Identification Card Digital Identity Security and Services Siniša Macan, DG of Agency

Transcription

1 Agency for Identification Documents, Registers and Data Exchange of Bosnia and Herzegovina Identification Card Digital Identity Security and Services Siniša Macan, DG of Agency

2 Agenda IDDEEA Document management bottom up leadership; system of documents in BiH Identity card and driving license of BiH the latest in the world of technology E-Government based on identity card e-service development Terminals that use eid card The first passport with polycarbonate page and color photograph

3 Legal basis Law on Agency for Identification Documents, Registers and Data Exchange of Bosnia and Herzegovina ( Official Gazette of BiH,No. 56/08) Law on Identity Cards of Bosnia and Herzegovina Nationals ( Official Gazette of BiH,nos. 32/01, 16/02, 32/07, 53/07, 56/08 and 18/12) Law on Electronic Signature ( Official Gazette of BiH,No. 91/06) European Directive on Services ( 2006/123/EC ) ICAO 9303

4 IDDEEA The Agency is an administrative organization, in charge for the field of identification documents, storage, personalization and transport of documents, and maintenance of central registers and data exchange between the competent authorities in Bosnia and Herzegovina. The Law on Agency for Identification Documents, Data Registers and Data Exchange of Bosnia and Herzegovina. Because of IDDEEA work, BiH have free visa regime with EU

5 IDDEEA 230 employees (special procedure for employment, background check ) The headquarter is in Banja Luka, with 4 regional offices (Sarajevo disaster recovery location, Mostar, Bijeljina, Bihac The Center for Storage, Personalization and Transport of Personal Documents is in Banja Luka.

6 Identification documents Identity card Driving licence Passport Documents for vehicle registration in BiH Registration plates Certificate of vehicle ownership Certificate of vehicle registration Internal sticker External sticker Tachograph cards Border cards (BiH/CRO)...

7 Registers The Agency is responsible for technical maintenance of the following registers: Personal identification number Permanent and temporary residence of BiH nationals Identity cards and identity cards for foreigners Passports (citizen, service, diplomatic) Driving licenses Registered vehicles and registration documents for vehicles Fines and criminal penalties Central voters register And any other register approved by the source authorities and with special decision of the Council of Ministers BiH We are not the owners of the data. The Agency s responsibility is technical maintenance, data integrity and safety.

8 Data exchange The Agency is responsible for technical maintenance telco network across BiH. Source Authorities Every municipality is part of network. G2G Register Register offices IDDEEA is telco operator for gov institutions G2B

9 Data exchange

10 Data exchange Those procedures are defined by the Agency, and published in the Official Gazette of Bosnia and Herzegovina Access to the network hardware resources is centralized (user management system, RADIUS + OID)

11 The Agency Statistical facts SDH Network Usage Number of locations Issuing of the personal documents 132 Ministries of Internal Affairs access to registers 180 Judicial institutions 112 Election comities 143 Registration offices 142 State Border Police 20 DKN 46 G2G (ADS, SIPA, Ministry of Foreign Affairs,..) 40 Other users 25 Total 840

12 Bootom up leadership No.1 in the world according to passport security No. 1 in the world according to techonological quality of driver`s license No. 2 in the world in the area of e-id

13 First learned lection: Document issuing system is not equal to document personalization system Continuous improvement of process Document personalization (electronic, laser, QA) Issuing to citizens (transpor t) Breeder documents (Birth Certificate) Buying system is easy. You just need money. Finding right persons is much harder. Data Acquisition (personal, biometric) Continuous inspections People is much more important than hardware and software! Continious security improvement Creating of blank document (layers) Identity checking (biometric, black lists, Registers Office ) Continuous education

14 eid - egov Strategy for development of ID documents Adopted in May 2010 eid is basement for egov services

15 Security in national eid card production There are no stock of blank documents Production of each card start after citizen applying for eid. The image of the holder is personalized with newest technology for color images of identification documents and it is inside of card body. All information of the holder, such as name, place and date of birth and a special machine readable zone are engraved by a laser system. In addition all holder information are stored by an chip module in a digital, high secure way. The chip module and an antenna is inside the card body.

