UOML (Unstructured Operation Markup

Language) Part 2: Layout-based document security

Version 1.0, WD2 – Rev.0

OASIS UOML-X TCMarch 10, 2014

Table of Contents

1. Introduction.................................................................................11.1. Terminology..................................................................................................................11.2. Summary.......................................................................................................................11.3. Normative References...................................................................................................11.4. No-Normative References.............................................................................................2

2. Documents Structure Related Security.....................................2

3. Identity Authentication..................................................23.1 UOML Objects About Identity Authentication.............................................................2

3.1.1 Role List..........................................................................................................33.1.2 Role..................................................................................................................3

3.2 Process Of Identity Authentication...............................................................................43.3 UOML Instruction About Identity Authentication........................................................6

3.3.1 Insert Role Object.......................................................................................63.3.2 Get Challenge Value..................................................................................83.3.3 Login Docbase.............................................................................................93.3.4 Logout Docbase........................................................................................10

4. Access Control...................................................................114.1 UOML Objects............................................................................................................11

4.1.1 Access Control List.........................................................................................124.1.2 Access Control Table Entry.............................................................................124.1.3 Access Control Item........................................................................................13

4.2 UOML Instructions.....................................................................................................14

5 Digital Signature.......................................................................155.1 UOML Objects............................................................................................................15

5.1.1 Digital Signature List......................................................................................155.1.2 Digital Signature Table Entry..........................................................................165.1.3 Digital Signature Item.....................................................................................16

5.2 Digital Signature Process............................................................................................175.2.1 Signature Process............................................................................................185.2.2 Verifying Signing Process...............................................................................20

5.3 UOML Instructions.....................................................................................................215.3.1 Sub-tree Signature...........................................................................................215.3.2 Verify The Signature Object............................................................................22

6 Communication Channel（Optional）..................................25

Attachment A....................................................................................26

2

3

1. Introduction

1.1. Terminology

Access Control Entry: The access authority of one target role accesses to one target object in Docbase.

Access Control List: The access authority list of multi-roles access to multi-objects in Docbase.

Access Control Table Entry: The access authority of multi-roles access to one object in Docbase.

Digital Signature List: The digital signature list of multi-sub-trees in Docbase.

Identity Authentication: A process to identify the role in Docbase.

Role: Roles in Docbase.

Role List: A list of all roles in Docbase.

Signature Verification: Verify the digital signature of sub-tree and back with results.

1.2. Summary

This standard is the 2nd part of UOML—the security control of layout-based document. It mainly describes identity authentication, access control and digital signature, such contents related to security.

This standard has a close connection with the 1st part of UOML—the operation standard of layout-based document, and through the introduction of this part, the related contents of security has been added into Docbase by UOML instructions.

1.3. Normative References

1

We quote the clause from following documents as the clause of our standard. The revision of all dated referenced standard is not fitted with this standard. However, we encourage the parties which reach an agreement decide whether use the latest revision. The latest revision fits this standard as long as the documents were not dated.

GB/T 18793-2002

Information Technology Extensible Markup Language （XML）1.0（neq W3C RFC-xml-19980210：1998）

W3C XML namespace（xml-names）XML Schema Definition Language(XSDL)1.1 Part1： StructureXML Schema Definition Language (XSDL)1.1 Part2：Data type

X.509

1.4. No-Normative References

2. Documents Structure Related Security

3. Identity Authentication

Identity authentication defines the roles that have authority to access Docbase. Only these permitted roles can log-in Docbase, then performs access control and digital signature according to their authority.

2

3.1 UOML Objects About Identity Authentication

Role List

Role

3.1.1 Role List

The Docbase has multi-roles, and each role can control the object in the Docbase.

Role ListSemantic List of all roles in Docbase.Property N/A.

Sub-element N/A.Parent-object Docbase.

Sub-object Role.

3.1.2 Role

RoleSemantic The role in Docbase.Property id The only identification of role in Docbase, it is optional.There’s

no id property when the object is created. The Docbase builds the id property based on the role certificate(e.g. HASH value of

3

role certificate).cert_type Type of certificate, default value is X.509.

certificateDigital certification of role(base64), it is optional. The login password is generated when the role creates password for login

Sub-element meta list.Parent-object role list.

Sub-object meta listRelevant information of the role, for example, create time, creator and so on. All the information is used by the application program.

About role in Docbase：1. There is a default role when a new Docbase was generated, and the default role has full

authority. If there isn’t any other role in the Docbase, the default role can login without program intervention. Using the default role, The application can add any kind of new roles in the Docbase such as administrator role, reading-only role. The application can also set the new role’s authority to access the Docbase.

