Today we want to analyse one of the latest trends in authentication, cloud signature. Do you know what it is used for? We are going to present its use for the authentication of procedures between companies or administrations, as well as its main advantages.
What is cloud signature or centralized signature?
It is a highly secure authentication solution and improves the usability of the signature.
As its name suggests, it is characterised by the fact that the digital certificate is hosted on a secure server (HSM), which the user accesses when he/she wishes to digitally sign a document by means of prior authentication of his/her identity in a robust manner.
Strong identification requires at least two identification procedures which can be: something that “the user knows” (password), something that “the user has” (key card, sms token, otp token, etc), something that “the user does or is” (signature, voice, fingerprint, iris and other biometric factors).
Thus, the certificate is never in the hands of the owner, but will be available whenever the user needs it, allowing authentication without the need to install any certificate or software on the device from which the transaction is carried out.
Cloud technology
As you know, cloud technology and systems are gaining importance every day. Undoubtedly, this trend extends to the field of authentication, leading to the emergence of the cloud signature.
Cloud computing is a very broad discipline with various modalities. For the matter in hand, it is worth highlighting the importance of the SaaS – Software as a Service – distribution modality, which allows the user to work with certain applications and programmes without the need for them to be installed on their computer. This increases the usability of the application in question since it is possible to access it from any device.
The rise of cloud services and applications is partly caused by the need we currently have, especially in professional environments, to have all the information available from any mobile device or tablet, just as we would from our desktop computer.
Thus, the increase in the use of mobile devices and their irruption in the labour market has led to the adaptation of the rest of the sectors to this mobile reality.
Mobility trends indicate that the use of mobile devices is increasing every year. In Spain, 77.1% of internet users accessed the internet in this way. Globally, it is estimated that 3.2 billion people worldwide have access to the Internet, of which 2 billion will use it via mobile devices.
As the need for mobility solutions increases, so does the requirement for authentication systems adapted to the new market conditions.
Until now, the signature of digital documents had to be linked to the traditional digital certificate in order to be legally valid. This can come in hard copy (smartcard, DNIe) or in software. In this case, the Certification Authorities issue the certificate in a file that is installed in the user’s web browser or operating system.
But after several years on the market, they have not been consolidated due to the multiple usability problems involved, so it was necessary to find a procedure to access certificates easily, conveniently and securely. This is how the cloud or centralised signature came about.
The European Union has not been indifferent to the need for this type of solution. That is why in its Regulation UN 910/2015 it promotes cloud signatures with the aim of consolidating a single European digital market (Digital Single Market). This new regulation requires member states to recognise, under certain conditions, the electronic identification means of natural and legal persons covered by the electronic identification scheme of another member state that has been notified to the Commission.
In other words, the European Union not only legally supports this solution, but is also doing everything in its power to extend it to all member states.
Advantages of Cloud or Centralized Signatures
This solution has many advantages, of which we can highlight three in particular: improved security, increased mobility and reduced costs, and usability. Let’s take a closer look at them below.
Improves security
The fact that the certificate is not physically installed on any device increases its security.
If the certificate is on a device where passwords are usually stored, it is relatively easy for someone else with access to the device to sign for us. However, in order to use the cloud signature, as mentioned above, two authentication factors are required.
It facilitates mobility and reduces costs:
This solution allows you to electronically sign documents from anywhere, with the only requirement of internet access.
By reducing time, waiting and maintenance costs are reduced. As well as being environmentally friendly, going paperless also reduces material and procurement costs.
Usability:
It is a user-friendly system. Usability is one of the main advantages of this type of digital rubric.
The tool works in a very simple way: by pre-registering, the physical identity is linked to the digital identity (enrolment). This makes it possible to issue a personal certificate on a secure cloud server (HSM) that will be invoked when needed.
Cloud signature promotes a significant improvement in usability for citizens and administrations. It allows them to interact, stay connected and carry out procedures securely and from anywhere.
How does eIDAS influence the development of the cloud signature?
After learning about the functioning and advantages of cloud-based digital signatures, the European guidelines advocating their implementation and use become more understandable.
In line with the Europe 2020 guidelines, work is being done to ensure that the digital transformation reaches all member states equally and progressively. The European Commission is committed to the digitisation of public institutions with the aim of optimising management and administrative procedures.
In order to regulate these technological developments, eIDAS, a European regulation on “electronic identification and trust services for electronic transactions in the internal market”, was born.
One of the objectives set out in this regulation is Europe’s interest in achieving a digital single market (DSM), which facilitates procedures and formalities between EU partners.
With this regulatory framework, we can understand the Commission’s commitment to cloud-based signatures to facilitate, promote and optimise administrative relations between member states.
The cloud signature is therefore a solution that respects the eIDAS regulation and is adapted to the centralising and universal mission proposed by the DSM (Digital Single Market). This intuitive tool allows any European citizen, subject to certain requirements, to identify themselves and interact with any EU entity and institution.
So much for our analysis of the cloud signature, a solution that, combined with a suite of suitable authentication products, can represent a technological advance for entities and institutions that want to improve their administrative management and optimise their procedures.