9911796707
TMI Blog2023 (5) TMI 449X X X X Extracts X X X X X X X X Extracts X X X X ..... ts range of operations. It is observed that the applicant has not ruled out possibility of classification of goods under consideration under 8473 30 and specifically 8473 30 99 as the product is also in the nature of an accessory which has to be used only with ADP machine for a very distinct function of generating digital certificates and signing, encryption authentication of data. The said function is relative or supplementary to the main function of ADP System - The functions of the apparatus are controlled by firmware (a chip containing a programme) installed in the product at the manufacturing process. The product contains small flash storage of 2 MB for auto run plug and play feature loaded with its middleware from factory. The product docs not have any function which can even remotely be related to that of a flash drive as used in general parlance. Applicant has stated that when a user buys the product under consideration, he buys it for its function of Digital Signature, Signing, Encryption and Authentication and not to use as a flash drive or pen drive. The applicant s contention that the classification of goods should be based on its primary function, is agreed upon. On th ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... reinafter referred to as 'subject goods'), proposed to be imported and applicability of Sr. No. 2 of Notification No. 24/2005-Customs, dated 01.03.2005, as amended. 2. The applicant is a registered LLP (Limited Liability Partnership) company involved in the business of trading. The applicant is intending to import 'Cryptogenic Device/Token' (ProxKey and ProxKey PRO) (herein after referred as 'subject goods'). In their submissions the applicant has stated the following: 2.1 Both ProxKey & ProxKey PRO represent the same product with same functions, technical specification with different brand name on hardware and its associated middleware/drivers & physical appearance in terms of color. 2.2 Products Overview, Features & Appearance-: a. Cryptographic Device/Token is very portable, easy-to-use and cost-effective solution for strong authentication, secure access and online transactions. It features a plug-and-play capability that brings convenience to end users and is designed to meet the demand for secure, fast and reliable external tokens with built-in secure mechanisms and designed to function with computer systems and automated data processing machined w ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... tself with transforming Electronic record into seemingly unintelligible forms and back again; (b) Use what is known as "Public Key Cryptography", which employs an algorithm using two different but mathematical related "keys" - one for creating a Digital Signature or transforming data into a seemingly unintelligible form, and another key for verifying a Digital Signature or returning the electronic record to original form, the process termed as hash function shall be used in both creating and verifying a Digital Signature. e. Further the Information Technology Act 2000, mandates that the key pair of the user must be mandatorily generated on the FIPS -140-2 Level 2 validated cryptographic Module / Hardware. The Federal Information Processing Standard [FIPS] 140-2 is a U.S. government computer security standard used to approve cryptographic modules. The National Institute of Standards and Technology (NIST) issued the FIPS 140 Publication Series to coordinate the requirements and standards for cryptography modules that include both hardware and software components. Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrit ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... mory of 256 KB out of which only 64KB can be used to store the user's private and public key pairs. The user's key pairs reside in the memory of the Crypto Processor / Module and the private keys can never be exported. h. The products are used for digital signature authentication/identification purposes using a system of a secure key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature using the cryptographic modules / Crypto Processor / Crypto CPU and validated algorithms. i. The products cannot be operated on a standalone basis and it should be operated along with a computer system for its authentication and identification. The products when connected with the computer or ADP read the data embedded in the device and send the information to the network / server to get the authentication for the transaction. Thus it means that mere token/device alone is not sufficient and it has to get connected to the computer system to access the network / server to send the details for its authentication / identification. Cryptographic Device cannot work without an ADPS. j. Rule 2 of the Information Technology (Security Pro ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... poses, classification of goods shall be determined according to the terms of the headings and any relative Section or Chapter Notes. The goods under consideration are classified with reference to the headings and any relative Section or Chapter Notes. 