Rostelecom: TRIB Standard Information Security Solution

Main articles:

• Biometric identification technologies
• SaaS - History. Philosophy. Drivers of development

The standard information security solution (TRIB) provides secure collection of biometric data.

2020

Launch of Cloud TRIB for Credit Institutions and Certification Centers

Rostelecom on October 6, 2020 announced the introduction into industrial operation of a cloud-based standard information security solution (OTIB). The company's solution allows credit institutions and certification centers to ensure the security of transmitted data during registration and remote verification of citizens in the Unified Biometric System. More than ten banks have already begun connecting to OTIB, about 70 more banks plan to connect by the end of 2020. Leading commercial certification centers also began the procedure for connecting to OTIB. This will allow them to organize the remote issuance of a certificate of the key of verification of a qualified electronic signature.

The cloud standard solution allows banks and certification centers to use the equipment located on the Rostelecom side to sign biometric samples and send them to the Unified Biometric System. To connect to OTIB, Rostelecom created a secure cryptographic network, which is based on domestic encryption equipment and meets all the information security requirements of the FSB of Russia for biometric data transmission networks. The implementation of the Rostelecom solution takes a short time - about two months. OTIB services were implemented according to a system project agreed with the FSB of Russia.

In the future, Rostelecom OTIB can be used in all areas of application of the Unified Biometric System, as well as where it is necessary to safely process and transfer personal data - when identifying an applicant without a passport in a bank or MFC, verifying risky financial transactions with remote banking, receiving electronic SIM cards, as well as in electronic notary, transport, purchases of goods in biometrics and other areas. OTIB is a comprehensive product with the help of which it is also possible to organize interaction with the interagency electronic interaction system (SMEV), digital profile or other services of the Unified Biometric System.

With the launch of OTIB, Rostelecom has become a player in the market, which offers a full-fledged set of solutions and allows the interaction of business and the state to be translated into a digital channel. The Rostelecom solution complex, in addition to OTIB, includes Biometrics ARM (a product for registering data in the Unified Biometric System) and a comprehensive access platform for working with the Unified Biometric System, SMEV, digital profile and other e-government services .

Previously, organizations that are engaged in remote identification of customers needed to do a lot of work to fulfill all the requirements of information security, to use a large number of resources and specialists of appropriate qualifications. The cloud solution of Rostelecom will significantly reduce the implementation time and reduce costs, as organizations will receive data protection as a service. Our solution with the help of cryptographic means of a high class of protection will help safely transfer personal data of citizens over public networks, "said Ivan Berov, director of digital identity at Rostelecom.

Ability to obtain an electronic signature certificate remotely using the EBS

On September 18, 2020, Rostelecom announced that, together with CryptoPro, it had prepared a standard solution for connecting accredited certification centers to the Unified Biometric System. Now the issuance of a qualified certificate of electronic signature can be carried out without the personal presence of a citizen. Information from the Unified Identification and Authentication System (ESIA) and the Unified Biometric System will be used to identify the applicant. The use of information technologies to provide information is carried out in accordance with the provisions of article 13 of Federal Law No. 63-FZ of April 6, 2011 "On Electronic Signature," taking into account the changes made by Federal Law No. 476-FZ of December 27, 2019.

According to the company, to protect the biometric data of citizens, certifying centers can use Rostelecom's standard security solution or connect to the company's cloud information security solution . In both cases, software and hardware cryptographic modules "Crypto Pro HSM" version 2.0 and "Crypto Pro NGate" are used.

The set of solutions of Rostelecom, the developer and operator of the Unified Biometric System, will allow certifying centers to conduct remote identification of applicants in accordance with the requirements of regulators. Both typical and cloud solutions are ready to be embedded in the infrastructure of certification centers. noted Ivan Berov, Director of Digital Identity of Rostelecom

In order to remotely identify the recipients of certificates using the Unified Biometric System, a set of cryptographic tools is required. Rostelecom solutions using Crypto Pro cryptocurrencies are already being used in banks to interact with the Unified Biometric System, and now they will be useful for certification centers. said Stanislav Smyshlyaev, deputy general director of KryptoPro

To connect accredited certification centers to the Unified Biometric System, it is necessary to conclude an agreement with Rostelecom and connect typical or cloud solutions of the company. These solutions will allow certifying centers to comply with legal requirements without significant additional investments.

A single biometric system allows you to remotely serve customers. Remote identification takes place using biometrics and a login and password from the public services portal. Security of data collection is ensured by banks registering citizens, data storage security - system operator - Rostelecom. CryptoPro provides cryptographic means of information protection.

2019

Completion of the TRIB study by KryptoPro

On August 6, 2019, Rostelecom announced the completion of a study of a standard information security solution for working with the Unified Biometric System. A report on the results of the study, which was commissioned by Rostelecom by the licensed laboratory of KryptoPro LLC, was sent to the FSB of Russia.

Based on the report, after the examination, a conclusion will be issued on the compliance of Rostelecom's standard decision with the requirements of the system project of the software and hardware complex agreed earlier with the FSB of Russia to ensure information security when processing biometric data. The standard solution will provide banks with the opportunity to reduce costs and significantly reduce the time to fulfill information security requirements when working with the Unified Biometric System.

A unified biometric system allows banks to remotely serve customers using biometric data, login and password from the public services portal. Security of biometric information collection is provided by banks registering citizens, data storage security - system operator - Rostelecom. The CryptoPro company is responsible for cryptographic means of information protection and security analysis of the created solution. The standard solution is implemented by authorized integrators who integrate it into the infrastructure of banks.

