Convergence and divergence of secure authentication in e-government and online banking as compared to European standards

The secure identification of a communications participants is crucial to the security of online transactions in e-government as well as in online banking. Consequentially, the two sectors have high expectations regarding their authentication procedures. However, they employ different solutions. The project, funded by the German Research Foundation (DFG), aims to explore the benefits of converging the two sectors methods. This convergence is regarded as a final step in a possible innovation process. By means of expert interviews, in an inter-bank-comparison, and in an international comparison, the key factors for a possible convergence of technical innovations in different usage contexts will be identified.

Secure authentication of users is a crucial factor in protecting online transactions in e-government and in online banking from fraudulent use, particularly from identity theft. In 2001, the Central Credit Committee (ZKA, today: Deutsche Kreditwirtschaft, DK) specified a signature application for bank chip cards, which was considered the safest solution from a technological viewpoint, in order to increase security in online banking. Thus, alternative solutions that are regarded as more secure than the relatively unsafe PIN/TAN-procedure have been available for years. Nevertheless, the PIN-TAN-method is only gradually being replaced by other procedures, and not all of the latter are based on the bank chip card as a means of authentication. For online transactions in e-government, an electronic proof of identity that is located on the government-issued ID card and meets high security standards has been introduced in 2010. The DK has not until now complied with the governments desire to transfer the use of this electronic ID card to the online banking sector. In contrast, in other European countries it is common that identical methods are being used in both sectors; albeit these methods are largely not based on chip cards. This raises the question which circumstances and which factors affect the convergence or divergence of the different authentication procedures.

Hence, the aim of the project is to examine the likelihood of a convergence of previously disparate authentication methods for online transactions with seemingly equal purposes for online banking and e-government. As a first step, we will identify factors that have led to the different authentication methods currently used by individual banks and explore why or why not online banking should adopt the government-issued e-ID. Subsequently, we will examine which factors facilitate and which factors inhibit a cross-sector transfer of technological innovations and their dependence on context. In doing so, it is particularly relevant to look at the decision makers differing priorities regarding technological security, cost and simplicity of operation.

With this in mind, the projects objective is to reconstruct and analyze the development of the different authentification methods. The last phase of this development is regarded as a question of the convergence of state-issued e-ID and the bank procedures, so that the effect of previous, technologically similar experiences on the reception of the e-ID as a new option can be examined.

By comparing currently deployed methods and by means of expert interviews with promoters, supporters and opponents in the banking sector as well as by international comparison we are aiming to investigate which conditions led to the convergence of the two sectors. From this information, more general conclusions can be drawn regarding the transfer of technological innovations on the internet along different contexts of utilisation.