Periodic Reporting for period 2 - ARIES (reliAble euRopean Identity EcoSystem)
Reporting period: 2018-03-01 to 2019-02-28
ARIES aims to improve identity, trust and security, and better support the law enforcement by addressing the challenges posed by wrong identity, identity fraud and associated types of cyber and other forms of organized crime. The project activities address technical, legal and ethical requirements of a comprehensive framework for a reliable e-identity ecosystem that will help citizens to increase their security and privacy in the digital world and their trust in online transactions. ARIES will provide mechanisms to allow citizens to generate a digital identity linked to the physical one and promote the usage of mobile and smart devices for trustworthy online authentication.
These were the project specific objectives:
• Develop a trustable, reliable identity ecosystem for secure, ethical and privacy respecting virtual identity management processes, with the aim of reducing identity fraud and associated crimes.
• Strengthen the link between physical and digital identities by using high assurance elements, including biometric verification and tamper-proof certified checks with breeder documents.
• Validate the ARIES approach in two realistic citizen-oriented scenarios: eCommerce and at the airport.
• Address key legal, ethical and societal aspects of eID adoption and identity-related crimes to augment confidence in eID use.
We have investigated actual existing processes of identity management in the physical and digital worlds and their life cycles, examining their weaknesses and identifying the improvements that are needed to reduce threats and we have designed an architecture, following privacy by design principles, open and extensible which enables the integration with different IDM services providers.
We have built a system that derives virtual identities from official identities issued by national authorities, such as ePassport and Spanish eNIC. The identity derivation process includes automatic document verification and document’s holder biometrics verification prior to issuance. These unique characteristics improve the level of trust perceived by end users and foster the adoption of eIDs by citizens.
ARIES identities are stored encrypted in users' mobiles. No information is permanently stored in ARIES components. Personal data are under users’ control. They can create different ID’s with different levels of security and privacy for different purposes. They decide on the information shared with services providers ensuring minimal disclosure.
ARIES architecture has been instantiated in two scenarios and evaluated by end users: eCommerce and airport demonstrators. Each of them pursuing different purposes.
In the eCommerce scenario the main goal was registration and authentication at an online eCommerce site. In the Ecommerce scenarios two biometrics were integrated: face biometrics and voice recognition. In the airport demonstrator ARIES identities were used in a high security demand environment, such as airplane boarding, combining physical and virtual identity management. In addition, a proof of concept of the use of privacy preserving technologies was carried out at the airport duty free shop, customers proved they were over 18 years old, and so entitled to buy alcohol beverages, without disclosing their current age.
Our research encompassed main socio-ethical considerations of the actual use and future adoption and acceptance of eIDs. Privacy and security perceived by end users evaluating our two demonstrators were greater than in the case of using other types of eIDs. The EU legal context applicable to ARIES system and future service providers using the ARIES system, mainly the eIDAS and GDPR Regulations have been analysed and legal implications identified.
ARIES assets have been clearly identified and ownership assigned to individual partners. Project partners are already very well positioned in the e-ID market, and the exploitation of individually owned components is not considered as a problem. Thanks to open source APIs and modular architecture each of partners is also able to reconstruct the whole ARIES platform, if needed. Nevertheless, the joint exploitation of ARIES results is considered through future agreements between ARIES partners. Consultants and integrators will be given a catalogue with description of ARIES components that enables them to “mix and match” to create custom designed offerings for the client
We hold privacy in the highest regards, we have analysed the personal data treatment across the system components and carried out an ethical assessment of the project demonstrators. Enrolment and authentication were studied, and potential risks highlighted. We have issued recommendations on information security safeguards to control privacy risks and produce specific data protection impact reports for future system implementations.
ARIES has contributed to future developments of identity management standards. ISO SC 27/WG 5 “Identity management and privacy technologies” has opened a new study period to collect and document use cases with a scope of compiling and produce functional requirements for identity assurance. The project has presented, through KANTARA discussion group, two use cases.
The Estonian presidency of the EU invited ARIES to a thematic meeting on "Registry of identity" with representatives of EU Member States in the framework of the Action plan to strengthen the European response to travel document fraud. Project concepts and achievements were explained to the policy makers audience.