Layer Security

Protecting Documents

Lock 2 96

Layer Security follows the principle of "protect the data, not just the infrastructure." This is done using end-to-end document-level encryption, which adds an extra layer of (sender-to-recipient) protection to avoid problems with intermediate parties snooping or not properly securing how they store or transmit messages.

The overall approach is summarised in the following diagram.



In the system above there are many clients that communicate with a distributed Messaging Service.

The end-system is typically a dedicated machine running in a business or government agency. It will usually interface to other systems e.g. accounting or reporting systems.

The client software is installed on the end-system. The Layer Security (LS) client is a unique, state-of-the-art, built-for-purpose technology designed to be:

  • Small, fast, and efficient - the executable being written in "C".
  • Easy to install and configure - just consisting of an executable and an associated configuration file.
  • Easy to manage - as most of the client-side cryptography is hidden from users.
  • Easy to integrate - into automated systems so as be almost invisible to the senders and recipients.

The Messaging Service handles the delivery of messages to the correct recipient. Each client must be registered with the service provider both at the commercial level (e.g. contracts, billing) and the technical level (e.g. for authentication, routing). The messaging protocol may be ebMS3/AS4, SMTP or any other message-based transport.


There are essentially three types of interactions.

Subscriber-to-provider interactions are at the business level.

  • Signup - occurs when a subscriber e.g. a business commits to a service. It will involve the setting up of an account and associated contractual and billing information.
  • Installation - will involve configuring software on an end system and the setting up of an account on the server which will be used for authentication (e.g. a certificate).

Client-to-server interactions are at the transport level.

  • Authentication - occurs on each connection. Clients authenticate the server using SSL/TLS. The server authenticates the client by checking the digital signature of the user's message against their registered certificate.
  • Sending - involves attaching the encrypted payload (S/MIME document - see below) to a message (ebMS3/AS4) and sending it using the "SOAP with attachments" push processing mode[1]. Messages are routed by the server using identifiers (to and from fields) in the AS4 envelope.
  • Receiving - involves connecting to an ebMS3/AS4 server and downloading any waiting messages using AS4 (SOAP "pull" processing mode)1. Note this means that clients need to periodically "poll" for messages.

Client-to-client interactions are at the user document level.

  • Documents - sent between endpoints are those useful to business and/or government. Examples include reports, invoices, compliance statements etc. Documents within each S/MIME attachment are compressed, signed and encrypted.
  • Co-ordination messages - may be sent between endpoints to enable end-to-end encryption, signing and technical non-repudiation e.g. read receipts or certificate management (exchanging or updating). All co-ordination messages are signed.

[1] The LS Client also supports "SOAP over email" in which messages are sent using SMTP and received using POP or IMAP.