GM/T 0109-2021Technical requirements for electronic signature service based on cloud computing (English PDF)

5.2 Service mode

Depending on the business scenario, the cloud-base signing service can provide services to the outside in different modes. Common service modes are as follows.

--- Collaborative signature mode: refers to the signer and the cloud-base signing server-side each saving a part of the key component, and generating the final signature result through cryptographic protocol interaction. See A.1 for details.

--- Proxy signature mode: refers to the signer hosting the key on the cloud-base signing server-side, and authorizing the cloud-base signing server-side to complete the signing operation for it when an electronic signature is required. See A.2 for details.

7.1 General requirements

Signers can use cryptographic modules to complete the cryptographic functions required for electronic signatures based on cloud computing. If a cryptographic module is used, the module shall pass the commercial cryptographic test and certification, meet the requirements of the security level matching the business in GB/T 37092; and support the requirements of 7.2~7.6.

7.2 Local data protection

Signers shall protect the integrity and confidentiality of local key configuration data and sensitive data.

7.3 Identity authentication

When the signer communicates with the cloud-base signing service, it shall support the authentication of the cloud-base signing service identity and declare its own identity in accordance with the access requirements of the cloud-base signing service.

7.4 Communication data protection

When the signer communicates with the cloud-base signing service, it shall protect the communication data in accordance with the access requirements of the cloud-base signing service.

7.5 Key management

When using the collaborative signature mode for electronic signature, the signers shall support the generation of the client component of the signature key within the cryptographic module, and support the storage and secure use of the key component.

7.6 Confirmation and control of electronic signatures

During the electronic signature process, the signer shall confirm the relevant data of the electronic signature and control the signing process through interaction. If the content confirmation and signature interaction adopt the cryptographic module, the following requirements shall be met:

a) It shall support the identification of the source of the received electronic signature request and the confirmation of the integrity of the electronic signature message content;

b) When the collaborative signature mode is adopted, it shall ensure that the customer end signature behavior matches the server-side signature behavior; for example, by verifying the signature to confirm whether the collaborative process is completed normally.

a) The digital signature algorithm shall adopt the SM2 elliptic curve public key cryptographic algorithm, which meets the requirements of GB/T 32918 and GB/T 35276;

b) The data integrity protection during the electronic signature process shall adopt the SM3 cryptographic hash algorithm specified in GB/T 32905;

c) The data confidentiality protection during the electronic signature process shall adopt the SM4 block cipher algorithm specified in GB/T 32907.

8.3.1.2 Requirements for electronic signature format

The electronic signature data generated by the cloud-base signing service shall meet the requirements of GB/T 25064 or GB/T 35275. For electronic signatures that need to be stored for a long time, the electronic signature shall contain the timestamp and certificate status information at the time of signing, such as CRL, OCSP response information, etc.

8.3.1.3 Requirements for digital certificate

If the electronic signature requires third-party authentication, the electronic signature service based on cloud computing shall use a digital certificate issued by a legitimate third-party electronic certification agency. The cloud-base signing service can be connected with the CA to manage user digital certificates. The digital certificate format shall comply with GB/T 20518.

8.3.2.1 User registration

The cloud-base signing service shall support the signer user to register with the cloud-base signing service. If there is a scenario where the relying party initiates the signature, the relying party user shall be supported to register with the system. The specific requirements are as follows:

a) When the signer user registers, the cloud-base signing service shall provide the signer user registration entrance and support the user to submit the registration information through the registration entrance;

b) When the relying party user registers, the cloud-base signing service shall provide the relying party user registration entrance and support the relying party to submit its registration information.

8.3.2.2 User review

The cloud signature service shall review the registered signer user or relying party user information to confirm whether it meets the policy requirements of the cloud-base signing service.

8.3.2.3 User activation

When the user activates, the cloud-base signing service shall generate a key for electronic signature for the signing user. The process requirements for generating the key are detailed in 8.3.3.2. In the collaborative signature mode, the cloud-base signing service shall negotiate the key with the signer to generate the user's signature public key. After the user activates, the user can use this key to apply for a digital certificate from a third-party electronic certification agency.

8.3.2.4 User information maintenance

The cloud-base signing service shall support users to query, maintain and manage their own information independently.

8.3.2.5 User logout

The cloud-base signing service shall support user logout.

8.3.3.1 Overview

The cloud-base signing service shall provide signature key management functions that match the business security level requirements in GB/T 39786, including key generation, key storage, key use, key backup/recovery, key destruction and other processes, as well as key migration required during operation and maintenance; and meet the requirement that the key is only controlled by the signer during the electronic signature process.

8.3.3.2 Key generation

When the cloud-base signing service generates a key for a user, it shall first perform identity authentication based on cryptographic technology on the user; and confirm whether the user operation is allowed through access control, and generate a key for the user after confirmation.

The cloud-base signing service shall ensure the isolation of key generation processes, record the key generation process in the log, and generate audit information. The audit information shall include the subject of key use, the time of use, etc. The log and audit information shall be tamper-proof, non-deletable, and non-forgeable.

