1. What is Long-Term Docs... 5

Transcription

1

2 Contents 1. What is Long-Term Docs General Properties of Long-Term Docs The Features of Long-Term Docs Long-Term Document Validity (LTV) Long-Term Document Archiving (LTA) Conversion of Common PDF into PDF/A to Provide Their Long-Term Archiving Feature Overview ISO Standard Compliance Support for Conversion into PDF/A Format Designed for Long-Term Archiving (LTA) Functions Providing Long-Term Validity (LTV) for Documents Functions Providing Long-Term Validity (LTV) for Data Using Internal Shared Folders Cloud Storage Monitored Account Data Mailbox A Trusted Snapshot of a Website and Website Contents Archiving Signing by Digital Certificates Qualified Time Stamps Digital Signature Visualization Insert picture on the page Automatic Services Implementation Methods Long-Term Docs Manager Easy Integration Integration using Internal Storages Integration using Cloud Storages Integration using Monitored Accounts Documentation System Requirements Server Requirements Requirements for Conversion into PDF/A Native Conversion Using the Application Interface Conversion using Print Shell Installing and Running Installing and Running Long-Term Docs Service Manager

3 Installation Running Account Login First Login to the Account Account Change License Certificate Settings Service Installation Long-Term Docs Server Operation Language Selection Configuration and Configuration Files Creating a New Configuration Naming a Folder Configuration Parameter Settings Editing an Existing Configuration Importing Configuration from a File Deleting Configuration Task Management Long-Term Docs Folder Specifications Naming and Location of the Maintenance Folder Folder Selection Local Computer Folder Cloud Storage Selection Setting Folder Properties Setting the Document Inclusion in the Maintenance Process Monitoring an Input Folder Monitoring a Mailbox Monitoring a Data Mailbox Monitoring Websites Providing Long-Term Document Legibility Conversion test Conversion Method Settings What File Types to Convert? Data Message Conversion Conversion Method Details Attaching a Digital Signature and a Time Stamp Digital Signature and Time Stamps Basics What You Will Need Signature Attachment Dialog Certificate Selection Attaching a Time Stamp

4 Conversion According to PAdES Specification Additional Information Visualization Attaching a Graphical Image of the Signature Attaching a Standalone Time Stamp Inserting a Image Long-Term Validity The Duration of Maintenance and Its Parameters Document After the Maintenance Period If There Is an Error Maintaining the Document Server Performance Monitoring Log File Maintenance Script Microsoft Office and Open Office Document Conversion An Example of DCOM Object Settings OpenOffice File Conversion

5 1. What is Long-Term Docs Long-Term Docs is a service that provides documents with long-term legibility and validity. It can be used and set up through a server application. The documents to be maintained are converted into PDF/A format which guarantees that you will be able to open and read it anytime in the future. Additionally, the documents are provided with a digital signature and a time stamp to ensure their validity and authenticity. The service regularly checks the stored document's certificates and, as a part of the maintenance process, continues to preserve their validity General Properties of Long-Term Docs Long-Term Docs provides long-term legibility and validity for documents and data essential and important for providing business continuity. To provide long-term legibility, documents can be converted from various formats into formats of the PDF/A family, as defined by international ISO standards. Subsequently, ETSI specification and PAdES requirements for long-term validity of authorized documents in PDF/A are fulfilled. Data and structured formats are treated according to the specifications for advanced digital signature CAdES or XAdES. The application provides a fast and easily configured document conversion from the contents of shared data storages within internal networks, but also offers devices for direct connection to storages like Google Drive, OneDrive, SharePoint or Office365. Another possible input channel are e- mail accounts, by processing attachments of communication. You can also define URL addresses of websites. Their contents is archived in legible form and secured for later validation. The application provides document processing by the latest standards: PDF/A documents by conversion from any accepted format. PDF/A documents compliant with the latest ISO standards for long-term archiving (A1:2005, A2:2011, A3:2012 valid from ) with format validation (used in Adobe Acrobat Reader Preflight) and conversion metadata generation. PAdES compliant with ETSI specification for PDF documents authorized by a digital signature for Long Term Validation (LTV) guaranteeing long-term validity (using SecuStamp LTV Service). XAdES compliant with ETSI specification to provide long-term validity of structured XML documents. CAdES compliant with ETSI specification available for any documents or data to provide their validity for any period of time. Support for digital signatures and time stamps is implemented: A full support for digital signatures and organization's marks (BES/EPES) is available, including the option to attach a qualified time stamp. Or a stand-alone time stamp can be attached to a document. It is also possible to use an archival time stamp with renewal as defined by ETSI specification (AdES) The Features of Long-Term Docs The main features of Long-Term Docs include: The application server, which provides access to the Long-Term Docs services and allows to define rules for document treatment and long-term archiving, can be installed to server operating systems Windows 2008 and Thanks to support of direct connection to cloud storages by Microsoft and Google, access to monitored network folders, monitored POP3 boxes and defined website URL addresses, it provides wide options of integration into the current organization. 5

