Suchergebnisse

In November 2010, the German government started to issue the new electronic identity card (eID) to its citizens. Besides its original utilization as a 'visual' identification document, the eID card can be used by the cardholder to prove one's identity at border control and to enhance security of authentication processes over the Internet, with the eID card serving as a token to reliably transmit personal data to service providers or terminals, respectively. To this end, the German Federal Office for Information Security (BSI) proposed several cryptographic protocols now deployed on the eID card. The Password Authenticated Connection Establishment (PACE) protocol secures the wireless communication between the eID card and the user's local card reader, based on a cryptographically weak password like the PIN chosen by the card owner. Subsequently, the Extended Access Control (EAC) protocol is executed by the chip and the service provider to mutually authenticate and agree on a shared secret session key. This key is then used in the secure channel protocol, called Secure Messaging (SM). Finally, an optional protocol, called Restricted Identification (RI), provides a method to use pseudonyms such that they can be linked by individual service providers, but not across different service providers (even not by malicious ones). This thesis consists of two parts. First, we present the above protocols and provide a rigorous analysis on their security from a cryptographic point of view. We show that the Germen eID card provides reasonable security for authentication and exchange of sensitive information allaying concerns regarding its usage. In the second part of this thesis, we introduce two possible modifications to enhance the security of these protocols even further. Namely, we show how to (a) add to PACE an additional efficient chip authentication step, and (b) augment RI to allow also for signatures under pseudonyms.

Electronic identification services (eIDs) have become strategic services in the global governance of online societies. In this article, we argue that eIDs are sociotechnical constructs that also have political-economic dimensions. In the European context, governmental and corporate efforts to develop eIDs are shaped by legal EU frameworks, which are almost exclusively focussed on technical and legal interoperability, such as the European Interoperability Framework (EIF) and the European Interoperability Reference Architecture (EIRA). Public concerns such as privacy, security, user empowerment and control over one's personal information prompts developers to propose a decentralized, attribute-based system governed on a nonprofit, nonstate basis (DAN-eID). To illustrate our argument, we explore a single emerging eID system (IRMA; acronym for I Reveal My Attributes) that is developing in a national context (The Netherlands). We argue that developing eIDs requires more than engineering ingenuity and legal compliance; as sociotechnical and political-economic constructs, they involve negotiation of conflicting social and political values.

Because of the Schaffhausen population's needs regarding more flexibility of authorities, an augmented importance of online services and increases in (cyber) security awareness, the e-government committee (eGov-Kernteam) of the Canton of Schaffhausen decided to pilot the electronic identity Schaffhauser eID+ to ultimately allow for efficient and effective Smart Government processes.* The aim of this practice article is to show how the Canton of Schaffhausen adopted a co-design approach to introduce its electronic identity and to set out key findings regarding the introduction of a technology-based public service innovation. Based on the strategic approach of a 'testing laboratory', co-design methodology was used through conducting usability tests and semi-structured interviews with selected individuals. The optimization suggestions collected were subsequently evaluated and reintegrated. Furthermore, the collected data were used to analyze the acceptance of the Schaffhauser eID+. This piloting procedure in cooperation with citizens unites several advantages: modest budgets, rapid and more targeted product changes and, in the sense of co-design, positive spillovers with regard to acceptance and legitimacy. In reference to Smart Government and to ensure ongoing civic participation, the co-design approach should also be considered in the further development of any E-ID or Smart Government project.

Because of the Schaffhausen population's needs regarding more flexibility of authorities, an augmented importance of online services and increases in (cyber) security awareness, the e-government committee (eGov-Kernteam) of the Canton of Schaffhausen decided to pilot the electronic identity Schaffhauser eID+ to ultimately allow for efficient and effective Smart Government processes.* The aim of this practice article is to show how the Canton of Schaffhausen adopted a co-design approach to introduce its electronic identity and to set out key findings regarding the introduction of a technology-based public service innovation. Based on the strategic approach of a 'testing laboratory', co-design methodology was used through conducting usability tests and semi-structured interviews with selected individuals. The optimization suggestions collected were subsequently evaluated and reintegrated. Furthermore, the collected data were used to analyze the acceptance of the Schaffhauser eID+. This piloting procedure in cooperation with citizens unites several advantages: modest budgets, rapid and more targeted product changes and, in the sense of co-design, positive spillovers with regard to acceptance and legitimacy. In reference to Smart Government and to ensure ongoing civic participation, the co-design approach should also be considered in the further development of any E-ID or Smart Government project.

Purpose
This paper aims at providing an overview of different approaches toward identity management pertaining to citizen to government (C2G) eGovernment applications.


Design/methodology/approach
The paper adopts a comparative law methodology. It asks how different legal systems deal with the same problem. The different legal frameworks of Austria, Germany, Liechtenstein and the Swiss Canton of Zug are analyzed and compared pertaining to identification and authentication. The process of comparison involves three phases: the descriptive phase (describing and analyzing the legislation to be compared), the identification phase (identifying the differences and similarities between the systems compared) and the explanatory phase (attempting to explain the resemblances and similarities between the systems).


