produced a document and that the contents
are just as they were at the time the document was signed. However, it does not verify

when the document was produced.
Authenticity of a digitally signed document is not secured after expiration or revocation of
PKC.
To secure authenticity of a digitally signed document after validity period or revocationof PKC, the following are necessary: proof that PKC, revocation information, etc. did
exist at a certain point of time; and evidence that the digitally signed document reallyexists.
The person who digitally signed a digital document can alter it by him/herself.
If there is a third party who guarantees that a digitally signed document existed at a
certain point of time, an attempt of alteration made later by the document author
him/herself will never succeed.
In addition, time-stamp is indispensable for establishing evidence of the existence ofdigital facts, proof of digital document delivery, etc. This chapter will discuss models,
technological trends, standardization and structure of time-stamping service.

3.1 Time-stamping Service Model(1) Functions Required of Time-stamping Service
Time-stamping service provides a proof that a certain piece of digital information existed
at a specific point of time. The service must satisfy the following two essential requirements.
・

Existential evidence of a certain piece of digital information at a specific point of timemust be supported by a technically traceable connection between time information anddigital information.

・The service will have no concern with digital information contents.
The first requirement includes the use of cryptographic technology, which essentiallyneeds security management requirements.

12(2) Time-stamping Service Component
A Time-stamp Authority (TSA) provides the service as in the model case that Figure 3-1
illustrates.
•

NTA
National Time Authority to generate, maintain and distribute national standard time. It
distributes national standard time to TA or TSA. Some NTAs periodically audit the time
managed at TAs.

•TA
Time Authority to distribute standard time to TSA. TAs periodically audit the time
managed at TSAs. TA is a trusted third party.

•

TSA
Time-Stamping Authority to produce and issue time-stamp token (TST) for digital datasubmitted from users. A TSA may also act as a TST verification player, which will be
described later, depending on time-stamping system adopted. TSA is a trusted third party.

NTA

TA
Time
Authority

National
Time
Authority

Communication
research
Laboratory(CRL) etc.

TSA
Time Stamping-StampingTA
Authority
Time
AuthorityTime distribution

TSA

Request for evidence of the existence(the hash of the document data)

ClientTime -stamp token
(TST)

TSA
Time Stamping
TSA
Time
Stamping
Authority
Authority
Time
Stamping-StampingAuthority

Time stamp protocol

Figure 3-1 Time-stamping Service Model

3.2 Technological Trends
Time-stamping technology is controlled by the following standards:

13

(1) International Standards
ISO/IEC 18014-1 Information technology – Security techniques – Time-stamping services
・Part 1: Framework
Providesframeworks

forrequirements,

scope,

andcomponents/functionsoftime-stamping services. It also outlines Independent Token and Linked Token, the twodifferent token systems to support authenticity of time-stamp.
・Part 2: Mechanisms producing independent tokens
Definesthreedifferentmechanismsofindependent

token

system:digitalsignature-based token (RFC3161 compatible), Message Authentication Code (MAC)-based token, and archive-based token.
・Part 3: Mechanisms producing linked tokens
Defines two mechanisms of linked token system: digital signature-based token anddigital signature-free token.

(2) Internet Standards (IETF: Internet Engineering Task Force)・

RFC3161 Internet X.509 Public Key Infrastructure

Time-Stamp Protocol (TSP)

One of the standards groups for PKI use on the Internet, defining protocols andtime-stamp tokens which represent procedures and formats of time-stamping models.
・

IETF Policy Requirements for Time-Stamping Authorities (draft – ietf – pkix – pr –tsa-00.txt) (2002-03)
Provides requirements on TSA operational policies.

(3) European Standards
・

ETSI TS 101 861v1.2.2 Time-stamping Profile
Specifications based on RFC3161. Defines requirements that time-stamp clients andservers should fulfill.

3.3 Time-stamping Systems
ISO18014 defines two time-stamping systems with different time-stamp token types,
which are called independent token and linked token. Typical examples of the two systems
are as follows.
(1) Independent Token System
Independent token system (a.k.a. Simple Protocol) is represented by PKI-based
time-stamp, which provides clients with a third-party guaranty by giving TSA’s digital
signature to the time information. A client sends TSA a time-stamp request in a prescribed

14

format along with a hash value (a message digest) of the document to be time-stamped. TSA
produces a time-stamp token (TST) with the received message digest, a digital certificate of
the time of acceptance and TSA’s digital signature included in a prescribed format (TSTtype), and sends it back to the client. The client receives and stores the TST, so that theoriginal document’s existence at the time of the TST issuance can be verified by using TSA’s
public key certificate (PKC), when necessary in the future.
This system is characterized by simplicity of TST validation, which requires only the PKC
for the public key cryptograph used to produce TST and its certificate. For effective
performance of the system, the TSA here needs to be a Trusted Third Party (TTP).

Digital document
Hash value（Message digest）

Calculatethe hash value

Time information

Hash value（message digest）

Digital signature
Time-stamp token

Time-stamp token
TSA （ Time Stamping

Authority)

ClientFigure 3-2 Time-stamp by Independent Token System (digital signature-based)

Independent token system also includes MAC-based time-stamp and archive-based
time-stamp.
(2) Linked Token System
Linking Protocol is a system depending on security of hashing algorithm. Having received
a digital document’s hash value from a client, TSA sends back a linked token to use as
evidence. Also, it periodically reports in the papers a total of hash values to provide achronological linkage of the tokens.
Figure 3-3 shows a system, where TSA issues a client with a time certificate in linkage

15

with the message digest and hash function of another time-stamp request, which has been
accepted just or shortly before. In this system, a newly issued time-stamp token isconsequently linked to all those issued in the past. Therefore, no forgery of time-stamp token
is possible unless coordinated with all the previous ones. In addition, with periodical
publication of the linking information in papers, forgery becomes even more difficult while
the linkage has to be verified only during the regular publication period.
This system always needs TSA for verification of a time-stamp token.

Caluculate hash value
with [a] and [b] integrated

R１aDigital Document
a,b
Caluculatehash valueb

Hash value（message digest）

L

R2

c
c,d
Time-stamp tokendClient[b], [c, d], [L], client’s ID, etc.
Time-stamp token

Figure 3-3 Linked Token System

3.4 Standardization of Time-stamp Protocol [Deleted]

3.5 Non-repudiation System
Time-stamp, which provides evidence of the existence of digital documents, is effective inpreventing repudiations. ISO/IEC 10181-4 and 13888 standardize the framework andtechnology of non-repudiation services.
Figure 3-4 shows a typical non-repudiation service, illustrating the players and systems
concerned to data transmission, non-repudiation service provided, and the technologies usedin the service provision.

16

The facts of data submission, receipt and transfer are stored respectively in the form of
token. The tokens, with time-stamping and digital signature technologies applied to, verify

TSA
Recipient

Submitter
Origin token (NROT)

Entity B

Entity A
Delivery token (NRDT)
Data storage

Data storage

Transfer token (NRTT)

Submit token(NRST)DA-A

DA-B
Delivery Authoritythat the data have been properly received.
Figure 3-4 Non-repudiation Service Model17

NR: no repudiation of
NROT :origin token
NRDT : delivery token
NRST : submit token
NRTT : transfer token

Chapter 4. Mechanism of Time Authentication InfrastructureTime authentication infrastructure can be technically defined as a system infrastructure
for providing standard time distribution, time-stamping, and other related services. The
standard time distribution service is conducted by Time Authorities (TAs) in place of
National Time Authority (NTA), while the time-stamping service provides evidence that adata item existed before a certain point in time, based on the time source distributed from
NTA or TAs.
This chapter describes the mechanism of time authentication infrastructure, which
supports time-stamping services. Time-stamping service systems (i.e. time-stamp token
issuance and validation systems) described here are based primarily on the international
standards such as RFC 3161 and ISO/IEC 18014.

