Datasheet FUJITSU Security Solution Compliant Archiving SecDocs V2.3 An archiving middleware based on open standards which preserves the evidentiary value powered by OpenLimit Digital Long-Term Archiving Archiving documents in digital fmats offers many benefits in comparison to paper-bound archives. Stage is very cost-efficient, and digital documents can be transferred both faster and cheaper. Digital documents do not suffer from physical aging which can render documents unreadable due to paper ink decomposition. Digital archives must fulfill two basic requirements in der to be able to fully replace paper bound archives. First, document fmats need to be guaranteed and stable, to be independent from some particular software f reading. Using standardized fmats like PDF/A and TIFF is a widely accepted choice to fulfill this requirement. In addition, it must be possible to assert that a document has not been modified, and that signatures in the document are authentic. Digital signatures and tamper-proof stage media provide protection, but only f a limited period: Media have a limited lifetime, and digital signatures get weaker over time due to technical progress.. Preserving the Evidentiary Value This is where SecDocs comes into play: It allows archiving documents in a fmat which retains the evidentiary value f arbitrary long retention periods. SecDocs is based on results of the research projects ArchiSig (digital oversigning) and ArchiSafe (secure long-term stage) which have been funded by the German Department of Commerce and which are now part of the Technical Directive TR-03125. SecDocs is designed as a middleware component which is used over Web Services (SOAP V1.1). This allows an easy integration into existing IT architectures and processes. As a stage system SecDocs can use ETERNUS CS8000 systems with ViNS NetApp s NAS filer, the SoftWORM feature SnapLock can provide additional protection against accidental intentional manipulation of documents in the archive. The security kernel of SecDocs is provided by OpenLimit, an internationally leading provider of certified software f digital signatures. This component was certified by the German Bundesamt für Sicherheit in der Infmationstechnik (BSI) accding to Common Criteria level EAL4+. The security target is based on the Protection Profile f ArchiSafe-compliant Middleware, but also includes elements from the technical directive TR-03125 (Preserving Evidentiary Value of Cryptographically Signed Documents). Page 1 of 5
Features and benefits Main features Permanent Protection of Document Integrity Documents are sealed with digital time-stamps Digital signatures f the document are verified Preservation of evidentiary value due to oversigning Interfaces and Open Standards Both archiving and administration is perfmed with SOAP V1.1 web services Access over HTTP(S) Proof of document integrity is done with RFC 4998 compliant evidence recds Documents are sted as XML files Benefits Ptable proof of document integrity, independent of stage location Permanent proof of authenticity, even if cryptographic certificates are no longer valid available Easy integration into existing IT landscape Can be implemented as a Cloud service Document integrity can be verified outside the archive from a copy of the document and a copy of the evidence recd Document types and metadata can be designed as desired Role Concept and Multitenancy Many tenants can use the same archive, completely segregated from each other Permissions f archiving operations can be freely assigned to different roles The archive can be implemented as a central service f several different IP processes Different tasks and responsibilities can be assigned to different business processes Price Concept pay per use License fees depend on number of documents in the archive Certified Security Kernel The components f signature verification and sealing is certified against Common Criteria EAL4+. New in SecDocs V2.3: Archiving big objects Transfer and sealing of objects up to 50GB Extension of use is possible at any time Security certified by BSI Archiving of media data (audio, video) and container objects Page 2 of 5
Topics Functional Overview SecDocs archives any type of documents, sealing them with a time stamp which is digitally signed by a time stamping authity. There is no need f a secret key within SecDocs which would need to be protected from unauthized access. F archived and sealed documents, the proof that they have not been tampered with can be perfmed at any time. The use of time stamps instead of conventional digital signatures allows an over-signing as proposed in the ArchiSig concept, preserving the evidentiary value. The security margin of all cryptographic algithms diminishes over time, due to increasing CPU power cryptographic research. This leads to a situation, where digital signatures are no longer tamper-proof. By over-signing the documents with a new time stamp the documents can be re-sealed, befe the iginal time stamp could be fged. The resulting chain of time stamps can be used to prove that every sealing was perfmed at a point in time where the algithm used was sufficiently secure. SecDocs delivers added value f documents which have been digitally signed, too. The algithms used f digital signatures are subject to aging as well and are getting weaker over time. By verifying the signatures while accepting documents f archiving and sealing the verification repts together with the documents, SecDocs preserves the proof of authenticity of digital signatures f the whole retention period. SecDocs stes the time stamps in a standardized fmat of Evidence Recds (RFC 4998). Using an evidence recd, the integrity of a document can be proven independently of the stage location (e.g. on media which are protected against overwriting). A document and the cresponding evidence recd can be retrieved from the document and fwarded to third parties. Even without access to the archive, and without examining the security management of the archive, the third party can verify the integrity of the document since the time of the first sealing, using just the document and the evidence recd. Interfaces and Open Standards SecDocs is an autonomous component, designed to be used over the net and integrated into existing IT processes. Usage f archiving and sealing of documents, and the administration during operation are perfmed over web services interfaces (SOAP 