Towards Stronger Data Security in an eID Management Infrastructure

Electronic identity (eID) is on everyone's lips as is increasingly used in various services nowadays. In Europe, the EU (European Union) Regulation N.910/2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS Regulation) has also created a legal structure for electronic identification, signatures, seals and documents throughout EU, so an intensive work is spent on putting it in practice. In this paper, we describe first the e-SENS (Electronic Simple European Networked Services) infrastructure, which is composed of (national) nodes set as part of the STORK 2.0 eID infrastructure and new nodes implementing the eIDAS specification. Since the e-SENS infrastructure uses the SAML (Security Assertion Markup Language) for authentication and attribute transfer, the data security is strongly related to SAML security. Moreover, it depends also on architecture complexity. We analyze two possible solutions for stronger data security in e-SENS: one is based on the exploitation of the SAML Holderof-Key web browser profile, while the other one exploits the encryption of the SAML tokens. We present details in adopting such solutions in e-SENS infrastructure and we discuss their pros and cons.