Certified biometric signature

biocertiX is software that extends the functionality of existing electronic document workflow systems with the ability to provide a handwritten signature on an electronic document using a stylus on Samsung tablets. In addition to the signature image itself, the system records a number of parameters used for authenticity analysis (biometric data).

The system was designed from the outset to ensure a high security level and has successfully passed the rigorous international Common Criteria certification.

The back-end of the biocertiX system (server part) is installed on the customer's infrastructure. The front-end system (mobile application) is installed on Samsung tablets. After integration with the biocertiX back-end, the client's electronic document workflow system sends a document for signature via an API. The mobile app presents this document and allows it to be supplemented with additional information with handwritten electronic signature.

Once the signature is made with the stylus on the mobile app, the biometric data is encrypted and the resulting PDF file is created, which is additionally stamped with a qualified electronic seal and tagged with a qualified timestamp.

BiocertiX has been certified under the Common Criteria (ISO 15408). This means that it meets strict international security standards verified by an accredited national laboratory. It has a number of security features to ensure that the document is integrally linked to the signature, and that the content and biometric data of the signature do not fall into the wrong hands.

Among the numerous security features are:

• security against unauthorised access to the system,
• security against modification or alteration of the document displayed for signing,
• security against CSRF attacks,
• security against interception of biometric signature data,
• security against copying of biometric signature data between documents,
• security of the cryptographic API for integration with other systems.

With the Trusted Third Party service, the private key required to decrypt biometric data is securely stored on the Hardware Security Module (HSM) on which it was generated and which it never leaves.

signaturiX is an electronic signature platform that enables the creation of different types of electronic signatures on a single document, i.e. simple signatures (click-to-sign), simple signatures with SMS, advanced signatures (handwritten signatures with or without biometrics), as well as qualified signatures. Depending on the type of signature, all that is needed to create a signature is a normal computer, a phone or, in the case of a biometric signature, a device with a stylus (e.g. a tablet or signpad).

biocertiX is a solution that includes the ability to create biometric signatures (a separate part of the signaturiX solution) on Samsung mobile devices, additionally secured with Samsung Knox and the Certum by Asseco trust services. Thanks to the partnership of three entities (Samsung, Asseco, Xtension), the biocertiX solution has been internationally certified according to Common Criteria standards. The first security-certified biometric signature solution of its kind was achieved.