A mobile signature is a digital signature generated either on a mobile phone or on a SIM card on a mobile phone.
Origins of the term
mSign The term first appeared in articles introducing mSign (short for Mobile Electronic Signature Consortium). It was founded in 1999 and comprised 35 member companies. In October 2000, the consortium published an XML-interface defining a protocol allowing service providers to obtain a mobile (digital) signature from a mobile phone subscriber. In 2001, mSign gained industry-wide coverage when it came apparent that Brokat (one of the founding companies) also obtained a process patent in Germany for using the mobile phone to generate digital signatures.
ETSI-MSS standardization The term was then used by Paul Gibson (G&D) and Romary Dupuis (France Telecom) in their standardisation work at the European Telecommunications Standards Institute (ETSI) and published in ETSI Technical Report TR 102 203. The ETSI-MSS specifications define a SOAP interface and mobile signature roaming for systems implementing mobile signature services. ETSI TS 102 204, and ETSI TS 102 207.
Today The mobile signature can have the legal equivalent of your own wet signature, hence the term "Mobile Ink", commercial term coined by Swiss Sicap. Other terms include "Mobile ID", "Mobile Certificate" by a circle of trust of 3 Finnish mobile network operators implementing a roaming mobile signature framework Mobiilivarmenne, etc. According to the EU directives for electronic signatures the mobile signature can have the same level of protection as the handwritten signature if all components in the signature creation chain are appropriately certified. The governing standard for the mobile signature creation devices and equivalent of a handwritten signature is described in the Commission Decision 2003/511/EC of 14 July 2003 on the publication of reference numbers of generally recognised standards for electronic signature products in accordance with the Electronic Signatures Directive. If the signature solution is Common Criteria evaluated by an independent party and given the EAL4+ designation, the solution can produce what the EU directive and consequent clarifications are calling a qualified electronic signature. The current standard dates back to the year 2002/2003 and is in the process being renewed and published by the end of 2012. Most, if not all, mobile signature implementations to date generate what the EU Directive is calling advanced electronic signature. The most successful mobile signature solutions can be found in Turkey, Lithuania, Estonia and Finland with millions of users. Technically the mobile signature is created by a security module when a request for it reaches the device (SIM card) and after introducing the request to the user with a few explanation prompts, the device asks for a secret code that only the correct user should know. Usually, this is in form of a PIN. If the access control secret was entered correctly, the device is approved with access to secret data containing for example RSA private key, which is then used to do the signature or other operations that the request wanted. The PKI system associates the public key counterpart of the secret key held at the secure device with a set of attributes contained in a structure called digital certificate. The choice of the registration procedure details during the definition of the attributes included in this digital certificate can be used to produce different levels of identity assurance. Anything from anonymous but specific to high-standard real-word identity. By doing a signature, the secure device owner can claim that identity. Thus, the mobile signature is a unique feature for:
Proving your real-world identity to third parties without face-to-face communications Making a legally-binding commitment by sending a confirmed message to another party Solve security problems of the online world with identity confirmation (an anonymous but specific identity is often equally good as a high-standards identity)
Public services
Estonian Mobile-ID See [1]. ParsMSS in Iran Pars Mobile Signature Services Project (ParsMSS) has been designed and produced in Iran for the first time since 2011. Pars Mobile Signature Services (ParsMSS) can be provided in two ways: SIM-Based and SIM-less. Registration Authority (RA) connects to this service and issues the electronic certificate in person or remotely. With this service, financial transactions and documents can be signed digitally.
Mobile Ink (Finland) Mobile Ink unites high security and user-friendly access to digital services which require strong authentication and authorization. Subscribers can get mobile signature access to m-banking or corporate applications for example. Mobile Ink is a commercial term associated with the mobile signature solution of Sicap building on Kiuru MSSP platform by Methics Oy. The platform allows simultaneous existence of multiple keys and associated identities with distinct registration procedures. This is used for example as a replacement for RSA SecurID dongles with anonymous but specific identity in corporate access applications.
… excerpt ends here. Continue reading the full article.
