Subject: Alternatives for Long Term Archiving

From: "Michael Tielemann" <[email-masked]>
Date: Thu, 8 Apr 2004 14:13:44 +0200

Dear all,

in my opinion the recently discussed n:m distribution is an academically
interesting approach. But I fear that in practice there is no chance to
run such a model. Spreading signed data is much expensive in
communication, storing, retrieving etc. Sure, there is a benfit in
security and evidence, but the overhead is in any industrial context not
feasable. Implementing distributed locations is to expensive in the
sense of hardware, stuff, building, several DMS (?), backup, disaster
recovery, managing responsebility, etc.  

I guess we need, lets say a local store which serves all neccessary
tasks.  This allows a more practicable implementation and modelling for
any company or application.

At our site we have a huge amount of stored documents, splitting this
mass up to several locations with all dependencies would be a nightmare.

Regards
-Michael

---

From: "A. Jerman Blazic" <[email-masked]>
Date: Thu, 8 Apr 2004 15:08:16 +0200

Dear all,

I have been following the discussion for some time and did go through
the n/m scenario and I have to add my position (also as a technology
provider).

As stated a couple of times before n/m solves some critical problems
(confidentiality) but mostly in scenarios when trusted archive is
presented as an outsourcing service (here I really liked Uli's
scenarios). Within an organization n/m approach does not deliver a
single benefit, since redundancy and disaster recovery is solved by
other approaches/technology and building a "new instance" taking care of
redundancy is a wrong direction. Also one should keep in mind that many
records do already exist today and transformation using n/m approaches
are to demanding and especially form the point of view that DMS systems
or docbases are not something that will be implemented with the trusted
archive but they DO exist already, archival standards should take care
mostly of collecting complementary data for unquestioned record
conservation over defined or undefined period of time. The approach
being implemented today by technology providers and organizations with
docbases is therefore based on deployment of archival interfaces
operating directly on existing records by producing conservation
relevant data. Three major points needs to be addressed ASAP: archive
interaction, archival meta and archival complementary data. Present
systems try to build sets of data (mainly trust anchors) on existing or
incoming records. Standardizing such (archival) data is a must, since it
can not rely on specific technology and this is where the problem really
exist at the moment. Data, meta data and complementary data must be
transparent of underlying technology and they must be combined with
seamless mechanisms for proving integrity on independent platforms or in
other words, they must be based on standardized semantic.

Regards

aleksej

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Michael Tielemann
> Sent: Thursday, April 08, 2004 2:14 PM
> To: [email-masked]
> Subject: Alternatives for Long Term Archiving
> 
> 
> 
> Dear all,
> 
> in my opinion the recently discussed n:m distribution is an 
> academically interesting approach. But I fear that in 
> practice there is no chance to run such a model. Spreading 
> signed data is much expensive in communication, storing, 
> retrieving etc. Sure, there is a benfit in security and 
> evidence, but the overhead is in any industrial context not 
> feasable. Implementing distributed locations is to expensive 
> in the sense of hardware, stuff, building, several DMS (?), 
> backup, disaster recovery, managing responsebility, etc.  
> 
> I guess we need, lets say a local store which serves all 
> neccessary tasks.  This allows a more practicable 
> implementation and modelling for any company or application.
> 
> At our site we have a huge amount of stored documents, 
> splitting this mass up to several locations with all 
> dependencies would be a nightmare.
> 
> Regards
> -Michael
>

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 8 Apr 2004 09:27:43 -0400

The n of m approach is proposed when you use multiple parties as trust
store.

If you feel that you need to store your own data and can defend in court
time stamps (all of which may be subject to cryptanalysis except the current
one), then you do not need multiple third parties.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of A. Jerman Blazic
Sent: Thursday, April 08, 2004 9:08 AM
To: [email-masked]
Subject: RE: Alternatives for Long Term Archiving

Dear all,

I have been following the discussion for some time and did go through the
n/m scenario and I have to add my position (also as a technology provider).

