Secure Verification Systems with UYAP, MERNİS and E-Signature

In today's rapidly digitalising world, access to public services and the secure conduct of legal transactions make advanced identity verification and authorisation mechanisms essential.

Türkiye's e-Devlet Gateway and the systems integrated with it (UYAP and MERNİS foremost among them) meet this need through Mobile Signature and Electronic Signature (e-signature) technologies. This article examines in detail the technical infrastructure of these integrations, the programs involved and the core principles of their security.

🔒 The Foundations of Secure Verification: Mobile and Electronic Signature

The digital equivalent of a wet signature, the Electronic Signature and the Mobile Signature gained legal validity under Electronic Signature Law No. 5070. These technologies use a public key infrastructure (PKI) to ensure that digital documents cannot be altered, that identities are verified and that signatures cannot be repudiated. PKI rests on two core concepts:

1. The private key: the secret key held only by the signatory, stored in an encrypted environment (a USB token or SIM card) and used to perform the signing operation.
2. The public key: a key that anyone may know, but which can only verify a signature created by the private key. This key sits inside the digital certificate issued by an authorised Certificate Service Provider.

How Does the Signing Process Work?

When you digitally sign a document — a petition in UYAP, for instance — the following steps take place:

1. Creating the hash: the whole document is passed through a hashing algorithm such as SHA-256, producing a short hash value that is the document's unique "fingerprint".
2. Encryption (applying the signature): this hash value is encrypted using the private key. The encrypted hash serves as the digital signature.
3. Validation: when the signed document reaches the recipient, their system (e-Devlet, for example) does two things: it hashes the document's current state again, and it decrypts the digital signature using the public key. If the two hash values match, the document has not been altered and the signature was applied with the private key. This process guarantees the document's integrity and non-repudiation.

The Technical Differences Between E-Signature and Mobile Signature

The e-Devlet Gateway and the Identity Verification Infrastructure

The e-Devlet Gateway (www.turkiye.gov.tr) offers a single identity verification service, giving citizens secure access to the services of different public institutions. Logging in with Mobile Signature and e-signature generally works through the following protocols:

• SAML (Security Assertion Markup Language): allows identity and authorisation information to be shared securely between the identity provider (IdP — in this case the e-Devlet login system) and the service provider (SP — the public institution's service).
• The e-signature application: for browser-based transactions, e-Devlet generally uses a native application downloaded to the computer that communicates with the smart card reader. This application handles PIN entry and the cryptographic signing operation on the device, then transmits the result securely to the server.
• The mobile signature workflow: with Mobile Signature, after logging into e-Devlet with a Turkish ID number and mobile number, the GSM operator's Mobile Signature Service (a small application on the SIM card) takes over. The user completes the signing with the PIN/approval request that arrives on their mobile phone. This process is managed through SIM card application technology over the GSM infrastructure and, on the server side, through a Secure Authentication Server integrated with the GSM operator.

UYAP (National Judiciary Informatics System) Integration

UYAP is a critical platform on which judicial processes are conducted electronically. The use of e-signature and Mobile Signature in UYAP is mandatory.

• UYAP Document Editor: a dedicated word processor used to open documents with the .udf extension and sign them electronically. Signing is done from within this editor, integrated with an e-signature card reader or the Mobile Signature service.
• Java and the .NET Framework: for e-signature to communicate properly with card readers and certificates, computer systems need the Java platform and, for some older systems, .NET Framework libraries.

The Role of MERNİS (Central Civil Registration System)

MERNİS is a central database holding the core identity and address details of all Turkish citizens. Although it is not itself a signing system, e-Devlet and other public systems work in integration with MERNİS data in the background during identity verification (confirming a Turkish ID number, for example). Identity details are also confirmed through MERNİS when electronic signature certificates are issued.

💻 The Core Programs and Technologies Involved

For the secure verification and integration infrastructure to work smoothly, several layers of software and technology operate together:

1. Client-side software (for e-signature): card drivers — these let the operating system recognise smart cards and USB tokens.
2. PKCS#11 libraries: standard APIs that allow applications to communicate with cryptographic tokens.
3. UYAP Document Editor: software developed specifically for signing judicial documents.
4. Java Runtime Environment (JRE): required for most e-signature applications to work properly.
5. Server-side technologies: LDAP (Lightweight Directory Access Protocol) — storing and querying certificate and user information in directory services.
6. OCSP (Online Certificate Status Protocol): checking a certificate's validity in real time.
7. Hardware Security Modules (HSM): the hardware in which Certificate Service Providers store their root and intermediate keys to high security standards.
8. Web services (SOAP/REST): the core communication protocols carrying data and identity verification between all these systems, from e-Devlet to UYAP and from MERNİS to the GSM operators.

Digital transformation has made public services more accessible and more secure for citizens. Mobile Signature and e-signature systems are among the most critical pillars of that transformation. Non-repudiation and data integrity in legal processes in particular have brought both speed and security to judicial transactions.

Setting up, managing and adapting these integrations and secure verification infrastructures to in-house software calls for technical expertise. At Arca Yazılım, through our e-mail address info@arcateknoloji.com and our website www.arcayazilim.com, we offer consultancy, software development and bespoke integration solutions for the Mobile Signature, e-signature and e-Devlet Gateway integration needs of companies and public institutions. You can rely on Arca Yazılım's expertise to take your digital security and process efficiency to the highest level.