Wireless PKI (WPKI) - mobile user authentication and electronic signatures

The European Union Electronic Signature Directive (1993/93/EC) provides a framework for the harmonization of legal, trust and technical aspects of electronic signatures. EESSI (European Electronic Signature Standardization Initiative) co-ordinates Industry and European Standards Bodies to provide an agreed framework and specifications for an open, market-oriented implementation of the Directive. Since then, several national eID (eIdentifier) projects started in Europe to provide e-Government services to citizens based on strong authentication and digitally signed transactions and documents.

The SDX (Signed Document eXpert) electronic signature integration and management product suite is developed by E-Group. It fully conforms to the EU Directive and general PKI standards. The SDX product suite components support application integration in a very flexible way on both client and server sides.

The mobile phone is a Personal Trusted Device for electronic security in all situations where strong authentication and non-repudiation of electronic signatures are needed.

E-Group offers mobile digital signatures in a centralized authentication framework, based on a Mobile Signature Service Provider (MSSP). The MSSP provides its services in an easy-to-use standards based service interface, ideal for e-Government and other e-Services.

Centralized authentication using mobile digital signatures

Typically, e-services (e-Business, e-Banking, e-Government etc.) have their own user authentication methods. In this case users have different type of authentication methods for different services. This is, however:

• difficult to use, and
• makes it hard to manage and develop services

The Mobile Signature Service Provider (MSSP) is a standards (ETSI MCOMM) based server software for centralized user authentication and transaction validation, which manages the whole transaction life-cycle of mobile digital signatures. The MSSP supports:

• multiple service providers with multiple services
• multiple signing devices
• multiple operator connections and technologies
• multiple certification authority technologies and connections

The mobile phone as a Personal Trusted Device

Mobile authentication and electronic signatures allow the user to access the services using the best possible user interface:

• personally face-to-face
• over the phone call
• web-based services with web browser and PC
• PDA, hand-held PCs
• MHP services with digi-TV
• vending machines
• gaming machines

The mobile phone is used for digitally signing authentication and non-repudiation Mobile Signature Service Provider requests. The mobile phone is ideal for generating digital signatures, because:

• it is always with you
• it is personal
• if you loose it, you notify your operator and they’ll disable it
• you realize immediately if you loose it
• it is an ideal place to store the private key and perform signing functionalities