Digitization of Signature Processes in SAP
Digital Signature
Everybody trusts in a document signed by hand. In our daily work, we therefore sign contracts, offers, invoices, sample releases, etc., thereby demonstrating that we agree with the content of the document and do not want anything to be changed. By signing, we also prove at the same time who we are and on behalf of which company we are acting.
But this process is very time consuming: in order to sign the document, we usually have to download it first and print it out. Then we can pull out the pen and put our signature. After that, the document has to be scanned again and sent or filed to the appropriate recipient.
That’s why there is a better procedure for this today: the digital signature. The digital signature – or digital signature procedure – also ensures the identity of the signer as well as the integrity of the content. And in doing so, it is by law equal to the manual signature, but many times faster!
Digital Signatures –
an Explanation
In the economic area of the European Union, procedures of this type are regulated in the eIDAS regulation (electronic Identification, Authentication and trust Services). If eIDAS is complied with, the signature or seal used is accepted by legal entities and authorities. This applies to both the legal validity and the authenticity and integrity of the electronic document. Legally binding regulations exist at national level for the USA, Switzerland, Singapore, Canada, South Africa, Australia and other countries. But China, India and Russia also recognize procedures of this kind.
Digital Signature –
Credible as Your Written Signature
→ Making declarations of intent as a natural person or on behalf of the company
→ Maintaining the authenticity of business documents
→ Basic component for electronic end-to-end processes
→ Recognized in the major economic regions of the world
Our Services around the Digital Signature
Capturing the Technical Framework Including Usability Aspects
- Clarification of the technical requirement for use
- Definition of the security requirement
- System performance and availability examination
Design of the Complete Process (End-to-End)
- Calling the signing or certifying function from SAP transaction e.g. delivery, billing document, production order
- Conception as background processing (hidden processing)
- Integration into workflow systems and multi-level approvals
- Handling and logging of the entire signing or certifying process (transaction control)
Implementation of Main and Subprocesses
- Acquire individual documents from different sources (ERP, PLM, shares, archive)
- Convert individual documents of different source formats, e.g. into neutral PDF format
- Merge individual documents
- Apply additional process information, metadata, blocking notes, barcode
Visualization of Signature as Output Representation
- Using the SAP signature page
- According structured standardized layout sheets (e.g. EASA form)
- Self-developed signature or end pages
- Display of company name, department, signature as image
Implementation of Signaturing and Certification Process
- Customizing, if necessary development and installation of required software components
- Adaptation of the user interface (UI) according to functional and visual aspects
- Integration of certificates and hardware (HSM, SmartCard, token)
Realization of Output Distribution
- Save to share space or archive
- Output to e-portals
- Automated dispatch via e-mail
- Final printing
The result: precisely fitting signature and certification processes integrated into the existing information technology, highly automated and free of media inconsistencies.
Intrigued?
Request further information without obligation!
FAQs on Digital Signatures
What about the Legal Requirements Regarding Digital Signatures?
The application of digital signatures, if necessary even a qualified digital signature on documents, is in some cases required by law. Signature workflows can be integrated into your proven document distribution processes for this purpose, enabling you to comply with these regulations. These include:
- the qualified digital signature when sending invoices
- the digital signatures in an approval workflow
- the certificates when sending documents to your supplier
Private and Public Key - what is it?
Encryption and decryption can be performed with different keys – i.e., with asymmetric key pairs. In this case, the keys of a pair absolutely belong together and cannot be exchanged for others. This is referred to as a private and a public key. Let’s assume that the sender of a piece of information is interested in ensuring that only the correct recipient receives a certain piece of information. To do this, the sender first has the recipient’s public key transmitted. The actual information is encrypted with this public key of the recipient and then sent. Decryption is only possible with the recipient’s private key.
Do I Need a Certificate for Digital Signing?
How Do Digital Signatures Work?
A digital signature does not necessarily mean encryption of the signed content. The signature serves to securely determine the author or the organization issuing the document. Here, the use of the private and public keys is reversed compared to file encryption: a checksum generated from and describing the document is encoded with the private key of the signer. The public key is included with the certificate. If decryption succeeds with the enclosed public key, it is proven that the certificate matches and the checksum is obtained. If the checksum matches the file, the signature was valid. Now I can still verify the issuer of the certificate with an independent authority. If the overall signature application process and the use of trust centers for key allocation and management are also confirmed by an independent audit, then the signature also meets the requirements for a qualified digital signature.
The use of encryption processes and certificates is regulated in numerous standards and laws. This is often referred to as an electronic signature and focuses on the legal aspect rather than the technical aspect. This then also includes the simple electronic signature, which uses digitally processed manual signatures (scanned lettering), as the simplest form.
What Do I Need to Keep in Mind When Using Digital Signatures with PDF?
PDF, unlike many other file formats, has the advantage that there is a place for a built-in signature in the file format; unlike a so-called remote signature. This makes the transport of the signature with the signed file easier and more secure. The one-to-one connection between signature and file is ensured by an encrypted checksum. Subsequent changes are then no longer signed, but can at least be added to the file by incremental changes. By means of multiple signatures, however, these changes can also be signed subsequently.
Do Digital Signatures and PDF/A Work Together?
PDF/A states that a standard-compliant file must not be encrypted or otherwise protected against access. As the owner of a PDF/A file, how can I protect the know-how it contains? Digital signatures can provide a good service here. Signatures, when verified as valid, prove that the associated file has not been modified since the signature was created. PDF/A- 2 has also improved an important function: it is now possible to subsequently update an expired certificate without changing the PDF/A file itself. The inclusion of the latest signature techniques in the standard makes this possible.
Signatures use encryption techniques. However, the actual content of a PDF/A file remains unchanged. This technology is therefore permitted for PDF/A and is also very well standardized. However, encryption of the entire data is not permitted for PDF/A. When sending the file via insecure channels, however, it can be sent using encrypted methods: For example, via secure e-mail procedures or packaged in a PDF container, which is itself encrypted.
What Does the Digital Signature in SAP ERP Cost?
A purely manual signing process requires only a file and the actual signature software. Where this file comes from and where it is saved in the signed status is up to the clerk. In the simplest case, a file directory in which the clerk saves and retrieves his work documents in Word and Excel on a daily basis is sufficient. In this use case, relatively low prices per user are possible.
Since the signature software is also the same in SAP ERP, these costs are the same here. However, in order to implement the automated procurement and storage of the file to be signed or stamped in SAP ERP, additional modules that require a license are often required to control and monitor the overall process. The signature type used (Advanced/FES, Qualified/QES) and the time-related signing volume also determine the price.