Patent Description:
A digital certificate is an essential basis for the identification of individuals or legal entities through official and reliable data sources, thereby constituting a secure means that can technically and legally allow verifying the identity of said entities over the Internet. Further, digital certificates enable the electronic signature of documents in a secure way, reducing the risk of tampering and generating reliable proofs of work and ownership through said signature.

The issuance and use of digital certificates are normally based on standards and legal regulations, such as the European Union (EU) regulation elDAS ("electronic IDentification, Authentication and trust Services") which states:.

The main advantages of using a digital certificate as credential for verifying the identity of an entity (person or company) comprise:.

Digital certificates are issued by competent entities, better known as Certification Authorities (CA) and contain relevant information for verifying the owner's identity, whether it is a person or a specific entity (company, institution, etc.). The digital certificate comprises, at least, the following: owner's data (such as the name or the tax identification number), public and private keys, issuance and expiration dates and other information about the issuing entity.

The digital certificate comprises two sorts of keys:.

A digital certificate may have different physical supports:.

Further, digital certificates are also classified according to the information they store. For instance, there exist natural person certificates, certificates of legal entity representative or public administration certificates, among others.

With regard to their validity and revocation, sometimes it is possible to invalidate a certificate before expiration by a request to the corresponding certification authority. Some of the most common reasons to revoke a certificate are:.

There exist many authentication procedures regarding the contracting of product or services of different nature. When contracting a service or a product, sometimes the supplier party may require a risk analysis to evaluate certain factors (economic status, criminal record, etc.) before validating an agreement. However, the obtention of said information mainly falls on the contracting party, who must carry out the appropriate procedures with different and departments of several entities (e.g. offices of Public Administration) to gather all what is required. This complex process involves significant drawbacks at the logistics management, and also from the administrative and legal points of view. For example, the supplier of the service or product almost completely depends on the contracting party, since it is really difficult to control and avoid the risk of fraud by reviewing and checking all the information provided by the client.

Other authentication solutions are known in the art. For instance, the articles "<NPL>), "<NPL>) and "<NPL>) disclose different system architectures for managing attributes associated to identified users. However, these solutions require the end user to authenticate separately before a plurality of identity systems to retrieve the attribute information. Contrary to such proposal, the invention provides a more advantageous solution involving less complexity for both the client and the supplier of a transaction.

The present invention overcomes the aforementioned problems and provides a server system that enables one or more clients to obtain information from one or more final users, straightforwardly from reliable third-party sources instead of relying on the information provided by said final users. Indeed, the invention is aimed at providing with an information system that is able to integrate one or more digital certificates of a final user, then to collect information of said client from different trusted third-party sources (i.e. Public Administration) and, finally, to report the consolidated data to a client. Through personal identification in electronic websites (usually with an electronic certificate), the invention can request data and obtain certificates in real time on different Public Administrations. This process provides with significant time and cost savings. But more importantly, it avoids the possibility of fraud since it is the Public Administrations or Government Entities themselves who provide the required documentation and information.

The invention provides an information system that integrates with the electronic websites of different government agencies (further referred to as certifying authorities) in order to obtain information associated with an entity (natural person or company) and corresponding digital certificates. The process of integrating and obtaining information can be adapted and parametrised according to the corresponding administrative procedure. Some examples of preferred applications of the invention are:.

A first object of the invention relates to an information system for managing at least one digital certificate from an end user in electronic transactions. Advantageously, the system comprises, at least:.

In a preferred embodiment of the invention, the gateway application of the information system further comprises searching means adapted to automatically search the digital certificate locally installed in the workstation. In a further preferred embodiment of the invention, the searching means are adapted to automatically search further digital certificates in the workstation. In this way, the gateway application is configured to select which certificates are needed for conducting the electronic transaction.

In a non-limitative embodiment, the information system further comprises at least one secured encrypted channel to conduct the electronic transactions among different elements of the invention, in particular, the server, the client, the certifying authorities and the end user workstation.

In other embodiments of the information system, the server further comprises a server web interface through which it communicates with the client or at least one certifying authority.

In other preferred embodiments of the information system, the server further comprises a service catalogue database with a list of plugins associated with different electronic transactions. In this way, said list comprises information about which certifying authorities are verified depending on the required particular electronic transaction.

