Equifax to become a CA
The consumer credit agency announces it's jumping into the certificate authority business, running a service to issue digital certificates using IBM technology.
IBM also refreshed and expanded its line of software for certificate authorities, calling it IBM Vault Registry. Digital certificates vouch for the identity of individuals or Internet servers, serving as an electronic ID card, and are considered a key element in creating an atmosphere of trust for online commerce.
Equifax will issue digital certificates on behalf of its business customers, focusing on corporate intranets, extranets for trading partners, and consumer-oriented uses like online banking and shopping.
"We shall create and maintain standards that safeguard not only individuals, but companies' privacy of information," said Thomas Chapman, Equifax chief executive. "It's a natural extension of our business in the [physical] world."
Equifax said it initially will issue digital certificates as an outsourcer for banks, retailers, and other financial institutions, rather than going directly to consumers. Pricing has not been determined but will include a set-up charge and per-transaction fees.
"Equifax is the leader in verifying credit in the physical world," Cheryl Ball, an analyst with industry research firm Cahners' In-Stat Group in Boston, told Reuters. "Businesses already understand how to use Equifax services. This is a simple extension."
Equifax maintains payment data on millions of customers and will use that data to authenticate the identity of individuals applying for digital certificates. Equifax also is the largest credit card processor for U.S. credit unions. It will offer its service to North American customers by fall, with expansion to other continents under discussion.
Jumping into the consumer-oriented segment, Equifax will compete with VeriSign, the leading certificate authority, and with GTE CyberTrust, which offers both outsourcing services and CA software that competes with IBM's. Entrust, a spin-off of Northern Telcom, also offers CA software, and companies like Microsoft and Netscape offer certificate server software. IBM's certificate management component, however, was licensed from Entrust.
Equifax also will use Payment Registry, IBM's renamed software (formerly Registry for SET) to issue special-purpose digital certificates required for the SET (Secure Electronics Transactions) protocol for secure Internet card transactions.
IBM earlier had announced its own SET certificate service, which never got off the ground and has been dropped in favor of Equifax. IBM will resell the Equifax service in North America.
"We want our customers to have the very best service provider," said Irving Wladawsky-Berger, general manager of IBM's Internet division. "IBM is good at a lot of things, but people want services from the business expert in that world."
Registry is the first Vault application, and IBM will introduce others by year's end to bring trust to Internet transactions, Mark Greene, IBM's vice president of e-commerce, said. New offerings will include software to time-stamp messages, to run cybernotary services, and to serve as electronic lock boxes for financial institutions that process payments for customers.
IBM's Vault Registry includes five separate products: IBM Vault Controller for controlling access to an individual's information; Certificate Management System to issue, revoke, and renew certificates; Registration Application to manage issued certificates; Agent for securely exchanging data between the Controller and remote users; Certificate Validator for checking the validity of a certificate during a transactions.
Vault Registry requires the use of IBM's eNetwork X.500 Directory for storing certificates and IBM DB2 Universal Database, for storing data. The system also uses the Lotus Domino Go Webserver.
IBM also announced partnerships with systems integrators Deloitte & Touche and SRA International for consulting and implementation services.
IBM's Vault Registry software ships next month on IBM's AIX platform, and the Agent and Certificate Validator components also are available on Windows NT. No pricing was announced.
Executives allow that it may be years before bankers and retailers are ready to accept customer verification via the wide-open Internet with the same confidence they now use private electronic networks to perform credit checks.
To start with, most state laws do not give "digital signatures," a key component of IBM's system, the same legally binding status as ink-and-paper contracts.
The IBM-Equifax alliance grew out of a close partnership begun in 1993, when IBM's computer services business began managing many of Equifax's back-office computer operations, executives said.
Reuters contributed to this report.