@eLaw.com.hk 葉謝鄧律師行

Certificate Repository

Certificate Internal Database is a database to keep track of the pending certificate request, issued or revoked certificate, private Certificate Revocation List (CRL), etc. Only RA and CA have the rights to update this database. A web user interface will be provided for users to query the status of their certificate requests and any issued or revoked certificate. Various fields in certificate, such as serial no, expiry date, subject name, etc will be indexed. This will allow faster queries based on these standard attributes.

A high performance directory server, based on the IETF LDAP standard, is used as a public repository of Certificate Revocation List (CRL), user and CA certificates. Its design is based on the RFC 2587 schema. A standard LDAP interface will be provided to native client for retrieving certificate for applications like S/MIME or SSL client authentication.

Concept of Public Key Infrastructure (PKI)

PKI covers the use of public key cryptography for authentication and access control of a user, guaranteeing the integrity and non-repudiation of documents signed by the user, and confidentiality of data.
PKI employs a pair of keys for each user: a private key which is known only to the user himself, and a public key which is published by some authority, in the form of a digital certificate (certificate for short).

In signing a document or an e-mail, a user signs using his own private key so that others can use the signer's public key to verify the authenticity and non-repudiation of documents or e-mail. Since only the user has his own private key to sign, non-repudiation is established.

Before sending an encrypted e-mail to a receiver, the sender installs the receiver's certificate in the sender's e-mail program which supports the use of PKI technologies. The program can, on the sender's instruction, encrypt an e-mail using the receiver's public key. The receiver, on receiving the encrypted mail, can use his private key to decrypt the mail. Since only the receiver has his own private key, the encrypted mail will only be readable by him. Others, even if they can get hold of a copy of the encrypted mail over the network, would not be able to read the encrypted mail as they do not have the receiver's private key to decrypt the mail. The use of PKI saves the trouble of maintaining and distributing the same encryption/decryption key between the sender and the receiver.

The e-mail program Netscape Messenger v4.7x supports the signing and encryption of e-mail using 1024-bit RSA keys and certificates.

By using strong public key cryptographic algorithms, such as 1024-bit RSA keys which the HKU CA and Hongkong Post are employing, it is practically impossible for anyone to crack the private key from the public key within the life-time of a private key.

HKU Certification Authority (HKUCA)

HKU Certification Authority (HKUCA), run by the HKU Computer Centre, set up public key infrastructure (PKI) to issue HKU digital certificates (HKU-Cert) from 22nd September 2000 to current HKU staff and students (HKU members).

Personal: the HKU-Cert of a HKU member serves as his digital identity for him to authenticate himself and sign electronically in using HKU Electronic Services Delivery (HKUESD) of digital signature applications.

Server: from 1st February 2002, HKUCA also issues HKU-Cert (Server) to administrators of computer servers approved by HKUCA. The server named in a HKU-Cert (Server) can use the certificate in applications employing Secure Socket Layer (SSL) encryption.

According to the University, HKUCA is not seeking Recognized CA status, as defined in the Electronic Transactions Ordinance, from the Director of Information Technology Services Department of the HK SAR Government. Therefore, HKUCA is not subject to the governing rules and regulations set out in the Electronic Transactions Ordinance.

Provisions as to confidential disclosure, etc.

An application for the registration of a design shall not be refused, and the registration of a design shall not be invalidated, by reason only of:
(a) the disclosure of the design by the owner to any other person in such circumstances as would make it contrary to good faith for that other person to use or publish the design;

(b) the disclosure of the design in breach of good faith by any person other than the owner of the design;

(c) in the case of a new or original textile design intended for registration, the acceptance of a first and confidential order for goods bearing the design; or

(d) the communication of the design by the owner to a government department or to any person authorized by a government department to consider the merits of the design, or of anything done in consequence of such a communication.

An application for the registration of a design shall not be refused, and the registration of a design shall not be invalidated, by reason only:

(a) that a representation of the design, or any article to which the design has been applied, has been displayed, with the consent of the owner of the design, at an official international exhibition;

(b) that after any such display as is mentioned in paragraph (a), and during the period of the exhibition, a representation of the design, or any article to which the design has been applied, has been displayed by any person without the consent of the owner; or

(c) that a representation of the design has been published in consequence of any such display as is mentioned in paragraph (a), if the application for registration of the design is made not later than 6
months after the opening of the exhibition.

Here, "official international exhibition" (正式國際展覽) means an official, or officially recognized, international exhibition falling within the terms of the Convention on International Exhibitions signed at Paris on 22 November 1928, and any protocols to that Convention, as revised or amended from time to time.

Computer programs, protected layout-designs (topographies) and designs for articles of a primarily literary or artistic character

Computer programs and protected layout-designs (topographies) are not registrable.

Provision may be made by rules for excluding from registration under this Ordinance designs for such articles of a primarily literary or artistic character as the rules may specify.

Designs contrary to public order ("ordre public") or morality are not registrable

A design the publication or use of which would be contrary to public order ("ordre public") or morality is
not registrable.

The publication or use of a design shall not be considered to be contrary to public order ("ordre public") merely because it is prohibited by any law in force in Hong Kong.

Designs are not registrable if appearance of article is not material

A design is not registrable in respect of an article if the appearance of the article is not material, that is, if aesthetic considerations are not normally taken into account to a material extent by persons acquiring or using articles of that description, and would not be so taken into account if the design were to be applied to the article.

Registrable designs

A design which is new may, upon application by the person claiming to be the owner, be registered in respect of any article or set of articles specified in the application.

A design for which an application for registration is made shall not be regarded as new if it is the same as:

(a) a design that has been registered in pursuance of a prior application, whether or not that design has been registered in respect of the same article for which the application is made or in respect of any other article; or

(b) a design that has been published in Hong Kong or elsewhere before the filing date of the application, whether or not that design has been published in respect of the same article for which the pplication is made or in respect of any other article, or if it differs from such a design only in immaterial details or in features which are variants commonly used in the trade.

The Registrar may, in such cases as may be prescribed, direct that for the purpose of deciding whether a design is new an application for registration shall be treated as made on a date earlier or later than that on which it was in fact made.

Defences to Product Liability

A defendant in a product liability action can raise many of the traditional tort defences.

A plaintiff's own negligence may reduce the potential damages based upon the degree of the plaintiff's comparative fault. That is the concept of contributory negligence.

If a person knowingly and unreasonably assumes the risk of a known danger, the manufacturer cannot be liable for the injuries that result. Thus, a person who intentionally pointed the laser beam to his eye and thereby hurt will not be able to recover injuries from the outlet maker. Some products, such new drugs like depressant, sex stimulant, may be dangerous, but not unreasonably so. To avoid liability, the dangers (such as side effect) should be made known to the public, and the seller clearly warns of the dangers, and properly packages and labels the product. Whether measures are adequate depend individual cases.

A manufacturer might also not be held liable if someone uses a product in an unforeseeable or unreasonable manner. For example, a person is injured on use of an electrical fan whose protective shield has been removed.

In cases of design defects, manufacturers may be able to escape liability on the basis of the "state of the art" defense, which asserts that the manufacturer has used the best available technology and design to make the product as safe as possible. If there is no safer known design, a manufacturer might not be liable for design defects. That is a matter of evidence that the manufacturer has to establish when defending his case.

Liable Parties in Product Liabiltiy

Generally, any person or entity in the chain of distribution can be liable for a defective product, including manufacturers, distributors, wholesalers and retailers.