oSIST prEN 17646:2021

SLOVENSKI STANDARD
oSIST prEN 17646:2021
01-maj-2021
Varnostne shranjevalne enote - Klasifikacija visoko varnostnih ključavnic po
odpornosti proti nepooblaščenemu odpiranju - Porazdeljeni sistemi

Secure storage units — Classification for high security locks according to their resistance

Unités de stockage en lieu sûr - Classification des serrures haute sécurité en fonction de

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

Unités de stockage en lieu sûr -¿ Classification des Wertbehältnisse - Klassifizierung von

serrures haute sécurité en fonction de leur résistance à Hochsicherheitsschlössern nach ihrem

l'effraction ¿- Systèmes répartis Widerstandswert gegen unbefugtes Öffnen - Verteilte

This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee

If this draft becomes a European Standard, CEN members are bound to comply with the CEN/CENELEC Internal Regulations

which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

This draft European Standard was established by CEN in three official versions (English, French, German). A version in any other

language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,

Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,

Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and

Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are

Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without

© 2021 CEN All rights of exploitation in any form and by any means reserved Ref. No. prEN 17646:2021 E

European foreword ....................................................................................................................................................... 4

1 Scope .................................................................................................................................................................... 5

2 Normative references .................................................................................................................................... 5

3 Terms and definitions ................................................................................................................................... 5

4 Symbols and abbreviations ......................................................................................................................... 8

5 Classification ..................................................................................................................................................... 8

6 Requirements ................................................................................................................................................... 8

6.1 General ................................................................................................................................................................ 8

6.1.1 General ................................................................................................................................................................ 8

6.1.2 Construction ...................................................................................................................................................... 9

6.2 System administration ............................................................................................................................... 10

6.2.1 Administrative procedures ...................................................................................................................... 10

6.2.2 Confirmation of remotely initiated security relevant operating procedures ........................ 10

6.2.3 Information processing system as central operation/administration instance ................... 11

6.2.4 Authentication of components ................................................................................................................ 11

6.2.5 Software and firmware .............................................................................................................................. 11

6.2.6 Administration interfaces ......................................................................................................................... 13

6.2.7 Authentication of users .............................................................................................................................. 13

6.2.8 Indication of the blocking status ............................................................................................................ 14

6.2.9 Recording events .......................................................................................................................................... 15

6.2.10 Data traffic in the secured state .............................................................................................................. 16

6.2.11 Detection of manipulations ...................................................................................................................... 16

6.2.12 Indication of blocking times ..................................................................................................................... 16

6.2.13 Resistance to spying .................................................................................................................................... 17

6.3 Information security ................................................................................................................................... 18

6.3.1 General protection aims ............................................................................................................................ 18

6.3.2 Requirements on cryptography .............................................................................................................. 18

6.3.3 Other information security measures .................................................................................................. 21

6.4 Security requirements ............................................................................................................................... 21

6.4.1 Negative impacts by power supply ........................................................................................................ 21

6.4.2 Resistance against electrical and electromagnetic influences .................................................... 21

6.4.3 Resistance against physical environmental influences ................................................................. 22

6.4.4 Temperature resistance ............................................................................................................................ 22

6.4.5 Reliability ........................................................................................................................................................ 22

6.5 Extraneous components ............................................................................................................................ 22

6.5.1 Use of extraneous components ............................................................................................................... 22

6.5.2 Additional components .............................................................................................................................. 22

7 Technical documentation .......................................................................................................................... 22

7.1 General ............................................................................................................................................................. 22

7.2 Required technical documentation ....................................................................................................... 22

7.3 Operating instructions ............................................................................................................................... 24

8 Test samples .................................................................................................................................................. 25

9 Marking ............................................................................................................................................................ 25

Annex A (normative) Determination of burglary resistance due to design requirements ............ 26

A.1 General ............................................................................................................................................................. 26

A.2 Electronic HSL as a part of a distributed system ............................................................................... 26

Bibliography ................................................................................................................................................................. 27

This document (prEN 17646:2021) has been prepared by Technical Committee CEN/TC 263 “Secure

storage of cash, valuables and data media”, the secretariat of which is held by BSI.