3.2 For ease of reference, the relevant portions of CTH 8471 are reproduced as under: 8471 Automatic data processing machines and units, thereof; magnetic or optical readers, machines for transcribing data on to data media in coded form and machines for processing such data, not elsewhere specified or included 8471 30 - Portable automatic data processing machines, weighing not more than 10 kg, consisting of at least a central processing unit, a keyboard and a display: 8471 30 10 --- Personal computer 8471 30 90 --- Other - Other automatic data processing machines : 8471 41 -- Comprising in the same housing at least a central processing unit and an input and output unit, whether or not combined : 8471 41 10 --- Micro computer 8471 41 20 --- Large or main frame computer 8471 41 90 --- Other 8471 49 00 -- Presented in the form of systems 8471 50 00 - Processing units other than those of sub-headings 8471 4 ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... eption of voice, images or other data, including apparatus for communication in a wired or wireless network (such as a local or wide area network); (iii) loudspeakers and microphones; (iv) television cameras, digital cameras and video camera recorders; (v) Monitors and projectors, not incorporating television reception apparatus. E. Machines incorporating or working in conjunction with an automatic data processing machine and performing a specific function other than data processing are to be classified in the headings appropriate to their respective functions or, failing that, in residual headings 3.4 Explanatory notes of WCO for CTH 8471 a. Subject to the provisions of Notes 5 (D) and (E) to this Chapter, this heading also covers separately presented constituent units of automatic data processing systems. These may be in the form of units having a separate housing or in the form of units not having a separate housing and designed to be inserted into a machine. Constituent units are those defined in Part (A) above and in the following paragraphs, as being parts of a complete system. b. An apparatus can only be classified in this heading as a unit of an automatic data pro ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... sal Serial Bus (USB) port." Thus the IT law itself recognizes the Cryptographic Device as a device, which is connected to the computer system by using USB port. It is able to accept or deliver data in a form (codes or signals) which can be used by the system The content to be signed flows thought the USB port to product and after the electronic record received by the product is converted into an unintelligible form by the private key, another key i.e. the public key returns the electronic record to the original form along with the signature (in this case digital) and transmits the data back to the ADPM to enable it to be printed or electronically transmitted to another device through mail or any other form of transfer. The documents would have the inscription "Digitally Signed by-------------" Not excluded by the provisions of Notes 5 (D) and (E) to this Chapter The product is specifically not covered under list of goods as mentioned in note 5(D). Also product is also excluded from Clause 5(E) since the device has only one core component which is a crypto processor which performs data processing function. 3.5 Classification opinion of WCO for Sub heading 8471 80 is reproduced ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... cessories (Other than covers, carrying cases and the like) suitable for use solely or principally with machines of heading 8470 to 8472, 847330-Parts and Accessories of machines of heading 8471 are capable of directly connecting to and designed for use with an Automatic Data Processing System (Hereafter known as ADPS) of Heading 8471. Relevant headings reproduced as under. The accessories covered by this heading are interchangeable parts or devices designed to adapt a machine for a particular operation, or to perform a particular service relative to the main function of the machine, or to increase its range of operations. Further accessory is in the nature of having a secondary, supplementary or subordinate function by accompanying as a subordinate; aiding in a secondary way; being additional; contributing or being contributory. The products are also in the nature of an accessory which has to be used only with ADP machine for a very distinct function of generating digital certificates and signing, encryption & authentication of data. The said function is relative or supplementary to the main function of ADP System. For the ease of reference relevant portions of chapter 8523 are ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... ing systems, data collection terminals, portable scanners, medical monitoring appliances, audio recording apparatus, personal communicators, mobile phones, digital cameras and automatic data processing machines. Generally, the data are stored onto, and read from, the device once it has been connected to that particular appliance, but can also be uploaded onto or downloaded from an automatic data processing machine. d. The media use only power supplied from the appliances to which they are connected, and require no battery. e. These non-volatile data storage devices are comprised of, in the same housing, one