1、 ETSI TS 102 640-1 V2.2.1 (2011-09) Electronic Signatures and Infrastructures (ESI); Registered Electronic Mail (REM); Part 1: Architecture Technical Specification ETSI ETSI TS 102 640-1 V2.2.1 (2011-09)2Reference RTS/ESI-000071-1 Keywords e-commerce, electronic signature, email, security, trust ser
2、vices ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document
3、 can be downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute,
4、the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI d
5、ocuments is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written
6、permission. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2011. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are T
7、rade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 102 640-1 V2.2.1 (2011-09)3Contents Intellectual Property Rights 4g3Foreword . 4g3Introduction 4g31 Sco
8、pe 7g32 References 7g32.1 Normative references . 8g32.2 Informative references 8g33 Definitions and abbreviations . 9g33.1 Definitions 9g33.2 Abbreviations . 11g34 REM Logical Model . 11g34.1 REM Functional Viewpoint . 12g34.2 REM Styles of Operation . 13g34.2.1 REM Store and Forward Style of Operat
9、ion . 13g34.2.2 REM Store and Notify Style of Operation 15g34.3 Roles within a REM MD 17g34.4 REM Administrative Viewpoint . 18g35 REM Interfaces 20g36 REM Events and REM-MD Evidence . 20g36.1 Overview 20g36.2 Event Types and their Proof . 21g36.2.1 Events and REM-MD Evidence related to the REM Send
10、ers REM-MD . 22g36.2.2 Events and REM-MD Evidence related to the REM Recipients REM-MD 22g36.2.3 Events and REM-MD Evidence related to the REM Recipient 22g36.2.4 Events and REM-MD Evidence related to connections with outside the REM-MD 25g37 REM Trust Building . 26g37.1 Closed REM-PD . 26g37.2 Inte
11、roperable REM-PDs TSL - No Root TSL 27g37.2.1 Interoperable REM-PDs TSL - No Root TSL: an example 27g37.3 Interoperable REM-PDs TSL - Root TSL 28g37.3.1 Interoperable REM-PDs TSL - Root TSL: an example 29g3Annex A (informative): REM Events and Actions flows 30g3Annex B (informative): Bibliography .
12、33g3History 34g3ETSI ETSI TS 102 640-1 V2.2.1 (2011-09)4Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and
13、 can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/ipr.etsi.org). Pursuant to the ET
14、SI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Forewor
15、d This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). The present document is part 1 of a multi-part deliverable covering Registered Electronic Mail (REM), as identified below: Part 1: “Architecture“; Part 2: “Data requirem
16、ents, Formats and Signatures for REM“; Part 3: “Information Security Policy Requirements for REM Management Domains“; Part 4: “REM-MD Conformance Profiles“; Part 5: “REM-MD Interoperability Profiles“; Part 6: “Interoperability Profiles“: Sub-part 1: “REM-MD UPU PReM Interoperability Profile“; Sub-pa
17、rt 2: “REM-MD BUSDOX Interoperability Profile“; Sub-part 3: “REM-MD SOAP Binding Profile“. Introduction Business and administrative relationships among companies, public administrations and private citizens, are the more and more implemented electronically. Trust is becoming essential for their succ
18、ess and continued development of electronic services. It is therefore important that any entity using electronic services have suitable security controls and mechanisms in place to protect their transactions and to ensure trust and confidence with their partners. Electronic mail is a major tool for
19、electronic business and administration. Additional security services are necessary for e-mail to be trusted. At the time of writing the present document, in some European Union Member States (Italy, Belgium, etc.) regulation(s) and application(s) are being developed, if not already in place, on mail
20、s transmitted by electronic means providing origin authentication and proof of delivery. A range of Registered E-Mail (“REM“) services is already established and their number is set to grow significantly over the next few years. Without the definition of common standards there will be no consistency
21、 in the services provided, making it difficult for users to compare them. Under these circumstances, users might be prevented from easily changing to alternative providers, damaging free competition. Lack of standardization might also affect interoperability between REM based systems implemented bas
22、ed on different models. The present document is to ensure a consistent form of service across Europe, especially with regard to the form of evidence provided, in order to maximize interoperability even between e-mail domains governed by different policy rules. ETSI ETSI TS 102 640-1 V2.2.1 (2011-09)
23、5In order to move towards the general recognition and readability of evidence provided by registered e-mail services, it is necessary to specify technical formats, as well as procedures and practices for handling REM, and the ways the electronic signatures are applied to it. In this respect, the ele
24、ctronic signature is an important security component to protect the information and to provide trust in electronic business. It is to be noted that a simple “electronic signature“ would be insufficient to provide the required trust to an information exchange. Therefore the present document assumes t
25、he usage of at least an Advanced Electronic Signature, with the meaning of article 2(2) of EU Directive 1999/93/EC i.1, issued with a Secure Signature Creation Device, with the meaning of article 2(6) of the same Directive. The scope of each part is summarised below. TS 102 640-1 (the present docume
26、nt) “Architecture“ provides an overall view of the REM, addressing all aspects: Logical model, namely: Components, Styles of Operation, Roles within a REM-MD, REM-MDs grouping in administrative domains named REM Policy Domains. Interfaces between the involved entities. Events of shipment, transmissi
27、on, delivery or download of messages concerning the REM environment and Evidence types generated by REM-MDs against these events. Layering model and trust building among REM Management Domains, within the same or a different REM Policy Domain, or to non REM Systems. TS 102 640-2 1 provides: Rules fo
