Electronic Invoices: An Application Area

An example of this approach can be sought in the area of electronic invoices. Article 2 of Directive 01/115/EC permits the usage of advanced electronic signatures to invoke the authenticity of electronic invoices. Another means to this end that the Directive accepts is EDI-based invoices in the meaning of the Commission Recommendation 94/ 820/EC on a European Model EDI Agreement (October 19, 1994). Facilitating the shift of processing electronic invoices in a mass scale requires including safeguards that ensure the validity, verification conditions, transaction constraints, and intended role in order to enhance the level of legal safety in the communication of an invoice.

The recommended approach could facilitate in practical terms invoice processing centers to migrate into electronic invoice formats that use advanced electronic signatures. This can be done by processing the signature validation and verification data in the context and permissions of the role of the signatories involved. The added benefit for the end user is greater legal safety with respect to the transaction involved and the validation data thereof.

Electronic Invoicing Example
Phase A: Invoice Issuer	Phase B: Invoice Processing Centre	Phase C: Invoice Recipient
Invoice Issuer sends signed invoice data to Invoice Processing Centre (IPC)	Invoice Processing Centre: Validates sender's signature according to constraints on its own signature policy Converts data format to match Recipient's requirements	Invoice Recipient validates IPC signing certificate

The table above outlines the suggested approach in a model that allows the usage of signature polices.

In phase "A," the sender issues an invoice issuance request that he signs by using an electronic certificate. An invoice issuance request contains the invoice data, such as the amount to be invoiced, and is addressed to the outsourced agent who typically handles invoicing for the company of A. According to the electronic invoice Directive, an electronic invoice can be signed electronically. Additional attributes or constraints can be inserted in a signature policy to convey the role under which such signing might be carried out, e.g., "Joe Doe, Accounting Manager." As "Accounting Manager," the issuer is entitled to sign outgoing invoices that he otherwise might be unable to validly do. Authorization attributes can be inserted in the signature policy and possibly also conveyed by means of an attribute certificate.

In phase "B," the recipient is the processing center that usually handles invoices on behalf of Joe's company. The processing center controls Joe's signature and authorization attributes against a signature policy that it applies in transactions with organizations like Joe's. The signature policy allows the processing center to quickly check, e.g., the validity of the applied electronic signature as well as any associated constraints, such as its signing role, authorization limits, etc.

Inserting the data received from Joe's organization into its electronic invoice format, the processing center raises the invoice and subsequently signs it.

In phase "C," the recipient, who is the business partner of the invoice issuer, receives the invoice that the processing center has sent. Since the recipient is a fairly small outfit with limited resources, he does not necessarily have the ability to make many controls on the signatures and roles, so he relies on the signature of the processing center to ensure the origin of the invoice received. Since the processing center is a party known to the recipient, it takes only a small effort to validate the signature that is used under a policy.