Horus Signature Appliance Secure your transactions with electronic signatures In environments that require a high level of trust, advanced or qualified electronic signatures are highly advised. They ensure a document’s integrity in paperless transactions and provide proof of acceptance by the signer. Quickly deploy your digital signature project with Remote signature: Ensure trust in your exchanges Horus Appliance a solution for mobile users Electronic signatures can support The deployment of a digital signature project Signing documents should be as easy organizations in their compliance journey can be complex with various integration as a hand-written signature. A remote with eIDAS regulation. While securing constraints to handle. The Horus Signature signature functionality enables the user to document and data exchanges, electronic Appliance facilitates the implementation electronically sign documents anywhere and signatures also contribute to reducing of digital signature within document from any device. processing costs, such as printing and workflows. Users can keep using their archiving, and to enhancing productivity with existing document workflow management Atos offers a server-based solution where dematerialized processes. application and add electronic signature signing is done remotely with strong processes without any discontinuity. private key management. After a secure Electronic signatures guarantee the integrity authentication (for instance, with a smart of documents and identify the signers. Once The Horus Signature Appliance uses card), the user can apply a signature made in a signer has produced a signature and the signature certificates generated by the Atos a tamper-proof environment. signature has been verified, the signature is PKI solutions or other PKI products. The secure and may no longer be repudiated. signature private key and the signature The server is accessed by third-party certificate are stored: software through documented Web services Each signer (e.g. a user or an application) • In an HSM for seal signature. (SOAP or REST). For the end user, an uses a signature key pair (a public key and application using these Web services can • Enciphered in the Horus database for a private key) and a public key certificate be deployed and customized to offer user- other uses cases. The enciphered keys generated by a certificate authority (CA). friendly interfaces, similar to a Web portal. are securely imported to an HSM, which provides a tamper-proof environment. An administration interface is provided for configuring applications and signature policies. The server can be used to sign in the name of an entity or to sign in the name of a physical person with centralized and secure signature keys management. Simplify your product Choose the right level of digital signature deployment using appliance Two deployment models are available for In a centralized environment, a mechanism The Horus Signature appliance helps specific use cases: basic/advanced and qualified. must be implemented to verify that only organizations deliver their projects quickly the owner of a sensitive key will activate and cost-efficiently, as: Before launching a project, users need to identify cryptographic operations on that key. The 1. Pre-defined configuration is which applications should have the most secure Horus User Explicit Consent appliance implemented: the appliance model is electronic signatures (qualified signatures) and defines secure mechanisms attached to the delivered with a standard configuration the ones where a basic or advanced signature digital keys that have to be activated and that can be used in most use cases, is sufficient. controlled before the key usage approval. with no extra time in specifications or integration, The Horus signature appliances are fully As a “Signature Activation Module” in ETSI 2. The product is delivered in a compliant with eIDAS regulation for the creation standards naming, the Horus User Explicit unique with of qualified digital signatures. To achieve this Consent appliance offers recognized hardware pre-configured and , compliance, the Horus signature solution for capacities of remote qualified signature. Atos features database natural persons is connected to the User Explicit is engaged in a “Qualification Elémentaire” 3. Minimal configuration is done at first run Consent appliance to ensure that a signature key process with the ANSSI for this appliance. to make the appliance ready to use. is solely controlled by its owner. The system maintenance and support are simplified as the appliance is an all-in-one solution facilitating the tasks that can be complex and time-consuming in a classic implementation due to tailored configurations (VMs, servers, HSM...). Define who should be engaged Electronic signatures are applied to cross- • Horus People signature: different people • Explicit Consent Manager (ECM): for department applications (billing workflows, can request personal signatures once they eIDAS qualified signature, sole control commercial contracts, payroll…) and can be have been pre-registered and a signature by the user of a private key must be adapted to different setups (decentralized/ digital identity has been enrolled for them. guaranteed. A specific hardware-based centralized; natural person/legal person, – User centralized signature with remote solution, the ECM, is used to manage seal). With the signature of the person, the access to the server the consent of the user in addition to a signatory personally commits to the signed – Users signature private keys are metasign-server. This solution does not data. With a seal, the signature is made on managed in the HSM (enrollment phase allow the use of the private key before behalf of an organization or a legal person. and signature) having activated it via an OTP or a Fido – Password management to protect the authentication. It acts as a Signature Different configurations are available with the user against misleading use of their Activation Module in ETSI terminology of Horus Signature Appliance: private key CEN 419 241-2 (protection profile for QSCD for Server Signing). • Horus Seal signature: for the delivery of seal signatures on behalf of a company or a legal entity. – Centralized signature for an application or “electronic seal” – Seal keys are maintained in the HSM – Key Ceremony for certificate creation A model tailored to your needs Horus provides a wide range of trust • A basic model with only one service • A high-availability model deploying infrastructure appliances (PKI, digital embedded in an HSM. This model is fully several appliances to ensure business signature, user explicit consent, time adapted to the Horus Root CA appliance continuity with a centralized database. stamping, blockchain) and offers different as it is autonomous and does not depend models adapted to the infrastructure’s needs: on the infrastructure. • A multi-services model, enabling the combination of many services in an HSM such as electronic signature or timestamping together with PKI. 02 Get a greater control over the security of the information system and independence from “as-a-service” solutions with a certified hardware solution, ease and speed of implementation. Horus Signature appliance supports the following functional modules Horus Signature Appliance high-level architecture • Signature creation: creation with the requested format using customized signature policies and the configured cryptographic Registration Web Service HSM token; multiple preconfigured signatures Application for registration formats are supported e.g., PAdES, XAdES. • Immediate verification (and augmentation): cryptographic signature verification and addition of the necessary Signature information to maintain its long-term validity Web Service PKI (i.e., connection with external timestamp for signature Server server). Production of a verification report. Signature Application • Subsequent verification: verification of all elements which are present in the signed Web Service document and generation of a signature for veriication verification. TimeStamp Horus Signature appliance supports the following signature formats Standards and technical specifications Advanced electronic signatures compliant • Common Criteria EAL4+ compliant with CWA 14167-2-PP with technical specifications as defined • NATO SECRET by ETSI (European Telecommunication • Compliant with eIDAS Standardisation Institute): HSM • «Qualification Renforcée» (the highest qualification from the ANSSI) • FIPS 140-2 level 3 (in progress) • CMS (Cryptographic Message Syntax), Certifications • CAdES (CMS Advanced Electronic Signatures), • Cryptographic profiles definition • Secure updates of embedded software • XAdES (XML Advanced Electronic Signatures), • Load balancing capability Administration • PAdES (PDF Advanced Electronic Signatures). • XAdES: XML Advanced Electronic Signature ETSI TS 101 903 Basic profile ETSI TS 103 171 Baseline profile ETSI EN 319 132-1 Building blocks and XAdES baseline signatures • PAdES: PDF Advanced Electronic Signature ETSI TS 102 778 including basic profiles (part 2), BES & EPES profiles (part 3), LTV format (part 4) and visual of signature (part6) ETSI TS 103 172 Baseline profile ETSI EN 319 142-1 Building Horus blocks and PAdES baseline signatures Signature • CAdES : CMS Advanced Electronic Signatures TS 101 733 & EN 319 122-1 Appliance • Signature policy: ETSI TR 102 038 XML policy ETSI EN 319 431 ETSI EN 319 441 • 2 Ethernet 10/100/1000BASE-T ports • 4 USB2