6 All created documents including common PDF files within the organization can be turned into a form compliant with legislation and internationally accepted requirements for long-term document preservation and validity Long-Term Document Validity (LTV) The application supports functions and specifications of the advanced electronic signature PAdES (ETSI) for document status validation and their PDF formats including validation of digital signature, mark and time stamp certificates, their check against the CRL list and document hash violation check. It automatically recognizes file formats, binary data is treated in compliance with CAdES specification and structured XML documents according to XAdES specification. The application also provides metadata storage at the server, so that it is possible to quickly find out which documents need to be renewed as of a given date, or to check their state and therefore automatically ensure their long-term validity and authenticity Long-Term Document Archiving (LTA) Support for long-term archiving for documents in any format including common PDF files by conversion into PDF/A (levels A1:2005, A2:2011, A3:2012), which is defined by international standard ISO (LTA Long Term Archiving) Conversion of Common PDF into PDF/A to Provide Their Long-Term Archiving The service also provides a reliable conversion of any PDF files into PDF/A format, which guarantees their long-term legibility independent of reading devices. By applying the PDF/A:3 standard, the original documents can be attached to the archived version Feature Overview ISO Standard Compliance Long-Term Docs converts documents into PDF/A format specified by ISO :2005, :2011 a :2012. This compliance ensures legibility of the archived documents for a very long time Support for Conversion into PDF/A Format Designed for Long-Term Archiving (LTA) PDF/A format standard guarantees that a PDF document created today will be usable many years after its creation. Documents converted this way are fully compliant with the requirement for effective and long-term archiving Functions Providing Long-Term Validity (LTV) for Documents Full support for document status and format validation includes validation of digital signature, mark and time stamp certificates, their check against the CRL list and document hash violation check, etc. The application provides metadata storage at a registration server; so that it is possible to quickly find out which documents need to be renewed as of a given date, or to check their state. All these services are provided by SecuStamp.eu portal, which regularly monitors all qualified authorities within the EU placed on the Trusted List. Additionally, archival records of issued CRL lists are available Functions Providing Long-Term Validity (LTV) for Data Full support and automated file format recognition ensures long-term validity for any documents and data, where it is not possible to provide their long-term legibility using PDF/A format. It applies, for example, to security video recordings of tests, voice recordings, binary data, codes or structured XML 6

7 documents. These types of documents and data are treated according to CAdES or XAdES specifications Using Internal Shared Folders Long-Term Docs natively uses the internal file system of the network where the Long-Term Docs server is installed. Therefore it is very easy to define the input channel for document treatment as a part of access rules to the internal file system or archival storage. Similarly, an existing file storage can be used for a Long-Term Docs folder, in which files and data are maintained according to set up rules Cloud Storage Long-Term Docs supports communication and use of commercial data storages by Microsoft and Google. Using these drive services like SharePoint, OneDrive, Office365 or Google Drive for the defined Long-Term Docs folder is very intuitive Monitored Account For automatic central document treatment, electronic mail and a pre-defined box can be used. Any attachment sent to the monitored account is automatically processed, treated and maintained in the Long-Term Docs folder in a legible form with long-term validity Data Mailbox Integrated functionality for monitoring a data mailbox and automatic conversion and archiving of data messages. Your data mailbox can be one of the sources of long-term documents. Archive your data messages in compliance with legislation at your preferred data storage A Trusted Snapshot of a Website and Website Contents Archiving Internet sites are a major source of information and often serve as a place of public promises information based on which important decisions are made. On the other hand it is relatively easy to change this information quickly. Long-Term Docs allows websites to be one of the sources of archive documents. A website is archived including the page source code, which is necessary for displaying the page later. Besides the website, documents linked from the page can be archived too. All this including information on the IP address where the page has been displayed, whether it has been secured with a certificate and what one, and the whole archive package is provided with a qualified time stamp Signing by Digital Certificates To provide trustworthiness of a document or as a proof of its intact integrity, documents and data can be provided with a digital signature, or more signatures within the organization. Certificates placed in the Windows certificate store or on a hardware Token can be used for signing. All the signatures are created in compliance with the advanced electronic signature specification: PAdES, CAdES or XAdES Qualified Time Stamps Long-Term Docs provides a native resource of qualified time stamps. No more troubles and contracts with time stamp providers! Time stamps from a trusted authority are essential for unambiguous and trustworthy proof of the time when the given file has been signed, received or otherwise manipulated. 7

8 Digital Signature Visualization The application allows a visualization of the signature and its status (whether it is verified and its integrity intact). The visualization's graphical symbol can be displayed at any selected place of the PDF document. The document's recipient can see at once whether the document is signed by a valid signature and whether it is unchanged from the moment of signing Insert picture on the page The Stamp function can be used for marking the documents with an image serving as a graphical "stamp" for example the company logo, signature image, etc. This graphical element, of course, cannot be placed into previously signed documents Automatic Services Long-Term Docs can be used to provide automatic archiving of any documents, electronic mail, website contents generally all file types that can be converted into the PDF/A format. Thanks to smart document processing according to their type it can provide long-term data archiving generally documents that cannot be converted into the long-term legible PDF/A format. Native functions for connection to internal shared folders or cloud storages by Microsoft and Google allow full automation of long-term legibility and validity services for files and data Implementation Methods The Long-Term Docs service is available by the means of an application server installed in an internal secure zone on a server with Windows Server 2008 SP1 operating system, or An important component is the setting up of the Long-Term Docs folder, in which the long-term document and data maintenance service is run. This folder can be placed either within the internal shared folders and storages, or an available cloud storage by Microsoft or Google, Inc. can be used. All the services necessary for the required treatment, looking up information on signature certificates, their revocation and other related services including qualified time stamps are drawn from the SecuStamp.eu portal Long-Term Docs Manager The complete account management, server settings and Long-Term Docs folder settings are easily available from the Long-Term Docs Manager interface. After the application is installed, login data for the Long-Term Docs account needs to be set up using a simple dialog. Time stamps, information needed for certificate validation and document registration are drawn using this account. 8

