EIDAS OPPORTUNITIES AND RISKS IN INTERNATIONAL COMPETITION FOR TSPS

Größe: px

Ab Seite anzeigen:

Download "EIDAS OPPORTUNITIES AND RISKS IN INTERNATIONAL COMPETITION FOR TSPS"

Reinhardt Julian Huber
vor 6 Jahren
Abrufe

1 CA-Day EIDAS OPPORTUNITIES AND RISKS IN INTERNATIONAL COMPETITION FOR TSPS Leslie Romeo Head of D & Trust Services 1&1 D GmbH Member of United Internet

2 Agenda 1&1 Member of United Internet AG Requirements according to eidas (for qualified electronic registered delivery services) D (vs. / =) eidas? Opportunities without risks? Avoiding risks, making it work!

1&1 - Member of United Internet AG Access Applications

product management, development and system administration)

in 11 countries 7 Certified Data Centers 70 000 servers in

3 1&1 - Member of United Internet AG Access Applications Network Devices Strong Team employees (2 700 in product management, development and system administration) Sales Power about 3.2 million contracts annually sign-ups for free services daily Operational Excellence 49 million accounts in 11 countries 7 Certified Data Centers servers in the EU and US Powerful Network Infrastructure km optical fibre network Content Software

4 1&1 - Member of United Internet AG

5 Requirements for qual. electr. registered delivery services Legal effect (Art. 43) 1. ( ) using an electronic registered delivery service shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form ( ) Same legal effect as paperbased transactions 2. ( ) using a qualified electronic registered delivery service shall enjoy the presumption of the integrity of the data, the sending of that data by the identified sender, its receipt by the identified addressee and the accuracy of the date and time of sending and receipt indicated by the qualified electronic registered delivery service. Requirements (Art. 44) Legal effect as qualified electronic signature, for that the effect of an actual signature Certification: ( ) provided by ( ) qualified trust service providers; Identification: ( ) high level of confidence the identification of the sender / adressee Integrity Protection: ( ) secured by an advanced electronic signature ( ) or seal ( ) Qualified electronic time stamp: ( ) Date and time of sending, receiving and any change of data are indicated by a qualified electronic time stamp. Certification, Identification, Integrity Protection, Qualified Signature lead to the legal effects by proven privacy, integrity, authenticity and liability

De-Mail vs. eidas? Comparison of Standards - The facts: Target: Digital Transformation of paper mail. Target: Trusted Services have the same legally binding status as the paper process.

6 D vs. eidas? Comparison of Standards - The facts: Target: Digital Transformation of paper mail. Target: Trusted Services have the same legally binding status as the paper process. Facts D ( 1ff. D G) Accredited D service provider Identification beyond a reasonable doubt of all Users as foundation of a D account (LOA 4) Continuous Integrity Protection Qualified signed received receipt, delivery receipt, and read receipt including time stamp. D (=)* eidas! *Confirmed by BSI, BNetzA and BfDI Requirements for qualified electronic registered delivery services (Art. 44 (1) eidas ( ) qualified trust service provider(s) ( ) a high level of confidence the identification of the sender; ( ) the identification of the addressee before the delivery of the data; ( ) preclude the possibility of the data being changed undetectably; the date and time of sending, receiving and any change of data are indicated by a qualified electronic time stamp. In Germany the certification as D Provider is one possibility to become a qualified trust service Provider according to eidas. (so far the only one)

Opportunities without risks? No Way! Opportunities EU-wide standardization Harmonization of different solutions in the member states. Uniform requirements Uniform legal effects.

7 Opportunities without risks? No Way! Opportunities EU-wide standardization Harmonization of different solutions in the member states. Uniform requirements Uniform legal effects. Level playing field on a european single digital market eidas the enabler of distortion of competition eidas the modell of sucess Risks Only abstract rules in eidas Regulation for qualified electronic registered delivery services Missing detailed implemeting acts Missing use cases Missing interoperability Possible and likely different interpretations of the Regulation by the member states and companies

8 Risks The vagueness of the eidas Regulation leads to: Different requirements in conformity with a wide variation in measurement Different barriers for market entry for TSPs Different barriers of product entry for users Different levels of assessment in regard of security, privacy, integrity, etc. Impossibility of interoperability Consequence: Market distortion Uncertainty of the user No mandatory interoperarbility Lowest assessment level will always be lowest bidder Security situation in EU will deteriorate overall the market stays as heterogeneous (and insecure) as it is now, but with a legal blessing

9 Making it work Ensure a level playing field Create implementing acts Reference mandatory international standards Ensure and enforce the same level of assessemt across the EU Promote rapid dissemination across all target groups Visible and mandatory offer by public sector Mandatory usecases (at least for business users and public sector), Modell Denmark Visibility for end user Involvement of entities that will disseminate information. Improve usage possibilities and create more incentives Reduce entry barriers (e.g. possibilities of identification) Subsidise usage

