Data boxes in the Czech Republic and their security

In 2009 Czech Republic introduced a completely new tool for electronic communication with public authority and consequently, individual users themselves. It is an information system (IS) for electronic delivery - IS of data boxes, which allows unambiguously identify and authenticate user, deliver a data message including attachments (any digital document) to the recipient and certify that the message has been received and the recipient has read it. The system of data boxes places a great emphasis on the user authentication. Despite of this information system utilising both one-factor and two-factor authentications, it is becoming apparent that the greatest weakness of current authentication method is the overly loose relationship between users and authentication devices. The report analyses and describes the choices and methods of authentication and user authorisation, which comply with the legislation of the Czech Republic and utilise the new developments in the multi-factor authentication. This system offers a brand new, state-guaranteed secure channel for communication between all users of data boxes, providing far higher quality security than the traditional e-mail communication.