Providing Login and Wi-Fi Access Services With the eIDAS Network: A Practical Approach

The digital identity (or electronic identity) of a person is about being able to prove upon authentication who one is on the Internet, with a certain level of assurance, such as by means of some attributes obtained from a trustworthy Identity Provider. In Europe, the eIDAS Network allows the citizens to authenticate securely with their national credentials and to provide such personal attributes when getting access to Service Providers in a different European country. Although the eIDAS Network is more and more known, its integration with real operational services is still at an initial phase. This paper presents two eIDAS-enabled services, Login with eIDAS and Wi-Fi access with eIDAS , that we have designed, implemented, deployed, and validated at the Politecnico di Torino in Italy. The validation study involved several undergraduate students, who have run the above services with their authentication credentials and platforms and with minimal indications on their usage. The results indicate that the services were beneficial. Several advantages exist both for the users and for the Service Providers, such as resistance to some security attacks and the possibility to adopt the service without prior user registration ( e.g. for short meetings, or in public places). However, some students expressed doubts about exploiting their national eID for Wi-Fi access, mainly in connection with usability and privacy issues. We discuss also these concerns, along with advantages and disadvantages of the proposed services

Authorisation in Context: Incorporating Context-Sensitivity into an Access Control Framework

With sensitive information about ourselves now distributed across personal devices, people need to make access control decisions for different contexts of use. However, despite advances in improving the usability of access control for both developers and users, we still lack insights about how the intentions behind policy decisions in different contexts of use are shaped. In this paper, we describe how context was incorporated into an access control framework using a study of how context influences access control decision making. We describe how the main recommendations arising from this study were used to build context into a policy editor for this access control framework

ATEMA: An attribute enablement module for attribute retrieval and transfer through the eIDAS Network

The electronic identities for natural persons become increasingly important to build services both at national level or in cross-border scenarios. To efficiently and securely handle them, several European Union (EU) Member State countries have developed various electronic identity systems. The eIDAS Network (implementing the European eIDAS Regulation 910/2014) connects such systems in a unified Pan-European infrastructure to allow citizens’ access to cross-border services within EU with their national authentication credentials. While the eIDAS Network as well as the main actors involved (eIDAS-Nodes, Identity and Service Providers) are known, its integration with entities providing other citizen attributes to the eIDAS Network is still an open issue.We propose ATEMA, an attribute enablement module, which combines citizen authentication via eIDAS Network with the retrieval of additional citizen data from national Attribute Providers. ATEMA implements two different solutions exploiting different technologies and standards to support the user consent management and the authorization of the released data, like the OAuth 2.0 protocol. With a prototype implementation, we detail the two solutions and their integration with the Italian eIDAS-Node and with an Attribute Provider at Politecnico di Torino (Italy) providing academic attributes

Electronic Identification for Universities: Building Cross-Border Services Based on the eIDAS Infrastructure

The European Union (EU) Regulation 910/2014 on electronic IDentification, Authentication, and trust Services (eIDAS) for electronic transactions in the internal market went into effect on 29 September 2018, meaning that EU Member States are required to recognize the electronic identities issued in the countries that have notified their eID schemes. Technically speaking, a unified interoperability platform—named eIDAS infrastructure—has been set up to connect the EU countries’ national eID schemes to allow a person to authenticate in their home EU country when getting access to services provided by an eIDAS-enabled Service Provider (SP) in another EU country. The eIDAS infrastructure allows the transfer of authentication requests and responses back and forth between its nodes, transporting basic attributes about a person, e.g., name, surname, date of birth, and a so-called eIDAS identifier. However, to build new eIDAS-enabled services in specific domains, additional attributes are needed. We describe our approach to retrieve and transport new attributes through the eIDAS infrastructure, and we detail their exploitation in a selected set of academic services. First, we describe the definition and the support for the additional attributes in the eIDAS nodes. We then present a solution for their retrieval from our university. Finally, we detail the design, implementation, and installation of two eIDAS-enabled academic services at our university: the eRegistration in the Erasmus student exchange program and the Login facility with national eIDs on the university portal