16 Security elements of national eid card 1. SECURITY BACKGROUND 2. ULTRA VIOLET FLUORESCENT IMAGE 3. HOLOGRAPHIC ELEMENT 4. SURFACE EMBOSSING 5. GHOST IMAGE (SECONDARY PORTRAIT) 6. COLOR SHIFTING 7. RAINBOW PRINTING 8. TACTILE EMBOSSED VALIDITY DATE

17 We user German profile (BSI standards) Main characteristic of B&H e-id First national e-id compatible with German e-id (almost 100%) Contactless chip produced by NXP Java Card Operating System (JCOP v2.4.1 r3) ICAO application, e-id application and e-sign application = traveling, identification and signing Applets developed in-house full control in hanf Advanced cryptographic functions (use of Elliptic Curve Cryptography)

18 Why do we use the German profile Due to lack of strategies on the use of smart cards in public administration, Germany was taken as the model. Hundreds of top professionals in the field of electronic identification documents and smart cards in Germany have spent years on the development on their electronic identity cards. We had very short time for the development and implementation of the project. This option reduces the time necessary for projecting and designing the system; the security of electronic identity card is increased.

19 Electronic memory element (chip) Chip embedding includes: increased document security; reduced possibility of copying; enrolment of biometric data; Secure identification of citizens shall be ensured during interaction with institutions and private sector in direct communication and within online communication. Moreover, additional function of the new identity card is the application for digital signature, which shall enable verification of documents and transactions in digital world.

20 Security mechanisms of protection of data on chip There is a contactless chip in the card body (produced by the company NXP) The chip supports the latest cryptographic algorithms (cryptography of elliptic curves) This contactless chip communicates with the terminal which is at the same time a device for reading and writing. BAC Basic Access Control PACE Password Authenticated Connection Establishment version 2 PA Passive Authentication EAC - Extended Access Control version 1 and 2 TA Terminal Authentication CA - Chip Authentication *Everything is in accordance with ISO , based on ISO 7816

21 Applications in the chip The data in the chip are organized in three applications: biometric ICAO application (same as the application on biometric passport), Application for digital identification (e-id) Application for digital signature (e-sign) with the qualified certificate Used for generating qualified digital signature It is necessary that a card holder creates pair of keys for digital signature before the use. Main master file (system data necessary for data access) *Data access is possible only after successful identification of a reader using BAC, PACE, TA or CA

22 Passwords used for data protection The passwords used for the BAC/PACE protocol differ depending on the type of application: a six-digit number from the first row or MRZ (Card Access Number), the hash of the document number serial number, date of birth and date of expiration from the machine readable zone (MRZ), eid PIN or transport key delivered to the holder at the moment of submission of the request or operational PIN known solely to the card holder, a ten-digit PUK delivered to the card holder at the moment of submission of the request.

23 Public Key Infrastructures PKI for documents - Signing of documents secure data object - Veryfing documents secure data object PKI of terminal for identification - The issuance of certificate for the use of application - Certificate chain is to be send to chip during TA procedure; There are several document verifiers because each of them has different part: Quality control during card personalization Identification in terms of the use of eid application (e-business and e- government) law enforcement checks - police and border police

24 Special functions of electronic identity card used by authentication terminals Generation of key pair for digital signing Setting PIN for digital presentation application Creating Pseudonym (unique identifier of citizen for different service providers) Age verification of the holder o eid card ( if a person is over 18) Verification of the competent authority that issued a document

25 The use of electronic identity card on Internet Special case of terminal access which is identified to a card; Terminal is consisted of the following two parts: - Local (PC and reader) - Remote (service provider) Personal data which shall be read by service provider are shown to a user the user can approve or revoke it (the same goes for the right to invoke special functions) Secure channel is established between local terminal and chip during identification, and also between local and remote terminal.

26 High security level of DL Holographic element Rainbow printing UV flurescent image Color shifting Security background (micro text or unique art objects)

27 The new generation of passports - Future goal Developing new security features using policarbonate Implementation of the first passport in the world with polycarbonate page and color image

28 Questions and answers We have answers!

29 The end Thank you for your attention!