In another embodiment of the information system, the server of the information system further comprises data processing means adapted to automatically process and interpret the information exchange among the server, the client, the certifying authorities, and the workstation.

In a particular embodiment, the server of the information system further comprises second electronic delivery means adapted to send installation requests to the workstation and data storage means adapted to store end user digital certificates. Advantageously, these data store means enable the digital certificate storage to reuse it in future transactions required by the same end user. These data storage means comprise one or more databases. In more preferred embodiments, the installation request comprises a link to a website where the gateway application is hosted or a file with said gateway application attached.

Other alternative embodiments of the invention comprise a plurality of servers, clients and/or workstations. Advantageously, a plurality of servers provides data redundancy and additional security.

A second object of the invention discloses a method for managing at least one digital certificate of an end user in electronic transactions, wherein said method comprises the use of the information system described above, and further comprises performing the following steps:.

In a preferred embodiment of the method of the invention, the server obtains the digital certificate by verifying whether or not it exists at least one valid digital certificate available for performing the electronic transaction and stored in the data storage means; followed by alternatively performing one of the following options:.

In a more preferred embodiment of the invention, the server further transforms the trusted information acquired from the certifying authorities into interpreted trusted information by means of data processing means, before sending said interpreted trusted information to the client. In this way, the server may use standard scraping techniques to structure the raw data received from the certifying authorities, depending on the format requirements of the client.

In alternative embodiments of the invention, the digital certificate is stored in the server in order to reuse said digital certificate in future transactions, prior acceptance of the end user. In this way, it avoids unnecessary additional information exchange with the end user.

In further preferred embodiments of the invention, the server is configured to disaggregate and anonymise the trusted information and obtain statistics from said information.

In the context of the present invention, the term "machine" or "workstation" refers to any computer means (computer, mobile phone, tablet or other suitable electronic device) comprising the hardware and software means required for installing and executing any component of the invention. Moreover, an "electronic transaction" or simply "transaction" refers to the information handshake among different elements of the system disclosed in the present application in order to acquire a product or service, or any other procedure involving an information validation.

The accompanying drawings comprise specifically the following figures:.

The invention proposes a solution based on an information system, intended to manage information and documentation data from different electronic websites and online platforms (for example, from the official authorities), in real time and in a secure way. The general purpose of the invention can be illustrated with the following example: a bank requires the financial status verification of a natural or legal person (e.g. an individual or a company) in order to issue a loan. In this context, instead of requiring this person (hereinafter referred to as end user) a set of required data, the bank may use the system of the invention to obtain relevant information from official sources (government, tax agencies, etc.) with the prior consent of the end user.

The architecture of the system according to a preferred embodiment of the invention is summarised in the <FIG>, which comprises: a server (<NUM>), a client (<NUM>), a certification authority (<NUM>) or third-party and an end user workstation (<NUM>). In this particular case, the server (<NUM>) comprises a back-end application (<NUM>) of the information system, the client (<NUM>) is identified as the bank, the certification authority (<NUM>) or authorities are the third-party official sources of information (government agencies, etc.) and the end user uses a workstation (<NUM>). The main components of the server (<NUM>) have also been detailed in <FIG>, comprising: the back-end application (<NUM>), which operates as a gateway; the server web interface (<NUM>); web services (<NUM>) comprising service catalogue databases and access to centralised certificates (e.g. X509 certificates) of different end users; and optional data storage means (<NUM>), such as one or more local databases, for storing different user credentials (i.e. digital certificates).

<FIG> corresponds to a further preferred embodiment of the invention in which the main components of the client (<NUM>) and the end user workstation (<NUM>) are displayed. In particular, the client (<NUM>) comprises a client web interface (<NUM>) for communicating with the server (<NUM>) and an optional digital certificate (<NUM>). The end user workstation (<NUM>) comprises a web browser (<NUM>), a gateway application (<NUM>) and a plurality of digital certificates (<NUM>), in this case, local digital certificates (<NUM>). The client web interface (<NUM>) enables the access to the server web interface (<NUM>), thereby serving as the front-end of the invention. When one or more local digital certificates (<NUM>) of the end user are involved in the authentication process, the gateway application (<NUM>) comprises a module for reading the local digital certificates (<NUM>), which is identified as a client certification provider. This client certification provider is intended to enable the use of the local digital certificates (<NUM>) for the process of identifying the end user before the public administrations in the context of a transaction. In this way, thanks to client certification provider, the local digital certificates (<NUM>) are accessible to the client web interface (<NUM>) from which the transaction is being managed.