As stated a couple of times before n/m solves some critical problems
(confidentiality) but mostly in scenarios when trusted archive is presented
as an outsourcing service (here I really liked Uli's scenarios). Within an
organization n/m approach does not deliver a single benefit, since
redundancy and disaster recovery is solved by other approaches/technology
and building a "new instance" taking care of redundancy is a wrong
direction. Also one should keep in mind that many records do already exist
today and transformation using n/m approaches are to demanding and
especially form the point of view that DMS systems or docbases are not
something that will be implemented with the trusted archive but they DO
exist already, archival standards should take care mostly of collecting
complementary data for unquestioned record conservation over defined or
undefined period of time. The approach being implemented today by technology
providers and organizations with docbases is therefore based on deployment
of archival interfaces operating directly on existing records by producing
conservation relevant data. Three major points needs to be addressed ASAP:
archive interaction, archival meta and archival complementary data. Present
systems try to build sets of data (mainly trust anchors) on existing or
incoming records. Standardizing such (archival) data is a must, since it can
not rely on specific technology and this is where the problem really exist
at the moment. Data, meta data and complementary data must be transparent of
underlying technology and they must be combined with seamless mechanisms for
proving integrity on independent platforms or in other words, they must be
based on standardized semantic.

Regards

aleksej

---

From: "A. Jerman Blazic" <[email-masked]>
Date: Thu, 8 Apr 2004 15:43:29 +0200

Of course, that is the main point. We should consider demands (at the
moment) and focus on them. Multiple parties scenario does not exist
currently... At least to my knowledge. But future infrastructures might
do that (n/m).

> From: Santosh Chokhani [mailto:[email-masked]] 
> Sent: Thursday, April 08, 2004 3:28 PM
> To: 'A. Jerman Blazic'; [email-masked]
> The n of m approach is proposed when you use multiple parties 
> as trust store.
> 
> If you feel that you need to store your own data and can 
> defend in court time stamps (all of which may be subject to 
> cryptanalysis except the current one), then you do not need 
> multiple third parties.
> 
> [mailto:[email-masked]]
> I have been following the discussion for some time and did go 
> through the n/m scenario and I have to add my position (also 
> as a technology provider).
> 
> (confidentiality) but mostly in scenarios when trusted 
> archive is presented as an outsourcing service (here I really 
> liked Uli's scenarios). Within an organization n/m approach 
> does not deliver a single benefit, since redundancy and 
> disaster recovery is solved by other approaches/technology 
> and building a "new instance" taking care of redundancy is a 
> wrong direction. Also one should keep in mind that many 
> records do already exist today and transformation using n/m 
> approaches are to demanding and especially form the point of 
> view that DMS systems or docbases are not something that will 
> be implemented with the trusted archive but they DO exist 
> already, archival standards should take care mostly of 
> collecting complementary data for unquestioned record 
> conservation over defined or undefined period of time. The 
> approach being implemented today by technology providers and 
> organizations with docbases is therefore based on deployment 
> of archival interfaces operating directly on existing records 
> by producing conservation relevant data. Three major points 
> needs to be addressed ASAP: archive interaction, archival 
> meta and archival complementary data. Present systems try to 
> build sets of data (mainly trust anchors) on existing or 
> incoming records. Standardizing such (archival) data is a 
> must, since it can not rely on specific technology and this 
> is where the problem really exist at the moment. Data, meta 
> data and complementary data must be transparent of underlying 
> technology and they must be combined with seamless mechanisms 
> for proving integrity on independent platforms or in other 
> words, they must be based on standardized semantic.
> 
> Regards
> 
> aleksej
> 
> practice there 
> > is no chance to run such a model. Spreading signed data is much 
> > expensive in communication, storing, retrieving etc. Sure, 
> there is a 
> > benfit in security and evidence, but the overhead is in any 
> industrial 
> > context not feasable. Implementing distributed locations is to 
> > expensive in the sense of hardware, stuff, building, 
> several DMS (?),
> > tasks.  This allows a more practicable implementation and modelling 
> > for any company or application.
> > 
> splitting this