Skip to content
smartCMS
/
/
Security & Auditing
Last updated

Security & Auditing

Security is one of the fundamental pillars of SmartCMS.
The system embeds multiple protection mechanisms, including:

  • Strong authentication
  • Encrypted storage of sensitive data
  • Full auditing of all operations
  • Role-based access control
  • Compliance with international PKI and digital identity standards
  • Support for digitally signed audit files (CAdES, PAdES, XAdES)

This section describes all the security‑related features of SmartCMS exactly as documented in the system’s technical white paper.

1. Auditing – Tracking Operations

SmartCMS includes a native auditing module designed to provide complete traceability of all significant events occurring in the system.
Auditing is implemented using a dedicated database, completely separated from the operational DB.

Every time an entity is created, modified or deleted, SmartCMS stores a record containing:

  • Timestamp (precision to the second)
  • Operator ID who performed the action
  • Action type ("Insertion", "Modification", "Deletion")
  • Snapshot of the affected data before/after the change

These logs allow an administrator or auditor to reconstruct every step of any entity's lifecycle.

1.1 Built‑in UI Navigation

Auditing information is available directly from the web interface:

  • Operators with AO (Audit Officer) privileges can navigate logs
  • Logs can be filtered by:
    • Date/time
    • Object type
    • Operation type
    • Operator
    • Free‑text expressions (search)

Each audited object includes an “audit trail”, i.e. full historical record from creation to present.

1.2 Exporting Audit Logs

Audit data can be exported to the most common formats:

  • CSV
  • JSON
  • XML

Furthermore, when the system is configured with an HSM module, exported audit logs may be digitally signed using:

  • CAdES
  • PAdES
  • XAdES

This ensures integrity, non‑repudiation, and compliance with regulatory requirements (eIDAS, national RA policies).

2. Secret Codes Protection

The system includes a complete subsystem dedicated to the life‑cycle management of secret codes, such as:

  • PIN
  • PUK
  • Emergency codes
  • Unlock/reset codes

These codes are:

  • Encrypted in the database
  • Accessible only to authorized operators
  • Generated using strong hardware RNGs (smart cards or HSM)
  • Optionally printed on security envelopes or scratch cards
  • Validated with the Luhn algorithm to avoid operator errors
  • Exportable/importable via standard encrypted formats (CSV, XML, JSON)

Operators may manually assign a scratch card or let the system automatically select one.

3. Authentication and Access Control

SmartCMS supports multiple authentication mechanisms to meet different security policies:

3.1 Supported Authentication Methods

  • Username + Password
    • Stored internally or through external LDAP/AD
  • Strong Authentication
    • Digital certificate stored on a smart card or token
    • This is the default mode for high‑security environments
  • Single Sign‑On (SSO) mechanisms provided by Bit4id
  • UKC Integration
    • Authentication and signing operations through Universal KeyChain

3.2 Role‑Based Access Control (RBAC)

Permissions are assigned based on:

  • Operator role
  • Division
  • Registration office
  • Specific task assignments

Common profiles include:

  • Registration Officer (RO)
  • Delegated Officer (DO)
  • Bureau Officer (BO)
  • System Administrator (SA)
  • Help Desk (HD)
  • Audit Officer (AO)
  • Token Holder (TH)

Each category has different visibility scopes and operational rights.

4. Compliance & Security Standards

SmartCMS is designed to comply with the security requirements of:

  • Public Key Infrastructures (PKI)
  • National e‑ID systems
  • eIDAS regulations
  • ISO 27001-compliant environments
  • CA/RA policies for certificate issuance (face‑to‑face identification, audit logging)

Digital signatures of exported auditing data further support legal validity and enforce compliance constraints.

5. Logging System

An advanced logging subsystem is integrated into the platform.

Features include:

  • Per‑module log verbosity
  • Custom log formatting
  • Multiple output targets:
    • File system
    • Syslog server
    • Database
  • Real‑time log monitoring (especially useful in clustered environments)
  • Native integration with Bit4id Smartlog for:
    • Tracking administrator access
    • Monitoring operations on electronic archives
    • Enforcing accountability policies

Administrators can inspect logs via the web interface or using the administrative shell.

6. Monitoring

The platform provides real‑time monitoring of:

  • SmartCMS internal modules
  • External CA services used for certificate issuance
  • System performance
  • Connectivity with CA gateways
  • Device personalization interfaces
  • Database status and queue systems

Monitoring commands are available via:

  • The SmartCMS administrative shell
  • The web administration interface (if enabled)

This ensures operational stability and rapid detection of anomalies.

7. Data Protection

SmartCMS protects all sensitive data by:

  • Using TLS/HTTPS for all communications
  • Encrypting secret codes at rest
  • Applying least‑privilege access policies
  • Enforcing operator‑level access rights
  • Supporting external identity validation services for personal data
  • Ensuring secure schema migrations without data loss

Summary

SmartCMS integrates a comprehensive security model that includes:

  • Strong authentication
  • Role‑based authorization
  • Full auditing and logging
  • Digital signature support
  • Monitoring of all internal and external services
  • Advanced secret code lifecycle management
  • Secure data handling and encryption

These features make SmartCMS suitable for mission‑critical environments such as national PKIs, identity ecosystems, healthcare systems, and enterprise‑scale RA infrastructures.

Previous page
Next page