10 Questions????????

76135 Karlsruhe Germany Phone +49 721 91374-3973

11 Contact 1&1 D GmbH Leslie Romeo Ernst-Frey-Straße 10 Head of D & Trust Services Karlsruhe Germany Phone

12 THANK YOU FOR YOUR ATTENTION!

13 Backup

14 D = eidas! Overview of Functions: Protocol depending on sender client Interoperational protocol between service providers Protocol depending on recipient client Service Provider Sender Requirements of the transmission protocol between service providers Service Provider Recipient Sender Web browser -Client Plugin Solutions OSCI-Client Gateway Verification/ adding of meta data Integritiy protection on message level Encryption on message level Delivery receipt Delivery receipt Encryption Verification of meta data and Integrity Recipient Web browser -Client Plugin-Solution OSCI-Client Gateway Optional: End-to-end encryption

Certified Infrastructure in EU 1&1 IT infrastructure is certified according to the De-Mail standard (BSI and BfDI) and intents to be recognized as a qualified eidas trust service (process pending) by

Technical specifications of the De-Mail standard have already been introduced in international standardisation bodies.

procedures for the interoperability of systems operating according to the De-Mail standard with systems of other member states.

15 Certified Infrastructure in EU 1&1 IT infrastructure is certified according to the D standard (BSI and BfDI) and intents to be recognized as a qualified eidas trust service (process pending) by July, 1st. The infrastructure is based on widely used and recognized international standards in the environment (SMTP, S/MIME, SSL, etc.) and it is globally adaptable. Technical specifications of the D standard have already been introduced in international standardisation bodies. possible next steps to offer and implement eidas compliant qualified trustservices: Interoperability Scope Expansion / Scalability The SPOCS project, sponsored by the EU commission, has drawn up procedures for the interoperability of systems operating according to the D standard with systems of other member states. D based systems are an integrated part of the esense project in regards to the crossborder legally binding communication with France, Austria, Slovenia and Greece. The 1&1 infrastructure can thus be implemented as already certified cost-saving white label solution ( SAAS / managed / on premise ). Operating for EU memberstates as nationwide or distributed system.. Highly scalable (from 1-10 million users upwards).

16 Absicherungsübersicht Kurze, automatisierte und entschlüsselte Prüfung (Spam / Viren) im flüchtigen Speicher Kurze, automatisierte und entschlüsselte Prüfung (Spam / Viren) im flüchtigen Speicher D erstellen Verschlüsselte Ablage im Postfach Übermittlung über verschlüsseltem Kanal Verschlüsselte Ablage im Postfach Anzeige der D Sender D Dienste- anbieter Sender D Dienste- anbieter Empfänger Umgebung vom BSI nach ISO auf Basis IT-Grundschutz und durch BfDI nach Datenschutz Kriterienkatalog zertifiziert und unter ständiger Kontrolle Empfänger Zweistufige Anmeldung Zwei-Faktor- Authentifikatio n (Besitz/Wissen ) Vertrauliche Transportkanäle Integritätsschutz durch DKIM-Signatur Pentests Striktes Rollen-Berechtigungskonzept durchgänginges 4-Augen-Prinzip Redudante Systeme DMDA-DMDA-Kommunikation über SSL-Tunnel Dokumentenverschlüsselung Schutz vor SPAM, VIren und Maleware Vertrauliche Transportkanäle Integritätsschutz durch DKIM-Signatur Zweistufige Anmeldung Zwei-Faktor- Authentifikatio n (Besitz/Wissen ) Qualifizierte elektronische Signaturen Qualifiziert signierte Abhol-, Versand- und Eingangsbestätigung Algorithmen gemäß Vorgaben des BSI

De-Mail gut gestartet, aber noch kein Durchbruch Kabel Dt. 1% Arcor 3% Freenet 4% Yahoo 4% Google 7% Microsoft 8% T-Online 9% 1&1 5% AOL 4% GMX 27% WEB.DE 27% ca.

DMDAs) Situation De-Mail (07/2014): 70% aller privaten Mailnutzer werden durch akkreditierte DMDAs direkt erreicht und haben De-Mail auf einen Klick verfügbar. ca. 1 Mio.

17 D gut gestartet, aber noch kein Durchbruch Kabel Dt. 1% Arcor 3% Freenet 4% Yahoo 4% Google 7% Microsoft 8% T-Online 9% 1&1 5% AOL 4% GMX 27% WEB.DE 27% ca. 80% des Markts national verteilt ca. 70% D Potential auf einem Klick (akkr. DMDAs) Situation D (07/2014): 70% aller privaten Mailnutzer werden durch akkreditierte DMDAs direkt erreicht und haben D auf einen Klick verfügbar. ca. 1 Mio. Endnutzer verbindlich unter Vertrag (50% identifiziert) ca Unternehmen mit D Domain unter Vertrag Erleichterung der Ende-zu-Ende Verschlüsselung durch die Integration von PGP in D per Ende 2014 Nationale Anbieter mit rechtssicherer Lösung: Nationale Anbieter: US-Provider:

Ähnliche Dokumente

Elektronische Identifikation und Vertrauensdienste für Europa

Brüssel/Berlin Elektronische Identifikation und Vertrauensdienste für Europa Wir wären dann soweit --- oder? Thomas Walloschke Director EMEIA Security Technology Office eidas REGULATION No 910/2014 0 eidas