Success Stories – SecureMark Digital Certificates

Equifax Automated Individual / Business Authentication +
GeoTrust Automated Certificate Issuance

SecureMark Digital Certificates are tScheme compliant S/MIME digital certificates that meet the requirements of the UK Government’s authentication framework and allow individuals and businesses to take advantage of the Government Gateway (http://www.gateway.gov.uk), as well as to add security to their personal / business emails and electronic documents.

SecureMark Digital Certificates are the result of a unique technology partnership between Equifax UK and GeoTrust Europe. Equifax’s automated verification processes are integrated with GeoTrust’s automated issuance processes to meet the stringent authentication requirements demanded by the Government. As a result, a SecureMark Digital Certificate is both recognised by the Government Gateway and due to Equifax’s unique authentication process and GeoTrust’s issuance platform (the fastest certificate issuance system in the industry) the applicant can begin using their certificate shortly after enrolling.

The enrollment process is simple – the applicant’s identity is verified during the online enrollment process through a series of multiple choice questions. The questions are formulated by Equifax using its US patented eID verifier technology which accesses data held on over 45 million UK individuals, By correctly answering the personalised questions, the applicant is proving who they claim to be. Upon a successful decision that the identity of the applicant is confirmed, GeoTrust will issue a SecureMark Digital Certificate containing the details of the applicant – effectively providing the applicant with a digital identity encapsulated within the SecureMark certificate.

The SecureMark Digital Certificate is the online equivalent to a driving license or passport and can be used to authenticate the certificate holder to online resources such as the Government Gateway. The SecureMark Digital Certificate may also be used to digitally sign emails and documents, thereby ensuring integrity and authorship.

The Government Gateway enables individuals and businesses to use many of the UK Government applications and services that are now available online. Such examples include the sending of Tax returns, VAT returns, IACS Area Aid Applications and Export declarations using appropriate Government web sites, portals or even through third party software packages.

A SecureMark Digital Certificate provides two critical functions: to authenticate the applicant to the Gateway, and to ensure any e-forms submitted remain integral (through the use of digital signatures). In order to be used to authenticate, it is essential that the certificate represents the true identity of the certificate holder.

Specifically the certificate must be issued to a “level 2 standard” as per the Government’s authentication framework. The authentication framework dictates that to meet level 2 there must be substantial assurance that the registrant’s real world identity has been verified. Level 2 involves the verification of the applicant’s personal or business details (including cross-checking) to demonstrate evidence of identity. In many cases the authentication may also involve the use of third party evidence to corroborate any details supplied by the application during certificate enrollment. Equifax verifies the real-world identity of the applicant using its industry leading and US patented eID verifier system and, providing the applicant is verified successfully, GeoTrust issues the certificate in accordance with the relevant technical standards.

Which Government Gateway services can I use my SecureMark Digital Certificate?
• Inland Revenue (Self Assessment and Corporation . Employer Tax
  services)
• New Export System – NES (HM Customs & Excise)
• DTI Export License
• Duty Deferment Electronic Statements (C&E)
• Corporate Tax (Inland Revenue)
• Rural Payments Agency (RPA) for IACS Area Aid Application
• Plus many more – see www.gateway.gov.uk for further details

SecureMark Digital Certificates are only made possible due to the unique GeoTrust Europe and Equifax UK technology partnership. The integration of automated technology for verification and issuance developed by Equifax and GeoTrust result in SecureMark certificates being ideal for individuals and businesses requiring a certificate that is both recognised by the Government Gateway, and is issued quickly and inexpensively.

Other certificates recognised by the Government Gateway are manually validated, which result in longer issuance times and higher costs to the applicant, whereas SecureMark Digital Certificates are available for only £25 plus VAT and are issued quickly.

Using a SecureMark Digital Certificate outside of the Government Gateway
SecureMark Digital Certificates can be used both inside and outside of the Government Gateway. Outside of the Gateway, the certificates may also be used to secure and sign the email / documents of the certificate owner, regardless of whether they are an individual or business. The certificates may also be used to authenticate the certificate owner to commercial web sites or online resources.

Summary of uses for a SecureMark Digital Certificate:
• Authenticate user of Government Gateway services
• Digitally signs electronic forms submitted to Government bodies through
  the Gateway
• Digitally sign personal / business email
• Encrypt personal / business email
• Digitally sign documents, such as Office files and PDFs
• Authenticate user to web site or online resource

Digitally signing an email or document will ensure it remains integral during transmission over the Internet. Any changes made to the digitally signed “object” will invalidate the signature and alert the recipient to
potential tampering.

SecureMark Case Study: UK Export Declarations
From 27th October 2002 the only way for exporters to submit export declaration applications to HM Customs and Excise at sea port and inland locations is electronically. This follows the launch of the New Export System (NES - NES is an electronic CHIEF (Customs Handling and Export Freight) based export processing system developed by Customs, in consultation with the trade) and is part of the Government’s plans to improve the efficiency and security of its transactions with businesses and individuals. Exporters with SecureMark Digital Certificates can use their certificates to make their declaration applications in a number of ways:

Web channel:
Exporters can connect directly to the CHIEF through their Internet browser. At sign-in point, the Government Gateway automatically authenticates the user through their SecureMark Digital Certificates. This method is ideal for exporters with low volumes of declarations. It is also ideal for “one-off” declarations as only the SecureMark certificate and a browser is required.

XML channel:
The declaration is sent to CHIEF in an XML wrapper. When the data is posted, the Government Gateway authenticates the sender through their SecureMark Digital Certificates. This method is ideal for large volume declarants.

The implementation of NES by HM Customs and Excise provides greater assurance to exporters and helps Customs meet its legal and procedural obligations more effectively. The ability for exporters to use SecureMark certificates has proven to be particularly valuable to small to medium exporters who have an immediate need to quickly, easily and securely submit their declarations.

SecureMark Case Study: UK Rural Payments Agency
The Rural Payments Agency (RPA) is an Executive Agency of the Department for Environment, Food and Rural Affairs (Defra). To meet its May 2003 deadlines, the RPA pressed to simplify and improve the efficiency for the submission of IACS Area Aid Applications by making application processes available online.

With more than 50,000 British farmers and selected agricultural agents now able to utilise the Internet to support their business operations, online IACS Area Aid Applications were a valuable means of easily and securely making electronic transactions.

In order to achieve the necessary level of authentication and security, the RPA integrated the use of SecureMark Digital Certificates into its application processes. Namely, the farmer would be authenticated through their certificate; their certificate would then be used to digitally sign the application details to ensure ownership and integrity (e.g. the form had not been tampered with during transmission).

There were many benefits in using SecureMark Digital Certificates for both farmers and the Government. For example being able to complete the forms online saved the farmer time. It also reduced the chance of making errors in the form as totals were calculated online, inconsistencies highlighted and automated guidance was provided throughout the process.

The certificate application and issuance were completed in a single on-line session with the minimum of data needing to be entered by the registrant. The process was made through what appears as a dedicated RPA Internet site.