The basic steps to obtain information about an end user with the information system involve:.

The operation of the information management platform provided by this invention is possible since it is the end user, who is the interested party in a certain transaction and provides the server (<NUM>) with the necessary credentials, such as its digital certificates (<NUM>), for the identification before the certifying authorities (<NUM>) websites in order to verify end user information. In this way, the invention can embed itself into a third-party corporate application, thereby integrating itself as one more element of the administrative flow defined said third-party entity. This approach fosters the automatised data management and collation received from official and trusted sources, thereby reducing as much as possible the fraud possibilities and misleading information provision to the client (<NUM>) during the transaction.

The back-end application (<NUM>) acts like a payment gateway, and it operates according to the specifications of the certification authority (<NUM>) platform, providing it with the information required. Additionally, the invention exhibits a high degree of customisation and preferably allows the incorporation of the third-party's logos and style guide. Consequently, it enables the visual and operational perception that the invention is part of the third-party operational flows in a transparent way. The invention comprises several plugins which specify which third-party websites can be visited to collect information and which procedures must be carried out and included in the consolidated data of the end user that are obtained from the certification authorities (<NUM>).

<FIG> illustrates the flow of the operation of an embodiment of the invention, applied for risk evaluation oriented to grant a loan. According to the alphabetical references from <FIG>, the following steps are performed (in the same order in which they are described):.

The integration processes performed to yield interpreted data are based on a REST API ("application programming interface") that allows the gathering of documents and relevant information from different sources. The procedure can be easily integrated by means of API methods because it works as a point of sale (POS) as it were a payment gateway. Most of these methods, listed below, comprise add, delete, list and update commands and can be easily implemented by an expert of the technique:.

With regard to the restrictions and equipment requirements (hardware and software), the invention incorporates a component, the client certification provider, on the end user workstation (<NUM>) aimed at obtaining one or more end user digital certificates (<NUM>), installed locally in its machine. the use of this preferred embodiment is applied to Windows (Microsoft) machines. Other prerequisite is the availability of a valid digital certificate (<NUM>). If the product selected by the end user requires the consultation of data in third-party electronic websites or platforms, it will be necessary to have at least one valid digital certificate (<NUM>) accepted by these platforms. For this reason, the digital certificate (<NUM>) must be provided to the server (<NUM>) in order to start the consultation process intended to the transaction.

The operation of the system for completing a transaction, which comprises the exchange of information among the end user workstation (<NUM>), client (<NUM>), certification authority (<NUM>) and the server (<NUM>) is described in the paragraphs below.

Firstly, the onset of the transaction involves the following steps:.

Secondly, after the approval of the end user for sharing information thereof with the client (<NUM>) and certifying authorities (<NUM>) services, the stage of obtaining end user information starts. At this point, the back-end application (<NUM>) will request the information and documentation required by the electronic websites (if necessary) and online third-party platforms included in the list of plugins associated with the selected product. This procedure will be repeated for each of the platforms that need additional information apart from that obtained through the certificate selected by the end user. Note that this step would be omitted if the electronic websites contemplated in the transaction require no additional information during the transaction creation.

In third place, once the gathering of all the information is completed, the back-end application (<NUM>) processes the information requests and required data analysis. The client (<NUM>) will be able to check the progress of the actions in progress by means of the web interface (<NUM>).

In fourth place, when the operations in progress are finished, the back-end application (<NUM>) prompts a message with a summary of the transaction result.

In fifth place, the invention sends the response to the transaction. After the completion of said transaction, the system sends the information resulting from the transaction in a predefined format (i.e. in the product parametrisation) to the entity collaborator. In the event of any incident in the delivery procedure, the documentation will remain available through integration.