9 In the next step, select the account that will permit the service to access individual folders and run the necessary operations. This is the Administrator's account. Most of the Long-Term Docs Manager is dedicated to Long-Term Docs folder management. For each of the Long-Term Docs folders, a list of all the settings is displayed along with the folder name and its location, current status and log file path. The lower part contains buttons for creating a new Long- Term Docs folder and editing the existing ones. More information on options and settings of Long-Term Docs folders can be found in chapter Microsoft Office and Open Office Document Conversion. 9

10 1.5. Easy Integration Note: This schema displays using Long-Term Docs folder in both internal and cloud storages. There are four areas of data sources internal storage, cloud storage, electronic mail and web Integration using Internal Storages Set up shared folders to easily access Long-Term Docs functions within the internal network. Standard rules for user access to shared resources provide permissions to use the service. Set up conversion profiles to set unified conversion rules including the final form of the PDF document and its required properties, security or time stamp Integration using Cloud Storages Set up folders in cloud services by Microsoft and Google to provide additional functions for your storage and the quality of stored documents. Thanks to accessibility and high security of these storages, your trusted documents will be always available and also your colleagues will be able to add important documents and data into the process of maintaining their long-term legibility and validity. Anytime, from anywhere. 10

11 Integration using Monitored Accounts Set up monitored accounts to provide effective use of the services straight from mobile devices, anywhere. Mail processing is fast and you can use profile settings to ensure processing of documents attached to the by a preset process and store them in the Long-Term Docs folder Documentation Documentation for the Long-Term Docs application is available on Long-Term Docs website at: System Requirements This chapter summarizes recommendations and system requirements for the software tool for Long- Term Docs service and PDF/A conversion Server Requirements Windows Server 2008 SP1 Windows Server 2012.NET 2.0 NET 3.5 for communication with ISDS, Google Disk, Google Apps and SharePoint 2010 / 2013 NET 4.5 for communication with OneDrive and Office365 SharePoint Server2013 Client Components for Office365 folders access Java minimum version 1.7, update 45 (1.7.0_45) Requirements for Conversion into PDF/A Native Conversion Immediately after the installation, without the need for any additional settings, conversion is available for documents of the following types: PDF, TXT, HTML, image formats (JPG, BMP, PNG ) Using the Application Interface Conversion into PDF/A from MS Office 2007, 2010 a 2013 applications (Word, Excel, PowerPoint) (using the developer's interface, interop, for handling MS Office applications) requires MS Office installation on the application server with the corresponding license coverage and registration of COM objects. Conversion into PDF/A from OpenOffice or LibreOffice applications using the direct application integration. Conversion of ZFO and FO using Software602 Form Filler Conversion using Print Shell Any file format using shell print from the corresponding application, which must be installed on the server, for example DWG formats. 11

12 2. Installing and Running Installation 2.1. Installing and Running Long-Term Docs Service Manager The application can be installed using an installation program, which is included in the package. The process is the same as other commonly used installation processes and leads the user through its steps Running Run the Long-Term Docs application from the Windows Desktop by clicking on the Long-Term Docs icon. The command for running the application is also available in the Start menu. The Long-Term Docs Service Manager window allows you to: Create and edit configuration files for the tasks in process (for processing files from folders and mailboxes) use buttons Add Config, Import Config, Edit Config and Delete Config to create and edit the list and parameters for file and mail conversion tasks. Monitor the list of conversion tasks the individual tasks are listed in the table at the lower part of the window. The configuration editing buttons always apply to the task description selected by clicking on the corresponding item in the table. Monitor the file with service performance protocol the Show Log button will display in Notepad application the contents from the file related to the item selected in the task table. Run and set times for the maintenance script below the task table, you can enable or disable running the maintenance script at a set time interval. 12

13 2.2. Account Login First Login to the Account The account provides the option to draw qualified time stamps, information necessary for signature certificate validation, information for the AdES signature structure and document registration to provide their long-term validity. Without the registration and successful login to the account, it is not possible to run Long-Term Docs. Log in to the account by clicking the link Log in using your Long-Term Docs account. In the dialog Login to the Long-Term Docs server, fill in the fields Username and Password using the login data that you received from the longtermdoc.eu portal. 13