Findings
Each of the four countries adopted different legal solutions. This is due to the different legal culture and the existing legal framework in which the legislator, in most cases, seeks to fit in the respective eGovernment solution, rather than adopting a completely new solution.


Originality/value
This study reveals different possibilities for legislatures to regulate electronic C2G procedures, ranging from a combination of electronic identity (eID) and electronic signature to pragmatic eID models in combination with further electronic authentication functionalities. The focus of the study is the legal framework and not the technical solution.

Indonesian people have electronic citizen card called e-KTP. e-KTP is NFC based technology embedded inside Indonesian citizenship identity card. e-KTP technology has never been used until now since it was launch officially by the government. This research proposes an independent framework for bridging the gap between Indonesia regulation for e-KTP and commercial use in the many commercial or organization sector. The Framework proposes interoperability framework using novel combination component, there are e-KTP reader, Middleware and Web Service. KAFA (e-KTP Middleware and Framework) implementing Internet of Things (IoT) concept to make it as open standard and independent. The framework use federation mode or decentralized data for interoperability, to make sure not breaking the law of privacy. Extended development of AES-CBC cipher algorithm was used to encrypt the data on the transport between middleware and web service.

Indonesian people have electronic citizen card called e-KTP. e-KTP is NFC based technology embedded inside Indonesian citizenship identity card. e-KTP technology has never been used until now since it was launch officially by the government. This research proposes an independent framework for bridging the gap between Indonesia regulation for e-KTP and commercial use in the many commercial or organization sector. The Framework proposes interoperability framework using novel combination component, there are e-KTP reader, Middleware and Web Service. KAFA (e-KTP Middleware and Framework) implementing Internet of Things (IoT) concept to make it as open standard and independent. The framework use federation mode or decentralized data for interoperability, to make sure not breaking the law of privacy. Extended development of AES-CBC cipher algorithm was used to encrypt the data on the transport between middleware and web service.

There has been a substantial interest among scholars in digital platforms and their governance. This paper proposes a different perspective on the phenomenon, by providing observations on non-focal firms' dependencies to external platforms. Using the case study results of Finnish firms' utilization of a monopolistic BankID authentication platform, we describe the platform ecosystem and its transformation on organizational and technology aspects. We show how legislation can transform the roles and relations between ecosystem participants and lead to the long-time dominant legacy platform weakening. Our study extends existing research on platforms and contributes new knowledge about the enforced adoption of the platform by heterogeneous organizations. These findings have important managerial implications, as they inform how non-focal firms can understand the use of existing and coming digital platforms.

This research describes the results of a field experiment which examines the effects of warnings on system trust and individual awareness in government computer systems through the use of email forgery. The experiment consisted of forging a trusted government email account and trying to get government computer users to reply to a forged email address. The results revealed that warning individuals about possible email forgery did not increase their awareness or reduce their level of system thrust in the email system nor did it increase their ability to detect email forgery. The results did determine that government computer users are extremely vulnerable to email forgery and that new security measures need to be adapted to protect these systems from this type of threat. The culmination of this effort was to support the use of email authentication through the use of the new common access card (i.e., smart card or CAC) by the military. Recommendations to implement effective email authentication and encryption capabilities.

En el presente artículo se realiza un análisis de la usabilidad del Documento Nacional de Identidad electrónico en países desarrollados y su futura implementación en el Ecuador, la necesidad de tener un documento de identificación electrónico legal que permita validar la identidad de los ciudadanos al momento de acceder a los servicios electrónicos públicos y privados. Se analizan conceptos referentes a la firma electrónica, las entidades que intervienen en el proceso, los mecanismos de encriptación de un mensaje, hasta culminar con la implementación de dicha firma electrónica. Finalmente, se hace una reflexión sobre la implementación de un nuevo documento de identidad en el Ecuador el cual debería contener las características necesarias acorde a las nuevas tecnologías existentes, los estándares internacionales y sus posibles usos en los servicios informáticos disponibles en el país. Palabras clave: Encriptación, tecnologías, servicios informáticos, identificación electrónica Applications of electronic signatures using digital certificates: The National Electronic Identity in Ecuador Aplicaciones electrónicas en Ecuador Abstract In the present article itself performs an analysis of the usability of the National Electronic Identity Document in developed countries and its future implementation in Ecuador, the need for a legal electronic identification document to validate the identity of citizens at time by accessing the electronic government and corporate services. Discusses concepts related to electronic signatures, the entities involved in the process, the mechanisms for the encryption a message, culminating with the implementation of electronic signatures. Finally, a reflection on the implementation of a new identity in Ecuador that should contain the necessary characteristics according to the new existing technologies, international standards and their possible uses and computer services available in the country. Keywords: Encriptación, tecnologías, servicios informáticos, identificación electrónica