or more flash memories ("FLASH E2PR.OM/EEPROM") in the form of integrated circuits mounted on a printed circuit board, and incorporate a connecting socket to a host appliance. They may include capacitors, resistors and a microcontroller in the form of an integrated circuit. Example of solid state non-volatile storage devices are USB flash drives. The product under consideration in no manner merits classification under heading 8523. The product is very specific to its data processing functions which has a very specific and apt entry under the heading 8471 80. The WCO Explan ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... f the above submission, the product under consideration merits classification under 8471 80 00 as other units of automatic data processing machines or under 8473 30 99- Others - Parts and accessories of the machines heading 8471 (ADPS). However, the product has specific character which are in consonance with principles laid to Chapter note 5C of 84, WCO Explanatory notes to 8471 80 and specific product entry of WCO classification opinion under 8471 80, the product with classifiable under the product with classifiable under CTH 8471 80 00 as other units of automatic data processing machines and eligible to avail benefit under benefit under Sr. 2 of Notification No 24/2005- Customs. 2. The applicant in their CAAR-I form declared that they intend to import the impugned devices, under the jurisdiction of Commissioner of Customs, Mumbai III (Import), Air Cargo Complex, Sahar, Andheri [East], Mumbai- 400099. His application, therefore was forwarded to the jurisdictional commissioner of customs for comments. However, no reply has been received, though reminders have also been sent. 3. A personal hearing was held on 30.01.2023 at 15:30 hrs. Shri Ankush B. Pagaria and Shri Rajesh Gosali ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... aried configurations and operating systems. They are among the securest and lightest cryptographic USB tokens in the world, complying with the most stringent international standards, like ISO 7816 4, 8, 9, FIPS140-2 certified and possesses the most reliable encrypting capabilities like DES, 3DES and RSA. The chip embedded in the device is a highly secure data container as the private key stored on the chip and can never be exported. With this device, users can access web-based applications, corporate networks and carry out online transactions easily, conveniently for consumers; the convenience of a robust yet simple "plug and-play" solution is unbeatable. The product also embodies an internal SPI Flash simulating CD-ROM for Auto Run Plug & Play feature, which provides the software package of mini-driver and allows the user to have a convenient experience. 5.1.5 a. The products closely resemble to USB Flash Drives/ Pen drive as covered under heading 8523 in physical appearance only but its functions, specifications & usage cannot even be remotely linked to USB Flash Drives/ Pen drive. The product used to generate the private key of digital signature which in turn is securely retai ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... his standard specifies the security requirements that will be satisfied by a cryptographic module. e. The products barely have only 1 critical component which determines the functioning of the product i.e. AS518 in the form of Crypto processor IC mounted on the PCB version no K023314A having an USB Interface. AS518 series is a high-performance 32-bit micro-processor based on ARM Cortex-M. The IC has its own RAM, Memory, CPU and various interfaces like USB, SPI, and UART. The IC has built-in hardware algorithm coprocessor provides excellent performance DES/3DES, AES, SFIA, RSA, ECC and other security algorithm module for signing, encryption and authentication. In common parlance these IC's together with all its embedded components, firmware and algorithms are also referred to as Crypto Modules, Crypto Processors, Co Processors, Crypto CPU. This Crypto IC along with its PCB version, Firmware and physical body are validated for FIPS 140-2 Cryptographic Module Validation Program. The various algorithms like DES, AES, RSA, ECDSA, HMAC, SHA, DRBG which the crypto processor support are approved by FIPS - Cryptographic Algorithm Validation Program [CAVP], The, Crypto processor, PCB, U ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... to be returned to the host system. The product is one such hardware token device with cryptographic processor to be used for the purpose and mentioned aforesaid. Further it is also submitted that user's private and public key pairs can be generated and retained only on the memory of the Crypto Processor / Module. The Crypto Processor / Module has very limited memory of 256 KB out of which only 64KB can be used to store the user's private and public key pairs. The user's key pairs reside in the memory of the Crypto Processor / Module and the private keys can never be exported. The products are used for digital signature authentication/identification purposes using a system of a secure key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature using the cryptographic modules / Crypto Processor I Crypto CPU and validated algorithms. The products cannot be operated on a standalone basis and they should be operated along with a computer system for its authentication and identification. The product when connected with the computer or ADP reads the data embedded in the device and sends the information to the networ ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... 