MSS (Mobile Signature Service) is a high-level service specified by the European Telecommunications Standards Institute that defines the roles participating in mobile identity management and mobile signature transactions, as well as functional and business-related requirements and interfaces. The specification is the governing standard for PKI and enables cross-compatible mobile signature solutions.
Video Mobile Signature Service
Background
The mobile signature services industry began in the early 2000s, with the release of the European Telecommunications Standards Institute (ETSI) mobile commerce standards (ETSI 102 203, 102 204, 102 206 and 102 207). The standards defined mobile signature as a universal method for using a mobile device to confirm the intention of a citizen to proceed with a transaction (digitally sign transactions on their mobile devices, turning the mobile device into personal trusted devices.) and mobile signature service as a facility that coordinates and manages the mobile signature process.
Maps Mobile Signature Service
Roles
Mobile User
The Mobile User is either a private person in possession of the mobile device, or a device embedded in the mobile device to which a mobile signature is associated.
Application Provider (AP)
The AP provides the service that the Mobile User wishes to authenticate themselves to or the contract that the User wishes to sign.
Smart Card Issuer
The Smart card issuer, typically a Mobile Network Operator, issues the Mobile User with a smart card that is in some form capable of completing signature operations and on-board key generation. The issuer associates itself with an MSSP.
Registration Authority (RA)
The RA, typically a Mobile Network Operator, is in charge of registering Mobile Users to MSS.
Certificate Authority (CA)
The CA is a service, typically a third party, that issues digital certificates to the Mobile User's public key.
Mobile Signature Service Provider (MSSP)
The MSSP is a service that facilitates the communication between the AP and the Mobile User's SIM card. The MSSP of the ETSI specification typically consists of a HomeMSSP, AE (Acquiring Entity) MSSP and possibly an RE (Routing Entity). APs connect to a HomeMSSP via AE MSSPs. HomeMSSPs connect to the Mobile User's SIM card directly.
Establishing a mobile identity
When a Mobile User subscribes to a Mobile Signature Service, the RA confirms their identity and binds their identity to a key pair as per Public Key Infrastructure. The keys can be generated server-side or on the User's SIM card with On-Board Key Generation. With OBKG, the SIM card generates the key pair, sends the public key to the MSSP to be bound by the RA and certified by the CA, and has the Mobile User assign a signing PIN on the private key, which begins its existence on and never leaves the SIM card.
Completing a signature transaction
When a Mobile User accesses an AP's service and wishes to perform a Mobile Signature, the AP sends a signature request to the Mobile User's HomeMSSP via an AE MSSP. The MSSP forwards the AP's request to the Mobile User's SIM card. Upon receiving the signature request, the Mobile User's SIM card can only complete the signature when the Mobile User gives their signing PIN. The requested data is signed with the Mobile User's private key and sent back to the Mobile User's HomeMSSP, which then returns the signature to the AP, who can verify it with the Mobile User's public key.
Roaming
The ETSI mobile commerce standard TS 102 207 defines a roaming framework between multiple MSS systems. If the AP and Mobile User's HomeMSSPs are different, the AP's MSSP can reach the Mobile User's by roaming. This way, an AP can make a contract with any of the MSS system operators provide a service for all Mobile Users in the MSS mesh.
Revoking an identity
If at any point there is reason to believe that the User's mobile identity is at risk, they may ask the Mobile Network Operator to have the CA revoke their certificate. Revoking the certificate of a User's public key makes the key pair unusable. Commonly, a revoked certificate cannot be reinstated remotely. Instead, a User must re-register in person in order to resume the use of MSS.
References
Source of the article : Wikipedia
0 Comments