GB/T 42745-2023Information and documentation - Trusted third party repository for digital records (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1.Structure and Drafting Rules of Standardization Documents"

Drafting.

This document is equivalent to ISO 17068.2017 "Trusted third-party digital file (archives) warehousing of information and documents".

Please note that some content in this document may be subject to patents. The publisher of this document assumes no responsibility for identifying patents.

Introduction

As an inevitable outcome of digital systems in various business activities, digital files increasingly need to ensure their authenticity within the storage period.

sex, and be recognized by law. The international community agrees that "digital files should not be deprived of legal recognition simply because their format is digital."

legitimacy and authority"1). Nonetheless, it is difficult for an organization to self-certify the authenticity of its digital files over time.

nature, therefore it cannot be used as effective evidence to support relevant business activities. In many cases, the data managed in an organization's file system

Word documents cannot be legally recognized. Therefore, human society increasingly needs warehousing services provided by neutral third parties to ensure

To ensure the authenticity of digital files.

In order to avoid business disputes arising from factors such as tampering with digital files, it is necessary to ensure that digital files are stored within the legally valid storage period.

Ensure the authenticity, reliability, integrity and availability of digital files.

Digital signatures are a common means of determining whether a digital file has been tampered with. However, digital signatures can only be valid for as long as they are valid (usually one to two years)

or shorter) to ensure the integrity of the information. Therefore, for file systems, when the custody period is longer than the validity period of the digital signature, it is difficult to prove

Integrity of digital files.

It is defined as a qualified third-party custody service to ensure that the client's digital files are kept legally and reliably. The purpose of TTPR is to

Provide trusted custody services for managed digital files to the client during the custody period. These services are provided by stakeholders (inspectors, auditors,

assessor, etc.) for regulatory review. The services provided by TTPR help to verify whether the digital files of the entrusting party can be used as acceptable evidence.

source.

The term "documents" in this document 2) is equivalent to the documents and archives of government agencies, units or organizations in the Chinese context.

Chapter 4 is an overview of TTPR, including the necessity of TTPR, credibility requirements, TTPR characteristics and the basic principles of its components.

Chapter 5 details the services provided by TTPR to the client's digital files during the storage period.

Chapter 6 details the technical requirements for hardware and software systems.

Chapter 7 details the operational process requirements.

1) Chapter 3, Article 8 of the.2007 UNCITRAL United Nations Convention on the Use of Electronic Communications in International Contracts.

2) According to the actual situation of China's archives work, "records" is translated into "documents", which is equivalent to the documents and archives of government agencies, units or organizations in the Chinese context (excluding

Archives collection), the title uses "documents (archives)" to facilitate retrieval and maintenance of "records" in the international standard series of document (archives) management

The original intention is to facilitate the maintenance of the consistency of the use of national standards that have been adopted and the wider promotion and application.

Trusted third-party digital files for information and documents

(archive) warehousing

1 Scope

This document sets out clear requirements for the authorized custody services of trusted third-party repositories (TTPR) to ensure the authenticity of the client's digital files.

validity, reliability, completeness and availability.

This document applies to custody and warehousing services of digital files as evidence sources within the legally obligated retention period in the private and public sectors.

This document is only used for authorized custody services of digital files between trusted third-party warehousing and entrusting parties.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations

For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to

this document.

Note. GB/T 34110-2017 Information and documentation management system foundation and terminology (ISO 30300.2011, IDT)

Note. GB/T 34112-2022 Information and documentation (archives) management system requirements (ISO 30301.2019, IDT)

Note. GB/T 41207-2021 Information and Documentation (Archives) Management System Implementation Guide (ISO 30302.2015, IDT)

3 Terms and definitions

The following terms and definitions apply to this document.

3.1

Document used to verify digital files in trusted third-party repositories.

3.2

authenticatedcopy

A digital copy of a digital file (3.5) whose authenticity has been verified.

3.3

Client

A person or organization that has entered into an agreement with a trusted third-party repository (3.15).

3.4

Client system clientsystem

The client uses the hardware and software required for the services provided by a trusted third-party warehousing (3.15).