 verification of digital signature on the level of SOAP message (WS-security), as well as after successful verification of the SAML token's signature from the municipality's platform, the end user is granted access to the On Secure JAVA Mobile Application desired platform services. After that, the user could send business requests (m-resi- dence certificate) to the platform. The SAML module communicates with WS-security module of the security object as well as with the Communication object. 11.4.3.6 Time-Stamping Module The time-stamping module is responsible for communication with the time-stamp- ing server. A time-stamping service supports assertions of proof that a datum existed before a particular time. In order to associate a datum with a particular point in time, a TSA may need to be used as a trusted third-party (TTP) service. As the first message of this mechanism, client application requests a time-stamp token by sending a request (TimeStampReq) to the TSA. As the second message, the TSA responds by sending a response (TimeStampResp) to the requesting entity. 11.4.4 Implementation Aspects The Java Specification Request 172 (JSR 172) specifies standardized client-side technology to enable J2ME applications to consume remote services on typical Web Services architectures [7]. JSR 172 defines a standardized API that J2ME cli- ents can use to invoke SOAP and XML-based Web Services. This API is in the form of an optional package for J2ME, and is referred to as Web Services APIs (WSA) for J2ME. WSA is actually a subset of the Java API for XML-based Remote Procedure Call (JAX-RPC) defined by JSR 101 [8]. With the ever-present concern over security, software applications must con- sider how to secure confidential data. A mobile application is not immune from privacy concerns. In fact, mobile devices and their software application have special considerations given that most people carry these devices wherever they go. 11.4.4.1 Bouncy Castle APIs In order to encrypt sensitive data, we used Bouncy Castle Cryptograp