towards gdpr, eidas and psd2 as a service · smart card technology cloud services open source...
Post on 20-Jul-2020
5 Views
Preview:
TRANSCRIPT
© 2017 ecsec GmbH www.skidentity.com
Towards GDPR, eIDASand PSD2 as a Service
>> 1
Dr. Detlef Hühnlein, ecsec GmbH
© 2017 ecsec GmbH www.skidentity.com
Agenda
>> 2
Introduction
Background
– Strong Authentication in the Cloud
– GDPR
– eIDAS
– PSD2
Towards GDPRS, eIDAS and PSD2 as a Service
Summary
© 2017 ecsec GmbH www.skidentity.com
ecsec GmbH – competences
IT-Security Identity Management Electronic Signatures
Smart Card Technology Cloud Services Open Source
Security Management Mobile Solutions eGovernment
www.ecsec.de
>> 3
© 2017 ecsec GmbH www.skidentity.com
Agenda
>> 4
Introduction
Background
– Strong Authentication in the Cloud
– GDPR
– eIDAS
– PSD2
Towards GDPRS, eIDAS and PSD2 as a Service
Summary
© 2017 ecsec GmbH www.skidentity.com
Authentication in the Cloud
>> 5
IdP
SPClient
ISISISISISIS
…
© 2017 ecsec GmbH www.skidentity.com
Strong Authentication in the Cloud
>> 6
…
IdP
SPClient
ISISISISISIS
EAC (BSI-TR-03110)
C2C (EN 14890)
TLS (RFC 5246)
HOTP (RFC 4226)
…
FIDO U2F
© 2017 ecsec GmbH www.skidentity.com
Agenda
>> 7
Introduction
Background
– Strong Authentication in the Cloud
– GDPR
– eIDAS
– PSD2
Towards GDPR, eIDAS and PSD2 as a Service
Summary
© 2017 ecsec GmbH www.skidentity.com
General Data Protection Regulation (GDPR)
>> 8
Regulation (EU) 2016/679
aka „General Data Protection Regulation”
Entry into force on 25 May 2018
Various new, and sometimes challengingrequirements, with respect to data protection
© 2017 ecsec GmbH www.skidentity.com
GDPR at a Glance
>> 9
https://blog.skidentity.de/en/is-your-identity-management-ready-for-the-general-data-protection-regulation/
Fines up to20 Mio €(or 4% ofturnover)
Accountability
Consent
Data Export (e.g. XML,
JSON)
Privacy byDesign
State ofthe Art Security
© 2017 ecsec GmbH www.skidentity.com
Agenda
>> 10
Introduction
Background
– Strong Authentication in the Cloud
– GDPR
– eIDAS
– PSD2
Towards GDPR, eIDAS and PSD2 as a Service
Summary
© 2017 ecsec GmbH www.skidentity.com
eIDAS-Regulation
>> 11
Regulation (EU) 2014/910 on electronic identification (eID) and trust services for electronic transactions aka „eIDAS-Regulation”
In force since 17 September 2014
Mutual recognition of notified eID schemes
Legal framework for trust services for– electronic signatures and seals (generation and validation)
– certificates for signatures, seals and website-authentication
– time stamps
– new trust services for• validation
• preservation and
• electronic delivery
© 2017 ecsec GmbH www.skidentity.com
eIDAS-related Implementing Acts
>> 12
https://eid.as
© 2017 ecsec GmbH www.skidentity.com
eIDAS-Ecosystem
>> 13
https://blog.skidentity.de/en/eidas-ecosystem/
© 2017 ecsec GmbH www.skidentity.com
eIDAS-TSP-Map
>> 14
https://eid.as/tsp-map
© 2017 ecsec GmbH www.skidentity.com
Agenda
>> 15
Introduction
Background
– Strong Authentication in the Cloud
– GDPR
– eIDAS
– PSD2
Towards GDPR, eIDAS and PSD2 as a Service
Summary
© 2017 ecsec GmbH www.skidentity.com
Payment Services Directive 2 (PSD2)
>> 16
Directive (EU) 2015/2366 on payment servicesaka „Payment Services Directive 2“ (PSD2)
Requires Account Servicing Payment Service Providers (ASPSP) (e.g. Banks) to
– apply strong customer authentication (Art. 97)
– provide access to accounts (X2A) for other paymentservice providers such as
• Payment Initiation Service Provider (PISP) (Art. 66)
• Account Information Service Provider (AISP) (Art. 67)
• Payment Card Issuer (PCI) (Art. 65)
© 2017 ecsec GmbH www.skidentity.com
Outline of PSD2 System Architecture
>> 17
© 2017 ecsec GmbH www.skidentity.com
Agenda
>> 18
Introduction
Background
– Strong Authentication in the Cloud
– GDPR
– eIDAS
– PSD2
Towards GDPR, eIDAS and PSD2 as a Service
Summary
© 2017 ecsec GmbH www.skidentity.com >> 19
SkIDentity – GDPR, eIDAS and PSD2 as a Service
© 2017 ecsec GmbH www.skidentity.com
Supported eID and Authentication Means
>> 20
© 2017 ecsec GmbH www.skidentity.com >> 21
SkIDentity – Patented Authentication Technology
EN 2439900
© 2017 ecsec GmbH www.skidentity.com
Awards
22
Trusted Cloud Award 2011
EuroCloud Germany Award 2015
European Identity & Cloud Award 2015
EuroCloud Europe Award 2015
Landmark 2013/14 in the Land of Ideas
Landmark 2015 in the Land of Ideas
Bavarian Innovation Award 2016
© 2017 ecsec GmbH www.skidentity.com
Seals, Accreditations and Certifications
23
BSI TR-03124 Certificatefor Open eCard App 2015
since 2014
BVA Authorization Certificateaccording to § 21 PauswG
ISO 27001 based on BSI Baseline Protection
for „Secure Cloud Infrastructure (SkIDentity)“ (BSI-IGZ-250)
„Trusted Cloud Data Protection “ Certificatefor „SkIDentity-Service“
© 2017 ecsec GmbH www.skidentity.com
Agenda
>> 24
Introduction
Background
– Strong Authentication in the Cloud
– GDPR
– eIDAS
– PSD2
Towards GDPR, eIDAS and PSD2 as a Service
Summary
© 2017 ecsec GmbH www.skidentity.com
Summary
>> 25
GDPR imposes new requirements, which shouldbetter not be neglegted
eIDAS provides framework for eID and trustservices for electronic transactions
PSD2 is expected to redefine the relationshipbetween customers, banks and related serviceproviders throughout Europe
eID and 2FA is the intersection of GDPR, eIDAS and PSD2
SkIDentity provides GDPR, eIDASand PSD2 as a Service!
© 2017 ecsec GmbH
Contact
www.skidentity.com >> 26
Thank you very much foryour kind attention!
top related