An ecosystem to secure our digital identities in the face of rising identity fraud In the digital era, crimes such as identity fraud and theft are on the rise. The ARIES ecosystem provides a secure, effective framework to counter these threats and keep our identities safe. Security © Iaremenko Sergii, Shutterstock Society and its underpinning services are becoming increasingly digitised, bringing multiple benefits to prosperity and quality of life. Nevertheless, this new digital environment also provides an opportunity for a range of new risks, particularly regarding the control over personal data. Crimes such as identity fraud and theft are on the up – a phenomenon that already costs businesses, citizens and sovereign states billions of euros. There is no globally accepted solution to these issues, legally or policy-wise, which is hampering efforts to combat the new threats. The ARIES project sought to rectify the situation, by creating an e-identity ecosystem framework, one which provides security and reliability for the management of virtual identities across the EU. “The project goal is to provide new technologies, security features and procedures to better support the needs of law enforcement authorities, ensuring a higher level of quality in security aspects like privacy-respecting credential management,” says Mr Javier Presa, ARIES Project Director at Atos. Securing the virtual you The proposed digital ecosystem aims to strengthen the link between physical and digital identities, while the design took into account both guidelines on privacy and analysis of existing services and identity-management processes. Within ARIES, citizens are able to generate a digital virtual identity cryptographically linked to a physical one, such as a national eID or ePassport, and to the biometrics generated through the process. “Linking proof of identity based on the combination of biometric traits and citizen digital identity, with the administrative processes involved in issuing these documents, provides a high level of authentication assurance,” says Presa. Ethical issues are critical when it comes to any form of data management, and this was an active area of research in the project. Data integrity is assured by storing the information locally and securely ensuring compliance with the EU’s new data law, GDPR, by delivering the derived identities only under the user’s explicit and informed consent. “We handled the ethical issue by ensuring that no more data should be enrolled or collected from a user’s document other than that specifically necessary for the service envisaged,” says Presa. Testing the ecosystem The first proof-of-concept was trialled in Porto in 2017, in an eCommerce environment. Users created a virtual ID for use in an online shop, and the system was tested for protection against identity theft. Another trial ran in an airport, testing ARIES’ effectiveness in boarding control, airport shopping and identity recovery. Comments from airlines, law enforcement authorities and other airport staff praised ARIES’ added security, reduced waiting times and efficiency savings in personnel. Users appreciated the general performance of the mobile ARIES application and liked the concept of holding a duplicate digital means of proving their identity. “The user-centric approach made them feel they were in control of their data at all stages,” says Presa. “Regarding the project execution itself, all the partners were very collaborative, fostering a very good ambience and being proactive, something that was highlighted during the final evaluation of ARIES,” adds Presa. “It is very important to highlight the necessity of encompassing digital, virtual and derived identities in European regulations,” says Presa. “They could be very helpful in a rapid adoption of these eIDs in an environment where mobile devices are being used for increased convenience.” Keywords ARIES, security, identity, digital, digital virtual identity, ecosystem framework