For signatures in different signature modes, the key generation shall meet the following requirements.

a) For collaborative signature mode, the cloud-base signing service shall generate the server key component for the user in the cryptographic device. In the process of generating the key, it shall be ensured that the key and the key component do not appear in plain text in the memory or network of non-dedicated cryptographic devices.

b) For proxy signature mode, the cloud-base signing service shall generate the signature key for the user in the cryptographic device.

access control.

8.3.3.6 Key backup and recovery

The electronic signature service based on cloud computing shall formulate a clear key backup strategy and adopt a safe and reliable key backup and recovery mechanism to back up or restore the key. Among them, the backup and recovery of the system key shall comply with the requirements of GB/T 25056. The ciphertext of the user signature key can be performed by database backup/recovery. Key backup or recovery shall be recorded and audit information shall be generated. The audit information shall include the subject of the backup or recovery, the time of the backup or recovery, etc.

8.3.3.7 Key destruction

If the user chooses to terminate the cloud signature service, it shall support the destruction of the user key or the server-side component of the user key. Key destruction shall comply with the requirements of GB/T 25056.

8.3.4.1 Overview

After the user generates a key and obtains a digital certificate, the cloud signature service shall support the function of providing electronic signatures in the form of cloud services. The cloud signature service receives the electronic signature request initiated by the signer or the relying party, and after identification and confirmation, it is carried out under the confirmation and control of the signer. The electronic signature function shall ensure that the user has sole control over the signature key.

8.3.4.2 Identification of signature requests

After receiving the signature request, the cloud signature service shall identify the source of the request. The specific requirements are as follows:

a) For signatures initiated by the relying party, the identity of the relying party shall be confirmed by verifying the digital signature and digital certificate; and the integrity of the request should be verified;

b) For requests initiated by the signer, the identity of the signer shall be identified and verified; and the integrity of the signature request shall be verified.

8.3.4.3 Requirements for the electronic signature process

The electronic signature service process shall use the user key server component or the complete user key to sign and return in the agreed format:

a) For the collaborative signature mode, the user's signature key server component shall be used for signing in accordance with the requirements of a) in 8.3.3.4, and meet the requirements of c), d), and e) in 8.3.3.4;

b) For the proxy signature mode, the user's signature key shall be used for digital signing in accordance with the requirements of b) in 8.3.3.4, and meet the requirements of c), d), and e) in 8.3.3.4.

8.3.4.4 Security control of the signature process

During the electronic signature process, the cloud signature service shall provide users with various security control measures.

a) In the collaborative signature mode, the collaborative signature process shall be securely controlled. The security control methods include but are not limited to:

1) The cloud signature service sets an error counting mechanism and an error counting upper limit for the signature behavior of the signer. When the user's signature error reaches the error counting upper limit, the electronic signature service shall be stopped; and an error counting clearing mechanism shall be provided;

2) The cloud signature service shall have the ability to identify the replay and tampering of the customer's partial signature results.

b) In the proxy signature mode, the security control of the signer's identity authentication and signature authorization process shall be supported. The security control methods include but are not limited to:

1) The cloud signature service sets an error counting mechanism and an error counting upper limit for the signer's identity authentication and signature authorization behavior; and stops providing electronic signature services when the authentication and authorization errors reach the error counting upper limit; and provides an error counting clearing mechanism;

2) The cloud signature service shall have the ability to identify the replay and tampering of authentication and authorization data.

8.3.5 Data security requirements

The cloud signature service shall use cryptographic technology to securely protect user data involved in cloud signature activities; and shall meet the requirements of 7.4 of GB/T 39786-2021 that match the business security requirements and the requirements of GB/T 31168, and meet the following requirements:

a) Cryptographic technology shall be used to desensitize sensitive data such as personal information;

b) Data security isolation shall be supported, such as encryption with different keys;

c) The integrity of various log data of the system shall be protected to ensure that the log data cannot be tampered with, deleted, or forged.

8.3.6.1 Access identity authentication

After receiving the service request, the cloud signature service shall authenticate the identity of the requester. The cloud signature service shall support different identity authentication mechanisms for the requests of the signer and the relying party, and the identity authentication may adopt the mechanism specified in GB/T 15843.

8.3.6.2 Access control

The cloud signature service shall set access control policies, user status and permissions, and determine how to respond to requests based on different request types and different request sources.

8.3.6.3 Data transmission requirements

The cloud signature service shall use a secure channel to communicate with visitors, such as the transport layer cryptographic protocol defined in GB/T 38636. The secure channel shall protect the confidentiality and integrity of the communication content.

8.3.6.4 Request processing and response

The cloud signature shall be processed accordingly based on the request type and different request sources. The request type shall include but is not limited to user management, key management and electronic signature, etc., and its specific requirements are shown in 8.3.2, 8.3.3, and 8.3.4.

8.4.1 Security operation requirements

The cloud signature service provider shall plan and manage the service-related personnel, processes, resources, technologies and other factors, as well as the related sites, networks, data and other aspects in accordance with the requirements of GB/T 36326. Including:

a) Service capabilities, service quality, and service security capability baselines shall be defined and service statements shall be published to relevant parties;

b) It shall be ensured that administrators cannot use user keys during the signing process and related processes.