The Digital Signature Service (DSS) is a scalable application programming interface (API)-enabled platform for rapidly deploying digital signatures (1, 2). For your own DSS service, you need to set up more than just sign-on workflows and user management (3). Signing certificates are required to verify the identity of the author of each document (4). These include cryptographic components such as key management, a FIPS level 2 or higher key storage system (HKSS) (such as hardware tokens or hardware security module [HSM]), an OCSP or CRL service, and a timestamp service (5–7). Integrating these components, especially for direct integration with the HSM, whether in the cloud or on premise, requires significant effort from IT and security departments, good cryptography knowledge, and the availability of necessary resources (8–10). When evaluating digital signature solutions, it is important to consider these hidden costs, investments, limitations, and overheads. Individually, if the DSS service is critical to the organization, it should operate with high levels of uptime and provide high performance (11, 12). That means you should design your solution with a certain amount of redundancy – with margin for the future (13). Consider that business is characterized by growth. Infrastructure must be scalable (14).

Ultimately, each organization must decide which DSS option best suits their project requirements (18). It takes into account the requirements of regulatory bodies, the size of the organization, and other factors, often unique to each case (19, 20). An electronic signature (ES), a digital document signed by ES, is equivalent to a paper document with a handwritten autograph (21, 22). A “cloud” ES has all the characteristics of a regular one; it is not stored on a flash drive or computer, but on the Internet – on a special, secure server, in the “cloud” (23, 24). The signing and encryption of the document also take place there; therefore, such an ES does not require the installation of special software on the computer (25–27). One of the advantages of the “cloud” signature is the ability to sign documents (including reports) and send them from any device anywhere in the world (28).

An ES “in the cloud” is something many of us use every day without even realizing it (29). The most notable example is the authentication mechanism in mobile and Internet banks, after entering the password, a one-time pin code is sent to you via SMS (30). Such two-level authentication, in essence, can already be an ES (31). With the help of ES, companies can submit reports to tax and other regulatory authorities (32), submit and recall that they conduct electronic document management. Digital signature is also widely used in public procurement (33). The technology of “cloud” ES, which appeared several years ago, makes this tool accessible to businesses (34). This is confirmed by tens of thousands of customers. One has to imagine a situation where a forwarding driver gets on a plane not with a wad of paper but with a tablet (35). At the point of shipment, he signs a bill of lading with the customer (36). But the “cloud” ES brings the main advantage when the delivery document differs from the quantity of goods actually sent (resorting to breakage during transport) (37).

ES performs the same function as a stamped signature. It ensures the authenticity of the document and contains the private and public keys (38). The document is signed using a private key, which is usually stored on a special medium – a token. You can buy a service from many companies that provide such services, except for the availability of a standard set of documents; no special requirements are required (39). “Cloud” ES is a regular ES, but with a difference: the private key is stored on the servers of the certificate authority, and the signing of documents is carried out there (40). The signer’s identity is usually verified by sending an SMS to a mobile phone. The technology is based on a special ES server located in the “Cloud” (41). For example, if a user needs to send a report to the tax office, his accounting system communicates with the ES server and sends him a document to sign (42). The ES server is obliged to request permission from the user – this can be done by sending a transaction confirmation code to his mobile phone, similar to Internet banking (43). By entering the confirmation code in the system, the user authorizes access to the ES key, and a signature is created for the document (44). All ES keys are stored in encrypted form on a special device that meets the most stringent security requirements (45). The operator of the ES server shall take all measures to minimize the risk of unauthorized access to the keys (46).

To use a “classic” ES, you need to purchase a token and special software. This is a significant expense, especially for start-up entrepreneurs (47). This software needs to be installed and configured if you are going to use the signature on multiple workstations – separately for each location (48). A “cloud” ES does not require the purchase of software or pre-configuration and cannot be lost or forgotten. Unlike traditional technologies, “Cloud” ES is available to users on any operating system and platform, including mobile devices (49). “Cloud” ES is popular among small companies or individual entrepreneurs who actively use services such as “online accounting and online document management” (50). In large companies that do not use “clouds,” using such a signature may be more expensive and difficult than using a conventional ES (51). This is a complex installation of information security tools (MDZ, antivirus, etc.) on the computer and client OS in order to reduce the possibility of computer infection by malware (52).

Public key infrastructure provides integrity and verifies the authorship of each document. Timestamps certify the time a document was signed, which is essential for time-bound transactions, rejection, and data retention for audit. Of course, the entire document management system with digital signatures must comply with the requirements of the country of jurisdiction and the countries where partners and customers work. Uniform standards for electronic document management and digital signature infrastructure are gradually being developed. A class of applications provide a complete windowed user interface for performing client-side crypto operations. As a rule, some CIPF is used as a crypto-core. This is shown in Figure 1.

The providers of document management solutions or applications want to integrate digital signatures or stamps. Another option is to offer them as a premium option to customers as guaranteed document protection against fraud.

A flexible model is supported here: digital signatures can be added as an additional or optional layer. Now, the businesses looking to integrate digital signatures or stamps are into their workflows. The system integrators are implementing the digital signatures in existing or new document management systems. The problem of creating a trusted environment for performing cryptooperations, especially EDS, is a separate big topic. This article does not plan to consider it in detail, but conceptually, developers go along the following lines.

All these documents are now sent in a long journey of communication between the accounting departments on the supplier’s and the buyer’s side. Although the problem of inconsistencies can be solved at the point of export, the fact of the change will be confirmed by a “Cloud” signature. This is shown in Figure 2.

Currently, there are completely new developments using block chain technology, that is, smart contracts. “Distribution, the basic principle of the technology, provides complete protection against compromise and unauthorized access to any document or signature, because each such block element (signature, document, archive, etc.) is located in a strong chain of numbered blocks. Protected by a very complex cryptographic code. Making changes to a block already in circulation Not possible; a smart contract is an electronic mechanism that describes a set of conditions that will fulfill certain events.” His work is based on the development and use of so-called low-trust protocols, where the protocol algorithm uses only software tools, and the human factor is excluded as much as possible from the decision-making chain – here A person acts exclusively.

The proposed HKSS was compared with the existing e-diploma system model (EDSM), block chain-based Lamport Merkle digital signature (BLMDS), antivirus security systems (ASS), and structural digital signature (SDS).

Cloud services vary in price and functionality. But they all guarantee flexibility, scalability, and high availability. Although the services are paid, companies are freed from the need to invest in the development of their own solutions, including the purchase of expensive cryptographic equipment. A cloud-based digital signature service may be required. In theory, these are companies of any size that develop or implement custom-built applications and want to integrate digital signatures or use an already integrated application. For example, when sending money, it is impossible to execute a contract without obtaining the number of ES specified in the contract. Talking about the spread of the practice of using “Cloud” ES and the possibilities of developing technologies, there is a problem. Today, it is connected with the fact that the problems of using such ES are not well spelled out in the regulations. So, companies will soon stop being afraid of “cloud” technologies and use such ES in their work even more. Expect to start using it in earnest.