The digitized world screams for technologies that would help to prove the validity of any digital data. One such timestamping infrastructure solution is provided by GuardTime, a company founded in Estonia.

The technology invented by digital data security experts and cryptology specialists Märt Saarepera (in upmost picture) and Ahto Buldas (in middle picture) has almost unlimited potential and possibilities to be used in various business or consumer solutions. It is an exciting subject, yet like the average end user has little idea about how the mobile network technologies work with mobile phones, few are aware of the timestamping technology and how it can be used.

So what is a timestamp then? GuardTime management board member Riina Einberg (in undermost picture) says that most people understand the meaning of timestamp as a set of information attached to the digital data that refers to a point of time and date. “Often people think that we are going to label salad boxes from local deli with time information when the salad was packaged,” jokes Einberg.

Technology that provides trust

In fact, GuardTime technology enables proving the validity and integrity of any digital data anywhere large corporations, lots of people, complicated regulations and cross-border businesses are involved.

Timestamp can be compared to a digital fingerprint that has been left by machines, devices and programmes while saving any digital data. Moreover, the digital fingerprint is not personal and does not indicate who has created the digital data.

It is considered rather difficult to forge a signature on paper or modify printed photos, especially compared to similar changes in digital world where you can make changes to any digital document with just a few mouse clicks.

Includes hash value

Timestamp includes a unique hash value or so-called control code of the data taken from a file at a specific moment of time. Such hash value is unique and unpredictable. If the data within the file is changed, the hash value will change as well, making the control code different from the original one.

Checking the integrity of the timestamp is based on the control code that is published by GuardTime. The company has named such code as Integrity Code and publishes it in business newspapers such as Financial Times and Nikkan Kogyo (Japan). To verify the data you only need to know a certain public algorithm to generate the control code from your data and then compare it with the Integrity Code in the newspaper. If the two codes match, the validity of the data has been proven.

Timestamping photos and x-ray photos

GuardTime’s timestamping technology has most use when integrated into different data or document management or archiving solutions. All companies and organizations archiving and having the need to prove the validity of its digital data is considered the market segment with most potential by GuardTime.

“We could be compared to making oil for engines. The oil can easily be the best, yet the end user rarely figures that out himself. The added value will quickly be noticed when the first partners will be using the solution,” says Riina Einberg.

Tests ongoing

The list of future partners using GuardTime solution is looking to be a long and varied one. Currently the technology invented by Estonians is being tested with several products and integration projects in order to add timestamping functionality to different systems.

Devices used in medicine industry or home electronics are just two examples of potential markets. Einberg believes that photo cameras could automatically add a timestamp to every picture taken with it in order to avoid the problem of losing the information of when the file was created while copying photos from a camera to your hard drive.

Timestamping real estate sketches

Also, if the file is timestamped, it is impossible to change or modify a digital photo without leaving a trace of the action.

Einberg gives another example that timestamps could be very useful with real estate construction plans. The city council receives the sketches of the project with the architect’s timestamp. After accepting the project, the documentation can be checked whether there has been any modifications made into it during the review process. If the project documentation is changed, it will receive a new timestamp that can be compared to the original one.

What is the best business model?

The best known timestamping service providers in the world are Codel, Surety and Authentidate. However, they all have different business models and technological solutions. For example, some of those companies offer downloadable software to be used in your computer and that enables timestamping your files.

Einberg says that as with any other new technology, existing alternative technologies are the competitors and not the similar service providers. “In case of proving the validity of data people still use paper based archives, notary. New technologies always bring changes to some paradigm – speed, volume or other physical limits.”

Providing validity of digital signatures

Estonias should be familiar with timestamping when using digital signatures. For example, proving the validity of digital signatures is offered by Sertifitseerimiskeskus, whose timestamping servise is integrated into digital signature and whose service is used in the local market.

GuardTime is an international company focused on the global market. “Clobal business can only be built with experienced international team. That was one of the key success factors for Skype,” Says Einberg.

Mike Gault, the irish CEO of GuardTime has a background in investment banking. He has had a long career in Barclay Capital in Japan. The CFO of the company and with long career in finance in several big corporations is Roger Lakhani. The CTO is Merike Kaeo (Käo), an Estonian who has previously been working with Cisco. A very experienced business development team is also based in Japan. GuardTime is funded by Martest Security, investment fund Safrole and Ambient Sound Investments.

Einberg emphasizes that GuardTime’s solution is more likely interesting for partners and integrators, rather than end users.

Photos: Joichi Ito and ASI

So, first timestamping…

… and then verification of the timestamp …