Axidian CertiFlow

A growing number of companies and government agencies looking to streamline their business workflow are now transitioning to electronic document management.

The backbone of electronic document management systems are electronic signatures and public key certificates designed for verifying the signatures.

Today, digital certificates are widely used for managing remote banking services, submitting tender documentation via electronic platforms, and maintaining security in the Internet of Things (IoT) and automated process control systems (APCS).

Proper, clever, and secure use of digital certificates is an important prerequisite for smooth operation of a majority of modern organizations.

The cornerstones of digital certificate management are specialized technology solutions that are commonly referred to as Public Key Infrastructure (PKI). PKI is a set of software and hardware tools that can perform a full range of digital certificate operations.

Stringent criteria are in place for the security of the key PKI components (for example, certificate authorities and tokens). Security requirements are usually stipulated by national and international cyber security regulations.

However, companies have to use PKI components from different manufacturers to address their corporate needs. Moreover, digital certificates may be issued by different certificate authorities, both internal and external (most notably, this is true for accredited certificate authorities that can issue qualified certificates for electronic signatures).

If you don’t have a centrally managed PKI service in place, you are bound to face a number of issues, such as unaccounted tokens and excessive workload required for PKI operation and maintenance. And this can make your PKI solutions and electronic signatures much less effective.

However, all these issues can be addressed by deploying a comprehensive PKI management system. A PKI system should be able to perform the following tasks:

• Centralized monitoring and control over the use of PKI components
• Digital certificate lifecycle management, regardless of the issuing public key authority
• Controlled use of PKI tokens from different vendors
• Self-service tools for corporate users enabling them to manage their own PKI tokens and certificates
• Automation of routine operations for certificate authorities responsible for issuance, revocation, and renewal of digital certificates.

Building a PKI management system is a complex task that requires multiple technical and organizational efforts.

If your PKI infrastructure includes one certificate authority and a few dozens of PKI tokens, it can be easily managed even with the software you already have. However, centralized management can prove a much more sophisticated task if you need to use numerous PKI tokens, a few certificate authorities (especially in the case of multiple manufacturers), or a large number of qualified electronic signatures issued by a third-party accredited certificate authority.

PKI management solutions can help you not only effectively manage your PKI components of varying origins, but also automate a series of routine operations related to issuing, revoking, and renewing your electronic signature certificates, as well as servicing your PKI tokens. This way, you can significantly reduce the workload of certificate authority operators without compromising the efficiency and cyber security of the processes.

You can also use the Axidian CertiFlow platform to delegate certain privileges to certificate holders so that they can service certificates and electronic signature tokens. Automated mechanisms embedded in the PKI management software can be used as intermediaries for these operations, so you no longer need to engage certificate authority operators. All these tasks can be addressed via appropriate self-service tools.

Operators often need to initiate large-scale jobs to handle user PKI tokens and certificates, while some of your employees may be absent from their workplace at that particular time (due to a business trip, vacation, or illness). Big companies with multiple branches are usually quite familiar with this situation. A specialized Axidian CertiFlow agent can help you address the tasks at hand automatically, keeping the involvement of CA operators at a minimum. Their functions will be limited to job assignment and progress monitoring, while the agent can take care of the execution across all individual workstations.

Corporate IT infrastructure today is an intricate structure of massive proportions that relies on multiple technical solutions for addressing various tasks. Many essential business processes, especially those related to cyber security, may involve technical tools from different vendors. PKI public key infrastructure is no exception.

PKI systems include the following technical tools:

• A certificate authority
• PKI tokens
• Digital certificates
• Certificate storage vault
• Target systems (EDMS, OS, etc.)

The key criteria used to evaluate PKI management solutions include, on the one hand, the list of supported solutions and manufacturers, and, on the other hand, the degree of integration with each specific solution.

The Axidian CertiFlow platform supports integration with several widely used certificate authorities. Thanks to this integration, it can not only monitor the lists of issued certificates, but also automate a number of routine operations. For example, you can opt to set up automatic mode for approving certificate requests, sending certificate requests to the CA, and delivering issued certificates to workstations with PKI tokens.

Another key feature of the Axidian CertiFlow solution is that it supports a wide rangeof PKI tokens from different vendors. Beyond technical support, the solution is also capable of keeping track of all tokens and relevant certificates and managing them (for example, setting up a PIN code policy).

Important integration capabilities include:

• An option to use digital certificates and PKI tokens for authentication in target systems via relevant external access management systems (for example, Identity Management)
• Support for mass issuance of PKI tokens and certificates via specialized smart card printers
• Integration with technical solutions and storage systems for certificates without PKI tokens (so-called virtual, software-based, and network smart cards)
• API for integration with other IT infrastructure components that rely on digital certificates
• Supported syslog for sending security event data to appropriate monitoring systems such as Security Information & Event Management (SIEM)

Axidian CertiFlow offers a high degree of integration with all the technical solutions and systems as required. This said, you can not only boost the overall efficiency of your PKI business process management, but also cut the costs associated with system management and maintenance.

• Сertificate authorities: Microsoft Windows CA, CAmelot
• CA operations: obtain certificate templates, create and send out certificate requests, approve certificate requests, issue certificates, suspend and revoke certificates, check certificate status, create and update CA user data.
• Tokens: removable hardware tokens, Microsoft Windows NT Registry, Trusted Platform Module (TPM), Microsoft Windows Hello for Business, and Axidian AirCard Enterprise.
• Removable hardware tokens: eToken (SafeNet), ESMART (SafeNetISBC), Yubikey (Yubico), ID Prime (Gemalto), and ePass (Feitian).
• Integration with access security tools, smart card printers, authentication management tools (Axidian Access), and identity management tools − IdM (via API)