Server Signing Processes: Key Pair Generation

The Key Pair Generation process is divided into the following sections:

  • User Authentication

  • Signer Selection (optional)

  • Signer Key Pair Generation

  • Signer Certificate Issuance

The Key Pair Generation process corresponds to the usage scenario (US4) Key Pair Generation and the operation Signer_Key_Pair_Generation assigned to the SAM.

Sequence diagram

tmp90613t9i.jpg

Figure 10: Sequence diagram of the Key Pair Generation process

Nr.

Step

Components

Description

4 Key Pair Generation

4.1 User Authentication

4.1.1

The User requests the SSSrv/UI for Key Pair Generation.

User, SSSrv

/UI

requestGenerationOfKeyPair

4.1.2

The SSSrv/UI performs checks on the request for Key Pair Generation.

SSSrv/UI

checkGenerationOfKeyPair

4.1.3

The authentication of the User is performed.

User, SSSrv

/UI, IdP

doingAuthenticationUser

(11 doingAuthenticationPrivUser |

61 doingAuthenticationSigner)

Sub process according used means of identifications = Username/Password. Result is the ID Token for the User which signalize that the authentication is performed successfully.

4.1.4

The SSSrv/UI responses the User to confirm the authentication by transmitting the signed ID Token.

SSSrv/UI, User

confirmAuthentication

4.2 Signer Selection (optional)

4.2.1

The Privileged User requests the list of Signer from the SSSrv/UI.

User, SSSrv

/UI

requestListOfSigner

4.2.2

The SSSrv/UI performs checks on the request for the list of Signer.

SSSrv/UI

checkRequestListOfSigner

4.2.3

The SSSrv/UI requests the SSA for the list of Signer.

SSSrv/UI, SSA

requestListOfSigner

4.2.4

The SSA checks the request for the Signer list.

SSA

checkRequestListOfSigner

4.2.5

The SSA requests the list of Signer.

SSA

requestListOfSigner

4.2.6

The SSA delivers the Signer list to the SSSrv/UI.

SSA, SSSrv

/UI

returnListOfSigner

4.2.7

The SSSrv/UI delivers the Signer list to the Privileged User.

SSSrv/UI, User

deliverListOfSigner

4.2.8

The Privileged User selects the Signer.

User

selectSigner

4.4.1

The SAM generates a certificate request based on the generated key material.

SAM

generateCertificateRequest

4.4.2

The SAM requests the SCDev to sign the supplied DTBS/R.

SAM, SCDev

requestSigningOfDTBSR

4.4.3

The SCDev signs the supplied DTBS/R.

SCDev

signDTBSR

4.4.4

The SCDev responses the SAM confirming the signing of the DTBS

/R by returning the signed DTBS/R.

SCDev, SAM

confirmSigningOfDTBSR

4.4.5

The SAM confirms the creation of a key pair to the SSA.

SAM, SSA

confirmGenerationOfKeyPair

4.4.6

The SSA requests the issuance of a X.509 certificate based on the certificate at the CA.

SSA, CA

requestIssuanceOfCertificate

4.4.7

The CA performs checks on the request for issuing a certificate.

CA

checkRequest IssuanceOfCertificate

4.4.8

The CA issues the requested Certificate.

CA

issueCertificate

4.4.9

The CA responds the SSA to confirm the issuance of the certificate by handing over the issued certificate to the SSA.

CA, SSA

confirmIssuanceOfCertificate

4.4.10

The SSA requests the publication of the issued certificate at the CA.

SSA, CA

requestPublicationOfCertificate

4.4.11

The CA performs checks on the request for publishing a certificate.

CA

checkRequest PublicationOfCertificate

4.4.12

The CA publish the provided Certificate.

CA

publishCertificate

4.4.13

The CA respond the SSA to confirm the publication of the certificate.

CA, SSA

confirmPublicationeOfCertificate

4.4.14

The SSA checks the validity of the certificate.

SSA

checkValidityOfCertifcate

4.4.15

The SSA requests the KM to store the certificate for the specified User.

SSA, KM

requestStorageOfCertificate

4.4.16

The KM checks the request for the storage of the certificate.

KM

checkRequestStorageOfCertificate

4.4.17

The KM stores the certificate for the specified User.

KM

storeCertificate

4.4.18

The KM responds to the SSA to confirm the storage of the certificate.

KM, SSA

confirmStorageOfCertificate

4.4.19

The SSA responses to the SAK/OS to confirm the registration of the user.

SSA, SSSrv

/UI

confirmRegistrationOfUser

4.3 Signer Key Pair Generation

4.3.1

The User requests the SSSrv/UI to generate new key pair.

SSA, SSSrv

/UI

requestGenerationOfKeyPair

4.3.2

The SSSrv/UI checks the request for generating a new key pair.

SSSrv/UI

checkRequest GenerationOfKeyPair

4.3.3

The SSSrv/UI requests the SSA to generate new key pair.

SSA, SSA

requestGenerationOfKeyPair

4.3.4

The SSA checks the request for generating a new key pair.

SSA

checkRequest GenerationOfKeyPair

4.3.5

The SSA requests the SAM to generate new key pair.

SSA, SAM

requestGenerationOfKeyPair

4.3.6

The SAM checks the request for generating a new key pair.

SAM

checkRequest GenerationOfKeyPair

4.3.7

The SAM requests the SCDev to generate new key pair.

SAM, SCDev

requestGenerationOfKeyPair

4.3.8

The SCDev creates a new key pair.

SCDev

createKeyPair

4.3.9

The SCDev confirms the creation of key pair by returning KeyID and the Public Key to the SAM.

SCDev, SAM

confirmCreationOfKeyPair

4.3.10

The SAM generates the Wrapped Key based on the generated key material and its properties.

SAM

generateWrappedKey

4.3.11

The SAM requests the KM for the storage of Wrapped Key.

SAM, KM

requestStorage OfWrappedKey

4.3.12

The KM performs checks on the request to store Wrapped Key.

KM

checkRequestStorage OfWrappedKey

4.3.13

The KM stores Wrapped Key including a user mapping.

KM

storeWrappedKey

4.3.14

The KM responds to the SAM confirming the storage of Wrapped Key.

KM, SAM

confirmStorage OfWrappedKey

4.3.15

The SAM requests the KM to register the public key of the generated key pair.

SAM, KM

requestRegistrationOfPublicKey

4.3.16

The KM checks the request for registration of the public key of the generated key pair

KM

checkRequestRegistrationOfPublicKey

4.3.17

The KM stores the registers the public key of the generated key pair

KM

registerPublicKey

4.3.18

The KM responds to the SAM confirming the registration of the public key of the generated key pair.

KM, SAM

confirmRegistrationOfPublicKey

4.4 Signer Certificate Issuance

4.4.20

The SSA responses to the SAK/OS to confirm the registration of the user.

SSSrv/UI, User

confirmRegistrationOfUser

Table 10: Step-by-step description of the process Key Pair Generation