A method of strong authentication of remote users based on an ID card with an electronic layer

Konrad Kamiński

supervisor: Wojciech Mazurczyk

In my searching I want to find method to effective use Polish ID Card to authenticate Orange Polska employees and partners (or other person, maybe clients in future) with or (better) without PWPW intermediation. Goal is to create strong authentication method during remote contact in cases of issuing and enrolment and emergency unlock of the organizational smart card. After the covid-19 pandemic, Orange Polska works in a hybrid model, and many employees have decided to use teleworking. A main tool to strong authentication in Orange is smart card with X.509 certificates. But corporate smarty card can be accidentally broken or locked. Additionally Orange Polska has offices in many cities in Poland. Therefore, it is important to find an alternative method of remote strong authentication.

This goal can be reached in few ways:

• using NFC reader connected to PC (costly) and provide mutual TLS authentication,
• using dedicated smartphone application as NFC reader (aka German solution) and provide mutual TLS authentication
• using dedicated smartphone with NFC application as authenticator
• using intermediation of PWPW service (last choice)
• other ideas.

Now I read about ICAO standards about machine readable documents and make review for solutions in other countries. A lot of countries use contacts card (electric interface ISO 7816-2). Contactless card require additional and costly hardware (NFC reader), but a lot a new smartphones have NFC module and can communicate with Polish ID Card.