Data protection, verification of documents and actual possibilities for use of encryption technologies and digital signatures in information society

Vlastimil Klima, cryptologist

Preface

This article deals with following topics: data encryption, verification of authenticity of electronic documents and a prevention of an unauthorized access to protected data etc. It demonstrates that technologies are ready to solve many operations of Civil Service and self-government in electronic way. Application of the proposed solution would not only simplify a citizen's life and make his dealing with the authorities quicker, but it would bring great financial savings due to clearer financial relationships in many involved systems. Safe digitalization of our lives is technically ready, but its practical realisation will take a long time without the financial and legislative support of the state.

Encryption technologies and their utilization

Now let me introduce basic concepts of this field, and the great possibilities that encryption technology offers to solve the needs of the information society. Most encryption mechanisms are standardized by the International Organization for Standardization (ISO) or by national standardization authorities such as NIST and ANSI. There would be no GSM mobile phones, credit cards, and safe access to the Internet and safe data exchange without encryption functions.

Encryption algorithms

Encryption algorithms are a transformation that converts plain data to encrypted data and the other way round. An encryption key controls this transformation. For encryption we use an encryption key, for decryption a decryption key. In the case that both keys are identical we speak about symmetric encryption algorithm. If they are different we speak about an asymmetric encryption algorithm or public-key encryption algorithm.

Symmetric encryption algorithms and their use

Symmetric algorithms are used for encryption of big data volumes. Their keys must be kept secret. The knowledge of the encryption key enables an access to encrypted data and, otherwise it prevents against unauthorized access. An incompetent person, who accesses encrypted data (when stored or transferred), cannot decrypt it without the knowledge of the encryption key. To make the system friendlier to users, the encryption keys are usually stored in protected hardware such as a chip card, SIM card or generally in so called tokens. Tokens are small, handy objects of a various shapes and appearances such as key tag, miniature infrared driver, chip's ring, touch memory etc. Their advantage: the user does not need to remember or even know the key.

Asymmetric ciphers

Encryption and decryption keys are different for asymmetric ciphers. They form a pair, one key works against the other, but only one of the keys can be public (verification key). There must be a guarantee that a secret (signature) key cannot be computed from the public one. We call them public-key cryptosystems. I will demonstrate that using them will make our civil life better. The keystone of these pleasant changes is a digital signature.

Digital signatures

A digital signature is not "a verse from agreed poem joined to the end of a text" nor "a scanned and digitalized signature" (according to the opinion of many people). A digital signature might be used with a plain text but also with any data file or a medical record even with a photograph. A digital signature is a number calculated from signed data. Thus is not possible to copy it from one document to another. The owner of the secret signature key using it on signed data creates a digital signature. That is why someone else cannot create the digital signature. Nevertheless everybody can verify it because the verification key in a pair is public. Digital signature is a widely used and internationally standardized technique. Let's mention the American government standard DSS (Digital Signature Standard) created for the US government for administrative purposes.

Paper documents will be replaced by digital ones

A digital signature can be used at any place where you would find a stamp or a hand-signature these days. All documents we know so far in paper form can be converted into digital documents and all authority or citizen signatures might be converted into digital form!

We can sign and verify digital signatures faster and more effectively then handwritten. We can sign what is almost unsignable by hand: a diskette content, photographs, projects of buildings, database request etc. Any paper documents can be published in digital form now. How does it work?

Technical structure for information society

A possible image of the realization of a digital signature follows.

Universal electronic card

A digital signature is based on mathematical (cryptographic) functions, that must be computed by microcomputer. The signature verification keys must be stored in the memory of the microcomputer. Let us call the equipment, containing the microcomputer, a universal electronic card (UEC). It can have a form of a chip card or a token of mini-calculator size (thicker chip card) with a large memory, eventually with a mini-keyboard and mini-display (with fingerprint-reader in the advanced version). A person carries a UEC on him instead of identity cards, change and various keys. UEC needs a certain interface for communication with surroundings (terminals). It has the ability to communicate for example via infrared and serial channels, contactless chip, touch memory etc.

Terminals

Stationary or mobile terminals used for communication with a UEC, reading and recording information can be used by all authorities, chemists, post-offices, shops, professions, means of transport even in households. UEC is able to communicate with some automatically (while entering building, means of transport) or manually (by insertion, movement, touch, remote control or infrared). Terminals may have various forms from very small hand readers on location, a reader of chip cards or infrared port of PC's, up to information kiosks with a big display, speaker or keyboard for blind people.

