Electronic identification (eID): The basis for trustworthy communication

The aim of electronic identification systems in accordance with eIDAS is to considerably simplify identification for the cross-border processing of administrative services at European level. Companies also benefit from these eID systems, as they can be used in the corporate environment. This saves time and effort and facilitates communication with customers, among other things. Electronic identification systems have already been introduced in numerous member states (such as the online ID function of the ID card in Germany).

The eIDAS Regulation provides for harmonisation of the various national eID systems at a (security) technical level. The regulation aims to establish interoperability between the systems. This is ensured by a voluntary notification procedure of the European Commission, in which member states can have their national systems notified. The eIDAS Regulation regulates the legal framework for mutual recognition. It distinguishes between three levels of assurance: "low", "substantial" and "high".

Notified eID systems are recognised across borders and enable access to national administrative services both for citizens of the member state and for EU citizens of other member states. To this end, the notified eID system used must have an equal or higher level of security than that required for the administrative service.

These three levels describe the confidence in the accuracy of a person's identification in the digital space.

• Low: Low requirements for identity verification - suitable for low-risk applications.
• Substantial: Extended verification with stronger protection of the transmitted data - e.g. through two-factor authentication.
• High: Highest requirements - e.g. through personal verification or official ID documents. This level is required for particularly sensitive administrative or business processes.

The security level depends on the protection requirements of the respective application. The more sensitive the data or legal implications of a process are, the higher the security level should be. The selection is made taking into account risks, legal requirements and user groups. A GAP analysis can help to validate the desired level and define specific measures to achieve the target.

The requirements for technical, organisational and legal measures increase depending on the level of assurance:

• At a low level, simple authentication without proof of identity is usually sufficient.
• At a substantial level, additional verification mechanisms, such as identity documents or digital proof, must be used.
• The high level requires proof of a government-issued identity document, encrypted communication, logging and, if necessary, manual verification processes.

Identification refers to the initial establishment of a person's identity, for example through identification documents. Authentication is the repeated verification of this identity, for example using passwords, biometric features or two-factor procedures.

Data used for electronic identification is predominantly personal and is therefore subject to strict data protection regulations in accordance with the GDPR and eIDAS.

The duration depends heavily on the preparation of the provider - with preliminary analyses, GAP analyses and documentation, periods of between 3 and 9 months are common.

Certification bodies such as TÜV NORD carry out the tests on the basis of the eIDAS specifications and relevant standards such as ETSI or BSI.