 |
Banking Technology
Fabien Buliard
April 30, 2004
Security - Key changes; Identrus's plans for secure B2B commercial transactions based on Public Key Infrastructure have yet to materialize
When Identrus was formed in 1999 the idea was that business-to-business secure e-commerce would rapidly become the norm, using its four-cornered model whereby two corporations, using Identrus digital certificates issued by two different banks, would transact with each other electronically.
That vision has yet to materialize, leaving Identrus in limbo for the last couple of years. The company is now shifting away from B2B e-commerce to focus on the government and consumer areas.
Identrus was created by ABN AMRO, Bank of America, Bankers Trust, Barclays, Chase Manhattan, Citigroup, Deutsche Bank and HypoVereinsbank and today has 60 participating financial institutions. Two years ago, at Sibos in Geneva, it was heavily promoting its payment initiation initiative, Project Eleanor, which was being piloted by a handful of banks. The noise around Eleanor has now died down to such an extent that one banker says the project "has been shelved".
John Bullard, Identrus' vice president and global ambassador, admits there used to be "a lot of hype around the different e-payment initiatives," but insists the Eleanor application is still available on the Identrus platform, although it is no longer being actively promoted. "There are other payment initiation applications on the market that we're actually talking with now," he adds.
There also used to be a lot of speculation around the merger of Project Eleanor with Swift's e-payments Plus application, but both organizations now seem to have moved on. Bullard says there is no reason why the two schemes could not converge, but admits there have not been "recent conversations." Swift confirms there is "no news" on the topic.
The question now is whether the model that Identrus was built upon at the outset still has a future. Clay Epstein, vice president product and technology at Identrus, admits that four-corner B2B transactions "certainly did not grow like the early anticipations of the internet boom days".
In fact, it appears digital certificates are mostly being used in a narrower context. "Some banks just use Identrus as an enterprise PKI," says Bullard.
"Some will use it for their customers to access cash management (two-corner), some will use it for two of their own customers to interact with each other within the bank (three-corner), and then the trickle of four-corner transactions come in, with the interaction between identities from bank A and bank B."
Epstein still sees the model evolving to the original vision, but "instead of starting with the B2B connectivity, we're starting with individual identity management segments within the bank", he says, adding that recent examples of identity theft and site spoofing constitute a major driver.
This strategic shift within Identrus is also a departure from the distant returns on investment of the early days, when banks were expected to spend millions on a certificate infrastructure and then wait for e-commerce to take off. The company is now focusing on specific applications whose added value is more tangible and easier to justify than stand-alone certificates.
It recently launched SimpleSign, a document-signing application developed in conjunction with Adobe, to create legally binding PDF files and, in January, acquired eFinance, a credit decisioning software provider formerly run by new Identrus chief executive Karen Wendel.
Epstein says the implementation of such products could result in major cost savings for paper processes like mortgage origination, which could be moved to a fully electronic process, with a legally enforceable digital signature.
"It will save money on shipping FedEx packages and in processing time, by being able to take an XML form, parse it, push it into a credit decisioning process and come back with an answer in a fraction of the time it would have taken otherwise," he explains. "And it is just one of hundreds of paper practices that exist within banks."
Banks themselves are starting to build commercial offerings based on digital certificates. Royal Bank of Scotland (RBS), through its Trust assured unit, created in 2002, is leveraging the Identrus infrastructure to provide identity services to its business customers. Although he will not give a specific figure, the head of Trustassured, Mark Robinson, says the bank has issued certificates "in the thousands". "We are by and large on target," he says. "It was never going to be a huge explosion and we are happy with the way the business is growing."
Trustassured expects a lot from the mandatory rollout around the BACS clearing house in the UK, which could result in the issuance of 70,000 to 80,000 certificates, just for RBS. "Every business customer will have a digital certificate," Robinson says. "It is definitely a shot in the arm for Identrus."
RBS is also working on a large initiative with one of the major pharmaceutical companies, within a syndicate that includes Citibank, Wells Fargo, UFJ and Standard Chartered Bank. Robinson says the banks are working towards a shorter product lifecycle and a greater amount of automation in the pharmaceutical industry, which could require between 200,000 and two million certificates globally, over the next couple of years.
Robinson believes that, besides the pharmaceutical industry, the oil and gas industry, public health services and more generally, the government space, are more open to digital certificates than others.
In fact, government PKI seems to be a major development angle for Identrus, which benefited from inroads made in that field by Digital Signature Trust, which it acquired in 2002. "Identrus realized very quickly that there was no point in building an infrastructure and waiting for things to happen," Bullard explains. "In every country, the biggest customer is the government".
Over the last two years, Identrus has devoted a lot of time to building interoperability between the financial PKI schemes and local government initiatives. This has led to banks in Australia becoming both Identrus and Australian Gatekeeper-certified, meaning that a credential issued by the bank can either be used within the international financial services market, or for authentication with the Australian federal government.
Identrus is replicating this localized approach with Italian banks within the EU digital signature directive, while other initiatives are in progress in Japan and the US.
On top of its new application-led approach, Identrus has added software-based certificates to the original smart-card only system, to widen the potential uses of its credentials.
"I think that the fact that they've broadened their scope is a matter of necessity for their own survival, as much as anything else," says Lee Kidder, director of the wholesale banking practice at research firm TowerGroup. "But it's probably a very smart strategy to adopt. They're looking for real successes that they can build upon credibly in smaller areas."
However, unlike RBS, Wells Fargo or ABN Amro, most Identrus banks are still very cautious in their approach to identity services and tend to sit on the fence. France's Societe Generale, for instance, simply states that as "one of many Identrus shareholders, it attentively follows the evolution of this organization".
To some extent, Identrus fell victim to the bursting of the internet bubble, like many other companies, and Kidder reckons that if it had not been owned by a group of banks, "we probably would never have heard from it again".
Bullard admits that things have been difficult but insists that its shareholders are thinking strategically about the way the platform can help them serve their customers. "So yes, they have given us time," he says.
October 1998: Eight major banks announce creation of e-identity company
April 1999: Identrus formed as Delaware Limited Liability Company
September 2000: Swift-Identrus Alliance
September 2000: Identrus launches Eleanor Payments Project
November 2000: bolero.net accepts Identrus certificates
May 2001: Microsoft-Identrus Alliance
August 2001: Identrus 50th member bank signs charter
August 2001: Identrus receives EU approval
February 2002: Tenth Identrus bank begins production
March 2002: Identrus acquires Digital Signature Trust
June 2002: Founding Identrus CEO Guy Tallent resigns
September 2002: Eleanor pilot launched with major pharmaceutical company
September 2002: Identrus approves software-based key storage
December 2002: Four Italian banks implement Identrus
March 2003: Launch of Identrus Japan
May 2003: Karen Wendel appointed as CEO
August 2003: Identrus and ANZ recognized by Australia's Gatekeeper
September 2003: Identrus joins Liberty Alliance as sponsor member
January 2004: Identrus acquires eFinance Corporation.
|
Schwartz Communications, Inc.
Rebecca Krueger
+1 415-512-0770
Identrust@schwartz-pr.com
|
|
|
|
RELATED CONTENT
PRESS RELEASES
IDENTRUST IN THE NEWS
|
|