4.1 Time Authentication Service Model

The time authentication service model in bid / application business of an electronic local government
NTA: National Time Authority
TA : Time Authority
TSA: Time Stamping Authority
TST: Time Stamp Token
CA : Certificate Authority

1.NTA
4.CA

(2)
(2) Time
Time distribution
distribution // AuditAuditcertificate
certificate issuanceissuance

2.TA(3)(3) Time
Time distribution
distribution // AuditAuditcertificate
certificate issuanceissuance(1)(1) Certificate
Certificate issuanceissuance
Not
Not essential
essential forfor linking
linking protocols
protocols

6. Applicant(Residents)

3.TSA

(4)
(4) TST
TST
request/response
request/response

7. Localgovernment

Submit of application

Application

Receipt of application

Receipt ofacceptance notice

AcceptancenoticeExamination of format
Examination of contents
Preparation of result
noticeReceipt of result notice

ResultnoticeSubmission of result
notice* Note: There are alsosystems integration
players and system
operation players, who
are left out here.

5. TST
Verification
Players(5)(5) TSTTST verification
verification
request/response
request/response

Figure 4-1 Time Authentication Service Model for E-application Transaction

18

The following paragraphs outline a time authentication service model applied to
e-application system of a local e-government. Players in this model are defined as follows,
except for NTA, TA and TSA, which have been already defined in 3.1 (2).
・CA
Certification Authority, which issues NTA, TA and TSA with appropriate certificates or
PKCs for digital signatures. Some time-stamping systems do not involve this player.
・TST verification player
Verifies the validity of time-stamp tokens. The entity of this role can be different
depending on time-stamping system. TSTs based on simple protocol system can be verified
on PKI by clients themselves. In the case of the TSTs based on linking protocol system,
TSA, who issues the tokens, or some other third party becomes the player.
・Applicant (resident)
Local residents making applications, or the residents’ software and tools. They follow
application formalities in communication with the application acceptance system of thelocal government. They can make a request to TSA for time-stamps to prove theirapplications’ existence. In the case of some trouble, they verify the validity of TSTs issued
from the local government, by using the TST verification player.
・Local government
Local government providing application services for residents, or the application systemitself. Based on time-stamping services provided by TSA, the local government gives
time-stamps to application forms from applicants, acceptance notice, result notice andother documents produced during the application transaction. In the case of trouble, it
verifies the validity of TSTs it has issued, by using the TST verification player.

4.2 Flow of Time-stamp Token IssuanceA client acquires time-stamps for their digital data, following the basic procedure as shown
below (Figure 4-2).
•

Submit time-stamp request to TSA
A time-stamp request has to include at least the hash value of digital data to betime-stamped, as well as a descriptor to indicate a hashing algorithm.

19•

Generate time-stamp token
TSA generates a time-stamp token and return the response including the TST to theclient.

•Receive time-stamp response from TSA
The response carries the requested TST, which shall be stored by the client.

ClientTime-stamping Authority(1)Document hashing(2)Submission of TST request

Document
Hash value

Hash value(3) TST generation(4) Receipt of TST
TSTDocument

TST

Figure 4-2 Flow of Time-stamp Token Issuance

4.3 Flow of TST Verification
Procedure of verification of the validity of a time-stamp token differs by time-stamping
system.

4.3.1 Verification of Simple Protocol TST
TSTs based on simple protocol system can be verified on PKI by clients themselves. The
basic procedure is as follows (See (1) in Figure 4-3).
•

Examine if the TST is syntactically well-formed.

•

Examine if the hash value of digital data to be verified is identical to the equivalenthash value in the TST.

•

Verify TSA’s signatures found in the TST.

20

Examine the validity of TSA’s PKC. Then, using the public key in the PKC, verify thesignatures in the TST.

Time-stamping Authority(or other TTP(s))

Client(2) Submission ofverification request

Document

TST(3) TST
verification

TST(4) Receipt ofverification result

TST linking
information

Verification(1) Verification

ResultFigure 4-3 Flow of TST Verification

Alternately, clients may ask a trusted third party to carry out the verification for them.

4.3.2 Verification of Linking Protocol TST
Verification of TST based on linking protocol system needs to involve players who possess
the linking information necessary for the verification. Specifically, TSA who has issued the
TST or other trusted third party should take part. The basic procedure is as follows (See (1),(2) and (3) in Figure 4-3).
•

Examine if the TST is syntactically well-formed.

•

Examine if the hash value of digital data to be verified is identical to the equivalenthash value in the TST.

•

Submit the request for verification of the TST’ validity to TSA who has issued the TSTor other trusted third party that has access to the issuing TSA’s linking information (i.e.
TSA’s summary links).

•

Receive the validation result from the TST or other entrusted third party.

21

4.4 Traceability of Time Authentication
Traceability of time authentication means the traceability of time information included intime-stamp tokens. The followings are the requirements for the traceability of time:•

It is provable that the time source of time-stamp token issued by a TSA has a logicalconnection with that of a TA or, if possible, NTA.

•

It is provable that the difference between the time used by a TSA for time-stamp token
issuance and the national standard time is within a prescribed permissible range.
Traceability of time authentication can be realized by the following methods:•

Include traceability information within time-stamp tokens.

•

TSAs produce evidence of undergoing periodical time audit by a TA or NTA.

22

Chapter 5. Time-stamp User Guideline
5.1 Framework
This chapter will introduce time-stamp user guideline for e-bidding, which is one of the
primary targets of the e-Japan Project efforts being made by local governments. The
guideline will specify the cases where time-stamps should be used within businessapplications, as well as the proper way to use them. To begin with, time-stamp informationcommon to different work types is provided in this section.
(1) Structure of the Guideline
Occasions demanding time-stamps and action taken on such occasions are almost the samein any work type, even if the causes and processes differ. Although detailed elements oftime-stamps and time-stamping are specific to each work type, they can be integrated into acommon concept of framework. Based on the common framework described below, we define
the elements for each work type: documents, timing, purpose and recommendation rating toacquire time-stamps, as well as time-stamp requirements/handling/validation.
First, the timing for getting time-stamps is pointed out in workflows of different work types,
with each workflow clarifying the correlation between documents and work type.
Documents given in the workflow is then listed with signs indicating recommendation
rating in relation with time-stamping purposes, which are detailed in the next section. The
recommendation rating is on three levels: “strongly recommended”, “recommended” and“preferable”
Requirements for time-stamps are numerically specified about performance and validity
period according to purpose.
A time-stamp will not work effectively by merely acquiring it. It must be properly verified
in relation with the lifecycle of a document it has been given to. In this guideline, verificationnecessary for the time of acquiring a time-stamp on a document, receiving the time-stamped
document, storing the time-stamped document is detailed.
For the purpose of document delivery/receipt certification, delivery and receipt shall betime-stamped on every individual act, partly overlapping with system logging, or a log file ofsuch acts shall be time-stamped for non-alteration and non-repudiation, while improving thelog file clock accuracy over the standard.
(2) Purpose of Time-stamp in E-bidding
To e-bidding explained here, time-stamps are important not only to verify the past statusof a certain piece of information, but also to certify its existence in order to avoid the risk ofalteration, spoofing or repudiation potential in the course of transaction. To avoid troubles
from the above-mentioned risk, status of information must be confirmed at each transaction

23

step after its submission to the local government, specifically: (1) what it was like initially,(2) how it changed in the course of transaction, (3) what it was like when it reached the final
step of transaction, (4) what notice it resulted in. At the same time, it is necessary to ensurethat the information exchanged between the applicant and the local government is verified
at every transaction step, and that the information exchange is mutually recognized by bothparties. The former is a time-stamp purpose to verify information handled at different pointsof time, which is called Document Existence Verification, while the latter is to confirm the
document delivery/receipt, which is called Delivery/Receipt Verification.
Separate from the above, by giving time-stamp to digitally signed documents, the limited
validity period of PKI-based digital signature is extended, securing document validity for alonger period of time. This is another time-stamp purpose called Long-term Storage
Verification, which enables long retroactive verification that the document has been
non-altered, and that digital signature and digital certificate were valid at the time ofissuance.
Table 5-1 [Deleted]

5.2 Guideline for Use in E-bidding
In this section, timing, purposes, and their relevant requirements for time-stamp use ine-bidding transaction of local governments will be explained.