This document is applicable to Distributed Systems (DS), i.e. high security locks with components which

have a wired or wireless connection via a transmission system in order to execute fixed operating

Products which are to be tested on the basis of this document comply with the generally recognized state

of the art at the time of testing. Due to the short innovation cycles in the field of electronic and, in

particular, information technology applications, the technical possibilities available at the time of product

Distributed Systems can be used, for example, to operate high security locks of secure storage units (safes

This document does not apply for stand-alone HSL, which are not part of a distributed system. For these

The standard will be revised with a frequency of 3 years as the research in the area of cryptography and

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including any amendments) applies.

EN 1300, Secure storage units - Classification for high security locks according to their resistance to

EN 1143-1, Secure storage units - Requirements, classification and methods of test for resistance to burglary

EN 1143-2, Secure storage units - Requirements, classification and methods of tests for resistance to

EN ISO/IEC 27001, Information technology — Security techniques — Information security management

For the purposes of this document, the following terms and definitions apply / the terms and definitions

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

additional component which allows information to be entered from a remote location and is intended for

status of a DS or a component of a DS before the first customer-specific modification has been carried out

quality that ensures, for example, that a communication partner is who he claims to be; for authentic

category of credential (knowledge factors (e.g. a password), possession factors (e.g. a card) or inherence

factors (e.g. biometric characteristics)) that is intended to verify that an entity requesting an access is

person who is identified by input of the required information as being authorized for a certain action

component of a DS that has an active influence on the data processing as well as the security state of the

component of a DS which is not manufactured especially for the DS but is used in the DS as a functional

Note 1 to entry: For example, public components of a transmission path or office computers may be used as

Note 1 to entry: In order to minimize the risk of unauthorized access to security relevant information by third

parties, it is strongly recommended that a DPU is used exclusively within the direct sphere of influence of the

transmission path for the exchange of information between the remote input unit and the processing unit

codes (e. g. opening, recognized, duress, parallel codes, cryptographic keys), authentication information

component which directly or indirectly allows the physical lock (locking) of further components, e. g. a

components operating as a unit, locally separated and aimed at the systematic implementation of a

Note 1 to entry: The exchange of information between the components can be wired or wireless

Note 1 to entry: A deliberate action may be, for example, the pushing of an operating button, the input of a

area of a secure storage unit which, due to the physical properties, is not accessible when the product is

Note 1 to entry: For example, this can be the inside of a safe door that has a mechanical cover even when the door

method for authenticating a user, service or component by means of two different authentication factor

Note 1 to entry: Examples of authentication factors can be found in the corresponding definition

ANSSI: Agence nationale de la sécurité des systèmes d'information (National Cybersecurity Agency

BSI (DE): Bundesamt für Sicherheit in der Informationstechnik (German Federal Office for

NIST: Federal Network Agency for Electricity, Gas, Telecommunications, Post and Railways

Distributed Systems are divided into four classes A (DS), B (DS), C (DS) and D (DS). For DS of class A (DS)

the lowest requirements are applicable, for those of class D (DS) the highest requirements are applicable.

For an approved Distributed System, the component with the lowest classification relating to LD, PU, IU

For HSL operated in distributed systems according to this document, the requirements of EN 1300 apply

in principle. The EN 1300 classification level achieved by an HSL determines the maximum classification

In case of conflicting requirements between EN 1300 and this document, this document prevails. Where

possible and applicable, reference is made to the corresponding clauses of EN 1300.

This document specifies requirements for independent components (see 6.2 to 6.4) and extraneous

components (see 6.5). As far as possible and applicable, reference is made to the clauses of EN 1300.

This document refers to the term state of the art. With state of the art, a method validated by accepted

organizations like European Union Agency for Network and Information Security (ENISA), the German

Federal Office for Information Security (BSI), the French National Agency for Information Systems

Security (ANSSI) or the Federal Network Agency for Electricity, Gas, Telecommunications, Post and

DS have a basic structure consisting of a processing unit (PU), a locking device (LD), an input unit (IU) as

well as the communication paths (CP) which could be through public or local networks and, if applicable,

a data processing unit (DPU) or a remote input unit (rIU) or both. It is possible that these components

exist more than once in the system. The structure is not predefined in detail, but is based on the

Independent components with the exception of the IU, the rIU and the DPU, shall be located in the access

The arrangement of the components shall be such that unauthorized access to these components can be

detected (e.g. by breaking a seal) even when the safe-storage space is properly opened.

If an HSL also provides product-specific functions through which data can be accessed at any location of

the DS, these functions may also only be performed by authorized users (according to 6.2.7).

