Lightbridge, Verisign beef up authentication security

People can get digital certificates without giving much proof of identity, said Bob Shelton, Lightbridge (www.lightbridge.com) director of strategic solutions. That’s strange, considering digital certificates are used to verify user identities during online or mobile transactions.

However, Lightbridge and Verisign (www.verisign.com) plan to add a new layer to the authentication process. Today, Lightbridge announced a deal to provide fraud and risk-management services to Verisign.

“We want to make sure those who receive digital certificates really are who they say they are,” Shelton said. “So rather than just applying for a digital certificate using the current means, the combined solution will be requesting additional information that relates to the customer’s identity.”

Lightbridge will check identity data that can’t usually be obtained by stealing someone’s wallet. Digital certificate applicants would be asked, for example, to provide information such as the name of the banks holding their mortgages. Application data will be compared to information on file at credit bureaus or in other databases.

If the answers on the application prove valid, Lightbridge will give Verisign a thumbs up. If there’s any doubt, Verisign could intervene and have an employee talk to the applicant.

The Verisign deal is a sign of Lightbridge’s commitment to extend its services into the mobile data space.

Shelton said authentication will become increasingly important for wireless carriers as more financial transactions are performed via wireless devices.

“In mobile business, connectivity is being provided by the wireless carrier,” Shelton said. “So there’s an implied fiduciary responsibility on the part of the carrier to make sure that transactions take place properly and that (subscribers) receive the information or services they’re requesting.”

Lightbridge plans to complete the beta phase of the authentication project and roll out the commercial application in early 2002.