Mobile signatures are electronic signatures which are created using a mobile device and rely on signature or certification services in a location independent telecommunication environment. They allow signatory mobility beyond fixed, secure desktop workstation with trusted, personal signing equipment.
How Mobile Signature works – SDX Composer
- The application presents the document to the user
- The application prompts the user to sign a document. (agreement, transaction etc.)
- The application calls the signing service of SDX Composer
- The SDX Composer calls the wPKI Integrator signature creation service
- The wPKI Integrator sends the signing request with embedded data to the mobile device
- The user creates the signature on his mobile and sends back the signature to the wPKI Integrator
- The wPKI Integrator checks the validity of the user certificate via CA services (CRL or OCSP)
- The wPKI Integrator sends back the signature and the validity data to SDX Composer
- The SDX Composer completes the signed documents - generates the data in XAdES format and extends with auxiliary data, optionally saves the document (timestamp, Signature Policy reference, other attributes)
- The SDX Composer hands over the signed document to the application
- The application notifies the user about the creation of the signed document
Wireless PKI (WPKI) - mobile user authentication and electronic signatures
The European Union Electronic Signature Directive (1993/93/EC) provides a framework for the harmonization of legal, trust and technical aspects of electronic signatures. EESSI (European Electronic Signature Standardization Initiative) co-ordinates Industry and European Standards Bodies to provide an agreed framework and specifications for an open, market-oriented implementation of the Directive. Since then, several national eID projects started in Europe to provide e-Government services to citizens based on strong authentication and digitally signed transactions and documents.
The SDX (Signed Document eXpert) electronic signature integration and management product suite developed by E-Group. It fully conforms to the EU Directive and general PKI standards. The SDX product suite components support application integration in a very flexible way on both client and server sides.
The mobile phone is a Personal Trusted Device for electronic security in all situations where strong authentication and nonrepudiation of electronic signatures are needed.
E-Group offers mobile digital signatures in a centralized authentication framework, based on a Mobile Signature Service Provider (MSSP). The MSSP provides its services in an easy-to-use standards based service interface, ideal for e-Government and other e-Services.
Centralized authentication using mobile digital signatures
Typically, e-services (e-Business, e-Banking, e-Government etc.) have their own user authentication methods. In this case users have different type of authentication methods for different services. This is, however:
- difficult to use, and
- makes it hard to manage and develop services
The Mobile Signature Service Provider (MSSP) is a standards (ETSI MCOMM) based server software for centralized user authentication and transaction validation, which manages the whole transaction life-cycle of mobile digital signatures. The MSSP supports:
- multiple service providers with multiple services
- multiple signing devices
- multiple operator connections and technologies
- multiple certification authority technologies and connections
The mobile phone as a Personal Trusted Device
Mobile authentication and electronic signatures allow the user to access the services using the best possible user interface:
- personally face-to-face
- over the phone call
- Web-based services with web browser and PC
- PDA, hand-held PCs
- MHP services with digi-TV
- vending machines
- gaming machines
The mobile phone is used for digitally signing authentication and non-repudiation Mobile Signature Service Provider requests. The mobile phone is ideal for generating digital signatures, because:
- it is always with you
- it is personal
- if you loose it, you notify your operator and they’ll disable it
- you realize immediately if you loose it
- it is an ideal place to store the private key and perform signing functionalities
|