5.2.1 Timing and Purposes
Purposes, timing and documents to use time-stamp in e-bidding transaction will be shownin the workflows below, based on the time-stamp purposes presented in the previous section.
The purposes are:
9 Delivery/Receipt Verification: Giving time-stamp to certificates of receipt, notices, etc.
to enable after-the-fact verification of delivery and receipt of bid sheets, notices,
etc., thus certifying non-alteration and non-repudiation.
Ex.: certificates of receipt, notices, etc.
9 Document Existence Verification: Giving time-stamp to documents requiring
chronological sequentiality of existence and execution, such as registration of
expected price information, execution of bid opening, etc. as well as to documents
whose existence at certain point of time (e.g. submission deadline) may be critical,
in order to certify non-alteration and non-repudiation.
Ex.: expected price registration, execution of bid opening, etc.

24

9 Long-term Storage Verification: Giving time-stamp to digitally signed documents,
virtually extending the limited validity period of digital signature, in order that
non-alteration of the document and certificate’s validity at the time of issuance canbe retroactively verified by long-stored verification results.
Ex.: bid sheets, notices, etc.
Timing of acquiring time-stamps and related purposes is explained by using the generalcompetitive bidding system, which represents the typical example of tender transaction
process defined in the basic design for “Electronic Procurement System” released from
Ministry of Land, Infrastructure and Transport in November 2001.

25

(1) Construction Procurement (by general competitive bidding system)(a) Workflow

Owner

BidderCommencement of Procurement

SearchSearchprocurement
procurementinformation
information

Register
Registerprocurement
procurementinformation
information

SubmitSubmitapplication
applicationfor
forbidding
biddingparticipation
participation

Receive
Receiveapplication
applicationfor
forbidding
biddingparticipation
participation

Receive
Receiveapplication
applicationacceptanceacceptancenotice
noticeNoticeNoticeapplication
applicationacceptanceacceptanceExamineExaminequalification
qualificationto
toparticipate
participate

Receive
Receivenotice
noticeof
ofdisqualification
disqualification

NoticeNoticedisqualification
disqualification

Receive
Receivenotice
noticeofofqualification
qualification

NoticeNoticequalification
qualification

disqualification

qualification

Register
Registerpaper
paperapplication
application

Bidding

SubmitSubmitbid
bidsheetsheet

AcceptAcceptbid
bidsheetsheet

Receive
Receivebid
bidsheetsheetacceptanceacceptancenotice
noticeNoticeNoticeacceptanceacceptanceof
ofbid
bidsheetsheet

Receive
Receivenotice
noticeofofbidding
biddingclosed
closedNoticeNoticebidding
biddingclosed
closedBid Opening

Bid
failureClose
Closebidding
bidding

Register
Registerpaper
paperbid
bid

Confirm
Confirmby
bybidbidobserver
observer

Judge
Judgebid
bidsuccessful
successful

ExecuteExecutebidbidopening
opening

Rebidding

Private contractfor unsuccessfulbidRegister
Registerexpected
expectedpricepriceinformation
information

BidsuccessfulTie

Pending

NoticeNoticepending
pending

Receive
Receivepending
pendingnotice
noticeNoticeNoticelottery
lottery

Receive
Receivenotice
noticeof
oflotterylottery

Lottery
Lottery
Receive
Receivenotice
noticeofofsuccessful
successfulbid
bid

NoticeNoticesuccessful
successfulbidbid

Confirm
Confirmsuccessful
successfulbidbidAnnounce
Announcesuccessful
successfulbidbidresultresultReceive
Receiverebidding
rebiddingnotice
noticeNoticeNoticerebidding
rebiddingConfirm
Confirmbid-opening
bid-openingresult
resultAnnounce
Announcebid-opening
bid-openingresult
resultReceive
Receivenotice
noticeofofprivate
privatecontract
contractfor
forunsuccessful
unsuccessfulbid
bid

NoticeNoticeprivate
privatecontract
contract
forforunsuccessful
unsuccessfulbidbid

Confirm
Confirmbid-opening
bid-openingresult
resultAnnounce
Announcebid-opening
bid-openingresult
resultReceive
Receivenotice
noticeofofbidbidfailure
failureNoticeNoticebidbidfailure
failureConfirm
Confirmbid-opening
bid-openingresult
resultAnnounce
Announcebid-opening
bid-openingresult
resultTo rebidding procedure

To private contract procedure forunsuccessful bid

Strongly recommended timing for time stamp
Recommended timing for time stamp

Figure 5-1 Construction Bidding Workflow and Timing for Time-stamps

26

Figure 5-2 [Deleted](b) Purpose of Time-stamp and Recommendation Rating
Table 5-2 details the purpose and recommendation rating of each time-stamp pointed
out with timing in the workflow above.

Table 5-2 Timing and Purpose of Time-stamp
Work
types

Job names

Targetdocument

Receiptofapplication forbidding

Application forbidding
qualification

Purpose/Rating
D/R

Exst

L-trm

○

○

Explanation
・Time-stamping the application for bidding

qualification on receipt by owner enables
future verification of the document andtime of its receipt as well as validity ofdigital signature/digital certificate on it.
・

For time-stamp on log, see 5.4 Time-stamp

Commencement of Procurement

Acquisition for Internal Log

Acceptancenoticeofapplication forbidding

Acceptancecardofapplication forbidding
qualification○

Examination ofqualification

○

○

・

Time-stamping the acceptance card of
application for bidding qualification ontransmission
byownerenablesverification of fact and time of the
document transmission.

・Time-stamping the result of examination ofqualification

by

owner

enablesfutureverification of examination details and time

validityofdigitalwell
assignature/digital certificate on it.

asNoticeofdisqualification

NoticequalificationofBidding
qualification
notice△・Time-stamping the bidding qualification
notice (disqualification) on transmission
by owner enables verification of fact andtime of the document transmission.

Bidding
qualification
notice△・Time-stamping the bidding qualification
notice (qualification) on transmission by
owner enables verification of fact andtime of the document transmission.

27

Work
types

Job names
Acceptancebid sheetofTargetdocument

Purpose/Rating
D/R

Bid sheet

Exst

L-trm

◎

◎

Explanation

・

the
bid
sheet
on
transmission
bybidderenablesverification of fact and time of the
document transmission.
Time-stamping
the
bid
sheet
on
acceptance by owner enables future
verification of the document and time of
its acceptance as well as validity ofdigital signature/digital certificate on it.

・

For time-stamp on log, see 5.4 Time-stamp・Time-stamping

Bidding

Acquisition for Internal Log

Notice of bid
sheet
acceptance

Bid
sheet
acceptancecard◎

Bid closing

Bidnoticeclosing○

Bid
noticeclosing○△・Time-stamping the bid sheet acceptancecard on transmission by owner enables
verification of fact and time of the
document transmission.

・Time-stamping the bid closing result by
owner enables future verification of bid
closing details and time as well as
validity of digital signature/digital
certificate on it.

・Time-stamping the bid closing notice ontransmission
byownerenablesverification of fact and time of the
document transmission.

Bid Opening

Expected priceinformation
registration

◎

◎

・

Time-stamping the registration result of
expected price by owner enables future
verification of expected price input
details and time as well as validity ofdigital signature/digital certificate on it

Bid
opening
execution◎◎・Time-stamping the bid opening result by
owner enables future verification of bid
opening details and time as well as
validity of digital signature/digital
certificate on it.

○

○

・

pending notice ontransmission
byownerenablesverification of fact and time of the
document transmission.
Time-stamping the pending notice on
production by owner enables future
verification of the produced document
and time of its acceptance as well as
validity of digital signature/digital
certificate on it.

