The Austrian eID system constitutes a main pillar within the Austrian e-Government strategy. The eID system ensures unique identification and secure authentication for citizens protecting access to applications where sensitive and personal data is involved. In particular, the Austrian eID system supports three main use cases: Identification and authentication of Austrian citizens, electronic representation, and foreign citizen authentication at Austrian public sector applications. For supporting all these use cases, several components -- either locally deployed in the applications' domain or centrally deployed -- need to communicate with each other. While local deployments have some advantages in terms of scalability, still a central deployment of all involved components would be advantageous, e.g. due to less maintenance efforts. However, a central deployment can easily lead to load bottlenecks because theoretically the whole Austrian population as well as -- for foreign citizens -- the whole EU population could use the provided services. To mitigate the issue on scalability, in this paper we propose the migration of main components of the ecosystem into a public cloud. However, a move of trusted services into a public cloud brings up new obstacles, particular with respect to privacy. To bypass the issue on privacy, in this paper we propose an approach on how the complete Austrian eID ecosystem can be moved into a public cloud in a privacy-preserving manner by applying selected cryptographic technologies (in particular using proxy re-encryption and redactable signatures). Applying this approach, no sensitive data will be disclosed to a public cloud provider by still supporting all three main eID system use cases. We finally discuss our approach based on selected criteria.
Prior to this paper, in @cite_12 we illustrate privacy-preserving design strategies for migrating the basic Austrian eID architecture into the public cloud. The three design strategies proposed there are based on proxy re-encryption, anonymous credentials, and fully homomorphic encryption respectively. Thereby, we conclude that using proxy re-encryption is the most practical approach. However, @cite_12 only investigates the basic use case of the Austrian eID system, namely identification and authentication of Austrian citizens (see Section for details). In this paper we follow a similar approach using proxy re-encryption, but now illustrate the migration of the complete Austrian identity infrastructure into the public cloud. Thereby, we include the two other main uses cases (identification and authentication in representation and foreign citizen authentication), which in part have already been discussed previously in @cite_19 @cite_29 . However, we want to emphasize that it is not a simple combination of these existing results, but we aim at demonstrating that privacy-preserving identity management in public clouds using proxy re-encryption is also possible for complex systems such as the complete Austrian eID ecosystem, which has broad applicability.
@cite_19 @cite_29 @cite_12
1562303395 2044485718
The STORK framework — enabling secure eID federation across European countries — will be the dominant identification and authentication framework across Europe in the future. While still in its start up phase, adoption of the STORK framework is continuously increasing and high loads can be expected, since, theoretically, the entire population of the European Union will be able to run authentications through this framework. This can easily lead to scalability issues, especially for the proxy-based (PEPS) approach in STORK, which relies on a central gateway being responsible for managing and handling citizen authentications. In order to mitigate the associated scalability issues, the PEPS approach could be moved into the public cloud. However, a move of a trusted service into the public cloud brings up new obstacles, especially with respect to citizens' privacy. In this paper we propose an approach how this move could be successfully realized by still preserving citizens' privacy and keeping existing national eID infrastructures untouched. We present the approach in detail and evaluate its capability with respect to citizens' privacy protection as well as its practicability. We conclude, that the proposed approach is a viable way of realizing an efficient and scalable Pan-European citizen identification and authentication framework. The current Austrian electronic mandate system, which allows citizens to act as representatives for other citizens or companies in e-Government services, relies on a centralized deployment approach. Thereby, a trusted central service generates and issues electronic mandates on the fly for service providers. The usage of this service is continuously increasing and high loads can be expected in the near future. In order to mitigate the associated scalability issues, this service could be moved into the public cloud. However, a move of a trusted service into the public cloud brings up new obstacles, especially with respect to citizens' privacy. In this paper we propose two approaches how this move could be successfully realized by preserving citizens' privacy and still being compliant to national law. The main objectives we focus on are minimal data disclosure to untrusted entities by still keeping the existing infrastructure nearly untouched. We present both approaches in detail and evaluate their capabilities with respect to citizens' privacy protection as well as their practicability and conclude that both approaches are entirely practical.