1、ETSI TR 102 045 1.1.1 (2003-03) Technical Repor Electronic Signatures and Infrastructures (ESI); Signature policy for extended business model 2 ETSI TR 102 045 VI .I .I (2003-03) Reference DTR/ESI-000006 Keywords electronic signature, security ETSI 650 Route des Lucioles F-O6921 Sophia Antipolis Ced
2、ex - FRANCE Tel.: +33 4 92 94 42 O0 Fax: +33 4 93 65 47 16 Siret No 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-prfecture de Grasse (06) No 7803/88 Important notice Individual copies of the present document can be downloaded from: http:lwmv.etsi .arq The present doc
3、ument may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the
4、 PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at ha p:/pa rta I. etsi I a rgltbista
5、t uslstatus .as p If you find errors in the present document, send your comment to: Cori vriaht Notifica tion No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. O European Telecommunications Standards
6、 Institute 2003. All rights reserved. DECTTM, PLUGTESTSTMand UMTSTMare Trade Marks of ETSI registered for the benefit of its Members. TIPHONTM and the TIPHON logo are Trade Marks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the bene
7、fit of its Members and of the 3GPP Organizational Partners. ETSI 3 ETSI TR 102 045 VI . 1 . 1 (2003-03) Contents Intellectual Property Rights 5 Foreword . 5 Introduction 5 1 Scope 7 2 References 7 3 Definitions and abbreviations . 8 3.1 Definitions . . 8 3.2 Abbreviations . 9 4 Overview 9 4.1 Backgr
8、ound research . . 9 4.2 . 10 4.3 Extended business model . 12 4.4 Signature scenarios . 12 4.5 Introduction to signature policies . 12 4.5.1 Signature policies in the “paper“ world . . 13 4.5.1.1 Statutory signature policies . 13 4.5.1.2 Customary signature policies . . 13 4.5.2 “Real world“ signatu
9、re policy example - Banking . 14 4.5.3 Electronic signature policies . . 15 Analysis of signature issues . 16 5.2 Formalities of signinghntention to sign . . 17 5.3 Identity of signer . . 17 5.4 Roles and attributes of signer . 18 5.5 Signature commitment types . . 18 5.6 Timing and sequence . . 18
10、Longevity . 19 5.9 Technical and security considerations . . 20 5.10 Multiple signatures . 20 5.10.1 Countersignatures . 21 Witnesses . . 22 5.10.3 Notarial signatures . . 22 Implications of the Electronic Signatures Directive 1999/93/EC 5 5.1 Transactional context/field of application . . 16 . 19 5
11、.7 . 5.8 5.10.2 6 7 7.1 7.2 7.3 7.3.1 7.3.2 7.4 7.4.1 7.4.2 7.4.3 8 8.1 8.2 8.2.1 8.2.2 8.2.3 Formalities of signing . 23 Roles and attributes 23 . 23 . 24 . 24 Meaning of “role“ “attribute“ and “privilege“ . Claimed versus certified business roles or attributes Authority as an attribute Categorizat
12、ion of roles Delegated authority . 24 Restricted authority . 25 . 25 Business roles . 25 Transactional roles in inte . 26 Signing roles . 26 Commitment types in electronic signatures . 26 E-notary signatures . 29 Electronic signatures as part of a validation process Simple administrative e-signature
13、 Real world commitment types . Electronic commitment types . 26 . 28 . 29 . 30 ETSI 4 ETSI TR 102 045 VI .I .I (2003-03) 9 9.1 9.2 9.3 9.4 9.4.1 9.4.2 9.5 Multiple signatures .30 . 30 . 31 . 31 . 32 32 . 34 Parallel signatures. . Sequential (parallel) signatures . Embedded signatures . Multiple sign
14、ature management Signing roles Commitment types for electronic . 33 Multiple signature validation . . 1 O 10.1 Legal effect of signature policies . 10.2 Implicit or express signature polices . . 10.3 Drafiing a signature policy . 10.4 Significant elements of a signature policy . . 10.4.1 Business ru
15、les . 10.4.2 Signature policy rules . 10.5 Illustrations for signature policy rules . . 10.5.1 Countersignatures for authorization . . 10.5.2 Countersignatures in a document flow . . 10.5.3 Delegated authority 10.5.4 Notarial signatures . 11 Conclusions 46 .47 11.2 Recommendations for future work .4
16、7 Annex A: Business scenario descriptions . 49 A. 1 General . 49 A.2 Purchase of life insurance . 49 A.2.1 Use Case . . . 49 A.2.2 Sequence Diagram . . 50 A.3 Supply chain (illustrated via linked service level agreements) 5 1 A.4 Land purchase 52 A.4.1 Use case . . 52 A.4.2 Illustrative document set
17、 . . 58 Signature policies .35 11.1 Recommended changes to the signature policy formats Annex B: Signature commitment categories . 59 Annex C: Modelhpecimen policy document 60 Annex D: Bibliography 62 History 63 ETSI 5 ETSI TR 102 045 VI .I .I (2003-03) Intellectual Property Rights IPRs essential or
18、 potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR O00 314: “Intellectual Property Rights (7PRs); Essential, orpotentially Essen
