On 23 July 2014, the European Union established eIDAS (electronic IDentification, Authentication and trust Services) that regulates electronic transactions, electronic signatures, involved bodies, and their embedded processes. Having taken effect on 1 July 2016, eIDAS provides a safe way for users to perform actions such as electronic funds transfers or transactions with government agencies.
eIDAS created standards for trust services to ensure that digital identities, including those for humans remain secure with the presumption of integrity, and are exclusively linked to the individual, entity, or machine through cryptographic protections. Such strict eIDAS standards require the security that hardware security modules (HSMs) offer. Here we will examine the role that HSMs play in securing digital identities for humans.
Digital Identity with eIDAS
One of the greatest things to come out of eIDAS is it has provided the means to facilitate secure and seamless electronic transactions across EU member state borders and ideally with non-EU countries. A digital identity opens the door for a person with an officially authenticated identity to conduct business electronically, including signing legal or financial documents. However, this means first securing an electronic identification.
As defined under eIDAS, an “electronic identification'' means the process of using person identification data in electronic form uniquely representing either a natural or legal person, or a natural person representing a legal person.
For an electronic identification to be performed, the process of authentication. According to eIDAS, this is “an electronic process that enables the electronic identification of a natural or legal person, or the origin and integrity of data in electronic form to be confirmed.” This process is performed through a trust service provider (TSP). A TSP is an entity that provides and preserves digital certificates that are used to authenticate digital identities.
Role of HSMs with Digital Identity
The Common Criteria Protection Profile – Cryptographic Module for Trust Service Providers outlines the security requirements that TSPs must follow with their authentications services under eIDAS. A cryptographic module, such as an HSM is required to generate and/or protect the secret keys and other sensitive data and control the use of such data for one or more cryptographic services to support TSP trust services.
An HSM that is Common Criteria-certified according to the eIDAS Protection Profile (PP) EN 419 221-5 “Cryptographic Module for Trust Services” allows trust service providers to be in compliance with the policy and its security requirements. Such HSMs:
- Have key authorization functionalities that are suited for eIDAS-compliant issuance of qualified certificates.
- Provide protection to keep cryptographic material protected and hidden at all times.
- Run on a secure operating system.
- Are resistant to hacking attempts because they are built with specialized and secure hardware.
- Have limited access through a strictly-controlled network interface.
- Offer an additional layer of security by storing decryption keys separately from encrypted data to ensure that if a data breach does occur, the encrypted data is kept secured.
- Strengthen cryptographic encryption practices throughout the entire key lifecycle from generation to storage to distribution to disposal.
Utimaco HSMs are certified under eIDAS standards in order to achieve higher levels of data security and trust whilst also maintaining high service levels and business agility. They provide a scalable and FIPS-compliant compliant hardware solution for secure key storage and processing inside the boundary of the HSM.
Further reading:
The European Digital Identity Trust Framework & Qualified Trust Services