Pending noticePending notice

○

・

28

Time-stamping

the

Work
types

Job names

Targetdocument

D/R

Exst

L-trm

Lottery notice

Lottery notice

○

○

○

Purpose/Rating

Explanation
・・

Noticeofsuccessful bid

Noticesuccessful
bidder

to

○

○

○

・

・

RebiddingnoticeRebiddingnotice

○

○

○

・

・

Noticeofprivatecontract
forunsuccessful
bid

Noticeofprivatecontracttounsuccessful
bidder

○

○

○

・

・

Notice of bid
failureCall-off noticeof bidding

○

○

○

・

・

29

the lottery notice ontransmission
byownerenablesverification of fact and time of the
document transmission.
Time-stamping the lottery notice on
production by owner enables future
verification of the produced document
and time of its acceptance as well as
validity of digital signature/digital
certificate on it.
Time-stamping

Time-stamping the notice to successful

bidder on transmission by owner enables
verification of fact and time of the
document transmission.
Time-stamping the notice to successful
bidder on production by owner enables
future verification of the produced
document and time as well as validity ofdigital signature/digital certificate on it.
Time-stamping the rebidding notice ontransmission
byownerenablesverification of fact and time of the
document transmission.
Time-stamping the rebidding notice on
production by owner enables future
verification of the produced document
and time as well as validity of digital
signature/digital certificate on it.
notice of private
contract to unsuccessful bidder ontransmission
byownerenablesverification of fact and time of the
document transmission.
Time-stamping the notice of private
contract to unsuccessful bidder on
production by owner enables future
verification of the produced document
and time as well as validity of digital
signature/digital certificate on it.
Time-stamping

thecall-off notice ontransmission
byownerenablesverification of fact and time of the
document transmission.
Time-stamping the call-off notice on
production by owner enables future
verification of the produced document
and time of its acceptance as well as
validity of digital signature/digital
certificate on it.
Time-stampingthe◎…Strongly recommended○…Recommended△…Preferrable

D/R…Delivery/Receipt verification
Exst…Document existence verification
L-trm…Long-term storage verification(c) Time-stamp Recommendation Rating
Meaning of recommendation ratings applied in Table 5-2 can be summarized for eachtime-stamp purpose as follows.
•

Delivery/Receipt Verification purpose◎

In the bidding transaction, verification of time is considered to be of essential for
acceptance of bid sheets, rebidding sheets and price estimates. Therefore,time-stamping at the point of acceptance of these documents is strongly
recommended.

○

Time-stamping is recommended at the point of transmission of important notices
where owners need prevention against after-the-fact repudiation.

△

For delivery and receipt of documents not referred in the above, time-stamp ispreferable where appropriate.

•

Document Existence Verification purpose◎

Where the sequential order of existence or occurrence in the bidding procedure isimportant, time-stamp is strongly recommended at the point of document
production or job execution.

○

Time-stamp is recommended at the point of production of various notices tobidders.

•

Long-term Storage Verification purpose◎

In the bidding transaction, verification of contents is considered to be of essential
for bid sheets, rebidding sheets and price estimates. Time-stamping at the pointof acceptance or unsealing of these documents is strongly recommended for the
purpose of long-term storage verification of contents, time and digital signature.

◎

The results of manual input or visual judgment at the point of paper bid
registration, expected price information registration, and bid opening execution
are strongly recommended to be time-stamped for the purpose of long-term
storage verification of contents, time and digital signature.

30

○Time-stamp is recommended at the point of production of various notices tobidders for the purpose of long-term storage verification of contents, time anddigital signature.

Figure 5-3, 4, 5 [Deleted]
Table 5-3 [Deleted]

5.2.2 Requirements for Time-stamp(1) Performance
Time-stamp must fulfill the performance requirements indicated in Table 5-4. The
range required by bidding procedure shall be calculated based on each bid owner’s peakcases (e.g. number of cases/day) with prescribed number of time-stamps and assumed
portion of online processing taken into consideration.
Table 5-4 Performance Requirements for Time-stamp
Requirements

Delivery/Receipt
Verification

Document Existence
Verification

Long-term Storage
Verification

Time accuracy provided by time-stamp

Within ±3 sec.

Within ±3 sec.

Within ±3 sec.

Capability of time-stamping within therange required by bidding transaction

○

○

○

※ Time accuracy indicated in the table represents the accuracy provided by TSA on time-stamping, with noconsideration of time difference between the e-bidding system and TSA network.

(2) Period of Validity
Validity period requirements defined in Table 5-5 must be fulfilled. Time-stamps withdifferent validity periods can be used where appropriate.
Table 5-5 Validity Period Requirements for Time-stamp
Requirements

Validity period of time-stamp

Delivery/Receipt
Verification

Document Existence
Verification

Long-term Storage
Verification

3 years and longer

5 years and longer

10 years and longer

The validity periods indicated above are the minimum necessity assumed for generalbidding transactions. Where there are document management rules on the owner’s side
defining longer periods for storing any document with time-stamp need, validity period oftime-stamp should be subject to such storage periods. Where storage periods are definedaccording to the amount of procurement fund, the longest validity period among themshould be applied, instead of using different periods by the fund amount.

31

Table 5-6 [Deleted]
When time-stamp dissatisfying the validity period requirements above has to be used,
newly issued time-stamp may extend the original period, provided that the bid owner has
a structure and system to ensure the period extension.
To be free of such complicated transactions as validity period extension, as well as to
avoid the risk of extension failure, it is preferable that time-stamp which can technicallyguaranty a validity period of 10 years and longer is adopted. If the technology does notallow this, a reliable structure and system must be prepared for proper implementation ofvalidity period extension.
(3) Verification
Bidding transactions should adopt time-stamping services that are available forverification at any time and in any way necessary, with both owner and bidder
undergoing the verification. It is preferable that the services adopted can provide the twoparties with an environment for easy and economical verification.
(4) Services to Use
Time-stamp services to use must fulfill the requirements in Table 5-5. However, it ismore desirable to use services provided by trusted third parties.
Table 5-7 Time-stamp Service Requirements
Requirements

Satisfying
technical
andoperational
standards for time-stamp issuance service
defined in this guideline
Satisfying
technical
andoperational
standards for time-stamp verification
service defined in this guideline

Delivery/Receipt
Verification

Document Existence
Verification

Long-term Storage
Verification

○

○

○

○

○

○

For the technical and operational standards defined in this guideline, see ‘Simple
Protocol’ and ‘Linking Protocol’ explanatory in 6.2 Time-stamp Issuance Service and 6.3
Time-stamp Verification Service.

5.2.3 Management and Verification of Acquired Time-stamp
Time-stamps for bidding-related documents will not be sufficient for verification of
documents with different purposes if they are merely acquired. They must be properly
verified in relation with the lifecycle of documents they have been given to, in order for
positive verification of documents’ delivery/receipt, existence and long-term storage.
Timing for time-stamp verification in bidding transaction will be presented below.

32However, as the timing presented here are of the minimum necessity, practical frequency
should be well considered according to actual business importance, system load and cost.
(1) Verification on Time-stamp Acquisition
Time-stamp token, digital signature and digital certificate (if the time-stamp is basedon PKI) should be verified immediately after acquisition of time-stamp.
Verification of the TST must include validation of the time when it was produced andverification if time-stamp policy and other time-stamp information (TSTInfo) arecompliant with the document contents applied for time-stamp.
(2) Verification on Receipt of Time-stamped Document
When receiving a time-stamped document whose time information is needed in thesubsequent procedures, the time-stamp should be verified in advance.
If the time-stamp is on a digitally signed document, the digital signature and digital
certificate should be verified at the same time.
(3) Verification on Storing Time-stamped Document
Before storing a time-stamped document its time-stamp should be verified.
The time-stamped document should be stored in a form that clarifies the relation
between the document and the time-stamp, and in a secure environment with little
chance for the document alteration.