19、tial, IPRs notlJied to ETSI in respect ofETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (5). All published ETSI deliverables shall include information which directs the reader to the above source of information. Foreword This Techni
20、cal Report (TR) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). I n t rod uct ion The work of the ETSI-TC ES1 and CEN/ISSS has already addressed issues relating to single signatures, but very often documents require more than one signature to give it le
21、gal validity or to make a transaction effective. These may be parallel independent signatures, such as those of a buyer and seller on a contract; or embedded, countersignatures, where the countersignature is applied on top of a primary signature, such as a witnesss signature, or the signature of a s
22、uperior validating the signature of a subordinate, To date, a signature policy has been defined only to allow the validation of one single electronic signature (TS 101 733 i), however, as more paper-based processes are being transposed into the electronic environment, there is a growing business nee
23、d to extend this policy to support multiple signatures. This is evidenced by the slow progress being made in relation to more complex business transactions, such as those requiring notarization, or those which, in the paper world have more stringent requirements for form. These include consumer fina
24、nce or credit transactions, transactions with structured payment/delivery terms. For this to happen there needs to be some way of communicating/expressing the purpose for and the context in which a signature(s) has been applied so that it will be legally enforceable in any Member State (and ideally
25、in any other jurisdiction). The present document is intended to supplement TS 101 733 i and TR 102 038 2 by investigating business needs and by providing a foundation for further work in relation to the technical implementation of a signature policy governing multiple signatures. It aims to provide
26、general guidance on a methodology for the validation of multiple signatures. It assumes that each signature will be validated under a signature policy for single signatures such as TS 101 733 i or TR 102 038 2. It therefore remains to validate the relationship of each required signature against the
27、others. The present document provides a framework for speciSling high level requirements for the acceptance by a business of electronic signatures. It then considers a set of signature usage rules for a number of aspects of the business requirements which could be used to inform an implementation of
28、 a signature policy. The rules are not organized into a model policy in the present document. The present document provides a framework for the development of such rules. There is a business need to transpose all the features of a handwritten signature into the virtual world, and to develop an equiv
29、alent trust in electronic signatures, particularly where they indicate a legally binding commitment. Directive 1999/93/EC 5 provides for the equivalence to handwritten signatures where an electronic signature is supported by enhanced technical security measures (article 5.1). However, there are many
30、 aspects of “real world“ characteristics of signatures which are not provided for in the Directive. These could conveniently be covered by a signature policy. ETSI 6 ETSI TR 102 045 VI .I .I (2003-03) The meaning of a signature is implicit in the signature itself, and yet it is readily understood ev
31、en by a lay person. Usually that understanding is drawn from the context in which the signature was made. The present document attempts to analyse the meaning and implied consequences of a “real“ world signature in a number of different business contexts. What commitment does a signature imply? What
32、 are the business purposes for which signatures are used? What are the consequences of a signature? What is its evidential value in legal proceedings? What are the relevant factors in relation to the creation of a signature? How can these factors be transposed into the virtual world? In many busines
33、s situations, more than one signature is required to give effect to a document or transaction. The most obvious example is in relation to a contract where both buyer and seller sign to indicate their acceptance of the terms of the contract and their will or intention to be legally bound by them. In
34、this case, the commitment implied by the signature, and the consequences of its creation it are straightforward. More complex to analyse are scenarios where counter signatures are required, i.e. where the signature of one person is countersigned by another. The meaning of such signatures, and the co
