This document is a preview generated by EVS

Size: px

Start display at page:

Download "This document is a preview generated by EVS"

Henry Pearson
6 years ago
Views:

1 CEN WORKSHOP CWA April 2005 AGREEMENT ICS English version Architecture for a European interoperable eid system within a smart card infrastructure This CEN Workshop Agreement has been drafted and approved by a Workshop of representatives of interested parties, the constitution of which is indicated in the foreword of this Workshop Agreement. The formal process followed by the Workshop in the development of this Workshop Agreement has been endorsed by the National Members of CEN but neither the National Members of CEN nor the CEN Management Centre can be held accountable for the technical content of this CEN Workshop Agreement or possible conflicts with standards or legislation. This CEN Workshop Agreement can in no way be held as being an official standard developed by CEN and its Members. This CEN Workshop Agreement is publicly available as a reference document from the CEN Members National Standard Bodies. CEN members are the national standards bodies of Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMITÉ EUROPÉEN DE NORMALISATION EUROPÄISCHES KOMITEE FÜR NORMUNG Management Centre: rue de Stassart, 36 B-1050 Brussels 2005 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members. Ref. No.:CWA :2005 E

2 Table of Content Foreword Introduction Scope and objectives Informative References Concepts and definitions Abbreviation Contextual Model for IAS interoperability Trust models Interoperability of IAS between schemes Conceptual model for IAS interoperability Roles Processes SCMF and generic trust model Smart card communities and communities The IAS functional model The IAS platform function The platform function The crypto function The application function The connectivity function The Human Interface function IAS system architecture The Smart layer The layer The layer The layer interfaces The functional model in the IAS system architecture The functional model in the Smart Layer The functional model in the User Access Point sub-layer The functional model in the Access Point sub-layer The functional model in the Layer The functional model in the PKI service sub-layer High level description of the primary processes - formal description UC 1.0.: activation UC.1.1.: Securing of the terminal-card link UC.1.2.: Component Authentication UC.N.3.: Certificate validation UC.2.0.: Connection to

3 7.6 UC.2.1.: Securing of the link UC.2.2.: holder authentication by PKI UC.3.2.: holder authentication by PIN/BioCode UC.3.0.: Interaction with the UC.3.1.: Signing of a data object UC.4.0.: Closing of the Connection UC.5.0.: deactivation IAS interoperability IAS interoperability scenarios IAS Interoperability architecture IAS interoperability processes Securing interoperability Introduction Securing the -Terminal interface (IOP#1) Securing the User Access Point - Access Point link (IOP#2) Securing the access to PKI services (IOP#3) Securing the Access Point - link (IOP#4) Securing the on-card applications IAS function interface (IOP#5) Common requirements for IAS interoperability Requirements related to the execution of the primary processes Requirements on secondary processes...55 Annex A Mandatory field in certificates...59 Table of Figures Figure 1: Towards a smart card infrastructure based on a common eid... 5 Figure 2: Simple 3-entity Trust model Figure 3: 4-entity Trust model Figure 4: Role modelling Figure 5: eauthentication primary process high-level use cases Figure 6: Generic trust model Figure 7: The trust model in the SCMF Figure 8: Interoperability of IAS services Figure 9: The functional box model Figure 10: Smart card information system architecture Figure 11: eauthentication system architecture Figure 12: The functional model in the IAS system architecture Figure 13: Primary processes model Figure 14: The Activation use case (UC 1.0.) Figure 15: The Connection to use case Figure 16: The interaction with the use case Figure 17: Summary of interoperability scenarios and levels Figure 18: IOP Figure 19: IOP - case Figure 20: IOP - case Figure 21: IOP - case Figure 22: On-card IOP - case Figure 23: On-card IOP - case Figure 24: On-card IOP - case

4 Foreword The production of this CWA (CEN Workshop Agreement) was formally accepted at the e-authentication Workshop's kick-off meeting on The document has been developed through the collaboration of a number of contributing partners in WS-eauthentication, representing smart card interests. This CWA has received the support of representatives of each of these sectors. A list of company experts who have supported the document's contents may be obtained from the CEN/ISSS Secretariat. This CWA consists of the following parts, under the general title CWA 15264: Part 1: Architecture for a European interoperable eid system within a smart card infrastructure Part 2: Best Practice Manual for card scheme operators exploiting a multi-application card scheme incorporating interoperable IAS services Part 3: User Requirements for a European interoperable eid system within a smart card infrastructure 4

