GM/T 0120-2022Implementation guidance for electronic signature service based on cloud computing (English PDF)

1 Scope

This document provides reference routes and methods for implementing electronic signature services based on cloud computing.

This document is applicable to the construction of electronic signature service systems based on cloud computing and the development of related products. It can be used as a reference for the testing and management of electronic signature service systems based on cloud computing.

2 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

GB/T 15843.3, Information technology -- Security techniques -- Entity authentication - Part 3: Mechanisms using digital signature techniques GB/T 15843.4, Information technology -- Security techniques -- Entity authentication - Part 4: Mechanisms using a cryptographic check function GB/T 20518, Information security technology -- Public key infrastructure -- Digital certificate format GB/T 25064, Information security technology -- Public key infrastructure --Electronic signature formats specification GB/T 25069, Information security techniques -- Terminology GB/T 25070, Information security technology -- Technical requirements of security design for classified protection of cybersecurity GB/T 31168, Information security technology -- Security capability requirements for cloud computing services GB/T 32905, Information security techniques -- SM3 cryptographic hash algorithm GB/T 32907, Information security technology -- SM4 block cipher algorithm GB/T 32918.2, Information security technology -- Public key cryptographic algorithm SM2 based on elliptic curves - Part 2: Digital signature algorithm GB/T 35275, Information security technology -- SM2 cryptographic algorithm encrypted signature message syntax specification GB/T 35276, Information security technology -- SM2 cryptography algorithm usage specification GB/T 36326, Information technology -- Cloud computing - General operational requirements of cloud service GB/T 37092, Information security technology -- Security requirements for cryptographic modules GB/T 38636, Information security technology -- Transport layer cryptography protocol (TLCP) GB/T 39786, Information security technology -- Baseline for information system cryptography application GM/T 0109-2021, Technical requirements for electronic signature service based on cloud computing GM/Z 4001, Cryptography terminology

3 Terms and definitions

For the purposes of this document, the terms and definitions defined in GB/T 25069, GM/T 0109-2021, GM/Z 4001 as well as the followings apply.

4 Abbreviations

The following abbreviations apply to this document.

API. Application Programming Interface CA. Certificate Authority CPU. Central Processing Unit HTTPS. Secure Hypertext Transfer Protocol IMEI. International Mobile Equipment Identity IMSI. International Mobile Subscriber Identity IPSec. IP Security JSON. JavaScript Object Notation KEK. Key Encryption Key OTP. One Time Password PIN. Personal Identification Number SDK. Software Development Kit SMK. System Main Key SSL. Secure Socket Layer TLCP. Transport Layer Cryptography Protocol USK. User Signing Key VPN. Virtual Private Network

5 General

The electronic signature service based on cloud computing can be planned and implemented according to the network security level protection requirements of the relevant business systems and the requirements of GM/T 0109, and in accordance with the requirements of GB/T 39786 for the corresponding levels of physical and environmental security, network and communication security, equipment and computing security, and application and data security.

a) Choose a suitable physical location. Follow GB/T 25070 to build an infrastructure that matches the business security level. The infrastructure includes capabilities for physical and environmental security protection, meets the physical and environmental requirements of GB/T 39786, and provides the required cryptographic support capabilities for electronic signature service activities. If the electronic signature service provider uses physical and environmental facilities provided by a third party, it can be required to comply with the requirements of GB/T 39786 that are consistent with the network security level required by the business.

b) Through network partitioning and network protection technology, deploy firewalls, intrusion detection network protection, network isolation and other technologies or products. Take security control and access measures that match the business security level for different partitions. At the same time, take corresponding boundary protection and other mechanisms to meet the requirements of GB/T 39786 for network and communication security. If the electronic signature service provider uses network facilities provided by a third party, it can be required to meet the requirements of GB/T 39786 that are consistent with the network security level required by the business.

c) The requirements of GB/T 39786 for equipment and computing security are met through security management and security operation and maintenance support. If the electronic signature service provider uses equipment and computing environment provided by a third party, it can be required to comply with the requirements of GB/T 39786 that are consistent with the network security level required by the business.

d) Design, deploy and operate cloud-based signing service. Cloud-based signing service works with signer and relying party to complete cloud-based electronic signature activities.

1) Cloud-based signing service uses various cryptographic modules, cryptographic products and cloud computing technologies to provide electronic signature functions supporting multiple business systems and multiple users, as well as supporting key management functions, as an independent operator outside of the signer and relying party. All service-related systems comply with the application and data security requirements of GB/T 39786;

2) In cloud-based electronic signature activities, the signer entrusts the electronic signature function or part of the electronic signature function to the cloud-based signing service, and the signer uses the terminal, application or application system to control and confirm the process of making the electronic signature;

3) The relying party conducts subsequent business operations by judging the validity of the electronic signature and related data provided by the signer or cloud-based signing service.

e) Provide operation management, operation and maintenance support and security auditing that match the service. Through the security management and maintenance of personnel, equipment, systems, etc. and the security auditing of various system logs, it complies with the requirements of GB/T 39786 security management. See Chapter 9 for specific implementation methods.

f) Publish its service quality, service level and service security statement to relevant parties. Accept testing, certification, supervision and third-party audits from relevant national departments.

6 Reference architecture

The overall architecture of the cloud-based signing service can be found in Figure 1.

In the electronic signature service based on cloud computing, the cloud-based signing service uses various infrastructures and various third-party supports to provide electronic signature functions and provide security management and policy management that match the service. As users of the system, the signer and the relying party use the functions provided by the cloud-based signing service to perform electronic signatures. Unlike traditional electronic signatures, the cloud-based signing service must have the characteristics of serving multiple tenants at the same time, sharing cryptographic resources, and horizontal expansion. The specific implementation methods are as follows.

a) Cloud-based signing service uses cloud signature infrastructure to provide electronic signature functions and related user management and key management functions through the service system, while providing operation management, security audit and operation and maintenance support that are consistent with the service level and capabilities;

b) The signer application connects to the cloud-based signing service to complete the electronic signature function through the programming API interface, communication protocol or signature module, and signature application provided by the cloud-based signing service;

c) The business system of the relying party participates in various processes related to electronic signatures through the programming API interface, communication protocol or access system provided by the cloud-based signing service, and completes the coordination functions required for the electronic signature function;

d) Cloud-based signing service can use cloud computing infrastructure, cloud architecture and cloud computing technology to enable the service to have features such as cryptographic resource sharing and horizontal expansion, and support services for multiple tenants at the same time. Cloud-based signing service can support the collaborate signature mode described in GM/T 0109-2021, or the delegated signature mode, or other signature modes;

e) In the process of providing services to the outside world, the cloud-based signing service can use various third-party services as the support of the electronic signature service. For example, the cloud-based signing service can issue digital certificates and provide various certificate services to users and business-related parties in the cloud-based signing service through a third-party electronic certification authority (CA).

7 Cloud signature infrastructure

Cloud-based signing services can deploy network infrastructure, cloud computing infrastructure, cryptographic computing resources and other infrastructures in accordance with the level requirements specified in GB/T 25070 that match the business and the business's design requirements for service capabilities and quality. The deployed infrastructure must support horizontal expansion and elastic services.

When deploying cryptographic computing resources, the cloud-based signing service can use server cryptographic machines, signature verification servers, timestamp servers, collaborate signature mechanism systems, cloud service cryptographic machines, SSL VPN, cryptographic modules or cryptographic systems that meet the requirements of 8.2 of GM/T 0109-2021 to meet the cryptographic requirements related to electronic signatures. The horizontal expansion of cryptographic capabilities can be supported by forming a cryptographic resource pool with multiple cryptographic devices.