How would you feel if your online request for a £1m insurance policy was intercepted by a rival? Encrypting important documents will protect you against such risks, explains Steve Rawsthorn….
Electronic security is much more complicated than household security or personal security and can be intimidating for those not in the know. Methods such as data encryption and sender authenticity are potentially crucial tools for brokers and the wider insurance industry, but what do they really mean?
There are two main types of encryption: symmetric and asymmetric key cryptography. These are instrumental in building secure e-commerce solutions and can be used to achieve confidentiality, integrity and authenticity.
Symmetric keys
Symmetric (or private) key encryption is the oldest and most widely known method of keeping data secure and can be likened to a combination safe. Plain text is transformed by using a secret key (encrypting/decrypting tool, known in lay terms as a code or cipher) into random-looking characters. No information can be retrieved without that same key. Emails encrypted this way can safely be stored or transmitted to places to which outsiders might have access.
The name “symmetric key” means that the same key is used both to encrypt and decode the text. Because an encrypted document can only be deciphered by fellow keyholders, there is an assurance as to the authenticity of the sender and the integrity of the document.
But the sender needs to be sure that the recipient is the only other person with access to the common secret key.
The system is flawed, because a recipient who alleges someone sent them a document could actually have sent it to themselves. For complete authenticity, asymmetric key systems are needed.
Asymmetric keys
Asymmetric (or public) key encryption can be likened to a safe with two combination locks: one to close the safe and one to open it. These combinations are different: the locking key cannot open the safe on its own, and the opening key cannot close it.
The idea is that if a broker (let's call him Bob) wants to send a confidential document, for example, a request for an insurance policy, to an underwriter (Alice), firstly he needs to ask for her close key. He will then put the document in the safe and close it with Alice's close key. Alice can only open the closed safe if she has the open key as well.
In practice, Alice will publish her close key in a directory, so it is known as a public key. Private keys are those that can open all the safes closed with the public key.
Asymmetric encryption can also be used to provide the digital equivalent of a signature. If a sender only wants to sign an electronic document (to authenticate it), they can create a close/open key pair and publish their open key, while keeping the close key private.
To create a digital signature on a document, a person puts it in a safe and closes it with their close (private) key. Then they send it to their chosen recipient, who will try to open the safe using the sender's open (public) key. If this works, it is guaranteed that the message was sent by the person claimed.
Interception
The authenticity of the public key is crucial. If another person, Charlie, can replace Alice's public key in transit or in a directory with a private key of his own, he will be able to read documents encrypted by Bob using Alice's alleged public key. So, Charlie could:
Neither Bob nor Alice might notice that Charlie is reading the documents. This demonstrates that the use of asymmetric encryption for digital signatures is not foolproof. Before relying on someone else's public key, you need be confident about the key's integrity. You also need to be certain of the identity of the private key's owner.
Hybrid encryption
Asymmetric encryption is far more difficult than symmetric and should be used sparingly. To bridge the gap, you can resort to hybrid encryption, a combination of asymmetric and conventional encryption.
Instead of asymmetrically encrypting the whole document with Alice's public key, Bob generates a random secret key (a “session key”) and encrypts the whole document using a symmetric key system. Then he asymmetrically encrypts the secret key with Alice's public key.
Using her private key, Alice asymmetrically decrypts the secret key and then decrypts the whole document using the secret key and the symmetric key system.
Instead of using one virtual combination safe, hybrid encryption uses two – one of which is symmetric and the other asymmetric.
These complex procedures highlight the pitfalls of the IT revolution, which must be of particular interest to the insurance industry as it tries to modernise. There is a shortage of companies with specialist training and the depth of knowledge to help fight e-crime. Making your network safe against hackers can be costly, but not doing so could be far more expensive.
