Software

Digital Signature Technology Available

Although great efficiencies have been demonstrated by the use of electronic recordkeeping systems, the six-figure setup cost of an FAA-compliant system can be prohibitive for many maintenance shops. One impediment to a paperless maintenance facility is the requirement for technicians and inspectors to sign-off their work for accountability. Using digital signatures produced in compliance with FAA guidelines can overcome this barrier and allow even small shops to work toward a paperless environment.

Advisory Circular 120-78, Acceptance of Electronic Signatures, Electronic Record Keeping Systems and Electronic Manuals, defines a digital signature as "cryptographically generated data that identifies a document's signatory (signer) and certifies that the document has not been altered." Based on public/private key cryptography, public key infrastructure (PKI), and other security protocols, digital signatures do not necessarily display a visible mark or signature, but indicate and authenticate the signer when the document opens.

Authentication is provided via two keys: a private key accessible only to the signer and used to sign the document, and a public key issued with the document. The public key allows anyone to open the document and verify the signature. If the document is changed in any way after it is signed, the encrypted code alerts the next viewer that the document has been altered. Furthermore, secure digital signatures cannot be repudiated; the signer of a document cannot later disown it by claiming the signature was forged.

Software can be set up to create digital signatures based upon some significant act, such as swiping a magnetic badge or smart card, signing an electronic document with a stylus on a tablet or handheld PC, or entering a series of keystrokes. Regardless of the type of digital signature entry, however, the software must capture, authenticate, associate, and store the entry with the electronic document.

Several vendors produce such software specifically for the maintenance industry, including Mxi Technologies, Continuum Applied Technologies, AvTrak, and Perceptive, to name a few. Producing either off-the-shelf customizable software or completely custom software packages that use PKI or other secure technologies, these vendors can incorporate various types of electronic or digital signature entry that meet FAA guidelines. While these robust systems are packed with time-saving features that provide a good return on investment for large corporations, they also come at an enormous price, normally running into hundreds of thousands of dollars after all customization and consulting fees are assessed.

Smaller facilities that want to take advantage of electronic recordkeeping systems can use commercial off-the-shelf software, such as Adobe Acrobat, that provides digital signature capability. Three of the four versions of Acrobat (Professional, Standard, and Elements) come with digital signature capability, although the free Acrobat Reader does not. Still, at $449 per license for Professional and $299 for Standard, Adobe Acrobat can be a great deal for small shops that need electronic recordkeeping capability on the shop floor.

Computer-savvy shop personnel can create blank shop forms using Acrobat Professional (or this service can be contracted). Then when the technician or inspector fills out the form on a computer station, handheld PC, or PDA using Acrobat Standard or Elements, he or she can assign his or her digital signature to the document. Forms can be set up to accept more than one digital signature, with each signature specifying a certain scope of approval.

Note that to comply with FAA guidelines, the Acrobat self-signing utility cannot be used, since the public key generated is not traceable to a specific person. Instead, a digital certificate issued by a third-party must be incorporated with the digital signature. The electronic equivalent of driver's licenses, digital certificates are issued by an external authority that verifies you are who you say you are and then encodes identification, contact, and authentication information into the certificate. When the document is opened, a link to the certifying authority verifies that the certificate is valid, and therefore the signature is valid.

Adobe has partnered with Geotrust to provide digital certificates to Acrobat users through its Certified Document Services program. However, Acrobat will also work with digital certificates purchased from other security providers, including Verisign, Entrust, and Betrusted. Certificate costs range from $78 to $149, depending on the provider, and most expire after one year. Digital certificates are generally kept on Java-based Smart Cards, USB tokens, or other devices issued to individuals. Shops with access to IT personnel may also set up their own PKI servers to manage digital certificates, or purchase server or web-based PKI technology from a number of vendors.

Note that digital signature is just one of a number of electronic signature methods accepted by the FAA, but it is the only one, especially when combined with a digital certificate, that meets all six attributes of an "acceptable electronic signature" per AC 120-78 paragraph 5c: uniqueness, significance, scope, security, non-repudiation, and traceability. - By Kim Rosenlof