14 Username of the currently logged-in account is displayed under the Username header Account Change The Long-Term Docs Account section, placed in the dialog window first from top, can be used to update settings related to the user, the account and license certificate settings. Click the Change Account link to open Login to Long-Term Docs Server dialog window. In this dialog, you can enter another username and password and click OK to change the current account used for running the server License Certificate Settings Click the link, Import License Certificate, to open a dialog window with license certificate import confirmation. The certificate name and validity are displayed under the heading License Validity. 14

15 Click the link, below Service Usage Statistics to open the Long-Term Docs website in a web browser. The page displays current information on long-term legibility and legislative validity topics Service Installation Install the folder management service by clicking Install in section Long-Term Docs Folders. The account name and password can be set in dialog Account for Long-Term Docs Service Login the account must have administrator's rights. 15

16 The account setting is then confirmed by information about running Now you can click OK to return to the main application window, where the individual conversion tasks listed in the table can run as they are planned. 16

17 The name of the running service is also displayed in the Long-Term Docs Folders section of the application window. Clicking Change Settings will allow you to stop the running service and change it or uninstall. The individual task items in the window are equipped with Run checkbox. If the checkbox is checked, the task is currently active (you can check it manually by clicking the box). Its current state is displayed by the indicator in Status column for example it shows Running. If the box is not checked, the task is currently inactive according to its specifications. The Status column displays the reason e.g. Stopped means that the task has been temporarily stopped. 17

18 3. Long-Term Docs Server Operation The Long-Term Docs server application can monitor contents of given folders, mailboxes, data mailboxes or web presentations and, through tasks with parameters set by configuration files, provide automatic conversion of their contents into PDF/A according to set instructions (if it is possible given the file type) and subsequent long-term maintenance with the aim to keep its legibility and up-todateness for the whole storage period. The server's activities are controlled from the Long-Term Docs window, which contains all controls needed to set up and run the long-term archiving and maintenance processes Language Selection The Long-Term Docs server can be run in several language environments. Use the Application Language drop-down menu placed in the top right window corner to select the required language and all the labels and control names are immediately displayed in the selected language Configuration and Configuration Files The long-term document maintenance tasks are specified and described by sets of named parameters (configurations), which can be used to save and later load settings for maintenance procedures for the long-term preserved documents where the documents are taken from, what to do with them and where to store them. Buttons for compiling and editing the configuration files are placed at the lower part of the window. Each such set of configuration data represents one task that handles receiving documents from one selected source, their conversion into a format suitable for long-term archiving and subsequent maintenance for the set archiving period. 18

19 To create a new configuration file, click Add Config... When it is created, the new file's item will be placed in the table in the middle section of the window. To alter an existing configuration file, click Edit Config... You can also click Import Config... to import the complete configuration description from an INI file with saved configuration description. Unnecessary configuration file can be deleted from the table by clicking Delete Config... You can create a whole range of configurations. Each one of them is focused on one document resource, from which the documents are taken to the maintenance process it can be a selected folder, an electronic mail box, data mailbox or a web page. Each set of configuration data is saved as a separate configuration file Creating a New Configuration A new (another) configuration file for long-term document maintenance can be created in Long-Term Docs Folder Settings window, opened by clicking Add Config... The window contains controls necessary and sufficient for a complete description of one configuration for long-term document maintenance. 19

20 Naming a Folder Configuration First, select a name for the Long-Term Docs configuration and enter it in the Name field. The configuration will be listed under this name in the table in Long-Term Docs server window. 20

21 Parameter Settings In the window you can assemble the whole configuration as described in the following chapters the description is identical for both creating and editing the configuration. Save the configuration by clicking OK in the lower part of the window Editing an Existing Configuration An existing configuration for long-term document maintenance can be edited anytime. 1. Select the required configuration by clicking on its item in the middle section of the Long- Term Docs server window. 2. Click Edit config The configuration description is loaded in the Long-Term Docs Folder Settings window. Edit what is needed. 4. Save the updated configuration by clicking OK Importing Configuration from a File The whole configuration can be imported from an existing INI file. 1. Click Import Config In the Open Configuration dialog, browse to the file which contains the configuration for importing. 3. Click OK to load the configuration and add it to the list in the server window Deleting Configuration If one of the configuration items is not needed anymore, you can deleted it from the list. 21

22 1. Select the unneeded configuration by clicking on the item in the middle section of the Long- Term Docs server window. 2. Click Delete Config After confirming the following dialog, the configuration is deleted Task Management The individual tasks for the Long-Term Docs server, corresponding to the created configurations, are listed in the Long-Term Docs Folders section in the middle of the Long-Term Docs server window. Each line corresponds to one task and its contents are displayed immediately after creating the configuration. The individual processes can be activated and deactivated here. To activate or deactivate a task, use the checkboxes in the Run column: 22

