Application of the U(SIM) card as secure device for electronic signature Mr. Pedro Fuertes Head of Business Development and Innovation Vodafone Spain 8th International Common Criteria Congress Rome, September, 26th

Goals To introduce the Mobile Digital Signature from Vodafone Spain To show the business opportunities for secure SIM based products To propose the CC world to develop a specific approach for SIM Certification Mobile Electronic Signature

Mobile Electronic Signature from Vodafone Spain Signature of documents from the mobile Based on PKI, secure, robust Under EU regulations Multi CA Allows: Introduction of new services Substitution of existing Authorization and Authentication methods Easy to use Large customer base HW and Basic SW certified at EAL 4+ (1) How do you sign, pen or mobile? Vodafone’s Mobile Digital Signature solution takes PKI security to the mobile world Mobile Electronic Signature Certifications ID BSI-DSZ-CC-0353-2005 And TUVIT-DSZ-CC-9253-2006

Why the mobile, why in the SIM? PC INTERNET CONNECTION - SCREEN - KEYBOARD - CARD + READER or - SW CERTIFICATE HANDSET WITH MOBILE ELECTRONIC SIGNATURE = Directive 1999/93/CE 34/2002 IS Law RD 14/1999 Mobile Electronic Signature 59/2003 ES Law DNIe CA’s set up Apps without certificate Mono CA applications Multi CA applications Coordinates cards PIN as secure method Certificate’s usage 1999 2001 2003 2005 2007 Mobile Electronic Signature

Transaction flows Certificate strength resides in the CA Vodafone acts as a intermediate between the Service Provider and the CA, adding the mobility value The Service Provider builds its own services on top of the Mobile Electronic Signature Mobile Electronic Signature

Is it worth to work on SIM Security? High penetration (> 107% in Spain) Intrinsically secure at Operator’s degree Room for several certificates Increasing processing capacity, Java Cards and crypto-coprocessors Increasing importance for Operators m-Payment Mobile TV Trusted applications DRM Access to other networks Is it worth to work on SIM Security? Mobile Electronic Signature

Proposals for Mobile Digital Signature ramp up In order to realise the business opportunities for the Digital Signature in the mobile world, we recommend the Common Criteria Forum to work on: Speed up the certification process and time Adapt and make more flexible the certification process We propose the CC World to define a specific approach to the SIM Certification in order to realise all the business opportunities that are ahead Mobile Electronic Signature

Thanks.