Azernews.Az

By Nigar Orujova

The Information Computer Center (ICC) of Azerbaijan's Communications and Information Technologies Ministry plans to achieve international recognition of its electronic/digital signatures (EDS), the Center told Trend news agency on Friday.

A digital signature (standard electronic signature) turns traditional paper-based signing into an electronic fingerprint or coded message, which is unique to both the document and the signer and binds them together. Digital signatures ensure the authenticity of the signer.

The Center is currently being certified by the international standard for information security.

"As for today, it could be said that the preparatory process has already been completed and an audit will be conducted at the initial stage in accordance with general procedures," a Center spokesperson has said. "We have already been certified on the management of quality control. Currently, we are going through the process of obtaining certification on information security."

Application of the mentioned standard becomes especially relevant today in the framework of the state Electronic Azerbaijan program. Certification of electronic services in accordance with the ISO 27001 standard will ensure transparency and facilitate citizens' access to such services.

ISO 27001 specifies requirements for an information security management system to demonstrate the organization's ability to protect its information resources.

At present, most of the national legislation ensures international recognition of electronic signatures and the associated keys and certificates, through the introduction of relevant provisions.

The regulations stipulate that an electronic signature that can be verified by a public key having a foreign certificate is recognized, if an agreement on recognition of such certificates was signed with the government that issued the certificate.

Electronic services are rendered under the May 23, 2011 presidential decree. According to the document, there is a section on e-services including online and informative e-services on the website of the communications ministry. While using them entrepreneurs can submit the necessary documents to the ministry, pay state fees and other charges online, or send the documents confirming payments, as well as obtain licenses and ministry certificates.

Azerbaijani mobile operators will be involved in the digital e-signature project.

Local cellular operators have been involved in the e-digital signature issuance project, head of the ICC, Nail Mardanov, told Trend.

According to Mardanov, the matter rests in using e-digital signatures in GSM networks. The opportunity of using Sim-cards with special cryptographic features is being considered. An important aspect in this issue is the organization which will install the application in Sim-cards -- that is, whether it will be installed by the certification center or by the operator.

"Today, the e-digital signature is provided by SMART cards," he said. "Their function is identical to ordinary Sim-cards used in operators' networks. New Sim-cards have already been used in the world. We are testing them. If the operators distribute these Sim-cards, besides recording the subscriber's phone number, they will also have to install the application to generate the e-keys. Further, the procedure of e-digital signature obtaining is identical to the way it is issued. That is, the user will need to fill out an application form to get a PIN-code which will be identified in the operators' networks."

The code will be used to generate keys through a specially designed application that will have to be downloaded to the mobile device. Distribution will be available at the e-imza.az. website. The application will ensure a request for receiving a certificate directly to the registration center.

Using devices capable of reading information about the e-digital signature from SMART cards is another way of using the existing e-digital signature from mobile phones and tablet computers.

"The matter also refers to [the use of] mobile card readers [USB, 5pin and 3.5 mm], which is still in its early stages in the world," Mardanov said. "One can buy them in world online stores. Soon we will present a list of devices that have been tested and approved for use at the website. In the future, these devices will be used more widely. In case of great demand, they will appear in computer hardware stores."

ICC will begin providing mobile two-factor authentication certificates from February 1. Two-factor authentication means that a user must enter a password and have a certain device or program confirming the right to access the information. Online banking is a classic example. It is necessary to enter a password and a one-time code sent by an SMS or generated by a special program on the computer to confirm the transaction.

The process of issuing e-digital signature certificates for mobile devices will begin by March 1. At present, it is necessary to implement the organizational structure with the registration centers located in the capital Baku and the regions.

According to Mardanov, a new certified center for e-digital signature distribution by means of mobile devices, which will be the fourth such center in Azerbaijan, will be opened in April.

So far, some 6,000 electronic digital signatures have been issued in Azerbaijan, with half of them purchased by state bodies, according to the Communication and IT Ministry.

On January 24, ICC introduced an authentication system for access to the portal of electronic government through mobile devices.

The new system empowers users to create digital certificates by using the two-factor authentication system and gain access to the e-government portal by scanning the QR code.