e-SENSElectronicSimpleEuropeanNetworkedServices

TheNordicBusinessLifecyclePilot

ICT2015- Innovate,Connect,TransformLisbon,October20-22,2015

presentedbyHansEkstålStefanSantessonDörtheKoerner

Conversion of EIDSwe-Nor

Time line perspective – LSP/CEF/ISA

Overallgoal andobjectives

Asmartsustainableandinclusive economyStimulatecross-bordermobilitywithintheBusinesslifecycledomain.Promote SMEs’growthOnce onlyDigitalbydefault

e-IDe-Signatures

e-Deliverye-Document

TheNordicpilotImplementing eIDandeSIGN inthePointofSingle Contacts

WP6Status

Demo

http://esp-sp.se/home/esensmenu

SwedisheSENS pilotinfrastructure

ConnectsEuropeancitizenstoSwedishgovernmente-ServicesAllowsuserstoauthenticatetheiridentityandsigndocumentsusingtheirnationaleID.Onlyrequirescross-borderauthentication.Fullyimplementeddemoinfrastructurefullyoperationaltoday.Implementingbothcrossboarderauthenticationandsigning.EasytointegrateintoServiceProviders.SubscribingtotheSwedishnationaleID infrastructureincludesintegrationwithEuropecitizeneID:s withnoadditionalwork.Cross-borderintegrationcomplexityoff-loadedtonationalproxyservice

CoreSwedishinfrastructure

Metadata

Discoveryservice

Signingservices

Signaturevalidationservices

Proxy

IdP

eIDASnode

IdP

SP

AA

IdP

IdP

SP

SP

SPIdP

Membership• Keypair• Metadata

SwedisheSENS PilotArchitecture

Obtainingrelevantidentitydata

Serviceprovidersneedusefuldataaboutusersthroughgenericandcountryindependentsyntaxandsemantics.Serviceproviderscan’tdouniqueintegrationforeachcitizencountry.AnAttributeAuthorityexpandstheattributesprovidedaboutEuropeancitizenstoSwedishServiceProviderswith:• ProvisionalID.Agenericidentifiergeneratedfromtheidentitydata

obtainedfromcross-borderauthentication.• ProvisionalIDquality.AnindicatorfortheprovisionalID’sresilience

tochangeovertime,ratedasA,BorC.• AnySwedishnationalidentifier(SwedishpersonalIDorSwedishco-

ordinationnumber)assignedtotheauthenticatedperson.

SEeIDAS nodeSEProxyIdPSP

AttributeAuthority SwedishIDregistry

STORKattributesfromcitizencountry

CompletesetofSEattributes

Query:Identifyingsubjectandrequestingattributes

Response:withknownandrequestedattributevalues

AssignednationalIDattributevalues

AttributeproviderfornationalID

TheprovisionalIDNationalattributeservice

Provisional IDalgorithms

Algorithm

Algorithm

Algorithm

Algorithm

IDdata

IDdata

IDdata

IDdata

ProvisionalID

Qualityindicator

Didtherightpersonsign?

eIDASnode

eIDASnode

ServiceProvider

Signeddocument

Authentication(Login)

SAMLAssertionAccordingtoSwedishattributeprofile

ProxyIdPswithattributemapping

Problem:Istheauthenticatedpersonalsothesigner?

Thecross-bordersigningchallenge

SomeeID:s donotprovidethecapabilitytosignadocument.Havingtheusertosignadocumentlocallyinthecitizencountryintroducesawiderangeofproblemsfortheserviceprovidervalidatingthissignatureinanothercountry• Differentsignatureformats• Determinetrustinthesigner’scertificate• Obtainingusefulidentityinformationaboutthesigner

thatmaydifferconsiderablyfromtheidentitydataofthesamepersonobtainedthroughcross-borderauthentication.

• Handlingcredentialexpiryandrevocationstatusfromothercountries.

Federatedsigning

Allowstheusertosigndocumentsusingasigningserviceintheserviceprovidercountry.Solvesmanypracticalproblems• Alwaysthesamesignatureformat• Notime-stampingneeded(Signaturecertificateissuedatthetimeof

signing).• Alwaysthesamevalidityperiod• Betteruserintegrity.Thedocumenttobesignedneverleavesthe

serviceprovider.• Almostnoneedforcertificaterevocation• Theuseridentityinthesignaturecertificateisconsistentwiththe

sameuser’sidentitythroughcross-borderauthentication• AlltypesofeID:s canbeused,alsoeID:s withnosigningcapability.• Newinformationflowwithsignatureacceptandproofofsign

messagedisplayandacceptensuresthattheuserisawarethatadocumentisbeingsigned.

• WORKSTODAY– NONEWSTANDARDSARENECESSARY.

Video- Use case Sweden=>Norway

WP6Status

Thanksforyourattention!

Andtimeforquestions?

Contactus:sens.info@lists.esens.eu

Facebook:www.facebook.com/Eu.eSENS

Twitter: twitter.com/eSENS_EU

LinkedIn:http://www.linkedin.com/groups/EU-eSENS-4998775

Visite-SENS:www.esens.eu