Authentication of personal data over telecommunications system

A non-transitory computer readable medium comprising computer program code which when run on a computer, will cause the computer to:

• generate a session identifier in response to the first request, sending the session identifier to the first user device;
• if the second request contains the generated session identifier, detecting a match;
• create, in response to receiving from a first end user device a first request indicating that one or more specific piece of personal data on a second user is to be authenticated, a pending session for the first request,
• map, in response to receiving from a second end user device a second request containing at least information with which the request can be mapped, the second request against pending sessions to find out whether there is a match;
• send, in response to a match, an authentication request to the second end user device to authenticate the second user by means of a mobile identification scheme;
• obtain, in response to receiving from the second end user device an authentication response indicating that the authentication succeeded, the specified pieces of personal data of the second user from a memory whereto personal data for mobile identification is stored;
• and
• send the obtained pieces of personal data of the second user to the first user device.

An apparatus comprising:

• at least one receiver;
• at least one transmitter;
• at least one processor;
• and
• at least one memory including computer program code;
• the at least one memory and the computer program code are configured to, with the at least one processor, receiver and transmitter, cause the apparatus at least to:
• generate a session identifier in response to the first request, sending the session identifier to the first user device;
• if the second request contains the generated session identifier, detecting a match;
• receive a first request from a first end user device, the first request indicating that one or more specific piece of personal data on a second user is to be authenticated,
• create a pending session for the request;
• receive a second request from a second end user device, the second request containing at least information with which the request can be mapped against pending sessions;
• map the second request against pending sessions to detect a match;
• send, in response to the match being detected, an authentication request to the second end user device to authenticate the second user by means of a mobile identification scheme;
• receive an authentication response from the second end user device;
• obtain, in response to the authentication response indicating that the authentication succeeded, the specified pieces of personal data of the second user from a memory whereto personal data for mobile identification is stored;
• and send the obtained pieces of personal data of the second user to the first user device.

A system comprising at least an authentication subsystem for mobile identification, the authentication subsystem comprising public keys, each associated with personal data of a person during a mobile certificate issuance;

• a first and a second end user device;
• a subscriber identity module comprising an authentication application and a keypair of a public key and private key of for the authentication subsystem, the subscriber module being inserted in the second end user device;
• a memory configured to store pieces of personal data of a user of the subscriber identity module, at least some of the pieces of personal data being inserted into the memory during the mobile certificate issuance and associated with the corresponding public key;
• a server configured to:
• use the authentication subsystem for the authentication;
• generate a session identifier in response to the first request, sending the session identifier to the first user device;
• if the second request contains the generated session identifier, detecting a match;
• create, in response to receiving from the first end user device a first request indicating that one or more specific piece of personal data on a second user is to be authenticated, a pending session for the first request,
• map, in response to receiving from the second end user device a second request containing at least information with which the request can be mapped, the second request against pending sessions to find out whether there is a match;
• send, in response to a match, an authentication request to the second end user device to authenticate the second user by means of a mobile identification scheme;
• obtain, in response to receiving from the second end user device an authentication response indicating that the authentication succeeded, the specified pieces of personal data of the second user from a memory whereto personal data for mobile identification is stored;
• and
• send the obtained pieces of personal data of the second user to the first user device.