5. 3 Guideline for Use in E-application [Deleted]
5.3.1 Timing and Purposes [Deleted]
5.3.2 Requirements for Time-stamp [Deleted]
5.3.3 Management and Verification of Acquired Time-stamp [Deleted]

5. 4 Time-stamp Acquisition for Internal Log
Information system for time authentication infrastructure should ensure its security andreliability through proper acquisition, maintenance and periodical audit of log information.
(1) Information to Enter into Logs
The system log and the access log should be recorded as important information of
security-related events, securing them with requirements as an audit log.
The audit log requirements include the following:(a) Type of event(b) Date and time of occurrence of event33

(c) Process results(d) Information to identify event origin (operator, system, etc.)(e) Time and authenticity verification by time-stamp
The audit log is acquired and maintained by files.
(2) Log Protection
Real-time log alteration detective and preventive measures should be taken.
Measures against log file deletion also should be taken.
(3) Time-stamp Acquisition for Logs
Log files should be provided with simple protocol or linking protocol time-stamp
issued by a trusted third party for time and authenticity verification.
Time-stamp acquisition is recommended on the following occasions in order to verify
that no loss, alteration nor alteration of information has taken place in themaintenance routine.
(a) Log file rotation(b) Transfer of log files to a loghost machine or any other machine(c) Archiving log files on external media or in storage(d) Log analysis, audit on time-stamp verification(4) Log collection
Log collection should be practiced as an integral part of the system function,
covering the whole operational history of a day.
(5) Period of Log Storage
Log file time-stamp should be stored and kept valid as long as the bidding andapplication documents may be regulated or even longer where appropriate. If the log
storage period is provided in system maintenance rules, time-stamp should be kept
valid and stored accordingly.
(6) Log Analysis
It is recommended that log output, acquisition, information will be analyzed daily or
weekly, in order to ensure that the service system is properly working.
(7) Log Audit
Log audit should be conducted periodically on log acquisition manners andmaintenance condition, as well as on the audit log contents. Log audit is preferable tobe conducted monthly, without prior notice to the operator who generates events.

34

Chapter 6. Time-stamp Provider Guideline
This chapter will present a guideline for providing time-stamping and related services.

6.1 Technical Guidelines
This section will detail the technical guidelines applied to time distribution service,time-stamping service and time-stamp verification service.

6.1.1 Standard Time Distribution Service
Standard time distribution is a service conducted by Time Authorities (TAs) in place ofNTA. This guideline will focus on the standard time distribution service for time-stamping
authorities (TSAs), clarifying the technical measures that Time Authorities are required.
(a) Time Authority’s clock
Time authority is required to distribute time with adequate accuracy.
・

Target accuracy of distributed time:

approx. ±300 ms

・

To realize this accuracy, Time Authority must use a clock with necessary andsufficient accuracy for its service.

・Time authority must provide itself with means to synchronize the clock for its
service with UTC, which is distributed by NTA, with necessary and sufficientaccuracy.

・Time authority must provide itself with means to properly manage leap seconds
synchronized with UTC.

(b) Time Audit by NTA
Time authority is required to undergo time audit by NTA or its substitute auditor on theclock for its service.
・

Target accuracy required for time audit:

approx. ±30 ms (between NTA and TA)・Time audit by NTA must be conducted in the way that necessary and sufficient
audit accuracy will be secured for time distribution service.

・Time authority is required to be with a system to receive from NTA a digital
certificate of time audit fact and results.

・

It is preferable that Time Authority has a system to protect the time audit

35

certificate issued by NTA from illegal alteration and deletion over a necessary
period of storage.
(c) Integrity of TimeTime authority must guaranty that the time it distributes retains accuracy within aprescribed range from UTC.
・ Time authority must have a mechanism to detect any departure of its time from therated accuracy.
・Time authority must have a system for recording its operational efforts to maintainintegrity of time.

(d) Identifying (authenticating) TSA
Time authority must identify and authenticate time-stamp server, whom it is going to
distribute time or time-audit.
・Time authority must provide itself with means to identify time-stamp server usedby TSA whom it distributes time, in order to avoid the risk of spoofing incommunication with time-stamp server.

・

It is recommendable for Time Authority to introduce the PKI-based mutual
authentication system as a way of identifying time-stamp server.

(e) Time Distribution to TSATime authority must provide the time to a time-stamp server, which is used by TSA, withaccurate time in a secure way.
・Time distribution to time-stamp server must be in a communication method thatcan prevent or detect time alteration.

・Time distribution to time-stamp server must be provided with a means tosynchronize the time-stamp server’s clock with UTC with accuracy required by TSA.

(f) Time Audit of TSA
Time authority must audit operation of the time that it distributes to time-stamp server.
・Time authority must provide itself with a means of auditing the time of time-stamp
server’s clock with necessary and sufficient accuracy.

・Time audit must take place at least once a day.

・ Audit results are important evidence of time operation by time-stamp server. Timeauthority must store audit results for future, keeping them verifiable and available
for TSA.
・Time authority must provide itself with means of audit result storage that can
prevent or detect time alteration.

36

・ Time audit of time-stamp server must be provided with a function to inhibit or
detect TSA’s altering the time it has been distributed.
(g) Controlling TSA Time Error
Time authority must support a function to notify TSA of detection that the time distributed
to time-stamp server’s clock has departed the rated accuracy.
・

It is recommended that Time Authority should support a function to suppress
time-stamping when detecting that time-stamp server’s clock time has departed therated accuracy.

6.1.2 Time-stamping Service
Time-stamping service is to issue secure time-stamp tokens to clients on request. The
agent of time-stamping service is called Time-stamp Authority (TSA). Typical methods togenerate secure time-stamp tokens are Simple Protocol system and Linking Protocol system.
In this section, technical guidelines for Time-stamp Authority to provide time-stamping
services will be detailed for each system.
(1) Simple Protocol
Technical guidelines for a simple protocol-based Time-stamp Authority are as follows.
(a) Time source
Time-stamp server’s time source (clock) to generate time-stamps and time distributing
agent should be clarified.
・Time distribution and synchronizing systems must be clarified by specifying TA,
GPS, standard radio wave, and NTP.

・Time synchronization must use secure and reliable system.

(b) Accuracy
Time-stamp server’s time source must be synchronized sufficiently with Japan Standard
Time.
・

Target accuracy required:approx. ±30 ms(c) Accuracy verification
It is preferable that Time-stamp Authority has means to verify accuracy of time-stamp
server’s time source.
・

It is preferable that time-stamp includes audit certificates and audit records issued

37

by TA, verifying the facts of time synchronization with TA, time audit, timeauthentication, etc., so that such information is always available for reference.
・

It is preferable that the certificates and audit records include specific information
about time/result/auditor in charge of implementation in order to detect fact of
having been altered.

(d) Time-stamp policy
Time-stamp Authority must clarify time-stamp issuance policy (time-stamp policy).
・Time-stamp must include information by which one can instantly identify
time-stamp policy such as time-stamp policy identifier, references, hash, etc.

・Time-stamp policy contents must be always available for reference.

・

It is preferable that time-stamp policy is available for verification of its
non-alteration.

(e) Time-stamp data type
Data type of time-stamp must be clearly defined, preventing misreading of time indication.
(f) Issuer information
Time-stamp must include information to identify time-stamp issuer and time-stamp
server.
(g) Client information
Time-stamp must not include any information about the client demanding the time-stamp.
(h) Serial number
It is preferable that every time-stamp has its own unique identifier.
・The identifier is preferred to be with a serial number to indicate the order ofissuance.

・

Whether serial number is used or not must be clarified in time-stamp policy.

(i) Ordering
Whether or not guaranteeing sequential relevancy between serial number and issuancetime, and coverage of the guaranty (‘guaranteed’, ‘guaranteed to the range of seconds’, etc.)
must be clearly presented in time-stamp or time-stamp policy.
(j) Representation of original data
Time-stamp must include hash value representing original data, so that identification tooriginal data will be possible. The representation of original data must be illegible to38

time-stamp issuer by digesting or encoding.
(k) Non-alteration (integrity) verification
Time-stamp must include MAC, signature or other means to verify its non-alteration.
(l) Hash algorithm, signature algorithm and key length
Time-stamp or time-stamp policy must include identifier of algorithm to calculate hashvalue for document to be time-stamped, time-stamp signature algorithm, and key length(where signature is used).
・

Hash algorithm in the cryptography list that is recommended by e-government(SHA-1, SHA256, SHA384, SHA512, and RIPEMD-160) must be supported.

・

Signature algorithm in the cryptography list that e-government recommends(RSASSA-PKCS1-v1_5, RSA-PSS, DSA and ECDSA) must be supported.