1 -- Comprising in the same housing at least a central processing unit and an input and output unit, whether or not combined : 8471 41 10 --- Micro computer 8471 41 20 --- Large or main frame computer 8471 41 90 --- Other 8471 49 00 --- Presented in the form of systems 8471 50 00 - Processing units other than those of sub-headings 8471 4 for 8471 49, whether or not containing in the same housing one or two of the following types of unit: storage units, input units, output units 8471 60 - Input or output units, whether or not containing storage units in the same housing 8471 60 10 --- Combined input or output units --- Printer : 8471 60 24 --- Graphic printer 8471 60 25 ---- Plotter 8471 60 29 ---- Other 8471 60 40 --- Keyboard 8471 60 50 --- Scanners 8471 60 60 --- Mouse 8471 60 90 --- Other 8471 70 - Storage units : 8471 70 10 --- Floppy disc drives 8471 70 20 --- Hard disc drives 8471 70 30 --- Removable or exchangeable disc drives 8471 70 40 --- Magnetic tape drives 8471 70 50 --- Cartridge tape drive 8471 70 60 --- CD-ROM drive 8471 70 70 --- Digital video disc drive 8471 70 90 --- Other 8471 80 00 - Ot ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... m the ADP system to the product and the signed /Encrypted/ Authentication content is returned to the host system. Thus it means that mere token/device alone is not sufficient and it has to get connected to the computer system to receive the data from ADP System signing / Encryption / Authentication. Product cannot work without a computer system. Even the product docs not have its own power source. To perform its data processing functions it need to draw power from its host ADPS. It is connectable to the central processing unit either directly or through one or more other units Rule 2 of the Information Technology (Security Procedure) Rules, 2004 defines "hardware token" to mean a token which can be connected to any computer system using Universal Serial Bus (USB) port." Thus the IT law itself recognizes the Cryptographic Device as a device, which is connected to the computer system by using USB port. It is able to accept or deliver data in a form (codes or signals) which can be used by the system The content to be signed flows thought the USB port to product and after the electronic record received by the product is converted into an unintelligible form by the private key, anot ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... function other than data processing, it is to be classified in the heading appropriate to that function or, failing that, in a residual heading (see Note 5 (E) to this Chapter). If an apparatus does not meet the criteria set out in Note 5 (C) to this Chapter, or is not performing a data processing function, it is to be classified according to its characteristics by application of General Interpretative Rule 1, if necessary in combination with General Interpretative Rule 3 (a). 5.8 Classification opinion of WCO for Sub heading 8471 80 is reproduced as under -Cryptographic processor containing a Data Encryption Standard (DES) encryption algorithm, which is connected as a peripheral device to one or more automatic data processing machines from which it receives commands to perform pre-programmed operations. Its function is to provide the necessary data security functions (e.g., authentication and encryption) which would otherwise have to be performed by software loaded onto the host automatic data processing machine; this eliminates the need for storage of certain security data bases in the automatic data processing machine(s). The functions of the apparatus are controlled by firmwar ..... X X X X Extracts X X X X X X X X Extracts X X X X ..... . 5.10 It is observed that the applicant has not ruled out possibility of classification of goods under consideration under 8473 30 and specifically 8473 30 99 as the product is also in the nature of an accessory which has to be used only with ADP machine for a very distinct function of generating digital certificates and signing, encryption & authentication of data. The said function is relative or supplementary to the main function of ADP System. Notwithstanding this I find that classification opinion of WCO for sub heading 8471 80 incudes under its scope a cryptographic processor containing a Data Encryption Standard (DES) encryption algorithm, which is connected as a peripheral device to one or more automatic data processing machines from which it receives commands to perform pre-programmed operations. Its function is to provide the necessary data security functions (e.g., authentication and encryption) which would otherwise have to be performed by software loaded onto the host automatic data processing machine; this eliminates the need for storage of certain security data bases in the automatic data processing machine(s). The functions of the apparatus are controlled by firmw ..... X X X X Extracts X X X X X X X X Extracts X X X X
|
