Mobile Certificate Based Network Services

Introduction Electronic services are growing rapidly and the lack of security, compatibility and effectiveness is one of the reasons why new methods like mobile certificate will play a big role in the evolution. Vetuma is a public administration's joint service for citizen authentication and payment in Finland. Vetuma has introduced for citizens an additional method for authentication and payment with mobile certificates (FI: Vetuma, 2011). The mobile certificate is based on the ETSI's MSS standards and has been developed in Finland in collaboration with mobile cellular network operators (Mobiilivarmenne, 2010). The MSS is used to give permission to a transaction (e.g. financial), which the user has initiated with his/her mobile device. Therefore the MSS is defined as a service in which the mobile signature process is coordinated or managed for the user and for the Application Provider (AP). The Mobile Signature Service Provider (MSSP) offers MSS systems for service providers (ETSI, 2003a; ETSI, 2003b). In Web Service Interfaces the MSS is used for authentication or for signing text content or a digest of text content. Therefore MSS has a Web Service Interface, which MSSP provides and/or implements for an AP. In implementation of network services for mobile certificates, the concept of MSS must be thoroughly understood. (ETSI, 2003b) The objective of this paper is to show how mobile certificate based solutions for IT services can be designed with FiCom application guideline (FiCom, 2012) for ETSI's MSS standards (ETSI, 2003a; ETSI, 2003b). Background and Related Research A mobile certificate is a recent Public Key Infrastructure (PKI) application. PKI is based on Public Key Cryptography discovered by Diffie & Hellman (1976) combined with certification of public keys as proposed by Kohnfelder (1978). An exhaustive presentation of the evolution and principles of PKI is found for example in (Gutmann, 2002). PKI is a basis for two-factor authentication and digital signature services. The fundamental PKI component is often called "token", which is a certified public/private key pair in Public Key Cryptography. A token is "soft" when the private key is stored in a file, which is usually encrypted. A token is "hard" when the private key is stored in hardware. Typical hard token examples are smartcards and cryptographic coprocessors in network servers. A hard token naturally provides far better protection against disclosure and tampering attacks than a soft token. A typical hard token application is a smartcard implementation of an electronic identity (eID) card. A smartcard requires an attached smartcard reader and smartcard interfacing software in a computer using the eID. However, if the hard token is located on the SIM/USIM card of a mobile phone, then the eID can be used also in a computer without a hardware/software interface to a smartcard. A SIM card hosting a hard token is called a PKI SIM card. A PKI SIM card usually implements an eID, which is called "Mobile PKI" or "mobile certificate". An assessment of Mobile PKI technology is published in (Oostdijk & Wegdam, 2009). Mobile PKI security is outlined in (Mobile, 2013). PKI SIM based digital signature solutions for e-banking are proposed in (Li, 2009). Mobile Certificate in Finland The mobile certificate developed by mobile phone operators in Finland is a hard eID token, which is used for authenticating the identity of a person and for approving a transaction or an agreement. Therefore it is used for granting access to electronic services and for digital signing of a text or a document (Mobiilivarmenne, 2011a). The private key of the mobile certificate is stored in the SIM card with the owner's personal information (Mobiilivarmenne, 2011c). The mobile operators have also signed a trust network agreement as Certification Authorities (CA) and agreed on a certification policy, which they manage and update (Mobiiliasiointivarmenne, 2011). …