・Key length equivalence of RSA 1024 bit must be supported, while key length
equivalent to RSA 2048 bit should be supported.

(m) Signature key
When signature is used, signature key must be protected with HSM.
・

HSM is preferred to be certified level 3, FIPS140-2 or higher.

・Signature key is to be with a structure disabling any backup.

(n) Certificate and revocation information
When signature is used, certificate and revocation information must be properly managed
or distributed.
・

When requested by client, public key certificate or its identifier must be included intime-stamp token for verification of time-stamp.

・

Certificate must be of exclusively issued for time-stamp use.

・

Certificate path and revocation information must be available for time-stamp
verifier.

・

Particularly for time-stamp for long-term storage, certificate and revocation
information must be kept available for a sufficiently long period of time.

(o) Validity period
Validity period of time-stamp, based on public key certificate’s validity period and hash’s
fragility, must be clarified in time-stamp policy. Validity period is preferred to be sufficiently
long (e.g. by renewing a 5-year valid certificate every year).
(p) Measures against compromisation

39

The algorithms of hash and signature must be proved to be secure at the time oftime-stamping. When fragility is pointed out, immediate replacement with anotheralgorithm with proved security is preferred.
(q) Transfer protocol
Time-stamp request and response must be transferable with at least HTTP or HTTPS.
(r) Replay attack protection
Supporting NONCE or other measures must be taken against replay attack.

(2) Linking Protocol
Technical standards required of linking protocol-based time-stamp are as follows.
(a) Data type of time-stamp record
Data type of time-stamp record must include the following information to avoid
misreading of time indication.
・ Version No.
・ Message imprint・・・information bound to TSA time (e.g. hash value)
・ Serial No.・・・exclusive number issued to timestamp record
・ Time-stamp ・ ・ ・ required to include information capable of representing UTC
according to ISO8601(b) Certification period
Period of non-alteration verification and guaranty of time given by time-stamp record
must be as long as storage period of digital document to be time-stamped. Although digital
document storage period differs by document type and client type, it generally must fulfill
the following requirements in order to provide sufficient certification period for clients.
Hash value length・・・160 bit and longer
Hash algorithm・・・RIPEMD-160, SHA-1, SHA-256, SHA-384, SHA-512
Note: MD5 is not included in the cryptography list recommended by e-government, so at
this moment it should not be used independently in time-stamp service. However,
together with any of the above hash algorithm, MD5 use in time-stamp service will be
regarded as fulfilling the required technical standards.
(c) Measures against algorithm compromisation
Linking protocol-based time-stamp service is recommended to prepare for compromisationof hash algorithm, by supporting ExRenewal extension defined in ISO/IEC 18014-3

40

(Mechanisms producing linked tokens). Client can extend time-stamp lifecycle by using
ExRenewal extension when its time-stamped digital document must be stored beyond the
expected time of TSA’s algorithm compromisation.
(d) Operation
Linking protocol-based time-stamp service must be supporting the following operations
defined in ISO/IEC 18014-3.
・Linking
Information bound with time under management by TSA (e.g. hash value) must be in
calculative link with that generated in the past.
・Integration
Plural requests at a certain point of time must be operated at a time through a demand
integration function.
・Publication
Linking information managed by TSA must be periodically made open to wide public.

6.1.3 Time-stamp Verification Service(1) Simple Protocol(a) Secure communication route
It is preferable that verification protocol between time-stamp verification services andtheir users is implemented on a communication route where security measures (against
spoofing, alteration, wiretapping) have been taken.
(b) Verification request data
・ Verification request data must include time-stamp token to be verified.
・ Verification request data may include original data of time-stamp.
(c) Verification process
・ Examine the format of verification request data transmitted from client.
・ Examine validity of time-stamp token transmitted from client.
・ Return error messages in the case of inadequacy of verification request data format orverification failure. The message must include the reason of the error.
・ In the case of successful verification, the verification result data must be returned toclient.

41

(d) Validity of time-stamp token
・ When time-stamp token includes public key certificate, examine if the certificate is stillvalid at the time of verification.
・ When time-stamp token includes public key certificate, it is preferable to examine thecertificate’s validity at the time of time-stamp token issuance.
・ Examine validity of digital signature included in time-stamp token by using validated
public key certificate.
・ Other verification method may be adopted instead of based on PKI technology. For
example, comparison may be possible between time-stamp token to be verified andtime-stamp token information securely stored within TST verification player.
(e) Verification result data
・ Verification result data must include time-stamp token in client’s verification request
data
・ Verification result data may include digital signature of TST verification player.
(2) Linking Protocol
The same standards as those mentioned in 6.1.2 (2) are required of Time-stamp Authority.
Time-stamp record issued by linking protocol-based TSA can be verified only by TSA who
possesses the linking information generated at the time of issuance. Therefore, thestandards required of verification demand accepter are the same as those required ofissuance demand accepter.

6.2 Operational Guidelines
6.2.1 Common Items(a) Obligations① Securing reliability and security of Time-stamp Authority itself
Time-stamp Authority is obliged to continue appropriate operation based on process
and procedures necessary implement services appropriate for a reliable and secure
TSA.
② Appropriate information to clients and dependents of the clients
Time-stamp Authority is obliged to make clients and dependents of the clients
understand their obligations well. At the same, time it is also obliged to provide themat appropriate points of time with information necessary for them to implement their
obligations.

42

(b) Responsibilities① Time-stamp Authority must define its own obligation, as well as define and disclose
its essential policies related to responsibility and guaranty.
② On disclosing its policies, Time-stamp Authority must also disclose its operation
rules and rules for service users, as well as outlines of other important information,in order that clients can evaluate the Time-stamp Authority’s reliability and better
understand client’s obligations and Time-stamp Authority’s obligations.
③ Responsibility and compensation must be defined for the case where Time-stamp
Authority has caused damage or loss to client by breach of operation rules.
(c) Organization and personnel management① Independence and neutrality
For constant and long-continued security and reliability, Time-stamp Authority is
recommended to be independent as much as possible from short-term strategic
influence of any specific corporation, agent or organization, and to stay neutral andfair.
② Professionalism
Time-stamp Authority is preferred to be with professional staff of information security
and system audit, in order to realize constant operation with high security andreliability, appropriate and sufficient adaptability to advanced technologies, and quick
response to problems.
③ Organization
An organization of Time-stamp Authority needs to meet the following requirements:• Department possible to deal with critical data is organizationally isolated.
• Each department has function of internal restraint in order to prevent accidents.
• Restraining functions such as audit by external organizations are properly
performed.
• Cause of accident can be identified.
(d) Financial basis
A financial collapse of the business means a crisis of secret key management, which is
the reliability basis of the issued time-stamp tokens. Therefore, Time-stamp Authority
must be operated and retained on a financial basis sufficient enough to afford positive
reliability by: secure equipment and facilities; professionals and experts of time-stamp,
cryptography, computer and law; development and operation of sophisticated and secure
time-stamp system; and compensation for damages.