5 1 Introduction 1.1 Scope and objectives This part of the CWA defines the interoperability architecture for the implementation of a smart-card based interoperable public eauthentication/eid infrastructure across Europe to be primarily used in the egovernment domain. The workshop considers smart cards as being Integrated Circuits contact cards, Integrated Circuits contactless cards and combined cards with either 2 or more chips on board or 1 chip with both contact and contactless communication capabilities. Although the use of SIM cards is not considered explicitly in this document, this does not exclude the use of SIM card based eid, especially when used for authentication and digital signature purposes. This document models the Interoperability (IOP) problematic from different perspectives in the following order: Context, concluding requirements Concepts o functional view o technical architecture for a smart card based eid system using on-line egovernment applications o dataflows view (description independent from technical solutions) o interoperability issues Specifications / common requirements for interoperability The CWA eauthentication intends to support migration from situation 1 (see below) where each eid-card has its own infrastructure and trust services into a situation 2 where card body, microprocessor, smart card infrastructure as well as trust services may be shared between different providers. epassport edriving license elogical access ehealth esocial security 1 2 egov. / ebus. on-card / on-line services Figure 1: Towards a smart card infrastructure based on a common eid The CWA considers the Identification, Authentication and electronic Signature function (IAS) as a generic one to be used for accessing online egovernment services with smart cards. Issues regarding the content and internal way of function of an application are out of scope. The CWA does however describe the relevant interface between the generic function and the application. 1.2 Informative References Open Smart for Europe v2, (March 2003) eesc Common Specifications for interoperable multi-application secure smart cards v2.0 5

6 ITU-T Recommendation X.811 (1995) Information Technology -Open Systems Interconnection - Security Frameworks For Open Systems: Authentication Framework ITU-T Recommendation X.813 (1996) Information_Technology- Open Systems Interconnection - Security Frameworks In Open Systems: Non-Repudiation Framework ISO/IEC (FCD 2003) Identification cards Integrated circuit(s) cards with contacts Part 4: Organization, security and commands for interchange ISO/IEC (2002) Identification cards Integrated circuit(s) cards with contacts Part 15: Cryptograpic information application CEN/ISSS WS/E-Sign CWA ,2 Group K eepoch project, Deliverable D4.2IOP Demonstrator "Safelayer Secure Communications" NICSS-Framework Scheme, NICSS Prerequisites, First Edition, Version 1.20, April 24, 2001 NIST Special Publication (2004) Draft Recommendation for Electronic Authentication ISO/IEC JTC 1/SC 37 Standing Document 2, Vocabulary on Biometrics 1.3 Concepts and definitions Abort Acceptor Access (AP) Provider To abnormally terminate a process An entity whose primary role is to provide business services/goods to a person using the smart card for accessing e-services or receiving goods. Also known as Service Provider. An entity in charge of managing the infrastructure (i.e. the card readers, terminals and necessary drivers, communication network and servers) used by card holders accessing the offered services. Accessibility Usability of a product, service, environment or facility by people with the widest range of capabilities In the context of this CWA, "accessibility" typically addresses users who have a disability, but the concept is not limited to disability issues. Advanced electronic signature An electronic signature which meets the following requirements Chapter 1 It is uniquely linked to the signatory; Chapter 2 It is capable of identifying the signatory; Chapter 3 It is created using means that the signatory can maintain under his/her sole control; and Chapter 4 It is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable. Under certain conditions, an advanced electronic signature may be considered as a qualified digital signature (q.v.) 1 according to Directive 1999/93/EC 1 q.v. stands for Quo vide - Which see 6

This document is a preview generated by EVS

This document is a preview generated by EVS CEN WORKSHOP CWA 14923-9 May 2004 AGREEMENT ICS 35.240.40 Supersedes CWA 13937-9:2003 English version J/eXtensions for Financial Sevices (J/XFS) for the Java Platform - Part 9: Depository Device Class