The client certification provider included in the gateway application (<NUM>) is the external component or module of the invention for reading local digital certificates (<NUM>). It is intended to enable the use of local digital certificates (<NUM>) for the process of identifying the interested party before the public administrations to make a transaction. In this way, thanks to client certification provider, the local digital certificates (<NUM>) are accessible to the client web interface (<NUM>) from which the transaction is being managed. The next paragraphs delve into aspects of the client certification provider such as its formats, operation, requirements, restrictions, and parametrisation.

It is worth remarking that during the installation of the client gateway application (<NUM>), Windows registry must be configured. Indeed, certain registers must be added so that the use of external protocols is allowed and how to operate depending on each one. First, several registers are added to KEY CLASSES_ROOT to allow the URIs ("Uniform Resource Identifier") corresponding to the invention to have a special treatment. Next, it must be indicated how to operate if the event that said customised URI arrives the instruction must launch the application, passing the URI itself as a parameter.

The application initialisation is triggered by using a customised URI that includes the identifier of the transaction that requires its use and the environment to which it must send the information. The default environment is production, so in this case only the transaction identifier is required. It should be noted that launching the invention applications through this type of URI requires user previous acceptance of the end user for security reasons. Every time one of these URIs is launched, a dialog box will prompt to ask for confirmation before running the application.

The available formats for the client certification provider module comprise an installer or an executable file, both of them available for download from the gateway component interface during the process of preparing and collecting data for the transaction.

Preferably, the end user requires having administrative privileges for installing either the installer or the executable version.

The internal functioning of the gateway application (<NUM>) of the invention in the executable mode, being the following steps of its workflow summarised below:.

The internal operation of the invention component related to the installer mode will now be described, along with its operative use in the case of local digital certificates (<NUM>) of the end user. In particular, the following steps must be considered:.

In the context of the client certificate validation, an SSL ("Secure Sockets Layer") authentication is applied. The connection requires a "HTTP Request" of. NET framework. In this way, by using at least one digital certificate (<NUM>) installed in the end user workstation (<NUM>) through the client certification provider of the gateway application (<NUM>), a connection to the certification authorities (<NUM>) services is established.

Here, we detail the exchange of messages between the client (<NUM>) and the server (<NUM>) for starting a transaction:.

At this point, the connection is established and both the client (<NUM>) and server (<NUM>) have received an acknowledgment to one another. Then, the followings steps are executed:.

Web scraping technology of analysis is a widely known technique for extracting information from third-party websites. This technique simulates the navigation of a human on the World Wide Web (WWW) using the HTTP (Hypertext Transfer Protocol) in an automatised way. Most of the search engines have adopted web scraping. However, the invention uses this technique for transforming unstructured data on the web (such as HTML format) into structured data which can be stored and analysed, for instance, in a central database or a spreadsheet. More particularly, the web scraping is applied to download end user documentation (mainly text information), via SSL end user authentication by means of a local certificate (<NUM>).

Claim 1:
Information system for managing at least one digital certificate (<NUM>) from an end user in electronic transactions, comprising:
- a server (<NUM>) a client (<NUM>) and a workstation (<NUM>) operable by a end user, wherein:
- the client (<NUM>) is adapted to receive by the end user a request an electronic transaction;-
the client (<NUM>) is adapted to require identification information to the end user;
- the client (<NUM>) is adapted to establish a communication with the server (<NUM>);
- the client (<NUM>) is adapted to send a request to the server (<NUM>) for an electronic transaction on behalf of the end user comprising the identification information;
and further characterised in that:
- the server (<NUM>) is adapted to send to the end user workstation (<NUM>) an installation request to download and execute a gateway application (<NUM>) adapted to provide the server (<NUM>) with a digital certificate (<NUM>);
- the server (<NUM>) is adapted to obtain at least one valid digital certificate (<NUM>) suitable for performing the electronic transaction, by means of the gateway application (<NUM>);
- the server (<NUM>) is adapted to obtain trusted information about the end user from one or more certification authorities (<NUM>) by means of one or more digital certificates (<NUM>);
- the server (<NUM>) is adapted to send to the client (<NUM>) the trusted information obtained from the certification authorities (<NUM>).