FundSERV Inc.

1
FundSERV Inc. The Investment Fund Network
2

• Digital Signatures in a Secure
• e-business Environment
• Amir Jafri
• VP, Technology
• FundSERV Inc.
• Session Image documentation,
• scanning and storage

3
Objectives

• Following this session you will understand
• How digital signature technology works
• The role of a Certificate Authority in creating a
  trust model with a high level of assurance
  
• How a digital signature can be leveraged to
  create paperless processes
  

4
Securing e-Business

• Strong authentication
• Data integrity
• Data confidentiality
• Centralized privilege management
• Non-repudiation

5
Public/Private Keys

• A key pair is made up of two complex numbers that
  are mathematically related
  
• Data encrypted by one can be decrypted by the
  other
  
• One key is designated to be public and is shared
  while the other is designated to be private and
  is not shared
  
• The public key can be used to encrypt information
  for the custodian of the private key

6
The Certificate Authority

• Binds a public/private key pair to a given
  entity
  
• Establishes a trust model which allows strangers
  to exchange encrypted data with confidence
  
• Provides a repository where public keys are
  stored
  

7
The Certificate Authority
USER INFORMATION John Smith President ABC Compa
ny CERTIFICATE INFO Issuer Expiration date S
erial number
Algorithm PUBLIC KEY
Digital Certificate
POLICY BASED AUTHENTICATION
Signed by CA
John Smith Issued by FundSERV Inc.
PRIVATE KEY

• The CA creates an electronic certificate that
  binds the identity of an entity to a
  public/private key pair
  
• The certificate contains unique attributes that
  identify the holder
  
• The certificate may be presented as a form of
  digital identification

8
Portability

• Roaming On Demand
• Smartcard
• USB Token
• Desktop

9
Creating a Trust Model

• Digital certificates can be used for a wide
  variety of applications
  
• Certificate policies and practices must be robust
  
  
• Multiple assurance levels can be created
• Stakeholders must be protected in the event of
  certificate abuse

10
Multi-Tier Trust Model
Certificate Authority
TRUST
Registration Authority
Local Registration Authority
11
Digital Signatures

• Certified identity of user
• Electronic audit trail of transactions
• Detection of altered content
• Efficient processes
• Reduced paperwork

12
Digital Signature Creation
Hash
Encrypt with Private Key
Apply Signature
DIGEST
Append to document
13
Digital Signature Verification
Hash
DIGEST
?
Decrypt with Public Key
DIGEST
14
Adobe Acrobat Example
Clicking on signature box initiates signing
process
15
Adobe Acrobat Example
User is prompted to unlock certificate
16
Adobe Acrobat Example
User is prompted to confirm signature
17
Adobe Acrobat Example
Digital signature is applied to document
18
Web Form Example
Digital signature is applied to a web transaction
19
Questions