23 If the box is checked, the task is activated. If the task is active, the Status column indicates Running. Click the checked box to uncheck it, the box is empty, the task is stopped the Status column indicates Stopped Long-Term Docs Folders Folder Settings The Long-Term Docs folder contains documents that have been treated according to the set up processing method. These documents will be kept in the state of long-term authenticity and legibility. It is strongly recommended to provide appropriate file access permission settings to authorized users with READ rights only for each Long-Term Docs folder. Because the documents are kept in the Long-Term Docs folder and the Long-Term Docs service only registers the documents' and signatures' metadata and the document cannot be determined or restored from the metadata, minimize the risk of unauthorized access or document deletion, which cannot be restored using the Long-Term Docs service How the Documents Are Stored When a document is placed in the preset Long-Term Docs folder, a new file name is created from the original one by adding an identification suffix. The documents are stored ONLY in your preset storage. The Long-Term Docs service only registers metadata related to the documents and signatures. It is not possible to determine or restore the registered document again from these metadata. Therefore the final filename takes the following form: [original_name]_!$$[3 more characters, 0-9 and A-Z].[extension]! represents an identification character for the Long-Term Docs service $$ identifies a file that have been prepared for long-term treatment, contains a time stamp and is within the so-called Grace period, in which it waits to make sure its signature certificate will not be revoked in the next 24 hours Once the document is registered to your Long-Term Docs account and checked for upcoming expiry every 24 hours, it does not contain the $$ characters anymore. Do not ever delete these file names in the Long-Term Docs folder! An example of a document name in the Long-Term Docs folder: Convert_html_!$$CG0.pdf A time stamp is attached to the document, identifying the time of entering the document into the long-term treatment and the document's state at the time. This moment marks the beginning of the Grace period. Convert_html_!_131632_CFZ.pdf The file has been registered in the Long-Term Docs folder for the long-term treatment process. According to the folder settings, it will be kept in a validable state by regular checks. The file name and its unique identification are tied to your Long-Term Docs account, under which it has been entered for registration and long-term treatment. If renamed, it will not be possible anymore to run the validity expiry checks and long-term treatment. 23

24 4. Long-Term Docs Folder Specifications Long-term document legibility is guaranteed by conversion into PDF/A format. To allow comparison, the original of the document, that is, the form in which it has been included in the process, can be attached to the long-term stored document. Data that cannot be converted into PDF/A is treated according to CAdES or XAdES specification. PDF/A (PDF) documents are treated according to PAdES specification. Long-term document monitoring and maintenance can be set for a whole range of folders and each one can store documents from different sources. Setting the methods of conversion and maintenance is a part of each Long-Term Docs folder configuration and is assembled when creating the configuration for each new folder by clicking the Add Config button in the Long-Term Docs window. For existing folders, the settings can be adjusted any time click Edit Config... in the Long-Term Docs window after selecting the folder in the Long-Term Docs Folders list Naming and Location of the Maintenance Folder In the Long-Term Docs Folder section of the Long-Term Docs Folder Settings window, select the base folder for storing the converted and maintained PDF/A files created in the long-term document maintenance and archiving process; that is, the folder on which the Long-Term Docs maintenance will be run Folder Selection Use the Select button to open the dialog which displays the tree structure of folders on the selected medium to allow easier selection. You can select a folder from the local network or cloud storages Local Computer Folder Select a folder on the local computer or local computer network in the same way that you select folders for example when saving documents in Word or similar applications. The Storage drop-down menu will be in this case set to My Computer. 24

25 If you need to create a new subfolder for one of the folders, right-click the folder name in the dialog and select New and then Folder from the context menu. Rewrite the temporary folder name New Folder with the name you want to give the folder. Confirm the folder selection by clicking OK Cloud Storage Selection The cloud storage can be set by the Storage drop-down menu. Open it to access a group of options. Items in the top section of the list (e.g. Microsoft Office 365) allow you to select business-type cloud storages. The lower part of the list (below the line) contains items for personal-type cloud storages for example Google Drive. Select one of the options to display the login dialog for the selected storage. For example if you selected the Google Drive service, you will access your storage by entering the address and password that you acquired when you registered to the service. 25

26 After you sign in, you will be asked to confirm once more that Long-Term Docs will have access to your selected folder in Google storage. Then your folder structure in the selected storage is displayed. 26

27 The cloud storage selection is subsequently reflected in the input field Path to folder in Long-Term Docs Folder Settings window. Sign in to the OneDrive storage in a similar manner: 27

28 Connect to the OneDrive Pro storage, which is available as a part of Office365, in a similar manner: If the domain in the login name is identical to your Office365 or SharePoint storage domain, fill in the Name and Password only. After successful login, your folders available in the selected storage will be displayed: 28

29 If you are running several domains under your Office365 and the login name is from a different domain than the SharePoint storage default domain, the URL address of the SharePoint storage must be filled in Setting Folder Properties Click Subfolder Sorting and Logfile settings in the upper section of the Long-Term Docs Folder Settings to set the properties for the future folder for stored document maintenance. This will open the dialog Long-Term Docs Folder Properties, where you can set up automatic document sorting and specify where to save maintenance logs. If you check the Automatic Subfolder Sorting box, the documents for maintenance will be saved into subfolders named according to a given template. Creating subfolders helps organize the stored documents and speed up their lookup and management. 29