2. It is the application itself to decide how to use the new role. The default role can be deleted by administrator role, which has full authority to Docbase.

3. If a role has the authority to add new role, this kind of role can create a new role in Docbase.

4. When the Docbase administrator deletes itself, the other roles can not delete any role in Docbase, except the role has the authority of role-deleted or document-decryption.

5. Only the role with document-decryption authority can convert documents from secure state to non-secure state.

6. The process of creating, modifying and deleting the role: the application opens the Docbase and get the role list handle, create role, call UOML instruction to insert role, DCMS assigns an id for the role. If the application didn’t assign a certificate to the role, create an assigned-type certificate for the role, if the application did, use the certificate and insert it to role list, back to the login credential and role handle that corresponded with the role that coded by base64, then you can create a role. Login with this role, you can modify the role in Docbase according to the authority you have. You can authorize to role only by your own authority. Roles can be added or delete if the operator has the authority. When a role is deleted, the item of itself in access control table should be deleted at the same time.

7. Currently, Docbase supports two styles to log-in, one is password and the other is X.509

certificate. The algorithm of password log-in is DES encryption algorithm and X.509 certificate is

4

a universal RSA algorithm.

3.2 Process Of Identity Authentication

The process of identity authentication through UOML shows below:

.

Including:

1. First the application opens Docbase and gets the Docbase handle. Then the application gets a challenge value from the DCMS by sending a UOML instruction called ” login_get_challenge”. Next the application uses its private key to encrypt the challenge value into a cipher text. Finally the application logins the Docbase by sending a UOML instruction called “login” and passing it a specified role and the cipher text.

5

2. The DCMS first decrypts the cipher text passed in by the application to a plain text by using the role's password or public key. Then the DCMS compares the plain text with that challenge value, if both are equal, login process is successful. If not, failed.

3. When the application completes the access to the Docbase via a specified role, it can send “logout” instruction to DCMS. Then DCMS performs logout process.

4. Finally, the application closes Docbase.

3.3 UOML Instruction About Identity Authentication

Include:

Insert Role Object

Get Challenge Value

Login Docbase

Logout Docbase

3.3.1 Insert Role Object

Call Instruction：

6

Return Instruction：

7

Properties on insert role objects as follows：Insert a role object

Function Insert a role object in the role list.

Property handle The handle of the RoleList.

RetstringVal The role handle returned by DCMD.binaryVal Login certificate data(base64).

For example：Instructions sent from application to DCMS as follows:<uoml:INSERT xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0" handle="hRoleList" pos=”-1”> <xobj> <role id="UOML admin" cert_type=”PASSWORD” certificate=”admin_password”> <metainfo> <meta key="cert_type" val="PASSWORD"/> </metainfo> </role >

8

</xobj></uoml:INSERT>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"><stringVal name="handle" val="role"/></uoml:RET>

3.3.2 Get Challenge Value

Call Instruction：

Return Instruction：

Properties on getting challenge value as follows：

9

Get Challenge ValueFunction Get the challenge value is generated by the Docbase.

Properties handle The handle of the Docbase.

Ret binaryVal Challenge value(base 64) is returned by DCMS.

For example： Instructions sent from application to DCMS as follows:<uoml:SYSTEM xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <login_get_challenge handle="docbase"/></uoml:SYSTEM>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> < binaryVal name="Challenge" val="password"/></uoml:RET>

3.3.3 Login Docbase

The system encrypts the challenge value for created role, and takes this value as password to login Docbase.

Call instruction：

Returned instruction：

10

The following table lists its complete definition：Login Docbase

Function Login the Docbase in a specified role.

Propertieshandle A handle to Docbase.role_id The only identity of a role in Docbase.encryptval A challenge value that is encrypted by using a role certificate.

Ret boolVal true： login successful；false： login failed.

For example：Instructions sent from application to DCMS as follows:<uoml:SYSTEM xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <login handle="docbase" role_id=”admin” encryptval=”password” /></uoml:SYSTEM>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <boolVal name="SUCCESS" val="true"/></uoml:RET>

3.3.4 Logout Docbase

Call instruction：

11

Returned instruction：

The following table lists its complete definition：Logout Docbase

Function Logout the Docbase as a specified role.

Propertieshandle The handle of the Docbase.role_id The only identity of a role in the Docbase.

Ret boolVal true： Logout successful；false： Logout failed.

