Digital Transactions Infrastructure

OpenTrust SPI

Safeguarding your business is our Focus 1/36

Digital Signature – Technical

Elements

Digest (hash) AOXIpjPDCS2z810AXDrKcv91qY=

Digital Signature V9FAokEfM8+yawm9wlQX………Flg68GKbjlNaZSzK4k=

Timestamp December 29, 2014 13:45:02.100 GMT

+ timestamp signature

Certificate Revocation List (CRL) December 29, 2006 14:00 GMT n° 02 01 fd b5..85 04/12/2014 12:30:20 n° 83 35 2a f4..ea 03/23/2014 10:37:00 or

OCSP Response + CA signature

Certificate Trust Chain

Document(s)

Signatory

Timestamp

CA (PKI)

2/36

Why you choose RecroNet?

Secured Non-repudiation

Compliance

Digital Signature Transaction Platform

eForms Data

Preparation

Customized Workflow

1

Verification Authentication eSign

Execution

2

Archiving

Completion

3

Audit Trail Reporting

Banking CRM ERP

Platform

Integrations

Anyone, Anything,

Anywhere, Anytime

3/36

The Solution and e-Government –

Scenario

Government

• Streamline the way government operates and improve the government to citizen experience, Accelerate the government services process

• Day to day communications & Gov Services channels

• Easily verify the documents who’s signing

Dept.

• Go paperless, eliminate inefficiencies, and add the mobility, accessibility, and convenience modern citizens , LLC expect with Digital Signature

• With fast, efficient, fully digital Solution that seamlessly integrate with existing forms, documents, workflows and back-end systems/ ERP.

• Improve the staff productive, citizen and other services

Legal

• Non-disclosure agreements, Board minutes

• Business contracts and agreements

• Policy management and compliance, further improve the data & Security

• Delight your citizen and partners

4/45

Regulations and Standards…

…are ready

• Regulation Framework – European Directive 1999/93/CE, December 1999

– Loi n° 2000-230 Mars 2000, Décret n°2001-272 Mars 2001

– Electr. Communications Act 2000, Electr. Signatures Regulations 2002

– German Act on Digital Signature 2001, Signature Ordonnance 2001

– US SEAL (1998), UETA (1999), ESIGN (2001)

– Croatia (Act on Digital Signature, NN 10/02, 80/08, 30/14)

– .…

• Signature Formats – ASN.1/DER format: PKCS#7, CMS (RFC 3369), PDF Signature,

CADES

– XML format: XML-DSIG, XADES (ETSI TS 101 903)

Note: Please consult your legal advisor if you have any other question regarding the legality of e-Signature

5/36

eSignature Legality in UAE

• Electronic Signature has been recognized by law in the United Arab

Emirates since 2006, with the passage of the Electronic Commerce Law.

Court Admissible General Business

E-Signature Legal Model

• eSignature Legality Summary Under UAE law, a written signature is not necessarily required for a valid contract – contracts are generally valid if legally competent parties reach an agreement, whether they agree verbally, electronically or in a physical paper document. To prove a valid contract, parties sometimes have to present evidence in court. Leading digital transaction management solution can provide electronic records that are admissible in evidence, under UAE laws, to support the existence, authenticity and valid acceptance of a contract.

DISCLAIMER: The information on this site is for general information purposes only. You use this information at your own risk. For legal advice or

representation, contact a licensed attorney in your area. Laws may change quickly, so RECRO-NET, cannot guarantee that all the information on this form is current or correct

6/36

PKI Architecture - Elements

7/36

Token Enrollment for Strong

Authentication

HSM

Bank’s Security Officer

Customer

Face to face enrollment of Bank’s Customer : - USB Tokens of the Security Officer and of the customer are connected at the same time to the same computer, to seal electronically the face to face - Authentication and Signature key pairs are generated on board of USB Token This ensures the non-repudiation of USB Token emission

Customers Identities LDAP

Repository

8/36

Typical process of signing

Business User

Signature & Validation

Server

Business Application

Web Interface

Sign Applet

Document

Browser

Document

Archive / Backoffice

Application/ ???

4 2

3 1

Steps to ensure non-repudiation: 1. Web application displays form and sends it business user. 2. The user fills out the form and digitally signs it using a smart card and Sign Applet 3. Web interface sends the signed document to SPI server to add the time stamp. 4. Web interface sends the signed document for further processing and storage.

RFC 3161

9/36

SPI Architecture

SOAP Connectors Web service

Server Signature Signature Validation Proof Management

User/rights Management Keystore Management Audit/Log

Management Profile Management

3rd party connectors

Security

Devices (HSM)

TimeStamp

Services Certification

Authorities

Archive

Services

Batch Processing

Web Portal Client/Server Application

Vendor Software

OpenTrust

SPI Applet

OpenTrust

Sign Viewer OpenTrust

SPI SDK

OpenTrust SPI Security Server

HTTPS

Web Console Management

User

Business Applications

TimeStamp

Services

10/36

SPI Technical Architecture

11/36

RECRO–NET Middle East

2702A Business Central Towers

Dubai Internet City

P.O. Box: 503012 Dubai

United Arab Emirates

Tel: +9714-4347599 / +9714-3754306

E-mail: middle-east@recro-net.com

www.recro-net.com

THANK YOU FOR TIME!

12/36