The expansion of the Swissdec information platform places new security requirements on the identification and authentication of participating companies. The Swissdec Enterprise Authentication (SUA) comprises the processes for registration, configuration as well as renewal and revocation, which allow a company to obtain a Swissdec Enterprise Certificate and thus make the data exchange secure and binding. The central information platform operated by the Swissdec association for the standardisation of electronic data exchange already enables the fully electronic transmission of wage data within the framework of the “Lohnstandard-CH (ELM)”. Based on this and as an extension of the process from the registration of a claim to the provision of benefits, the “Leistungsstandard-CH (KLE)” is currently being developed. Swissdec-certified payroll accounting and ERP systems can thus considerably simplify the companies’ processes, enable correct declarations and reduce the administrative effort. The electronic handling of business processes, from event reporting (e.g. accident reporting to the insurer) to daily allowance accounting, places additional demands on the design of communication as well as the identification and authentication of the participating companies:

• Secure channel: All communication links between ERP system, Swissdec distributor and end recipient (insurance companies & authorities) must be protected by a mutually authenticated, secure channel at transport level (2-way SSL).
• Authentication at message level: All end systems involved must be uniquely authenticatable at message level (by signing the transmitted data).
• Confidentiality at messagelevel: In order to be able to additionally protect the transmitted information against further attack vectors despite the secure channel, the transmitted data contents must be encrypted for the respective recipient.
• Non-repudiation: Throughout the entire communication process, the sending and receiving of data should not be repudiated by all entities involved. Non-repudiation is a prerequisite for bindingness.
• Bindingness: All data and information relevant to a communication process (incl. signature & time stamp) must be logged and archived.
• Registration: The identification and registration of companies for the purpose of issuing UID certificates must be carried out by Swissdec. In this process, the identity check of a company is based on already existing relationships with the applying companies. In this way, registration processes can be handled in a partially automated, unbureaucratic and yet secure manner.

The SUA solution concept, which was developed by the IAM research group of the ICTM Institute in cooperation with itServe, provides for online registration based on an existing contractual relationship of a company with an insurance company (V&B) (see Figure 1). After checking the data sent and comparing it with the BFS UID register, a password is generated and sent to the company by letter. With this password, it is then possible in a second step to collect a UID certificate for the company from the Swissdec CA.

Figure 1: SUA registration process

Swissdec UID certificates are advanced X509 certificates issued for a UID entity (company). These UID certificates are used by the company’s ERP system as part of a machine-to-machine (M2M) communication. This allows the ERP system to authenticate itself to the Swissdec distributor on behalf of the company, sign messages to be sent and receive encrypted data for the company. Swissdec is currently in the process of setting up the Swissdec CA and implementing a sample solution for SUA. A first pilot installation is to be implemented before the end of this year.

References

1] https://www.swissdec.ch/de/ [2] https://www.bfh.ch/ti/de/forschung/forschungsbereiche/identity-access-management-iam/ [3] ictm .bfh.ch [4] https://www.itserve.ch [5] https://www.uid.admin.ch/Search.aspx