STORK: a real, heterogeneous, large-scale eID management system

Carlos Ribeiro, Herbert Leitold, Simon Esposito, David Mitzman

Research output: Contribution to journalArticleResearchpeer-review

Abstract

Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.
Original languageEnglish
JournalInternational Journal of Information Security
DOIs
Publication statusPublished - Jul 2017

Fingerprint

Electronic scales
Semantics
Interoperability
Identification (control systems)
Internet

Keywords

  • STORK
  • eID
  • Identity Management
  • SAML

Cite this

STORK: a real, heterogeneous, large-scale eID management system. / Ribeiro, Carlos; Leitold, Herbert; Esposito, Simon; Mitzman, David.

In: International Journal of Information Security, 07.2017.

Research output: Contribution to journalArticleResearchpeer-review

@article{ac8cbf7c2c194541b6dd12cb2fd01b9d,
title = "STORK: a real, heterogeneous, large-scale eID management system",
abstract = "Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.",
keywords = "STORK, eID, Identity Management, SAML",
author = "Carlos Ribeiro and Herbert Leitold and Simon Esposito and David Mitzman",
year = "2017",
month = "7",
doi = "10.1007/s10207-017-0385-x",
language = "English",
journal = "International Journal of Information Security",
issn = "1615-5262",
publisher = "Springer Verlag",

}

TY - JOUR

T1 - STORK: a real, heterogeneous, large-scale eID management system

AU - Ribeiro, Carlos

AU - Leitold, Herbert

AU - Esposito, Simon

AU - Mitzman, David

PY - 2017/7

Y1 - 2017/7

N2 - Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.

AB - Verifying who someone is on the Internet is a prerequisite for online services that process sensitive or valuable information. While this has been solved with national or sectorial electronic identification (eID) schemes, general, cross-border solutions are rare. Cross-border eID difficulties have several origins: (i) incompatible national eID models; (ii) different legislations with incompatible objectives; (iii) lack of common language and semantics; (iv) different common procedures, specially in what concerns mandates and delegation; (v) different implementations of the same eID models. These have been addressed by STORK, a project that developed a federated cross-border eID system that was piloted in about twenty European Union Member States in service sectors as sensitive as eBanking and eHealth. STORK designed and implemented a large-scale interoperability framework, allowing different systems of different models to coexist, using a common language with a common semantics and satisfying national privacy legislations. The experience gained from this large-scale pilot fed into EU policy-making, in particular, the recently enacted eIDAS Regulation requiring mutual recognition of eID by 2018 has been directly influenced by STORK and its lessons learned.

KW - STORK

KW - eID

KW - Identity Management

KW - SAML

U2 - 10.1007/s10207-017-0385-x

DO - 10.1007/s10207-017-0385-x

M3 - Article

JO - International Journal of Information Security

JF - International Journal of Information Security

SN - 1615-5262

ER -