On enabling additional natural person and domain-specific attributes in the eIDAS network

Within digital virtual space, secure and efficient user authentication and identification are essential to prevent identity theft and unauthorized access to sensitive information and services. The eIDAS network implementing the European (EU) Regulation 910/2014 links the electronic identity (eID) systems of EU countries to allow citizens to access services by authenticating with government eIDs. At authentication time, the eIDAS nodes transfer core personal attributes to the service providers (SPs), i.e. name, surname, date of birth, and an identifier. Since long-term applications require more personal or domain-specific data, e.g., to perform identity matching, the SPs must obtain them securely afterward in addition to the eIDAS attributes, with additional costs and risks. Herein, we extend the eIDAS network to retrieve and transfer additional person and domain-specific attributes besides the core ones. This process introduces technical, usability, and privacy issues that we analyze. We exploit a logical AP Connector acting between the eIDAS node and the local entities providing additional attributes. We implemented two AP Connectors, named AP-Proxy and AP-OAuth2, allowing the Italian pre-production eIDAS node to get additional attributes from the Politecnico di Torino university backend. In an experimental campaign, about 30 students have accessed academic services at three foreign universities with Italian eIDs and transferred additional attributes over the eIDAS network. Regardless of some usability and privacy concerns encountered, the user experience was positive. We believe our work is helpful in the implementation of the recently adopted European Digital Identity framework, which proposes to extend the person identification data set recognized cross border and the creation of digital wallets that link different data sets or credentials

Model-driven architectural risk analysis using architectural and contextualised attack patterns

contextualised attack pattern

Here’s Johnny: a Methodology for Developing Attacker Personas

Abstract—The adversarial element is an intrinsic part of the design of secure systems, but our assumptions about attackers and threat is often limited or stereotypical. Although there has been previous work on applying User-Centered Design on Persona development to build personas for possible attackers, such work is only speculative and fails to build upon recent research. This paper presents an approach for developing Attacker Personas which is both grounded and validated by structured data about attackers. We describe a case study example where the personas were developed and used to support the development of a Context of Use description for the EU FP7 webinos project. Keywords-Persona, Attacker, Toulmin Model, Attack Tree; I

Sensitivity of SARS-CoV-2 B.1.1.7 to mRNA vaccine-elicited antibodies

Transmission of SARS-CoV-2 is uncontrolled in many parts of the world; control is compounded in some areas by the higher transmission potential of the B.1.1.7 variant1, which has now been reported in 94 countries. It is unclear whether the response of the virus to vaccines against SARS-CoV-2 on the basis of the prototypic strain will be affected by the mutations found in B.1.1.7. Here we assess the immune responses of individuals after vaccination with the mRNA-based vaccine BNT162b22. We measured neutralizing antibody responses after the first and second immunizations using pseudoviruses that expressed the wild-type spike protein or a mutated spike protein that contained the eight amino acid changes found in the B.1.1.7 variant. The sera from individuals who received the vaccine exhibited a broad range of neutralizing titres against the wild-type pseudoviruses that were modestly reduced against the B.1.1.7 variant. This reduction was also evident in sera from some patients who had recovered from COVID-19. Decreased neutralization of the B.1.1.7 variant was also observed for monoclonal antibodies that target the N-terminal domain (9 out of 10) and the receptor-binding motif (5 out of 31), but not for monoclonal antibodies that recognize the receptor-binding domain that bind outside the receptor-binding motif. Introduction of the mutation that encodes the E484K substitution in the B.1.1.7 background to reflect a newly emerged variant of concern (VOC 202102/02) led to a more-substantial loss of neutralizing activity by vaccine-elicited antibodies and monoclonal antibodies (19 out of 31) compared with the loss of neutralizing activity conferred by the mutations in B.1.1.7 alone. The emergence of the E484K substitution in a B.1.1.7 background represents a threat to the efficacy of the BNT162b2 vaccine