30 Create the subfolder naming template in the Name field. When creating the template, you can take advantage of the list of dynamic variables that you can insert from the list opened by the arrow button on the right from the entry field. The arrow button opens a context menu with the following commands: Date and Time, Date, Time, Year, Month, Day, Hour, Minute and Second. You can use the commands to create combined folder names. Dynamic variables for creating the template are as follows: %DATETIME% date and time, formatted as yyyy-dd-mm_hh-mm; e.g _18-45 %DATE% date, formatted as yyyy-mm-dd; e.g %TIME% time, formatted as hh-mm; e.g %YEAR% year as four digits: yyyy, e.g %MONTH% the number of the month (mm) e.g. 10. %DAY% day in the month, e.g. 18. %HOUR% hour in 24-hour format e.g. 21. %MINUTE% minute (mm); e.g. 26. %SECOND% second (ss) e.g. 38. The date and time values refer to the moment of creating the folder. If you want to create logs of the performed maintenance, check the box Maintenance Logs. In the following field, set the folder in which to create the file for logging the conversion and maintenance process Setting the Document Inclusion in the Maintenance Process Monitoring an Input Folder The contents of a selected folder can be monitored, if you check Input folder in the Long-Term Docs Folder Settings window. 30

31 Then specify the folder in the field next to Input Folder. Either enter the path to the requested folder manually, or select the folder interactively in the dialog that opens by clicking Select. The contents of the selected folder will be monitored and any newly inserted files converted according to the settings into PDF format. The folder can be selected from either an available network location within the internal network, or from cloud storages. Select the storage type from the drop-down menu. The default location is My Computer Monitoring a Mailbox The contents of an box can be monitored if you select POP3 Account in the Long-Term Docs Folder Settings window. 31

32 Click Settings to specify how to monitor the mailbox contents for your account: Enter the address of the POP3 mailserver into the POP3 Server field (e.g. pop.seznam.cz). In Port, specify the port number where the POP3 server "listens" the default is 110. You can require secure connection through SSL by checking Use Secure Connection (SSL). Enter the login name for the account in the field POP3 Login. Enter the corresponding password for the above account in the field POP3 Password. Enter the number of days in the field Remove in to set the period after which the incoming messages will be deleted from the mailbox. If you set the value to 999, nothing will be deleted from the mailbox Monitoring a Data Mailbox The contents of a data mailbox can be monitored and a long-term validity for the data messages provided, if you check Data Mailbox in the Long-Term Docs Folder Settings window. 32

33 Click Settings to select which data mailbox to monitor: Specify the data mailbox in the dialog Login to the Data Mailbox by entering the login data: Enter the data mailbox username (login) in the Username field. Enter the corresponding password in the Password field. Click OK to confirm the entered data Monitoring Websites The contents of selected web pages can be monitored, if you check Web Pages in the Long-Term Docs Folder Settings window. In the input field, enter the addresses of the websites whose visualization, contents and linked documents you will want to download and long-term store. 33

34 5. Providing Long-Term Document Legibility Long-term document legibility is achieved by converting them into the PDF/A format. To allow comparison, the document's original can be attached to the converted document. Convert a document into PDF/A by checking Provide Long-Term Legibility by Conversion into PDF/A. 34

35 5.1. Conversion test For PDF conversion is necessary to ensure the right settings of applications according to the converted files. For example Open Office for *.odt files. For test of the application settings needed for conversion to PDF (PDF/A) use PDF Conversion Test Information of the result of the test is shown in the list. For example missing DCOM object registration for the *.doc file Conversion Method Settings Set how exactly will the input documents be converted into PDF in the PDF/A Conversion Settings window, which you can open by clicking Settings in section Provide Long-Term Legibility by Conversion into PDF/A. 35

36 5.3. What File Types to Convert? The window in the upper part of the dialog lists the extensions for all allowed file types, that will be converted into PDF. You can add to the list manually the individual items are separated by a semicolon. File types not included in the list will not be converted. Some file types can only be converted if an application working with this file type is installed and configured Data Message Conversion Data Messages files in ZFO format are regularly converted into PDF/A. If the conversion is not necessary or you need to disable it, open the PDF/A Conversion Settings dialog and check Do Not Convert Data Messages (ZFO) Conversion Method Details By applying the PDF/A:3 standard, the original documents can be attached to the archival version. To make use of this option, check Convert into PDF/A-3 Format with the original file attached. 36

37 Another option is a conversion from the graphical form of the text (from an image) into characters. Use this option by checking Allow OCR of Image Documents Attaching a Digital Signature and a Time Stamp Digital Signature and Time Stamps Basics How does digital signature work? First, a so-called document hash is created. It is a data string of a given, fixed length, which unambiguously characterizes the document's contents. This hash is then encrypted with the signing person's private key. The result is a digital signature, which, along with the original document's contents, creates a digitally signed document. The document's recipient verifies the signature's authenticity by comparing a freshly created hash with the hash acquired by decrypting the digital signature using a public key of the signing person. Validity of the public key of the signing person is verified by so-called certificate, issued and digitally signed by a certification authority. A digital signature therefore ensures the recipient that the document has been really sent by you and that its contents have not been altered. A document that you are digitally signing can be also provided with a time stamp. You can obtain it from a time stamp authority; the request includes the document's hash. These three pieces of data the document, the digital signature and the time stamp create connection not just to the person who signed the document, but also the moment in time before which the document certainly existed. Creating the time stamp does not depend on the contents of the stamped document, because it is only based on its hash. This is important, because there is no way to deduce the document's contents from the hash, so not even the time stamp authority is able to learn the document's contents. Most importantly, the time stamp contains the current date and time, the stamp's serial number and identification of the issuing authority. This data will be attached to the input data and all of it provided with the time stamp authority's digital signature. The applicant will receive the result as a reply to their request What You Will Need Everyone who wants to digitally sign documents must possess their own digital certificate, which must be obtained in advance from one of the certification authorities. The source of qualified time stamps is provided by the Long-Term Docs service. Certificates used by Long-Term Docs must be installed in the computer certificate store, not in user certificate store. To do this, follow these instructions: Installation must be done using MMC console. 1. Start -> Run -> mmc 37

