IDnomic Signature Appliance Secure your transactions with electronic signatures In environments that require a high level of trust, advanced or qualified electronic signatures are highly advised. They ensure a document’s integrity in paperless transactions and provide proof of acceptance by the signer. Quickly deploy your digital Remote signature: Ensure trust in your exchanges signature project with an appliance a solution for mobile users Electronic signatures can support The deployment of a digital signature project Signing documents should be as easy organizations in their compliance journey can be complex with various integration as a hand-written signature. A remote with eIDAS regulation. While securing constraints to handle. The Signature signature functionality enables the user to document and data exchanges, electronic Appliance facilitates the implementation electronically sign documents anywhere and signatures also contribute to reducing of digital signature within document from any device. processing costs, such as printing and workflows. Users can keep using their archiving, and to enhancing productivity with existing document workflow management Atos offers a server-based solution where dematerialized processes. application and add electronic signature signing is done remotely with strong processes without any discontinuity. private key management. After a secure Electronic signatures guarantee the integrity authentication (for instance, with a smart of documents and identify the signers. Once The Signature Appliance uses signature card), the user can apply a signature made in a signer has produced a signature and the certificates generated by the Atos PKI a tamper-proof environment. signature has been verified, the signature is solutions or other PKI products. The secure and may no longer be repudiated. signature private key and the signature The server is accessed by third-party certificate are stored: software through documented Web services Each signer (e.g. a user or an application) • In an HSM for seal signature. (SOAP or REST). For the end user, an uses a signature key pair (a public key and application using these Web services can • Enciphered in the database for other uses a private key) and a public key certificate be deployed and customized to offer user- cases. The enciphered keys are securely generated by a certificate authority (CA). friendly interfaces, similar to a Web portal. imported to an HSM, which provides a tamper-proof environment. An administration interface is provided for configuring applications and signature policies. The server can be used to sign in the name of an entity or to sign in the name of a physical person with centralized and secure signature keys management. Simplify your product Choose the right level of digital signature deployment using appliance Two deployment models are available for In a centralized environment, a mechanism The Signature appliance helps organizations specific use cases: basic/advanced and qualified. must be implemented to verify that only deliver their projects quickly and cost- the owner of a sensitive key will activate efficiently, as: Before launching a project, users need to identify cryptographic operations on that key. The 1. Pre-defined configuration is which applications should have the most secure User Explicit Consent appliance defines implemented: the appliance model is electronic signatures (qualified signatures) and secure mechanisms attached to the digital delivered with a standard configuration the ones where a basic or advanced signature keys that have to be activated and controlled that can be used in most use cases, is sufficient. before the key usage approval. with no extra time in specifications or integration, The signature appliances are fully compliant As a “Signature Activation Module” in ETSI 2. The product is delivered in a with eIDAS regulation for the creation of qualified standards naming, the User Explicit Consent unique with digital signatures. To achieve this compliance, appliance offers recognized capacities of hardware pre-configured and , the signature solution for natural persons remote qualified signature. Atos is engaged in features database is connected to the User Explicit Consent a “Qualification Elémentaire” process with the 3. Minimal configuration is done at first run appliance to ensure that a signature key is solely ANSSI for this appliance. to make the appliance ready to use. controlled by its owner. The system maintenance and support are simplified as the appliance is an all-in-one solution facilitating the tasks that can be complex and time-consuming in a classic implementation due to tailored configurations (VMs, servers, HSM...). Define who should be engaged Electronic signatures are applied to cross- • People signature: different people can • Explicit Consent Manager (ECM): for department applications (billing workflows, request personal signatures once they eIDAS qualified signature, sole control commercial contracts, payroll…) and can be have been pre-registered and a signature by the user of a private key must be adapted to different setups (decentralized/ digital identity has been enrolled for them. guaranteed. A specific hardware-based centralized; natural person/legal person, – User centralized signature with remote solution, the ECM, is used to manage seal). With the signature of the person, the access to the server the consent of the user in addition to a signatory personally commits to the signed – Users signature private keys are metasign-server. This solution does not data. With a seal, the signature is made on managed in the HSM (enrollment phase allow the use of the private key before behalf of an organization or a legal person. and signature) having activated it via an OTP or a Fido – Password management to protect the authentication. It acts as a Signature Different configurations are available with the user against misleading use of their Activation Module in ETSI terminology of Signature Appliance: private key CEN 419 241-2 (protection profile for QSCD for Server Signing). • Seal signature: for the delivery of seal signatures on behalf of a company or a legal entity. – Centralized signature for an application or “electronic seal” – Seal keys are maintained in the HSM – Key Ceremony for certificate creation A model tailored to your needs Atos provides a wide range of trust • A basic model with only one service • A high-availability model deploying infrastructure appliances (PKI, digital embedded in an HSM. This model is fully several appliances to ensure business signature, user explicit consent, time adapted to the Root CA appliance as it is continuity with a centralized database. stamping, blockchain) and offers different autonomous and does not depend on the models adapted to the infrastructure’s needs: infrastructure. • A multi-services model, enabling the combination of many services in an HSM such as electronic signature or timestamping together with PKI. 02 Get a greater control over the security of the information system and independence from “as-a-service” solutions with a certified hardware solution, ease and speed of implementation. Atos signature appliance supports the following functional modules Signature Appliance high-level architecture • Signature creation: creation with the requested format using customized signature policies and the configured cryptographic Registration Web Service HSM token; multiple preconfigured signatures Application for registration formats are supported e.g., PAdES, XAdES. • Immediate verification (and augmentation): cryptographic signature verification and addition of the necessary Signature information to maintain its long-term validity Web Service PKI (i.e., connection with external timestamp for signature Server server). Production of a verification report. Signature Application • Subsequent verification: verification of all elements which are present in the signed Web Service document and generation of a signature for veriication verification. TimeStamp Atos signature appliance supports the following signature formats Standards and technical specifications Advanced electronic signatures compliant • Common Criteria EAL4+ compliant with CWA 14167-2-PP with technical specifications as defined • NATO SECRET by ETSI (European Telecommunication • Compliant with eIDAS Standardisation Institute): HSM • «Qualification Renforcée» (the highest qualification from the ANSSI) • FIPS 140-2 level 3 (in progress) • CMS (Cryptographic Message Syntax), Certifications • CAdES (CMS Advanced Electronic Signatures), • Cryptographic profiles definition • Secure updates of embedded software • XAdES (XML Advanced Electronic Signatures), • Load balancing capability Administration • PAdES (PDF Advanced Electronic Signatures). • XAdES: XML Advanced Electronic Signature ETSI TS 101 903 Basic profile ETSI TS 103 171 Baseline profile ETSI EN 319 132-1 Building blocks and XAdES baseline signatures • PAdES: PDF Advanced Electronic Signature ETSI TS 102 778 including basic profiles (part 2), BES & EPES profiles (part 3), LTV format (part 4) and visual of signature (part6) ETSI TS 103 172 Baseline profile ETSI EN 319 142-1 Building Signature blocks and PAdES baseline signatures Appliance • CAdES : CMS Advanced Electronic Signatures TS 101 733 & EN 319 122-1 • Signature policy: ETSI TR 102 038 XML policy ETSI EN 319 431 ETSI EN 319 441 • 2 Ethernet 10/100/1000BASE-T ports • 4 USB2 ports • 1 VGA port • Integrated keyboard and chip card reader • Redundant electrical