1.1). High availability and higher archiving throughput can be achieved by connecting me than one server to the same archive. The archived documents are sted on a NFS file system, the WORM feature NetApp SnapLock can optionally be activated. F an efficient management of internal data SecDocs needs a data base (Oracle 11g Release 2 MySQL as of version 5.5). The operation of SecDocs with web services and the HTTP(S) transpt protocol enable SecDocs to perfm as a central archiving service. The SOAP applications can be running on the same server, within the same internal netwk, they can be distributed wld-wide. An authentication function makes sure that only authized users have access to a SecDocs archive. To archive documents in SecDocs, customer specific XML schemas can be registered. Every incoming document is validated against the registered schemas, during this process customer-specified elements are evaluated (meta data, digital signatures). Binary content, e.g. PDF-A files, can be embedded in Base64-encoding. SecDocs detects any digital signatures which are embedded in PDF documents, these are validated in the same way as attached signatures. F searching within the archive, SecDocs provides SPARQL, a standardized query language which is designed f web services. Role Concept and Multitenancy In one SecDocs archive, documents of several tenants can be archived, totally segregated from each other. F every tenant, there is a role of an administrat, who e.g. can register document types, and define different ganizations with separate archiving locations. Within each ganization, the operations of the archiving service can be freely distributed to different roles, allowing f example to assign a special role f deleting documents from the archive. Transparentes Pricing concept: Pay per use The licensing scheme f SecDocs reflects the active usage of an archive, counting documents when they are added. Therefe, extending the use f new ganisatiions processes is easily possible. On the other hand, running expenses are reduced if no new documents are added to the archive, even if the current set of documents remains accessible. Certified Security Kernel The security kernel of SecDocs is certified based on the Common Criteria Protection Profile f an ArchiSafe Compliant Middleware f Enabling the Long-Term Preservation of Electronic Documents accding to EAL4+. Certificates issued by the German Bundesamt für Sicherheit in der Infmationstechnik (BSI) are recognized internationally and assert the confmance with the protection profile. Page 3 of 5
Technical Details Technical Requirements Hardware Server Process RAM Stage Stage requirement after installation Technical Requirements Software Operating System Data base Interfaces Archiving Document Types Administration Suppted Algithms Documentation x86 Server, 64 Bit At least 2GHz At least 16GB NetApp NAS filer, optionally with SnapLock ETERNUS CS8000 with ViNS 1.5GB (without data base) Red Hat Enterprise Linux 6 update 5 64 Bit (AMD64/x64) newer SuSE SLES 11 SP3 64bit (AMD64/x64) newer Oracle 11g Release 2 Standard Edition Enterprise Edition MySQL as of version 5.5.40 Web services with SOAP 1.1 over HTTP(S) Any, per customer specified XML schemas Web services with SOAP 1.1 over HTTP(S) Hash Algithmen SHA-1 (no longer suited f QES), SHA-224, SHA-256, SHA-384, SHA-512, RIPEMD-160 1 (no longer suited f QES) Signature Types CMS, PKCS#7, PKCS#1, DSA, ECDSA, XML-DSIG, Timestamps Padding Methods PSS-Padding, PKCS#1 Version 1.5, DinSig-Padding http://manuals.ts.fujitsu.com/ SecDocs V2.3 User Guide SecDocs V2.3 Installation Guide SecDocs V2.3 Return Values OpenLimit Middleware V3 Server Administration Guide OpenLimit Middleware V3 Server Additional Infmation OpenLimit Middleware MigSafe/OverSign Return Values Conditions Ordering and Delivery This software product is supplied to the customer under the conditions f the use of software products against installments a single payment This software product can be obtained from your local Fujitsu regional office. Page 4 of 5
Me infmation Fujitsu products, solutions & services Products www.fujitsu.com/global/products/ In addition to Compliant Archiving, Fujitsu offers a full ptfolio of other computing products: Stage systems: ETERNUS Server: PRIMERGY, PRIMEQUEST, Fujitsu SPARC M10, BS2000 Mainframe Client Computing Devices: LIFEBOOK, STYLISTIC, ESPRIMO, FUTRO, CELSIUS Peripherals: Fujitsu Displays, Accessies Software Netwk Solutions http://www.fujitsu.com/global/solutions Infrastructure Solutions are customer offerings created by bringing Fujitsu s products, services and technologies together with those from partners. Industry Solutions are tailed to meet the needs of specific verticals. Business and Technology Solutions provide a variety of technologies developed to tackle specific business issues such as security and sustainability, across many verticals. Services www.fujitsu.com/global/services/ Application Services suppt the development, integration, testing, deployment and on-going management of both custom developed and packaged applications. Business Services respond to the challenge of planning, delivering and operating IT in a complex and changing IT environment. Managed Infrastructure Services enable customers to deliver the optimal IT environment to meet their needs. Me infmation To learn me about Fujitsu, please contact your Fujitsu sales representative, Fujitsu business partner, visit our website. www.fujitsu.com/compliant Archiving Fujitsu green policy innovation www.fujitsu.com/global/about/environment/ Fujitsu Green Policy Innovation is our wldwide project f reducing burdens on the environment. Using our global knowhow, we aim to resolve issues of environmental energy efficiency through IT. Please find further infmation at: Copyright 2015 Fujitsu Technology Solutions GmbH Fujitsu, the Fujitsu logo and SecDocs are trademarks registered trademarks of Fujitsu Limited in Japan and other countries. Disclaimer Technical data subject to modification and delivery subject to availability. Any liability that the data and illustrations are complete, actual crect is excluded. Designations may be trademarks and/ copyrights of the respective manufacturer, the use of which by third parties f their own purposes may infringe the rights of such owner. Contact Fujitsu Technology Solutions GmbH Mies-van-der-Rohe-Straße 8, 80807 München Website: www.fujitsu.com/fts 2015-04-10 EN Page 5 of 5