Qualified Mobile Server Signature

Abstract

International audienceA legal basis for the use of electronic signatures exists since the introduction of qualified electronic signatures in EU Directive 1999/ 93/EC. Although considered as key enablers for e-Government and e-Commerce, qualified electronic signatures are still not widely used. Introducing amobile component addresses most of the shortcomings of existing qualified signature approaches but poses certain difficulties in the security reasoning. The proposed server based mobile signature approach authenticates the signatory over trusted channels and assists the protection of the signature-creation data with organizational measures. As with traditional qualified signature approaches, strong authentication of the signatory to the system is ensured by two factors. Knowledge of a PIN and possession of a valid subscriber identity module card is verified over two separate communication channels. The qualified mobil server signature fulfills the requirements on secure signature-creation devices defined by the EU directive and in particular its Austrian implementatio

Design strategies for a privacy-friendly Austrian eID system in the public cloud

“…These middleware approaches are used to access citizen card implementations which are based on smart cards. Other citizen card implementations can also be server-based such as the mobile phone-based alternative of Orthacker et al (2010), which in fact require no local software installations on the client. The approach of Orthacker et al (2010) uses short messages (SMS) to transfer transaction codes to the citizen's mobile phone.…”

A privacy-preserving eID based Single Sign-On solution

“…A second approach using mobile phones for authentication gets well established at the moment. The concept of this approach has been described in detail by Orthacker et al [6].…”

A Server-Based Signature Solution for Mobile Devices

“…In particular, the model applies to the concept proposed by Orthacker et al [9] and to the Austrian Mobile Phone Signature. Considering concrete implementations of the derived model, the secure and reliable realization of possession proofs is the challenging part.…”

“…The ServerBKU supports the server-based creation of electronic signatures and thus already implements the functionality of the components Signature Service and SSCD defined by the functional model. As it relies on the concept proposed by Orthacker et al [9], the ServerBKU makes use of the classical SMS-TAN approach to authenticate users. The authentication factor possession is covered by a TAN, which is sent to the user via SMS and has to be returned by the user to prove possession of the SIM.…”

“…As server-based signature solutions store and process the signatory's cryptographic signing key centrally, these means are not under physical control of the signatory. In 2010, Orthacker et al [9] have shown that sole control over cryptographic signing keys can be guaranteed, even if they are not under physical control of the signatory.…”