DOUBLE SECURITY FEATURES: E-Scrolls that use digital signatures and time stamp technology help counter fake degree certificates
IT is the first university in the world to generate digitally certified scrolls for its graduates.
In an attempt to address the issue of counterfeit degrees, Malaysia’s oldest public university, University of Malaya (UM), has deployed an information systems and communications security to produce digital degree certificates or E-Scrolls for its graduates.
UM uses the nShield hardware security modules (HSMs) and Time Stamp Server by Thales, a French multinational company providing technology solutions for aerospace, transportation, defence and security
The last two batches of graduates (roughly 12,000) received their E-Scrolls that have double security features, in addition to their traditional paper certificates to eliminate instances of counterfeiting and fraud.
Each E-Scroll has digital signatures of two signatories, namely the vice chancellor and registrar of the university, and a secured time stamp based on time reflected at the SIRIM National Master Clock Centre.
At the time of production, students’ graduation information is converted into a PDF file. The university registrar and vice chancellor will then use their respective private signing keys to access the master certificate and use the GlobalSign digital IDs to digitally sign the certificate.
Unauthorised access is prevented at this stage as the private signing keys are only accessible to both the signatories.
The scrolls are then digitally signed followed by stamping of the time through the Thales nShield server. This server will verify the time against the National clock server and embed the exact time and date on the certificates.
The E-Scrolls are then uploaded to a dedicated server based at the Information Technology Centre in UM and are distributed online through the university’s Registry of Graduates online systems.
Graduates can download their E-Scrolls after a simple authentication process and attach the document for various online applications that require authenticated degree certificate copies.
UM Information Technology Centre director Dr David Asirvatham says paper certifications are difficult to be authenticated as anyone can forge signatures and produce an authentic-looking degree.
“More than 6,000 students graduate from UM each year, and we feel it is our duty to present them with a certificate that has strong credibility and integrity as it is widely associated with our university.
“Thales provides us with the 2048-bit encryption technology to issue a digitally signed and time stamped E-Scroll for a solution that is quick and simple to deploy. Not only does the E-Scroll overcome the issue of counterfeit degrees, but in a world where a growing number of graduates applies for jobs online, employers are able to quickly and easily validate the authenticity of the certificates,” says David.
He adds that more and more graduates are applying for jobs online and many organisations are also adopting the paperless concept.
“E-Scrolls now work exceptionally well for online applications or for employers who like to verify the authenticity of an applicant’s qualifications. When employers click on an E-Scroll, a PDF document containing the applicant’s degree certificate opens up. A verification tab will automatically pop up indicating that the digital certificate is verified and authentic. If information on the scroll has been modified, the verification tab will show up in red, indicating some form of tampering. They can also manually click on the digital signature panels to gain technical information on the certificate and signatories.
“UM also provides an alternate method of verification for its graduates through the Registry of Graduates website that contains the list of graduates,” adds David.
This technology presents an easy way to prevent fraud and students and employers will find it much easier to authenticate the degree in just one click.
“With hindsight, many employers are not aware of such technology. We have had recent graduates returning for authorisation letters from the university to verify their degrees as employers expect to see tangible proof of degree.”
UM is looking into commercialising this technology apart from deploying it to generate digitally signed invoices ans purchase orders for the university soon.
Thales e-Security regional marketing director of APAC Jim Yip says UM is the first to deploy this innovative technology.
“Thales and its technology partners are in active discussions with several higher education institutes in Asia on how we can enable them to tailor and deploy the same technology.
“The security of E-Scroll is based on a technology called Public Key Infrastructure. This is a proven technology that is widely used by governments worldwide to protect the e-passport, citizen identification cards, and by the financial institutions to secure transactions and online banking,” says Yip.
HSMs used in the E-Scroll system provide a dedicated hardware that protects the usage and storage of the encryption keys.
“Think of it as an equivalent of a bank vault that keeps cash and valuables safe in a digital world,” he says, adding that Thales nShield HSM is independently certified by international standards such as FIPS 140-2 and Common Criteria.
On the collaboration with UM, Yip says the university sees a need to protect its reputation by taking a proactive approach to mitigate future risk with electronic degree certificate.
“Thales has the right technology to help the university to put together a secure, easy to use, easy to deploy and cost-effective system in place.
Thales together with its Malaysian partners, GiAT Infosys Sdn Bhd and Haynik Holding Sdn Bhd, have been collaborating with UM since mid-2011.
Read more: UNIVERSITIES: Digitalised scrolls — signed, sealed, delivered – Learning Curve – New Straits Times http://www.nst.com.my/channels/learning-curve/universities-digitalised-scrolls-signed-sealed-delivered-1.470505#ixzz2zVFKSzta