STORK: a real, heterogeneous, large-scale eID management system

Carlos Ribeiro, Herbert Leitold, Simon Esposito, David Mitzman

Research output: Contribution to journalArticleResearchpeer-review

Abstract

Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.
LanguageEnglish
JournalInternational Journal of Information Security
DOIs
StatusPublished - Jul 2017

Fingerprint

Electronic scales
Semantics
Interoperability
Identification (control systems)
Internet

Keywords

  • STORK
  • eID
  • Identity Management
  • SAML

Cite this

STORK: a real, heterogeneous, large-scale eID management system. / Ribeiro, Carlos; Leitold, Herbert; Esposito, Simon; Mitzman, David.

In: International Journal of Information Security, 07.2017.

Research output: Contribution to journalArticleResearchpeer-review

@article{ac8cbf7c2c194541b6dd12cb2fd01b9d,
title = "STORK: a real, heterogeneous, large-scale eID management system",
abstract = "Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.",
keywords = "STORK, eID, Identity Management, SAML",
author = "Carlos Ribeiro and Herbert Leitold and Simon Esposito and David Mitzman",
year = "2017",
month = "7",
doi = "10.1007/s10207-017-0385-x",
language = "English",
journal = "International Journal of Information Security",
issn = "1615-5262",
publisher = "Springer Verlag",

}

TY - JOUR

T1 - STORK: a real, heterogeneous, large-scale eID management system

AU - Ribeiro, Carlos

AU - Leitold, Herbert

AU - Esposito, Simon

AU - Mitzman, David

PY - 2017/7

Y1 - 2017/7

N2 - Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.

AB - Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.

KW - STORK

KW - eID

KW - Identity Management

KW - SAML

U2 - 10.1007/s10207-017-0385-x

DO - 10.1007/s10207-017-0385-x

M3 - Article

JO - International Journal of Information Security

T2 - International Journal of Information Security

JF - International Journal of Information Security

SN - 1615-5262

ER -