1

I am working for a customer who needs to implement digital signatures (and I emphasize digital, not just electronic) on SharePoint list items. Due to the context of the project, I have the following constraints:

  • InfoPath is a no go
  • There needs to be some kind of possible validation of the signature (hence digital, I need CFR21 Part 11 compliance for those who know it)
  • The data to be signed can reside inside multiple list items (split in different lists in a master/detail fashion)
  • Any amount of custom development is not a problem

I have seen a few add-ons that offer digital signatures on documents or single list items. The catch for me is that I need a solution that spans multiple items. I'm having a hard time thinking of a clean/tamper-proof architecture.

Thank you in advance.

2

[Disclosure: I work for CoSign]

You will need to write software to:

Sign the collection of list items

  1. Collect up all of the appropriate fields in all of the list items (the master and its details).
  2. Serialize them into a "bundle of bits." This operation needs to be repeatable in the same way each time. Eg, the detail records need to be ordered by line item number.
  3. Use the CoSign SAPI API to sign the bundle of bits and generate the signature as a "detached signature." This is easy to do with the CoSign API. Example.
  4. Save the detached signature back into the SharePoint system. I'd create a signature field as part of the Master list items. Of course, you will NOT include the contents of the signature field when you serialize your set of data in step 1, above.

Verify the signed collection of list items

Write a function to enable the SP user to verify a set of your data:

  1. Repeat step 1 from above.
  2. Repeat step 2 from above.
  3. Retrieve the "signature" field from the master record stored in step 4 above. Use it and the SAPI verification function to verify that the current value of the bundle of bits matches the signature.
  4. Show the verification results to the user. You may also want to store the verification results as additional fields in the master record for easy listing when viewing the library. In that case, be sure to clear the verification result field whenever any of the data is changed.

Also

You will also want to handle multiple signatures per data set. Not hard but beyond the scope of this answer.

CFR21 issues

CoSign digital signatures are used for many many CFR21 Part 11 applications, so that's not a problem.

But usually the verification process can either be done by the originating software or by external software. I don't know whether CFR21 requires the ability to externally verify the signatures. If so, then you'll also need a way to export both your serialized data and the detached signature for verification by a third party. You may be able to wrap them together in one of the XML signed data standard formats. You can contact CoSign sales and CoSign Professional Services for additional help.

  • So your answer is basically: Use our product? – Louis Oct 2 '13 at 11:49
  • You can use the CoSign API or a different api for creating and verifying the digital sig of the data. CoSign works well for this, your app is an example of what our customers do. Note that creating the signatures is the tricky part if you will have different signers--in order to accomplish the CFR21 issues for non-reputability, you need a Secure Signature Creation Device. This is exactly what CoSign provides, with low TCO via its centralized storage of private keys. Otherwise you need to deal with getting access to the private keys, an expensive process to develop and admin. – Larry K Oct 6 '13 at 1:14
  • Going to accept this answer because it is exactly the path we're going on after finding out another part of the client's company had a CoSign box already :). – Louis Oct 21 '13 at 12:53
-1

Our Company, K2C Solutions, offers a set of features that enables Electronic Signature (eSignature) and Digital Signature (dSignature) in any SharePoint Designer or Nintex workflow.

Free trial can be downloaded at http://www.k2c.com

As per 21 CFR part 11, it requires Electronic Signature only, but we added also Digital Signature to sign a pdf with certificates. Also we have some solution to convert signed file in PDF.

In our website you can see some video and tutorial, hope this help

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.