The New Service World of Managing Physical and Mobile Credentials

As part of a continuing blog series on mobile government (mGov), we’ve discussed the expansion of online access to government services, and how derived credentials, a form of digital ID, can make it safer to use mGov services.

In this blog, we look at the emerging discipline of credential management, which ensures a properly derived and stored credential, and the types of applications that can benefit from using derived credentials. We begin by looking at the best way to derive a digital credential.

Smartcard eIDs provide the foundation

The smoothest transition to mobile access begins with the proven, verified electronic IDs (eIDs) associated with smartcards. This is because smart card eIDs are governed by national or internationally recognized standards and have proven themselves, in years of use in billions of authentications, to be a trusted way to identify a person. The digital credentials derived from smart card eIDs reflect this high level of trust and provide a sound basis for mobile access.

The embedded secure elements (eSEs) used to support derived credentials are another important part of the security picture, since they’re compatible with existing contactless smart card infrastructures (including those that use MIFARE or NFC), and can be authenticated using in-place methods. Built-in compatibility with the existing infrastructure also helps simplify the deployment and lowers the cost of ownership.

Having established an infrastructure for trusted ID services that are based on derived credentials, governments can get closer to the ideal of creating a single-entry point for multiple services, since the new infrastructure makes it possible to issue one ID that fits every application. Using a single ID to access multiple services, in what’s referred to as “federated” ID management, is something private organizations are pursuing, too, since the approach enables secure use of private digital information while extending the service offering.

One ID, many uses

As an example of using one digital credential to simplify access to multiple services, consider a smartcard-based eID program that already includes two applets, one for a national ID and one for a health card. Adding a third applet, for a driver’s license, makes the smart card design more complex and means more stakeholders must align and agree on a suitable card profile.

With an infrastructure for properly derived credentials and a flexible authentication platform, however, these design constraints are essentially removed. A single ID can be securely linked to multiple applications, for use with any number of public and private services. The initial card launch can be quick, with new use cases added over time. The total cost of ownership goes down, while the number of options available to citizens goes up.

The derived credential can be used in much the same way traditional IDs are used, but in a mobile context. In the case of the driver’s license, for example, the derived mobile driving license might be used to reserve a rental car, to verify the driver’s authorization to operate the vehicle. The derived credential from a national ID can serve as verification of residency when applying to open a bank account, initiate utility service to a new apartment or join the local library. In similar fashion, the derived credential from a healthcard might be used to verify medical information, such as a prescription for medication or corrective lenses, when using an online pharmacy or ordering a pair of eyeglasses. Derived credentials offer a unique combination of flexibility and security, making it possible to transition just about any service, public or private, to the mobile environment.

Context-aware authentication

In many of today’s online applications, developers are forced to make a tradeoff between security and convenience. As the level of protection increases, ease of use tends to go down, since the authentication process becomes more complex. Using derived credentials in mobile devices promises to eliminate this trade-off between security and convenience, since the mobile format enables next-generation ID methods that are both secure yet easy to use because they are context aware. That is, the authentication method used by the back-end system takes into account factors like who the user is, what they are requesting, how the user is connected, the time of day and where the user is located. With context awareness, the authentication process might use one set of requirements when the access request comes from a network inside a government office, but a different set when it comes from a public Wi-Fi.

Operating in response to current conditions, these context-aware methods promise to optimize security, convenience and cost. The identification method can vary depending on the device and its specific features. For example, if the device is equipped with a biometric sensor that reads fingerprints or recognizes a face or voice, then the authentication method can use the biometric. If the device doesn’t have a biometric, then a PIN number, a Transaction Authentication Number (TAN), or a password can be used as the basis for authentication.

The added level of flexibility afforded by derived credentials and context-aware authentication means it’s easier to choose the right level of security for each situation. With high-stakes applications, such as access to health records, for example, multi-factor authentication can be used to reach the necessary level of security, but with applications that present a lower risk, a less sophisticated authentication method can lower the technology overhead – without compromising privacy or security.

NXP’s approach to derived credentials for mGov

At NXP, we’re building on our number-one position as a supplier of silicon solutions for eGov to support the trend toward mGov. We are already a leading supplier of eSEs to the smartphone industry, and a recognized innovator in the secure services that rely on eSEs for protection and are using that experience to build solutions for other mobile devices and mGov applications. We’re also creating a service platform that will provide our customers with an infrastructure for digital authentication supporting various credential types.

Using eID hardware as a starting point, the NXP platform supports an easy design and deployment of secure authentication services for mobile applications, and will help developers migrate multi-application eID operation into the mobile space.

Go a level deeper

To learn more about our work in this area, visit the eGov section of our website or contact your local sales office.

Related links

NXP blog: Derived credentials create a secure, convenient link between physical and digital identities

NXP blog: Paving the way for digital identities and mobile eGov access