For example：Instructions sent from application to DCMS as follows:<uoml:SYSTEM xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <logout handle="docbase" role_id=”admin”/></uoml:SYSTEM>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <boolVal name="SUCCESS" val="true"/></uoml:RET>

12

4.Access Control

4.1 UOML Objects

UOML objects about the Access Control List：

Access Control List

Access Control Table Entry

Access Control Item

4.1.1 Access Control List

This object defines access control information to Docbase, and stores the information under Docbase object.

The following table lists its complete definition：Access Control List

Semantics The right of multi-roles access to multi-objects in the Docbase.Property N/A.

Sub-element N/A.Parent-object Docbase.

Sub-object Access control table entry.

13

4.1.2 Access Control Table Entry

Each access control table entry includes the access right that every role owns for a specific object. Currently, the specific object includes Docbase, doc, page and layer. That means the authority of the contents under layer can not be controlled.

The following table lists its complete definition：Access Control Table Entry

SemanticsThe right of multi-roles access to specific objects(Docbase, doc, page, layer)in the Docbase.

Properties object_id The only identification of the accessed objects in Docbase.Sub-element N/A.Parent-object Access Control List.Sub-object Access Control Item.

4.1.3 Access Control Item

Access control item is under the access control table entry, it defines an access authority that a role owns for the object.

14

The following table lists its complete definition:

Access Control ItemSemantics The right of the specific role access to the specific object in the Docbase.

Properties

role_id The only identification of the role in the Docbase.allow Allow right (Multiple character strings separated by commas).

forbidForbidden right (Multiple character strings separated by commas).

Sub-element N/A.Parent-object Access Control Table Entry.Sub-object METALIST

The METALIST can be used to extend the properties of the access control item, such as start, end, repeat, dev type and so on. DCMS only takes charge for saving and loading, not to explain the authority.

The access authority to sub-object in document can be inherited from the parent-object.

Among them, right strings that used by allow and forbid are as follows:

Category Right Strings RightsGrant and PRIV_GRANT A role can grant its rights to other roles.

15

revoke rights PRIV_REVOKE Revoke others’ rights granted by owner.

Universal rights

OBJ_TITLEView the object title(Only Doc object and its parent-object that have the title).

OBJ_ADD Add object.OBJ_DEL Delete object.OBJ_GET Get the object’s content.OBJ_SET Set the object’s content.

Docrights

DOC_READRead the document(that is, get the bitmap of the age).

DOC_ABSTRACT Extract the document content.DOC_RPM To decrypt the managed document.

Rolerights

ROLE_ADD Add role.ROLE_DEL Delete role.ROLE_UPD_KEY Update role certificate.

In addition to the default rights that have defined above, users can increase the rights according to their requirement. The key word of the rights should be started by USR_, and followed by the five user-defined chars that identifies a corporation or any other thing. The Docbase saves the definitions of rights defined by users, and the application explains the specific meaning.

4.2 UOML Instructions

UOML can achieve the access control without adding new instructions, UOML-I can completely satisfy the access control needs by the basic instructions.

For example：Instructions sent from application to DCMS as follows:<uoml:INSERT xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0" handle="hACLList" pos=”-1”> <xobj> <acl object_id="Page0" </acl> </xobj></uoml:INSERT>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"><stringVal name="handle" val="acl"/></uoml:RET>

16

<uoml:INSERT xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0" handle="hACL" pos=”-1”> <xobj> <acl entry rold_id="role1" allow=” OBJ_SET_PROP,OBJ_GET_SUB,OBJ_GET_PROP”> </acl> </xobj></uoml:INSERT>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"><stringVal name="handle" val="aclentry"/></uoml:RET>

5 Digital Signature

5.1 UOML Objects

UOML objects about digital signature:

Digital Signature List

Digital Signature Table Entry

Digital Signature Item

5.1.1 Digital Signature List

This object defines the digital signature of all roles in Docbase, and stores the information under Docbase object.

The following table lists its complete definition:

Digital Signature

17

Semantics Digital signature of multi-trees in the Docbase.Properties N/A.

Sub-elements N/A.Parent-object Docbase.

Sub-object Digital signature table entry.

5.1.2 Digital Signature Table Entry

Each digital signature table entry includes a digital signature to a specific object by every role. Currently specific object only includes four layer, which is Docbase, doc, page and layer, that means the content below layer can not be digitally signed.

The following table lists its complete definition：Digital Signature Table Entry

Semantics Digital signature of specific sub-tree in Docbase.

Properties object_idThe multi-identification of the sub-trees in Docbase that is separated by comma. (That is the unique identification of sub-tree node in the Docbase).

Sub-element N/A.Parent-object Digital Signature List.

Sub-object Digital signature item.

5.1.3 Digital Signature Item

The digital signature item is below the digital signature table entry, and defines a digital signature to the sub-tree-object by a role.