35、mmitment being assumed by the countersigner, often is unclear without a careful study of the underlying business process. Even then, in the scenarios examined, there remains a great deal of ambiguity surrounding counter signatures. The present document, therefore, assumes a broad interpretation of a
36、 signature policy and therefore, a signature policy may be a useful tool for specifiing the means for the creation and verification of all the typical qualities of a handwritten signature. A signature policy could include the means for reproducing the “real world“ ceremony, or formalities of signing
37、. It could also include who may sign, in what capacity, what should be signed and in what circumstances. By defining the domain and/or the application to which the signature policy will apply, it is possible to reproduce some of the contextual information which is relevant to interpreting the signat
38、ure commitment, as in the paper world. As these factors will vary according to the circumstances in which a signature is to be used, it follows that it is not possible to define a single, model policy to cover all scenarios. The present document analyses some of the factors common to many situations
39、, and aims to provide “building blocks“ which can be assembled (“LegoTM“-style) to make a signature policy which is relevant to a particular business need. A signature policy can (indeed, perhaps should) be drafted by reference to a specific business application It does not ignore the fact that ther
40、e is probably an existing business need for guidance or a set of rules which could be specified by two parties with no previous relationship who want to sign a once only contract electronically. However, it is unlikely that they will have the technical expertise to implement a signature policy devel
41、oped under the present document and/or that such an implementation will be cost effective on a one-off basis. It is also unlikely that signature policies will be read or understood in depth by potential signers. It is perceived that the principle use of signature policies is to communicate a busines
42、s requirement and signature context to aide systedapplication interoperability between different developers of an Enterprise application (such as modules developed by JD Edwards and SAP) or other XML-based developers such as Sterling Commerce, Documenturn, Webmethods, Tibco and BEA Systems. Signatur
43、e usage rules need to take into account an interface between human operators and a computer system. Only a person can make the decision to apply a signature. This is true even when the signature is on behalf of an organization or entity. Even where signatures are created as a part of an automated pr
44、ocess, at some stage a person must have made a decision to configure a system to perform that task. On the other hand, it is feasible that a person may be guided through a signature policy through an application interface. The present document provides a framework for specifiing high level requireme
45、nts for the acceptance by a business of electronic signatures. It then considers a set of signature usage rules for a number of aspects of the business requirements which could be used to inform an implementation of a signature policy. The rules are not organized into a model policy in the present d
46、ocument, rather clause 10 provides a framework for such rules. ETSI 7 ETSI TR 102 045 VI .I .I (2003-03) 1 Scope The present document addresses signature policies to be used in the management of multiple signatures within extended business models. The concept of a signature policy is an important el
47、ement for the establishment of a common basis for electronic signatures. However, there are many assumptions made regarding the application of signatures as well as concerns as to the use of signature policies by Relying Parties. TS 101 733 i already addresses certain aspects of electronic signature
48、s for the establishment of a common basis for a signature policy. It already contains specification tools for the definition of signature policies but it is recognized that it still has to address other signature policy concerns such as multiple signatures, referred to as an extended business model.
49、 The present document on signature policies elaborates on the signature policy concept (defining the meaning of the signature e.g. what the signature is meant to endorse), addresses certain aspects of multiple signatures (especially with respect to their current application in the paper world) whilst recognizing their applicability in all EC countries and for global trade, and if necessary propose extensions of the standard. The objective of the first part of the deliverable, following an analysis of signature issues, is to identiSl the business requirements, while
