lid timestamp token 7: TSA response reception 8: Message creation 9: Embody authorization token 10: Message security features application 11: Message dispatch Figure 11.4 Secure service request creation and dispatch. authorization token is described in detail in the next section. This SOAP message is the one that will be sent to the platform. The next step for the mobile application is to automatically apply strong security features on the message (Step 10) and to dispatch it to the platform (Step 11). 11.3.2 Certificate Management Protocol In order to register and retrieve a PKI certificate from the corresponding Certification Authority (CA), a mobile user with an appropriate secure mobile application could use the XKMS protocol (XKMS 2.0), and particularly its XML Key Registration Service Specification (X-KRSS) part. On Secure JAVA Mobile Application A possible scenario of the generation of the user asymmetric key pair and a cor- responding PKI certificate by using the secure mobile application and the XKMS protocol is described below. This scenario is shown in Figure 11.5. 1. The user will be registered in a registration office for this service. The user will obtain an "empty" secure mobile application at the registration office along with a PIN letter with an initial username/password for accessing the application and a XKMS authentication code. The password will be enforced Mobilephone user XKMS service 1: Generation of asymmetric public/private keypair 2: Generation of XML signature 3: Generation of SOAP message 4: Send SOAP register message: <RegisterRequest> <PrototypeKeyBinding> <Authentication> <ProofOfPossesion> 5: Register result message <RegisterResult> <KeyBinding> 6: Verification of XML signature 7: Store certificate in record management store Figure 11.5 Procedure of the user registration for obtaining the PKI certificate from the XKMS server. Service Delivery Platforms to change upon initial starting of the application. The XKMS authentication code will be valid for a specific period of time. 2. 