Method for generating an electronic signature

A telecommunication terminal for requesting the generation of an electronic signature of a user for an electronic document from a signature server computer wherein the telecommunication terminal is assigned to the user, said telecommunication terminal configured to:

• establish a secure Internet session between the telecommunication terminal and the signature server computer system,
• receive the electronic document to be signed via the secure Internet session from the signature server computer system, and/or visualize the electronic document on a visualisation device of the telecommunication terminal,
• transmit a request of the user via the secure Internet session for the generation of the electronic signature by the signature server computer system for the electronic document visualised on the visualisation device,
• receive a code from the signature server computer system via a separate and/or separately secured side channel of the communication network, and
• transmit a combination of the code and authentication information of the user to the signature server computer system via the secure Internet session, wherein the telecommunication terminal comprises a communication interface for establishing a local connection to an ID token of the user, and wherein said telecommunication terminal is further configured to:
• authenticate the user to the ID token, and
• enable attributes of the user stored in the ID token to be read via the local connection by the signature server computer system with end-to-end encryption between the ID token and the signature server computer system.

A signature server computer system for generating an electronic signature of a user for an electronic document, said system configured to:

• establish a secure Internet session between a telecommunication terminal of the user and the signature server computer system, wherein the telecommunication terminal comprises a communication interface for establishing a local connection to an ID token of the user,
• generate and send a code from the signature server computer system to the telecommunication terminal via a side channel of the mobile communication network,
• receive a combination of the code and authentication information of the user via the secure Internet session,
• check the validity of the combination of the code and of the authentication information by the signature server computer system, wherein
• said signature server computer system comprises a high-security module configured to store the private key of the user for generating the electronic signature of the user, and wherein said system is further configured to:
• authenticate itself to the ID token via the Internet session, the telecommunication terminal and the local connection,
• establish a connection, with end-to-end encryption, with the ID token via the Internet session, the telecommunication terminal and the local connection,
• send a read command to the ID token via the connection with end-to-end encryption for reading attribute values from the ID token,
• receive the attribute values via the connection with end-to-end encryption, and
• store the attribute values as part of registration data for the user.