Country Update Austria

1
Country UpdateAustria
Porvoo 5, Interoperable European Electronic
Identities 13./14. May 2004, Tallinn, Estonia
2
The Citizen Card

• Define function rather than form
• Identification, authentication, confidentiality
• extendability and modularity a must
• technology independence a must
• Separate key players
• Administration, CA, developers, users
• Account for different technologies
• smartcards, mobile phone, PDA, ...
• Open market

3
Security-Layer

• High-level interface using internet standards
  HTTP, HTML, XML
• simple request/response protocol
• Functions
• signing documents
• verifying signed documents
• storing/retrieving data
• utility functions

4
Current Status

• Law
• E-government law put into forcein March '04
• By-laws put into force April '04
• Citizen cards
• 60.000 student cards rolled out
• Mobile signature started in April '04
• ATM card roll out starts in October
• Social security card delayed until '05

5
Interoperability

• Successful tests with
• Finnish ID card, Italian ID card
• German signature card
• We are interested in other cards!
• Need of online registering with Austrian
  authorities once
• Signature format
• XMLDSig ETSI XAdES, CMS
• Able to handle UES although currently not
  generating it

6
Identity Management

• High quality, privacy, data protection
• Cross application and cross border

Process requiring an identification
MATCHING MECHANISMS DIVERSIFICATION FOR SAKE
OF DATA PROTECTION
Valid identity representations of a person
Identity representation of a valid proxy
7
IM (2)

• Context dependant PINsbased on one highquality
  source PIN
• Acting by proxy

8
Putting it all together
9
Applications

• Electronic service of documents
• with return receipt
• legally binding
• Instant e-payment
• guarnteed, non-repudiatable
• Rapid e-government
• Deploy a new application form within one day
• Back office
• electronic workflow and authorization

10
Thank you for your attention
Arno.Hollosi_at_cio.gv.at Federal staff unit for
ICT-strategies Prime Minister's
Office http//www.cio.gv.at/ http//reference.e-
government.gv.at/
11
Citizen Card

• Define function profile
• Do not define concrete technical or physical
  characteristics
• Capsule relevant modules into the secure
  signature creation device
• Access functions through high-level, open
  interface only

12
Model
13
Identity Management
What is IM? creation, verification, maintenance
and use of data identifying a person - be it
natural or juridical.
Where to build IM upon? IM has to be based on
data that can be trusted and needs to use
mechanisms and formats that are generally
recognized. Names, signatures etc. are not
suitable as they might be changed or be revoked.
What do we expect from IM? a uniquely defined
and maintained set of data that can be well
distinguished for each person and that can be
alligned with procedures - ideally without prior
registration to these procedures. Such IM should
work cross application and cross border.
14
Context Dependant ID

• Use ID-number as base key for context dependant
  ID-numbers (cd-IDs)
• Advantages
• different numbers for different areas
• doesnt allow correlating databases
• still only one number to maintain/verify

15
Context Dependant ID (2)
base id number
context dependant id
context dependant id