Roaming : E Signature : Two Factor Authentication : Digi-Sign.com

Digi-ID™ [1] digital signatures make it possible to trust electronic transactions as if they were printed on paper and signed by a trusted business partner. To have the same trust in a digital signature, the private keys used for signing must be protected.

Typically, this protection is provided by installing the Digi-ID™ on the users' computer, Digi-Token™ [2] or Digi-Card™ [3]. In cases where complete mobility is required and tokens or cards are unsuitable, the solution is to have roaming digital signatures that are accessible from any web browser, 'anywhere'.

Using a central server that stores the user’s private key in a secure database, the user can use their Digi-ID™ at any time over the internet (i.e. from a web browser or e-mail client). Two factor authenticated [4] access ensures that the private key remains under the user’s sole control and that it is easily accessible.

Compared to traditional key storage solutions where software, tokens or smart cards are used, this roaming solution offers:

• Enhanced Key Protection - the private keys are generated in and never leave the server’s high security environment.

• Enhanced Security - the private key is protected by the user’s password at all times, which means that not even the signing sever can access the key

• Mobility – signer can always be reached via the internet and does not require installation of software on the user's side

• Central Key Management – simplifies otherwise complex tasks like key renewal and policy enforcement

This roaming solution consists of two servers: a signature server and an authentication server. APIs in ANSI-C or Java and a standardised PKCS#11 and MSCryptoAPI Cryptographic Service Provider [CSP] are used to interface with these servers. The authentication server is invoked by the signature server to authenticate the user’s request using two factor authentication [4] and once granted, gives the user control of their digital signature, as required.