18

The following table lists its completely definition：Digital Signature Item

Semantics Digital signature of specific sub-tree in Docbase.

Properties

cert_typeThe type of signature certificate, the default value is X.509, ECC.

key_type The type of key, RSA，ECC.keytypepara The parameter of key, e.g. 1024,2048,160 and etc.

hashtype digest algorithms: SM3，SHA1，MD5. Default value is SHA1

pubcertificate Public certification（base64）pricertificate Private certification（base64）signature Signature data（base64）

Sub-element Meta List.Parent-element Digital signature list.

Sub-objectMeta list(METALIST), include the name of graphic object, creator, creating time and etc.

5.2 Digital Signature Process

There are two processes in digital signature, Signed and Verified. The login role should have the authority to modify the current document. In the verification, you can use verifying operation, no matter login with any role.

19

5.2.1 Signature Process

At present, digital signature can only be achieved in four objects, Docbase, documents, pages and layers. The basic process of signature for these specific sub-trees through UOML is as below:

(1) Signature of external applications

20

1. The application gets the handle of the root node object of the sub-tree.

2. DCMS creates the signature table entry by the handle which the application getting from

the root node object of the sub-tree(if there’s a signature table entry already, return the

handle). Then create a signature item and return the handle of the signature item.

3. Set the public key of a signature item, digest algorithms and etc.

4. DCMS gets the sub-tree’s digest by the handle which the application getting from the

root node object of the sub-tree.

5. The application gets the digest of the sub-tree successfully, does the external signature,

and generates the signature data.

6. Set the signature data by the handle (the result of the step 2) of the signature item.

(2). Signature in UOML

21

1. The application gets the handle of the root node object of the sub-tree successfully.

2. DCMS creates the signature table entry by the handle which the application getting from

the root node object of the sub-tree (if there’s a signature table entry already, return the

handle). Then create a signature item and return the handle of the signature item.

3. Set the parameters of the signature item (certification, key and etc.).

4. Apply signature by calling the signature interface.

5.2.2 Verifying Signing Process

The process of verifying sub-tree by UOML:

22

1. According to the identification of sub-tree that the application is preparing to verify in

the Docbase (that is the identification of the root node of the sub-tree in Docbase) to

form a string, and separated each sub-tree by comma, take this string as parameter and

send “verifying specific sub-tree” to DCMS.

2. DCMS checks the digital signature table entry in the list by this unique string in

Docbase, and search the digital signature object according to the digital signature table

entry. Then get the parameters of the signature object.

3. DCMS calculates the digest value of the sub-trees, call the public key of the digital

signature object to get the signature result, and compares the result with the signature

data of the signature object.

4. Return the verifying results.

5.3 UOML Instructions

UOML instructions about digital signature：

Sub-tree Signature

Verify the signature object

5.3.1 Sub-tree Signature

Call instruction：

23

Returned instruction：

The following table lists its complete definition：Sub-tree Signature

FunctionSign the specific sub-tree, insert the signature object in the list, and return the handle of new signed-object to users.

Parametersobject_id

The multi-identification of the sub-trees in Docbase that is separated by comma (that is the identification of sub-tree node in the Docbase).

handle_ref The object handle of the associated graph object (it is optional).Ret stringVal The handle of signature object.

For example：

24

Instructions sent from application to DCMS as follows:<uoml:SYSTEM xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <sign handle="page, page1, page2" /></uoml:SYSTEM>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <stringVal name="sign" handle="hSign"/></uoml:RET>

5.3.2 Verify The Signature Object

Call instruction：

Returned instruction:

The following table lists its complete definition：25

Verify the object signatureFunction Verify the signature of the specific sub-tree, and return the signed result.

Parameters object_idThe multi-identification of the verifying sub-trees in Docbase that is separated by comma. (That is the identification of the sub - tree node in the Docbase).

Ret boolVal The result of verifying signature, successful or failed.

Example：Instructions sent from application to DCMS as follows:<uoml:SYSTEM xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <verify handle="page, page1, page2" /></uoml:SYSTEM>Instructions returned from DCMS to application as follows:<uoml:RET xmlns:uoml="urn:oasis:names:tc:uoml:xmlns:uoml:1.0"> <boolVal name="SUCCESS" val="true"/></uoml:RET>

26

6 Communication Channel（Optional）

To communicate between the database and the application needs to establish a secure transmission channel. The data transmission of all communication process should be transmitted ciphertext in order to guarantee the security of data, recommend using the SSL protocol to make authentication and data encryption transmission of the communication between the application and Docbase.