38 2. In the new opened window, click on the item File -> Add/Remove Snap-in -> Certifkáty -> Click on Add -> select Computer account -> Next -> Finish -> OK 3. In the newly added section Cerfiticates (Local Computer) continue : Open Certificates (Local Computer) -> Right click Personal -> All Tasks -> Import 38

39 4. Continue as in any other certificate installation process select the certificate file, enter password and private key protection level and add certificate to the store. By adding certificate to Computer store, any user on the computer can see the certificate. If you don t want user to be able to see / use the certificate, you must set up the permissions. Right click the certificate -> All Tasks -> Manage Private Keys... -> set the read or Full Control permissions to account you want to use this certificate. The account which is used for Long-Term Docs service must have Full control permission to this certificate Signature Attachment Dialog Open the window for attaching a signature and time stamp to a file by checking Add Digital Signature or a Time Stamp and clicking Edit Signature. 39

40 The digital signature settings window contains controls for certificate selection and for determining how to incorporate it into the document Certificate Selection Select the certificate for attaching a digital signature in section Certificate Selection in the upper part of the window. If you want to use your own certificate correctly installed in the digital certificate store, use the Select button in dialog Select Certificate to open the list of your certificates and select the one you want to use. 40

41 Attaching a Time Stamp A time stamp can be requested by checking Create a Signature with a Time Stamp. Time stamps are provided directly through the Long-Term Docs service. They are qualified time stamps within EU with a minimum guaranteed validity of 5 years Conversion According to PAdES Specification If you check Create a Signature in PAdES Format, the conversion will support electronic signature as specified by PDF Advanced Electronic Signatures (PAdES). Opening a document signed in this way in Adobe Reader allows signature validation, starting with version Adobe Reader X Additional Information In the Details section, you can enter information that led you to attaching a digital signature to the document. Use the Reason for Signing drop-down menu to state why you are signing the document. If none of the options applies to your situation, enter it manually into the field. The Location (e.g. City) field can carry information, where the document has been created (for example in which city, which company department, etc.). You can use the Contact (e.g. ) field to include an additional contact information like the electronic address of the document's author, etc. 41

42 Visualization Attaching a Graphical Image of the Signature For digitally signed PDF documents, you can select to attach a graphical image of your signature (or the company logo, etc.) and combine its use with digital certificate validation. The signature image must be created in advance and saved in a file in one of the graphical formats. To insert and place the signature image, use the Signature Visualization section of the dialog Digital Signature Settings (on lower far right). Here you can select the file with the "signature" image template, specify where to place this signature in the final document and optionally select its text accompaniment. To include a signature into a digitally signed PDF document, start by checking Display Signature Image. Then select the image file using a system dialog opened by the Browse button. In the preview window, set the location of the signature image frame by dragging it to a selected place on the page using the mouse. You can add a short text to the signature by checking the Description Text box. If you check Display Graphically the Signature Validation Result, the signature image will be accompanied by a symbol showing the digital signature validation result (for example a green tick, if everything is in order) Attaching a Standalone Time Stamp A standalone time stamp without a digital signature can be attached to the document. In the Long-Term Docs Folder Settings window, check Attach a Standalone Time Stamp and click Edit Stamp. 42

43 Set the parameters for attaching a time stamp in window Standalone Time Stamp Settings. Use the three fields in the Details group to set the reason for stamping, the location of stamping and contact information for the person who attached the stamp. All this information is optional. Use the Timestamp reason drop-down menu to state why you are stamping the document. If none of the options applies to your situation, enter it manually into the field. The Location (e.g. City) field can carry information, where the document has been created (for example in which city, which company department, etc.). You can use the Contact information (e.g. ) field to include an additional contact information like the electronic address of the document's author, etc Inserting a Image Check Add Image in the Long-Term Docs Folder Settings window to enable the Edit Image button. 43

44 Click the button to open the Edit Image window, which will allow you to place a signature or stamp image on selected pages of the final PDF document (it can be any picture, for example a company logo) and select the method of incorporating it into the document. A path to the image file with the stamp picture must be entered into the field Image file. You can either enter it directly or click Browse to locate the file using the system dialog. Use Insert image on to specify whether to put the stamp on all pages of the document or just the first or the last page, or to select any other pages. Another option is the Image Layer drop-down menu use it to decide whether to place the stamp in the top or bottom layer of the converted document. Note that some applications add a white background when printing documents or selected object this would cover the watermark placed in the bottom layer. Similarly to the watermark, you can avoid this problem by placing the stamp in the top layer, otherwise it will not be visible in the PDF. Select using the Image placement switch, where to display the stamp physically in the document: Choose the Manually place the image in the preview window on the right side, use the mouse to drag the stamp image frame to the selected place on the page. Automatically place the image at select from the list one of the preset locations. You can use the Image Size slider to change the stamp image size and set its resulting size on the page. 44

