Developing a mobile identity application by using trusted execution environment

New identity cards in Turkey, which are started to be used instead of old ones, have the technology to be used for authentication purposes also in electronic environments. On the other hand, it is not straightforward to use the new ID cards on smartphones due to the smart card reader requirements and compatibility issues with respect to software library. This study introduces a Mobile Identity solution that works in the Android environment to overcome these technical challenges. Our solution consists of two basic components. The mobile phone application generates a public key and private key pair using Trusted Execution Environment technology. The private key does not exit the Trusted Execution Environment and is thus protected from threats from the Rich Android environment. With the desktop application, the public key obtained from the mobile phone is signed with the private key on the user's identity card (in a sense, a digital certificate is generated) and the third parties could authenticate digital signatures generated by the mobile phone application for authentication purposes by ensuring the secure connection between the public key and the user. The solution we have developed is considered to be a secure and usable alternative to existing mobile authentication solutions, especially for e-government applications.