43(e) Disclosure
For better trust by clients, Time-stamp Authority must positively disclose or makepublic its management, technical and operational information within a range that
security is not affected. Disclosure system for emergency case should be also necessary.
The following information must be disclosed.
① Management information
Management information including financial status must be disclosed or made open to
public for clients’ conviction.
② Technical information
Technical information must be disclosed or made public as possible for clients’conviction of Time-stamp Authority’s security and reliability. Technical information
disclosure of time-stamp tokens before expiration of verifiable period should include
technologies used in the past.
③ Security measures enforcement information
Periodical audit results on security management (measures against unlawful
operation, authority dispersion, education of staff, etc.) must be disclosed or madepublic for clients’ conviction of Time-stamp Authority’s operational security.
④ Operation rules
Operation rules based on this guideline must be open to public.
⑤ Rules for service users
Rules for service users defining service contents and damage compensation policies
must be made public.
(f) Confidentiality
Information that may affect Time-stamp Authority’s security and reliability must be
properly managed with information system’s instant and wide accessibility in mind.
① Confidentiality of security-related information
Such confidential information as operator identification, operational system, machineroom plan, audit information, and equipment and system security must be handledaccording to carefully defined rules, observation of which is appropriately reviewed.
② Confidentiality of client information
To prevent inappropriate use and leak, client information must be handled according
to its secrecy rules, observation of which is appropriately reviewed.
(g) Service suspension and discontinuation
Suspension or discontinuation of service must be publicly informed or notified toclients with a defined schedule and rule.
No suspension must be without prior notice to clients, except for emergency halt by an44

unexpected interruption.
(h) Client’s personal information① Information use
Time-stamp Authority must not use personal information supplied by clients beyond
necessity of service provision.
② Disclosure of purpose
The purpose of personal information use must be defined in operation rules and madepublic.
③ Disclosure of personal information
Time-stamp Authority must not disclose personal information about clients, except forthe cases that:• Client or its representative demands disclosure of the client’s registered personal
information. Time-stamp Authority must prepare personal verification rules, whichmust be implemented before the disclosure in such cases.
• Disclosure of personal information is demanded by statute, or client agrees to thedisclosure within a legal extent.
④ Access control
Access to clients’ secret information must be limited to authorized personnel in order tomaintain secrecy.
⑤ Storage• Time-stamp Authority must provide itself with a system to secure safe storage anduse of clients’ secret information, in order to prevent alteration, deletion, leak, etc.
• It is recommended that clients’ secret information should be backed up for
prevention of loss in fire, etc.
(i) Audit
Time-stamp Authority must record service operation information, auditing it
periodically in order to maintain system security and reliability.
① Definition of audit information
Audit information is the information needed in audit of operation rules, rules forservice use, technical information, security measures, system event record, etc. The
following are the details of audit information.
• Time source accuracy record and time audit record• Record of the entire service process from distribution of service use rules tocommencement of service, service contract termination or expiration• Record of entrance to and exit from facilities and relevant admission record• System operation record45• System performance record• Account book access and disposal records② Storage of audit information
Audit information must be protected against alteration, deletion, leak, etc. with clearly
defined access authority, and stored to be available during a proper period of time
where necessary. It is preferable that audit information should be backed up
periodically and preserved in a remote storage.
③ Audit frequency
Audit must be conducted at least once a year.
④ Audit information storage period
Audit information must be stored for at least 10 years.
⑤ Disclosure of audit results and necessary action
Audit results must be disclosed as soon as it finishes. To defects and failures pointed
out the following actions must be taken:• Temporary measures until the defects are corrected (e.g. suspension of operation,adequate information to clients, etc.)• Rectification of the defects⑥ Storage of audit information and results
Audit information and audit results must be stored for a prescribed period of time withappropriate and reasonable measures against alteration, alteration, deletion, etc. byillegal access.
(j) Restoration from system trouble, compromisation or disaster
Unexpected interruption of time-stamp service may cause serious damage to clients.
Therefore, actions in such events must be clearly prearranged for quick restoration.
① When accuracy of the time-stamp system has departed from the rated range, whichshall be regarded as a system trouble, time-stamp server must be urgently stopped forrestoration.
② Measures against destruction of hardware, software or data
Start restoration quickly using backup systems.
③ Equipment management in disasters
When equipment and facilities are damaged in disasters, operation must continue onspare equipment and backup data.
(k) Time source management and traceability① Synchronization with standard time
The clock of time-stamp system must be synchronized with UTC.
② Time accuracy at Time-stamp Authority

46

Time used by all of Time-stamp Authority’s systems must not depart more than 3
seconds from UTC.
③ Time accuracy at time-stamp server
Time at time-stamp server used by Time-stamp Authority’s systems must not departmore than 3 seconds from UTC.
④ Time traceability
Time used by Time-stamp Authority for time-stamping must be kept traceable on UTC,by retaining time audit record conducted by TA or NTA.

6.2.2 Simple Protocol(a) Key management at Time-stamp Authority2
Time-stamp Authority must securely and reliably manage the signature key pair fortime-stamp token and encryption key in communication for their entire lifecycle.
①

Key generation
・ Key pair and public key must be generated by a reliable key generation system. It
is preferable that the key generation system is installed within hardware security
module.
・ More than one manager must control generation of key pair and public key.

②

Key storage・ Once generated, a key must be stored with its information elements separated
from each other in order that any element can provide, by itself, no secret of thewhole key, or it must be stored as a whole within hardware security module,
・ When stored as separate information elements, each element must be preservedby an authorized individual.
・ When stored as a whole within hardware security module, plural individuals must
be authorized to preserve the key in order that it cannot be taken out by any
single individual.

③

Use of key
・ Public key and secret key must be kept within hardware security module whenused for digital signature or decryption. When stored as separate information
elements, the element loading to hardware security module must be operated in
front of plural observers.

2

Reference: Certification Authority Guidelines（V1.0），Authentication/Notary Working Group, Electronic Commerce
Promotion Council of Japan，March 1998.

“http://www2.ecom.jp/report/pdf/H09/h9_cert2.pdf”

47

・ When connecting hardware security module to time-stamp token generation
system or preparing the key within the module for use, plural individuals mustobserve the operation.
④

Key preservation
・ Public key in Time-stamp Authority must be preserved and protected fromalteration, as it needs to be kept useable after its validity expiration.

⑤

Key disposal
・ Secret key with expired validity and other keys over storage period must be
disposed of to prevent illegal use.
・ The disposal must take place in front of plural observers, making sure that one
iota of secret information is not left legible.
Regular renewal of key⑥

・ A key must be given its validity period, which must be renewed regularly. The
validity period is determined based on the policy of Time-stamp Authority.
⑦

Restoration of key compromisation and disaster・ Time-stamp Authority must provide itself with measures against the cases wheresecret key was leaked by illegal operation or deciphered by a third party, or
damaged from disaster.
・ When secret key has been or will be compromised, Time-stamp Authority must
immediately revoke the key in question and start a procedure for the key madeanew.
・ When secret key has been compromised, time-stamp tokens generated with the
key must be revoked all together.
・ When secret key has been compromised, revocation of the key must be notified toclients or made public.

(b) Restoration of system trouble, compromisation and disaster
Unexpected interruption of time-stamp service may cause serious damage to clients.
Therefore, actions in such events must be clearly prearranged for quick restoration.
①

Measures to take when private key of time-stamp system has been compromised.
When invalidating time-stamp token, time-stamp tokens generated with the key
must be revoked all together.

6.2.3 Linking Protocol
The following are operational standards for linking protocol-based time-stamp issuanceservice. (See 6.2.1 for operational standards not based on linking protocol.)48

(a) Linking information management by TSA・ Generation of linking information
TSA must guarantee that TSA is generated in a secure management environment as
mentioned in 6.2.1.
Linking information is the information generated by the following procedures:
A time-stamp user sends hash values to TSA.
The TSA receives the hash values for certain period of time and then integrates the hashvalues to generate new single hash value which represents all hash values from thetime-stamp user(s). TSA calculates a linking information(t) utilizing the nearest
previous linking information(t-1) and the newly generated single hash value. It is a hashvalue in relation with time, which can be used as data for future verification.
・ Commencement of linking information generation
Linking information generation must be started in a physically secure environment as
mentioned in 6.3, under twofold control by a TSA system administrator and a TSA
management officer. The generation must take place in a reliable system whose security
standards are guaranteed.
・ Preservation of linking information
TSA must guarantee the integrity of linking information as long as its service isprovided, by preserving it with a reliable system whose security standards areguaranteed. Accessing linking information needs agreement between the TSA staff
member in charge and the TSA manager.
・ Disclosure of linking information
TSA must disclose linking information periodically in order to prove its legitimacy. How
and whom are of TSA’s option provided that the following requirements are fulfilled.
9 Requirement for acquiring linking information
Acquisition of linking information requires agreement between the TSA staff
member in charge and the TSA manager.
9 Requirement for disclosing linking information
To make it a well-known fact in public and unfalsifiable, linking information must
be open to public in newspapers for at least one week. Drafts transacted withpublishing companies must be kept secret from outside and preserved as long as theservice period for them lasts.
・ Audit of linking information

49

When implementing the audit defined in 6.2.1, relevancy of relation between the linking
information disclosed and the linking information actually managed by TSA must be
included in the audit information.
(b) Time-stamp record
TSA must guarantee that time-stamp record is securely issued with accurate time.
・ Time-stamp record to issue must be given exclusive descriptor.
・ Time value used for time-stamp record must be based on at least JST (Japan Standard
Time) or UTC (Coordinated Universal Time).
・ The time included in time-stamp record must synchronize with UTC with an accuracy
range defined by TSA’s policy. However, if the time-stamp record defines a time
accuracy range of its own, the synchronization with UTC must be accurate within sucha range.
・ Time-stamp record must include data representation (e.g. hash value) to which
time-stamp was given as instructed by the time-stamp demander.
・ Time-stamp record must include data necessary for verification (linking information,intermediate hash value necessary to generate root hash value).