45 6. Long-Term Validity 6.1. The Duration of Maintenance and Its Parameters The questions of providing long-term document validity are addressed in window Long-Term Docs Folder Settings, section Provide Long-Term Validity. If you want to include long-term validity maintenance in the current configuration, keep the box Provide Long-Term Validity checked. Use the Maintain for field to set the time span in which the documents covered by this configuration will be treated. The default setting is 10 years. Within this time period, validity of the digital signatures and time stamps will be possible to verify. The following parameters are available for document treatment within the set time period. To set them, click Settings in the dialog Long-Term Validity Settings. To exclude documents with one or more invalid signatures from the maintenance, check Only maintain documents with ALL the signatures valid. On the other hand, if you want to maintain even the documents without any signatures, check Provide unsigned documents with a time stamp to allow their maintenance. In that case a time stamp must be available. You can assign it in the dialog opened by the Select button. The currently selected time stamp is listed before the control Document After the Maintenance Period After the maintenance period ends, the document is moved to the folder designated for storing the documents that will not be maintained anymore. 45

46 The path to the folder can be specified in field After the maintenance period, move the document to folder. You can select the folder in the dialog opened by the Browse button placed on the right from the input field If There Is an Error Maintaining the Document... If a document is still within the period set for its maintenance and a problem occurs which cannot be dealt with, there are two ways of solving this situation in the section Documents that could not be maintained: the document can be moved to a selected folder or sent by to a preset address. A document that cannot be maintained within its maintenance period is automatically moved to the folder specified in field Move to Folder. The folder can be easily selected in dialog opened by the Select button. If you check Send to , you can additionally send the file by to the specified address. Set the address in the SMTP Settings dialog which opens immediately after checking the box. Firstly, enter the address of the SMTP server used for sending in field Server Address. Enter the server's port number in Port. The default value for this type of servers is 25. You can also enter your login name (Account Name) and Password. If you do not enter these details, you will be requested to fill them in every time the application connects to the server. 46

47 7. Server Performance Monitoring 7.1. Log File Click the Display Log button on the lower right of the Long-Term Docs Service Manager window to request the log, a protocol of the server's activity. The log displays progress records of document conversion into PDF performed by the server. The records appear in the window automatically as the server continues working. A standard Windows application, Notepad, is used to display the file. Therefore you can use its functions for example the clipboard, search, font settings, etc. Each record on one page is preceded by a timestamp showing when the activity took place. The LONG-TERM DOCS.LOG file is created in the folder set in the Long-Term Docs Folder Settings window. If the log file is to be created at all, the box Maintenance Logs must be checked and the following field must contain a path to the folder where to create the file Maintenance Script Check Run the Maintenance Script to run a VBS maintenance script in the interval set in the field on the right. More information can be found in file Maintenance.vbs. 47

48 48 Admin Guide

49 8. Microsoft Office and Open Office Document Conversion This function might, in some cases, require for the service some additional permission settings to the individual COM objects of the applications. If these permissions are not set, problems might occur when converting some formats. The error will show as VBS script error (the script type varies with the type of the document being converted) An Example of DCOM Object Settings This description will use the configuration of a Word Document object as an example (the process is identical for other MS Office applications, the examples shown here apply to Microsoft Server 200x and MS 7 operating system). Run the dcomcnfg.exe tool (e.g. from the command line). To open the component service console using the following steps: start -> run -> dcomcnfg -> OK open the Component Services menu -> Computers -> My computer and click on the DCOM Config tab (do not open it, just select). Select the Details button on the toolbar and the right menu will display a list as shown on the image above. Select the application you want to configure. If the program you want to set up is not displayed on the list, you can find it by the following method: For 64bit programs on 64bit system or 32bit programs on 32bit system: start -> run -> mmc For 32bit programs on 64bit system: start -> run -> mmc -32 ctrl + m -> select Component Services item on the left -> Add -> OK follow the instructions above 49

50 The configuration will be shown on the example of Word Document object (the same procedure can be used for any other MS Office Application). DCOM object of the Word application is called Microsoft Office Word Document. If this object is not available, it has probably not been registered yet. Usually it suffices to run the MS Word application and exit it, then restart the server. If the object is still not displayed then, another option is to look it up in the registry using the CLSID of the Word application. The setup then applies to a DCOM object with a similar CLSID. For successful conversion using dedicated application you must set up the identity for application to the same account, which you are using in Long-Term Docs manager as a service account. In case you change the service account, you need to update all DCOM objects identities to new account. Warning: This settings change the launching identity for selected application for every user on this computer. It is suggested to install and use this software as dedicated for Long-Term Docs. Typically settings must be applied to allow conversion of MS Word documents, MS Excel and MS PowerPoint. 50