Communication environment

Communication environment might be heterogeneous is suitable for use on the internal. Some terminals can have their own (line or radio) connection with a central database. Connection can be on-line, periodic or totally off-line. The aim is to connect the UEC, terminals and central database together.

Principal of using universal electronic card

A UEC contains memory divided in sheet memory while each application reserves its own sheet, where it writes information or reads from. The principle leans on

Central database

Each authority or commercial institution (banks, telecomm) provides its own Central Database. Each application can have its own central database. Interactions among databases are created and approved by their owners. The copying of a current sheet content of any user of the application is kept in a particular database. It might be helpful in the case of loosing the UEC.

Examples of Application

Each citizen can have different content of his UEC, according to the application he is involved in. Application can digitally provide:

There are a lot of alternatives.

 

Example: Appointment with a doctor

While visiting your doctor you would insert UEC into your doctor's reader and your photograph and personal data appear on his monitor. He can see the records from your last visit in central database. Performed transactions are stored in database and the doctor writes a digital prescription. You go to chemists and introduce yourself using your UEC. The chemist can see exposure prescription in central database (if you wish it could be stored directly in your UEC); he gives you the medicine and takes away a particular charge from your EP. You leave. You did not need your Health Insurance, nor prescription or change. Nobody wrote useless records. Neither the doctor nor the chemist had to write a report for Insurance Company. Transactions are filed and accounted among central databases. The doctor saw your valid health Insurance; his transactions were recorded and signed by him for the Insurance Company. The doctor signed the prescription and the chemist verified it and signs it again and sends it to the Insurance Company for repayment. No incompetent transactions, payments, or prescription falsification!

Legislation and projects in the EU, CR, Germany, Austria and Belgium

European Union

So far there are no harmonized laws and policies for electronic data transaction and protection in EU. However the directive EU dealing with database protection has already been published

Czech Republic

Momentary condition of Czech legislation is not ideal for digital signing. Only the Act of Accountancy no 156/1991 allows other ways of enviable method than a Classic signature. There is no specification for a digital signature. On the other hand the Act does not ban this way of signing. Approval of digital signatures and other authentication methods are agreed in contracts between the parties. Similar solution might be found in Telecommunication Act no 110/1964. It lets the parties choose the methods of protection and authentication to be used. There is the no 256/1992. Act concerning data protection: the runners of Information systems are obliged to protect personal data. There are certain legislation initiatives to establish rules for database protection and legalization of electronic transactions, digital documents, certification authorities and digital signatures

Germany

Germany with its Act of Electronic Signatures is a sovereign leader in the field of legislation in Europe. This Act was accepted in connection with Information and Telecommunication Act (4. 7. 1997) and it has been valid since 1. 8. 1997. Germany became historically the first country stating general conditions for verification of digital signature authentication and use of cryptographic equipment.

In the concrete:

Austria

Austrian Ministry of Education established electronics student cards-so called INDEX. The card is based on a chip card (smart card). The students use the card as students, an authentication object to show their, schedule of lectures and a canteen card. This particular project counts on each working person to be provided with a card replacing ID and all kind of Insurance.

Belgium

Each Belgian citizen is now obtaining a multipurpose card containing name, date of birth, social identification number, insurance records and selected health records and records about previous employers, unemployment, injuries etc. Publishing this Social-Identity card, this year only 10.5 million issues is going to be released, according to the Ministry of Social Affairs it should prevent frauds in hospitals, chemists, companies, banks, etc. Owners of terminals will be in touch with the database of this Ministry and they will be able gain the records they need. Supposedly this will ease information transmission among employers and Social and tax authorities and it should also stop various frauds, e.g. working without work permit

Summary

We have shown the possible use of encryption technologies for data protection and digital signatures in this article. We have sketched options for the technical realization and benefits this technology can have for a citizen and a country. At the end we mentioned the condition of legislation and project examples in some of the European countries, proving that we have not talked about any visions but about becoming reality.

Acknowledgements

The author thanks to Ms. Ivana Skopova, the Vice president of Marketing of the Decros Ltd. for providing him with valuable information especially from the field of legislation and existing projects.