6.3 Infrastructure
6.3.1 Facility
Table 6-1 indicates the standards for facility where system for time business service isinstalled.
As the system for time business needs particularly strict management in terms of reliability,
security and integrity, this guideline has applied the standards based on iDC use.

50

Table 6‑1 Facility Standards(1)

Category
Building

Item
Aseismatic (earthquake‑resistant)standards
Base isolation
Interior material(2)Electric equipment

Noise, EMC
Redundancy

Emergency power generator
Oil reservoir for generator

Uninterrupted power supply system
Fire alarm system
Central monitor system

Grounding system
Entrance/exit control(3)

Air conditioning(4)Installation location

Server room control
Type
Capacity
Operation time
Water leak detection system
Temperature/humidity adjustment
Rack
Mount baseInstallation location
Double power source
Flooring material(Reference:

iDC Utility Guidelines,iDC Initiative)

51

Achievement target
Fulfill standards for a building
Earthquake‑resistance, if seismic isolator
adoptedNon combustible
Static electricity‑proof
EMC shield, etc.
Doubleredundancy
fromintaketo
distribution/power panels
Power‑source inspection without power
supply interruption
Secure redundancy larger than server area
capacity (N+1) by gas turbine generator
Capacity larger than refillable interval.
Supply‑control tank. Reserve capacity ofmore than 24h use.
Including 1 spare system for each group.
High sensitivity fire detection system.
Covering all machines and equipment s
operational condition. 24 h monitor
available.
Integrated grounding system
Combine IC card gate system and biometricsystem
ITV monitor camera. No blind corner.
Blow low, draw highN+1 以上 Over N+1 for every server area
24 h continuous
Install in air conditioner s drainage area
Temp：22〜24℃±2℃Humid：50%±20%
EIA standard 19 in. rack with locks on front
and back.
Fixed earthquake‑proof or 2D or 3D baseisolated mount base preferable
Not in space shared with other system.
Install in another room or enclose in a cage
Supporting 2‑system distribution panel
Static electricity‑proof

Essential
Recommended
Essential
Recommended
Recommended

Recommended
Recommended

Recommended
Recommended
Recommended

Recommended
Recommended
Recommended
Recommended
Recommended
Recommended
Recommended
Recommended
Recommended
Recommended
Essential
Recommended
Recommended

6.3.2 Network
Table 6-2 indicates the standards required of network system for time business service.
These standards simply indicate requirements for the network as an element of the system
to provide time business services, not defining individual installation, hardware or software.
These standards are applied to both TSA and TST verification player.
Table 6‑2 Network Standards
Category

Item

Achievement target(1)Connection with external Illegal access prevention

System to detect or protect from illegal access Essential

networkandattackfromexternal

network(e.g.

Firewall). Measures against such attacks asservice interruption, secret information theft,certification

information

theft,

alteration,

virus, etc.
Prove

Server certification

legitimacy

byservercertification. Essential

Provide clients with function to prevent
wiretapping , alteration, etc.
Use line service with constant quality without Essential

Time information acquisition

delay and not affected by other traffic.
Connection with other networks

Whenconnectingwithpluralnetworks Essential

outside, no IP reachability from one network toanother allowable.
Redundancy is needed to line to connect to TA, Essential

Reliability

and such devices as hub/switch, firewall,routerThis is not essential if the system as a whole
securesthebusiness

continuity

by,

for

instance, having a backup center separately.
Concentration of service and high traffic Recommended

Measures against high load

(massive

servicedemands)

cause

no

interruption of service provision except for
permissive delay (e.g. load balancer).
(2)Internal network

With servers and other equipment located in Essential

Architecture

appropriate segment by service or by function,（LAN）needless communications between segments
canbeblocked.

Digitalsignature-related

server and server storing time-authenticatedinformation are installed in secure segments,
with direct access from outside restricted.
System configuration (hub/switch, firewall, Essential

Reliability

router,

etc.)

and

LAN

are

redundancy-structured.
High traffic causes no interruption of service Recommended

Measures against high load

provision except for permissive delay (e.g.
load balancer).

52

6.3.3 Server Storage
Table 6-3 indicates the standards required of system for time business service.
These standards simply indicate requirements for the system to provide time businessservices, not defining individual installation, hardware or software.
Table 6‑3 Server Storage Standards
Category(1) System design

Item

Achievement target
Front server is parallel-extendible, andExtendibility

Recommended

capacity of time certification server anddatabase server is extendible for futureneeds.
NTP, time-stamp issuance, and verification

Function Division

Recommended

service work on separate systems. Eachsystem divides server by application.
System redundancy, double power source,

Reliability

Recommended

hot swap, UPS are introduced for higher
reliability.
Measures for service continuity is taken

Availability

Essential

using such technologies as load sharing, hotstand-by, clustering.
Measures to ensure backup/restoration of

Backup/restoration

Essential

system data and log data is taken using
mirroring, clustering, and backup on
movable media.
(2) Security

Refusal of needless access, needlessAccess control

Essential

application deletion, and needless port use
cutoff are implemented to improve theserver strength itself.
Well-tested security patch adaptation,

Security control

Essential

verification of file coordination, and system
log recording are implemented for server’s
own security control.
(3) Quality control

Servers for time business service are

Service quality

Essentialsynchronized with UTC by using NTP, etc.
Prepare a system monitoring system to

System monitoring

Recommended

watch CPU load, memory consumption,
HDD resource and I/O use rate. The
monitoring system is preferred to beequipped with function to monitor hardware
defects and hardware interior temperature.
Test environment, spare parts, etc. are

Defect control

prepared for response to unexpected events.

Appendix 1 Terminology [Deleted]
Appendix 2 References [Deleted]

53

Recommended

The Guideline Subcommittee Members
Chairman: Masahiro Honda

Keisuke Ichikawa
Masahiro Honda

AMANO Corporation
Asian Business Exchange Consortium(ABEC)

Yoshiyuki Kobayashi

NTT Communications Corporation

Takanori Fujiu

NTT Communications Corporation

Toru Sakurai

NTT DATA Corporation

Nobuyuki Mitani

NTT DATA Corporation

Kiichi Yamato

GOTDATE Co., Ltd.

Toshiaki Kojima

Kyokuto Boeki Kaisha, Ltd.

Satoshi Murayama

Sun Microsystems, K.K.

Toru Mukai

Seer Insight Security Inc.

Masakazu Uehata

Seiko Instruments Inc.

Koichi Shibata

Seiko Instruments Inc.

Keiji Shimano

Seiko Instruments Inc.

Tsukasa Iwama

Communications Research Laboratory

Yoshinori Onuki

Telecom Engineering Center

Ayako Komatsu

NEC Corporation

Yoshinobu Tanigawa

Hitachi, Ltd.

Toshiaki Shirakami

Marubun Corporation

Kazuya Miyazaki

Mitsubishi Electric Corporation(In no particular order)54

【Contact】
Time Business Forum (TBF) Secretariat
inSupport Center for Advanced Telecommunications
Technology Research
Koike Bldg., 1-20-2, Shinjuku
Shinjuku-ku, Tokyo 160-0022
Tel +81-3-3351-8423
Fax +81-3-3351-6690
URL：http://www.scat.or.jp/time/55