Introduc)on to STORK2.0 project

Transcription

1 Introduc)on to STORK2.0 project AAI Workshop Brussels, April 2014

2 EUROPEAN EID CONTEXT FOR EGOVERNMENT

3 NaKonal online services today with eid CENTRAL GOVERNMENT ONLINE SERVICES LOCAL GOVERNMENT ONLINE SERVICES CITIZEN BUSINESS ONLINE SERVICES NON- PROFIT ORGANISATION ONLINE SERVICES

4 All MS have their own eid infrastructure CITIZEN CITIZEN CITIZEN CITIZEN CITIZEN

5 Borders will open & NaKonal online services will improve CITIZEN OpportuniKes for public and private sector CITIZEN CITIZEN CITIZEN CITIZEN

6 Large Scale Pilot - STORK Results countries PEPS/VIDP- Enabled all over Europe More than 30 services running More than 40 different credenkals supported 6

7 STORK CredenKals

8 Cross Border Authentication for electronic services Safer Chat Student Mobility Electronic Delivery Change of Address ECAS Integration

9 STORK 2.0 PROJECT

10 Overview 3 year project 2012 to countries involved 58 partners

11 STORK structure IdP IdenKty providers (for basic idenkty a_ributes, generally are public bodies or CA that offer their services to general public) SP Service providers connected to the infrastructure (in the academic pilot in STORK2.0, most of them are universikes) PEPS/V- IDP interconnected proxies that integrate STORK common infrastructure (Kpically, one per country and run by a public administrakon or on behalf of it) AP A_ribute providers (for business a_ributes, specific a_ributes related to different sectors of ackvity such as educakon, banking, health...)

12 STORK 2.0 Pilots elearning and ACADEMIC QUALIFICATIONS ebanking PUBLIC SERVICES for BUSINESSES elearning: cross- border academic services. Academic Qualifica)ons: use of academic informa)on ()tles, registers, qualifica)ons) by governmental and private ins)tu)ons. Online banking services suppor)ng na)onal eids. Enable companies to open bank accounts and consult their daily procedures electronically and remotely. Enable legal en))es to use online public services in other Member States, with already exis)ng procedures and applica)ons. BUSINESS- ORIENTED ehealth Secure online access to medical data. The pa)ents rights to access to their personal medical data in cross- border health services.

13 CollaboraKon with LSPs Interac)on with the other LSPs building on gained experience and lessons learned. Close liaisons foreseen with: ecodex for legal aspects around eid for legal persons epsos for integrakng STORK 2.0 solukons for eid- based authenkcakon with its ehealth infrastructure esens for an infrastructure for cross- border public services delivery in support of the Digital Single Market

14 PLATFORM DEVELOPMENT

15 Enhancements to STORK 1 It encompasses eid for secure electronic authenkcakon of both legal and natural persons. It includes facilikes for mandates, widely useable across the EU, providing strong data proteckon and secure ways of transferring a_ributes, all under user control. Its allows the use of STORK not only to private sector but also public sectors, in the first place banks. This increases the requirements on availability, security, and reliability.

16 User Consent Plaform built around the user centric approach. No data is being sent abroad unless the user allows the administrakon to do so. The user can give his consent in various different ways: Implicitly: By introducing his credenkal, he implicitly allows the data to be transferred to its desknakon SP. Explicitly for data types: Allows users to exclude a_ributes to be sent. Explicitly with data values: Eliminates data to be sent to SP. As data is signed, user may not exclude any item.

17 Business Processes Authen)ca)on on behalf of: Allow access to an applicakon with data of another legal/natural person. Powers (for digital signature) (as part of a contract, commercial proposal, etc.), and representakon powers of signatory should be verified. Powers as stored by a service provider need to be updated / validated periodically.

18 Business Processes User Basic Id A_ributes Name Address Date of Birth Specific Business A_ributes Extended Id A_ributes Degrees Profession CerKficaKons Languages Official permits Academic Life Financial Life Health Life Public Services 18

19 IdP PEPS PEPS b TADS IMMD a

20 Business Processes Business Acributes A_ributes proceeding from a certain business sector, oken with a meaning limited to this sector, are to be retrieved from various A_ribute providers Need from pilots to interchange extended personal data (hasdegreewith diplomasupplement, ishealthcareprofessional, etc.) As standardised as possible (for cross- border use) MulK- country a_ribute colleckon

21 Other Processes in STORK 2.0 Signatures AdopKon of a common solukon for creakon and validakon of signatures Based on exiskng open source sokware (e.g. PEPPOL) Covering standards adopted by the EC, especially PAdES and XAdES with most common versions IntegraKon, packaging, examples, and revision of documentakon Version control Control of sokware and configurakon versions Procedure for automakc inclusion of renewed cerkficate AutomaKc inclusion of new MS Anonymity For anonymous esurveys, evokng, etc.

22 Plans Feb 2014 Common development and test Node integrakon and test Pilot integrakon and test Mar 2014 Mar 2015 Pilot running and evaluakon Maintenance, bug fixes Packaging

23 E- SIGNATURE

24 esignature AuthenKcaKon is not sufficient AuthorisaKon is a step Signature may be mandatory, e.g. in Banking Based on LSP PEPPOL signature service

25 SECURITY - QAA

26 A_ributes - QAA / AQAA As authenkcakon levels for a given applicakon may differ across Member States, the project defined acribute quality authen)ca)on assurance levels (AQAA) at a European scale to: Measure the quality of different acribute provider procedures. Ensure interoperability between the different acribute standards that exist in Europe.

27 QAA level framework STORK QAA level Descrip)on 1 Minimal assurance 2 Low assurance 3 SubstanKal assurance 4 High assurance Allows for mapping nakonal eid solukons to STORK QAA levels. Provides a means for mapping different member states levels onto each other. Similar to the IDABC authenkcakon levels report. CompaKble with the Liberty IdenKty Assurance Framework.

28 QAA AccreditaKon Body STORK2.0 will analyse the need and possible mechanisms to set up a neutral accredita)on body, verify compliance to the STORK QAA framework, take care of the contractual aspects regarding trusted eid interoperability. The requirements of such a body will be idenkfied, its feasibility will be examined, and a business as well as a governance concept will be designed. AlternaKves, like mutual recognikon, are included in the analysis. Stork 2.0 is an EU co- funded project INFSO- ICT- PSP

29 Visit STORK 2.0 website stork2.eu! Subscribe to STORK 2.0 Newslecer! HOW TO GET INVOLVED ParKcipate & like Stork eid Facebook page! Follow us on Connect to Stork 2.0 EID LinkedIn page! Register in STORK 2.0 online groups! Contact us at stork2.eu!

30 DemonstraKon of the funckonality Visit the pilot: stork.eu/pilots/pilot3.htm

31 Thank you for your a,en.on! stork2.eu