27

Attachment A

<xs:complexType name="ROLE"><xs:sequence minOccurs="0">

<xs:element name="metainfo" type="uoml:METALIST"/></xs:sequence><xs:attribute name="id" type="xs:string" use="optional"/><xs:attribute name="cert_type" type="xs:string" use="required"/><xs:attribute name="certificate" type="xs:base64Binary" use="required"/>

</xs:complexType><xs:complexType name="ROLELIST"/><xs:complexType name="ACL">

<xs:attribute name="object_id" type="xs:string" use="required"/></xs:complexType><xs:complexType name="ACLENTRY">

<xs:attribute name="role_id" type="xs:string" use="required"/><xs:attribute name="allow" type="xs:string" use="required"/><xs:attribute name="forbid" type="xs:string" use="required"/><xs:attribute name="start" type="xs:dateTime" use="optional"/><xs:attribute name="end" type="xs:dateTime" use="optional"/><xs:attribute name="repeat" type="xs:unsignedInt" use="optional"/><xs:attribute name="dev_type" type="xs:string" use="optional"/><xs:attribute name="device" type="xs:string" use="optional"/>

</xs:complexType><xs:complexType name="ACLLIST"/><xs:complexType name="SIGN">

<xs:attribute name="object_id" type="xs:string" use="required"/></xs:complexType><xs:complexType name="SIGNENTRY">

<xs:sequence minOccurs="0"><xs:element name="metainfo" type="uoml:METALIST"/>

</xs:sequence><xs:attribute name="filter" type="xs:string" use="required"/><xs:attribute name="cert_type" type="xs:string" use="required"/><xs:attribute name="certificate" type="xs:base64Binary" use="required"/><xs:attribute name="signature" type="xs:base64Binary" use="optional"/><xs:attribute name="object_id_ref" type="xs:string" use="optional"/>

</xs:complexType><xs:complexType name="SIGNLIST"/>

28

<xs:element name="INSERT"><xs:complexType>

<xs:sequence><xs:element name="xobj" type="uoml:COMPOUND"/>

</xs:sequence><xs:attribute name="handle" type="xs:string" use="optional"/><xs:attribute name="pos" type="xs:int" use="optional"/>

</xs:complexType></xs:element><xs:element name="SYSTEM">

<xs:complexType><xs:choice>

<xs:element name="flush"><xs:complexType>

<xs:attribute name="handle" type="xs:string" use="optional"/><xs:attribute name="path" type="xs:string" use="optional"/>

</xs:complexType></xs:element><xs:element name="login_get_challenge">

<xs:complexType><xs:attribute name="handle" type="xs:string" use="optional"/>

</xs:complexType></xs:element><xs:element name="login">

<xs:complexType><xs:attribute name="handle" type="xs:string" use="optional"/><xs:attribute name="role_id" type="xs:string" use="required"/><xs:attribute name="encryptval" type="xs:base64Binary"

use="required"/></xs:complexType>

</xs:element><xs:element name="logout">

<xs:complexType><xs:attribute name="handle" type="xs:string" use="optional"/><xs:attribute name="role_id" type="xs:string" use="required"/>

</xs:complexType></xs:element><xs:element name="sign">

<xs:complexType><xs:attribute name="handle" type="xs:string" use="optional"/><xs:attribute name="filter" type="xs:string" use="required"/><xs:attribute name="handle_ref" type="xs:string" use="optional"/>

</xs:complexType></xs:element>

29

<xs:element name="verify"><xs:complexType>

<xs:attribute name="handle" type="xs:string"/></xs:complexType>

</xs:element><xs:element name="use_plugins">

<xs:complexType><xs:attribute name="handle" type="xs:string" use="optional"/><xs:attribute name="plugins" type="xs:string" use="required"/>

</xs:complexType></xs:element><xs:element name="query" type="uoml:QUERY"/>

</xs:choice></xs:complexType>

</xs:element><xs:element name="RET">

<xs:complexType><xs:choice maxOccurs="unbounded">

<xs:element name="boolVal" type="uoml:BOOLEAN"/><xs:element name="intVal" type="uoml:INT"/><xs:element name="floatVal" type="uoml:DOUBLE"/><xs:element name="dateVal" type="uoml:DATE"/><xs:element name="timeVal" type="uoml:TIME"/><xs:element name="dateTimeVal" type="uoml:DATETIME"/><xs:element name="durationVal" type="uoml:DURATION"/><xs:element name="stringVal" type="uoml:STRING"/><xs:element name="binaryVal" type="uoml:BINARY"/><xs:element name="compoundVal" type="uoml:COMPOUND"/>

</xs:choice></xs:complexType>

</xs:element>

30