The processes of registering biometric data and obtaining authenticated access using the Unified Biometric System are based on the complex interaction of four heterogeneous participants: the user, the bank, the Unified Identification and Authentication System and the Unified Biometric System. The central link of interaction is the bank, which performs most of the operations, making them using high-class cryptographic means KB/KB2. The developers of Rostelecom have created a safe solution that will allow banks to protect user data, "said Stanislav Smyshlyaev, director of information security at CryptoPro.

The decision of Rostelecom, as a developer and operator of the Unified Biometric System, will allow banks to fully fulfill the requirements of regulators and do so within the deadlines established by law. The standard solution of the company is ready to be embedded in the infrastructure of banks and allows financial organizations to interact with the Unified Biometric System in full compliance with security requirements, "said Ivan Berov, Director of Digital Identity at Rostelecom.

Integration with RS-Connect

On July 16, 2019, R-Style Softlab integrated RS-Connect line modules to work with the Unified Biometric System with a typical information security solution created by Rostelecom. More details here.

Security Code - Standard Solution Implementation Partner

On March 18, 2019, Security Code became an authorized partner of Rostelecom to introduce a standard information security solution when working with biometrics. The company's services will allow banks to reduce the cost of ensuring information security and reduce the time to fulfill the requirements of regulators.

Identification of the user in the Unified biometric system "Rostelecom Key" takes place according to two parameters - voice and face. The security of data storage is ensured by the system operator - Rostelecom, the security of collecting biometric information is monitored by banks registering citizens.

To reduce the costs of ensuring information security when working with biometrics, banks can use the finished product - a typical Rostelecom solution. The system draft of the standard solution for information security when working with biometrics was agreed by the Federal Security Service of the Russian Federation and approved for use in credit organizations. As of March 2019, the development of the main modules of the standard solution has been completed. In accordance with regulatory requirements, case studies are being conducted to obtain a conclusion from the FSB of Russia on the compliance of the created standard product with the previously agreed system project.

The project includes a description of the standard product architecture, a list of approved hardware and special software, interaction schemes, as well as the basic principles of integrating the standard solution into the bank's information systems.

The Security Code will provide design, supply, implementation, maintenance and technical support of a software and hardware complex designed to protect biometric information when it is transferred between the bank and Rostelecom.

In the Security Code laboratory, the company's experts assembled and successfully tested the standard solution, which will further reduce the time to implement the solution on the customer's site to a minimum.

Another advantage of interaction between banks and the Security Code is that the company's products are included by Rostelecom in the draft standard solution for information security when working with biometrics.

In addition to the standard solution, banks can use the Security Code products to provide protection when implementing the tasks of connecting to the EBS:

• channels communications within a financial institution (COP 3 class);
• AWS of biometric sample collection operators;
• biometric personal data processing systems.

It is known that by January 1, 2020, biometric data collection should be provided in all bank branches in Russia. We are already ready to embed a standard solution for ensuring information security in the infrastructure of banks, which will allow them to register biometric data through SMEV and receive the results of verification of biometrics of citizens for the provision of financial services. Thus, our services and our products will make it possible to quickly ensure the readiness of banks to fulfill obligations under biometric identification.

Coordination with the FSB of Russia of the draft model solution

On February 15, 2019, Rostelecom announced that the system draft of the standard information security solution created by it when working with biometrics was agreed by the Federal Security Service of the Russian Federation. Using a standard solution will allow banks to reduce the cost of ensuring information security when working with the Unified Biometric System and reduce the time required to fulfill requirements.

According to the company, the Unified Biometric System allows banks remotely to accept customers for service using, biometric data login and from password. A single portal of public services Security data storage is provided by the system operator - Rostelecom, the security of collecting biometric information is monitored by banks registering citizens. To reduce costs while ensuring information security when working with biometrics, banks can now use the finished product - a typical Rostelecom solution.

The system project agreed by the FSB of Russia includes a description of the architecture of the typical product, a list of approved hardware and special software, their interaction schemes with each other, as well as the fundamental principles of integrating the standard solution into the bank's information systems. Rostelecom in the project plays the role of a developer, the CryptoPro company is responsible for cryptographic tools and conducting security analysis of the created solution. The implementation is carried out by authorized integrators who are already ready to embed a typical solution in the infrastructure of banks.

The solution developed by Rostelecom meets the strict requirements of cryptographic resistance. The security of cryptographic mechanisms and protocols was checked by methods of analyzing protocol solutions standardized in Russia and abroad. All protocols are implemented within a functionally completed box solution that provides a high-level embedding interface. As a result, it is not necessary to conduct additional analysis and control of embedding when implementing the solution in the bank. Stanislav Smyshlyaev, Director of Information Security of CryptoPro

The approval of the draft decision of the FSB of Russia is an important step, now banks have the opportunity to use a typical approach to ensuring security when working with biometrics. The solution will be implemented by authorized integrators, which will allow banks to quickly and efficiently fulfill security requirements. In general, the creation of a standard solution is another cube in the ecosystem of products for safe work with citizens' data at all stages of interaction with the Unified Biometric System. Ivan Berov, Director of Digital Identity of Rostelecom

The development of the main modules of the standard solution has been completed, in accordance with the system project, case studies are being conducted to obtain the conclusion of the FSB of Russia.