28、r building a REM-MD Envelope and, consequently, a REM Dispatch or a REM-MD Message. Syntax and semantics of REM-MD Evidence to be produced by a REM Management Domain. Rules on the signature to be applied within REM-MD Envelopes. Specifications on TSL to be issued for mutual recognition of REM-MDs. T
29、S 102 640-3 i.6 specifies requirements on the Registered E-Mail Management Domain (REM-MD) Information Security Management System based on per ISO/IEC 27001 i.9. Provisions, additional to ISO/IEC 27001 i.9 controls, are also specified that address: REM-MD practices statement. REM Interconnection Sta
30、tement. REM Sender/REM Recipient Authentication. Electronic signature related issues relevant to the REM. measures related to records retention and destruction. TS 102 640-4 i.7 “REM-MD Conformance Profiles“ specifies two levels of conformance requirements: Basic Conformance Profile that indicates t
31、he minimum set of mandatory requirements that are to be met by any REM-MD that claims to be conformant with TS 102 640-1 (the present document), TS 102 640-2 1 and TS 102 640-3 i.6; and Advanced Conformance Profile that includes a set of voluntary additional requirements to the Basic Conformance Pro
32、file for enhanced security and advanced evidential services. TS 102 640-5 i.8 “REM-MD Interoperability Profiles“ addresses the followings aspects: Defines a profile for interoperability among REM-MDs based on SMTP relay protocol. Profiles the implementation of TS 102 640 based systems, addressing is
33、sues relating to authentication, authenticity and integrity of the information to achieve interoperability between such systems. Covers all the options to profile REM-MD for both styles of operation: S and 2) “Store and Notify“ (S c) describes a policy domain environment; and d) specifies a list of
34、different types of events and the REM-MD Evidence types that represent them. Evidential services are deemed to comply with legal, regulatory or contractual requirements to provide legal validity and enforceability under domestic or international law. The present document does not provide specificati
35、on for interactions among architectural elements internal to the REM-MD. Although interfaces to physical mail could exist, the present document does not provide standardized interfaces to physical mail. The structure of the present document is as follows: clause 2 contains the list of normative and
36、informative references; clause 3 includes definitions of the relevant concepts to the present document and abbreviations; clause 4 contains the logical model for REM provision; clause 5 specifies REM interfaces; clause 6 provides a list of different types of events and REM-MD Evidence; and clause 7
37、deals with the implementation of a TSL based mechanism for allowing mutual trust of REM-MDs. 2 References References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-speci
38、fic references, the latest version of the reference document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid
39、 at the time of publication, ETSI cannot guarantee their long term validity. ETSI ETSI TS 102 640-1 V2.2.1 (2011-09)82.1 Normative references The following referenced documents are necessary for the application of the present document. 1 ETSI TS 102 640-2: “Electronic Signatures and Infrastructures
40、(ESI); Registered Electronic Mail (REM); Part 2: Data requirements, Formats and Signatures for REM“. 2.2 Informative references The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1 Dire
41、ctive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures. i.2 Void. i.3 ETSI TS 102 023: “Electronic Signatures and Infrastructures (ESI); Policy requirements for time-stamping authorities“. i.4 IETF RFC 3161 (2001):“Intern
42、et X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)“. i.5 IETF RFC 1305 (1992): “Network Time Protocol (Version 3) Specification, Implementation and Analysis“. i.6 ETSI TS 102 640-3: “Electronic Signatures and Infrastructures (ESI); Registered Electronic Mail (REM); Part 3: Information Secu
43、rity Policy Requirements for REM Management Domains“. i.7 ETSI TS 102 640-4: “Electronic Signatures and Infrastructures (ESI); Registered Electronic Mail (REM); Part 4: REM-MD Conformance Profiles“. i.8 ETSI TS 102 640-5: “Electronic Signatures and Infrastructures (ESI); Registered Electronic Mail (
44、REM); Part 5: REM-MD Interoperability Profiles“. i.9 ISO/IEC 27001:2005: “Information technology - Security techniques - Information security management systems - Requirements“. i.10 ETSI TS 102 231: “Electronic Signatures and Infrastructures (ESI); Provision of harmonized Trust-service status infor
45、mation“. i.11 ETSI TS 102 640-6-1: “Electronic Signatures and Infrastructures (ESI); Registered Electronic Mail (REM); Part 6: Interoperability Profiles; Sub-part 1: REM-MD UPU PReM Interoperability Profile“. i.12 ETSI TS 102 640-6-2: “Electronic Signatures and Infrastructures (ESI); Registered Elec
46、tronic Mail (REM); Part 6: Interoperability Profiles; Sub-part 2: REM-MD BUSDOX Interoperability Profile“. i.13 ETSI TS 102 640-6-3: “Electronic Signatures and Infrastructures (ESI); Registered Electronic Mail (REM); Part 6: Interoperability Profiles; Sub-part 3: REM-MD SOAP Binding Profile“. i.14 E
47、TSI TS 101 733 (V1.5.1): “Electronic Signatures and Infrastructures (ESI); CMS Advanced Electronic Signatures (CAdES)“. i.15 ETSI TS 101 903 (V1.2.2): “Electronic Signatures and Infrastructures (ESI); XML Advanced Electronic Signatures (XAdES)“. ETSI ETSI TS 102 640-1 V2.2.1 (2011-09)93 Definitions
48、and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and definitions apply: certification authority: authority trusted by one or more users to create and assign public-key certificates information security policy: statement of policy which provides manageme
49、nt direction and support for information security in accordance with business requirements and relevant laws and regulations long term storage: role that supports the integrity of data and the authenticity of a signature over the period required to store data for evidential purposes that can be used by the Message Archive message archive: optional role that supports storage of REM Objects and REM-MD Evidence, as required for later use for evidential or any other legally admitte