All configuration and service activities mentioned above as well as any additional product-specific

functions shall generate a monitoring entry in accordance with the requirements of 6.2.9.

System-wide, the entry of codes is only permitted via specially designed and protected components (IU

The following security-relevant operating procedures shall (if remotely initiated) be confirmed by means

For the following security-relevant operations it is sufficient if the deliberate action from an authorized

user within the DS is performed on one lock for this lock as well as for further locks of the same or a lower

The aforementioned requirements and the resulting deliberate action shall be documented in the

In principle, one or more DPUs can be used to transfer operating and administration procedures to the

DS. This can be useful, for example, when administrating a large number of safes with a small number of

rIUs or when controlling the DS from a central point. In this case, the DPU shall meet the following

Cryptographic algorithms as described in 6.3.1 and 6.3.2 shall be used to process or store information.

The software shall be used and administrated in accordance with the requirements of 6.2.5.

Codes may only be entered on a DPU by authorized users and shall only be entered in conjunction with

The DPU shall provide an authenticated person (such as an administrative user) the ability to create a

NOTE The representation of the network refers to all independent components of the DS.

The manufacturer shall describe the implementation of all requirements in the technical documentation.

All independent components (see 3.6) of a DS shall be able to authenticate each other. The exchange of

authentication information shall be in accordance with the requirements for cryptography set out in 6.3.1

The process of authentication shall be implemented using methods, which are state of the art.

For communication between components it is required that these components have been successfully

If the authentication process can be managed by a user (e.g. (re-)initialization, modification or resetting

of a component authentication), this should only be possible for authorized users.

NOTE The authentication of the components can be closely related to the securing of the transmitted data (by

encryption). However, authentication has a fundamentally different protection goal. While the encryption of the

data secures their confidentiality, a positive authentication ensures the authenticity of a component. It is also

possible to achieve further security profits through the combination of authentication and encryption functions.

Thus, for example, the signing, integrity protection and falsification protection of data transmissions can be

achieved. Furthermore, firmware and software can be verified for authenticity and integrity and secure boot

The secure system configuration of DS components has a special significance with regard to information

security. It is therefore important that the manufacturer checks it for errors and weak points before it is

The configuration and the underlying software of IP-supported DS components shall not have any

vulnerabilities in a “system vulnerability scan” according to the Common Vulnerabilities and Exposures

The software/firmware shall only be obtained from a source within the direct sphere of influence of the

If the software/firmware is transmitted via public networks, it shall be encrypted using state-of-the-art

security and testing mechanisms and checked for integrity. Additionally, the software can be transmitted

The software/firmware of DS components shall be updateable (not applicable for extraneous

DS-wide at least one mechanism shall be available through which updates can be checked and the

software/firmware of the individual components can be updated automatically or manually.

If updates are available, one or more messages shall be displayed to the operator of the DS until these

have been taken into account. The manufacturer shall describe the types of a message in the technical

NOTE 1 An update message can, for example, be received centrally by an authorized user (e.g. an administrator)

Remote updates shall be transmitted in encrypted form (according to 6.3.1 and 6.3.2) and can be signed

additionally. An asymmetrical encryption method with individual key pairs for each communication

If only symmetric encryption methods are used, it shall be ensured that an individual key is used by two

communication participants. This key shall be unique system-wide and shall be transmitted to both

The manufacturer shall describe in the technical documentation which procedure he uses to secure the

NOTE 2 The use of asymmetric encryption methods is taken into account, for example, when using public-key

Each update no matter if for a single lock or for the entire distributed system shall be initiated by the

input/transmission of a recognized code (e.g. input on IU or rIU) or password (e.g. input on DPU) and in

addition, the installation shall be confirmed by the entry of a recognized code at least at one local input

unit. The number of possible incorrect entries of these authorization codes, which are processed by the

DS in immediate succession, shall be limited in accordance with Clause 6.2.7.6. Updates shall not delete

Before updates are activated, their authenticity and integrity shall be confirmed (e.g. using a hash

EXAMPLE The activation can be confirmed, for example, by entering a special code or – after a corresponding

Any intervention in the firmware/software shall trigger a monitoring entry in accordance with 6.2.9.

The manufacturer shall list all necessary measures for carrying out an update in the operating

Updates shall be identified by a unique version number and be clearly identifiable.