eidas Regulation NIS Platform meeting Brussels 25 November 2014

Transcription

1 eidas Regulation "How the use of electronic identification and trust services can improve cybersecurity" NIS Platform meeting Brussels 25 November 2014 Andrea SERVIDA DG CONNECT, European Commission Head of eidas Task Force

2 eidas Regulation (EU) N 910/ the ambition Strengthen EU Single Market by boosting TRUST and CONVENIENCE in secure and seamless cross-border electronic transactions 2

3 E-Transactions workflow Website authentication: check if the website you enter is really linked to the tax authority. eid: identify (or authenticate) yourself using, for instance, an eid means Submitting a tax declaration Creation of the tax declaration E-registered delivery: Tax authority sends acknowledgement of receipt Time stamp: Proof of submission of the tax declaration in due time E-signature/ e-seal: Signing or Sealing the tax declaration Preservation: storage of the tax declaration and acknowledgment of receipt 3

4 eidas breaks new ground (1/2) Provides legal certainty and fosters the usage of eid means for on line access ("world première") never regulated at EU level before Addresses all the stages of a generic e-transaction, from the authentication of a web site to preservation Provides the legal framework for a comprehensive toolbox of mechanisms and services to boost trust and confidence in electronic transactions 4

5 eidas breaks new ground (2/2) Takes a risk management perspective, not based on normative rules but on principles: Transparency and accountability: well-defined minimal obligations for TSPs and liability Trustworthiness of the services together with security requirements for TSPs Supervision: Light-touch reactive monitoring for TSPs vs. fullfledged supervision for QTSPs Technological neutrality: avoiding requirements which could only be met by a specific technology Market rules and building on standardisation Provides one set of rules directly applicable across all EU MS Regulation (plus 1 DA and 28 IA) 5

6 eidas Mutual recognition of eids Mandatory recognition of electronic identification Voluntary notification of eid schemes "Cooperation and interoperability" mechanism Liability rules Assurance Levels: "high" and "substantial" (and "low") Interoperability framework Access to authentication capabilities: free of charge for public sector bodies & according to national rules for private sector relying parties 6

7 eidas Trust services 7

8 eidas Timeline of implementation Entry into force of the Regulation Voluntary recognition eids Date of application of rules for trust services: Mandatory recognition of eids 8 8

9 TECHNICAL An eidas World REGULATORY Implementi Expert ng & Comitology Group Delegated acts Promote CEF / DSI EU market solutions LSPs eidas Regulation Negotiation with 3rd countries MARKET Standardis ation activities Awareness/ Communicati on tools Engagement events ENISA Global industrial policy STAKEHOLDERS' ENGAGEMENT 9

10 High level stakeholder event of 19/11/14 "eid: a key to business growth and innovation" - Co-organized with Member States - Focus on sectors consuming eid means - e-commerce, Financial & Payment Services, Tourism, Transport, Airline Operators, Telco Operators, Social Innovators - Objectives - Identify business needs for cross-border use of eid credentials - Raise awareness - Understand cross-border use cases in private sector - Showcase of innovative commercial use of eid means 10

11 Few important messages: - Increasing business demand for trust, security and convenience in online transactions - Convenience and usability as deciding factors in uptake-> mobile environment/diversity of credentials - Public sector should lead by example - Need for European interoperability and standardization-> federating eid & global dimension - Role of Govs vs business model for provisioning and consuming eid means - Cross-sector & cross-border use of eid calls for more regulatory fitness Presentations available here: 11

12 ENISA Support for eidas ENISA (European Agency for Network and Information Security): 2012 Report on the implementing eidas art Guidelines for Trust Service Providers 2014 ENISA focused on the areas of: Common audit schemes for trust services providers in Member States. Technical guidelines for independent auditing bodies and supervisory authorities Proposal for incident reporting framework, discuss with NSBs European Cyber Security Month in Oct ENISA will continue to support related activities relevant to the implementation of the provisions of the Regulation 12

13 Large Scale Pilots (LSPs) Interoperable e- procurement Electronic Identity 19 partners 11 countries 32 partners 14 countries Total Budget 30,8 M Total Budget 26 M Patient Summary / eprescribing 47 partners 23 countries Total Budget 23 M Business mobility 33 partners 16 countries Total Budget 24 M ejustice 17 partners 15 countries Total Budget 14 M Electronic Identity 60 partners 20 countries Total Budget 18,7 M Consolidation & extension of LSPs 22 partners 20 countries Next: Connecting Europe Facility (CEF) Service Infrastructures (DSIs) Total Budget 27,4 M Digital 13

14 Standardisation mandate by CEN and ETSI 6 Trusted Lists Providers List of TSP services approved (supervised) by National Bodies (e.g. Trusted Lists) Certificate Authority Time-stamping Signing Servers Validation Services TSPs supporting esignature 4 5 Trust Application Service Providers Rules & procedures Formats Signature Creation / Validation Protection Profiles 1 Signature Creation & Validation XAdES (XML) CAdES (CMS) PAdES (PDF) AdES in Mobile envmts ASiC (containers) Common Criteria Protection profiles Smart Cards HSMs Signing services Signature Creation Devices 2 3 Cryptographic Suites Key generation Hash functions Signature algorithms Key lengths

15 International dimension EU leader in the eidas domain (e.g. world-class hardware, software and services providers, and administrations at the forefront of egovernment) Strategic cooperation with a few selected countries (e.g., US, Japan, etc.) Economic/business opportunities (e.g., Brazil, India, etc. & UN, ITU, ISO, etc.) Capacity building (e.g. south-mediterranean, sub-saharan region, Eastern Partnership countries, etc.) 15

16 For further information and feedback Web page on eidas Impact assessment Text of eidas Regulation in all languages eidas functional mailbox EU_eIDAS 16