The European project Digital Europe for All (DE4A, www.de4a.eu) represents a research project in a close relationship to the European Single Digital Gateway Regulation (SDGR). It focusses on the research on “Trust” and “Semantics”, combined with three pilots. Austria (BMDW, BRZ) is involved in the project, mainly as piloting partner. The project pursues existing European results deriving from European initiatives and regulations, like CEF and eIDAS, as well as preceding European projects, like TOOP. The use of international open standards represents a prerequisite to the project. The broad approach of the project is highly demanding, but promises a significant progression to the realisation of the SDGR, overall the Once-Only principle (OOP) and the technical equivalent therefore, the Once-Only-Technical-System The European regulation SDGR represents a regulation, which defines a single IT-system for the exchange of evidences for a significant number of public procedures among all European member states. With the explicit promotion of the OOP it reaches far beyond the existing interoperability undertakings until this day. OOP (with OOTS) should be implemented in Europe by the end of 2023. The implementation of the SDGR requires the possibility of finding data in administrative registers and data sources across national borders; and of course mechanisms that make the data accessible and addressable. The quality assurance of the exchanged data is also particularly noteworthy, and this will be provided from the users directly, with an explicit acceptance of the exchanged data.
DE4A was launched in January 2020. The scientific goal is to develop in-depth research (and application) in two technical areas; the technical representation of trust (trust) and means for semantic interoperability. The project follows the technical approach to demonstrate the benefits of a secure and user-centric exchange of once-only data over standards-based distributed digital services. As a result, the implementation in real online procedures within the piloting Member States is aimed at in three pilot areas. New technology applications such as blockchain and machine learning methods are also considered for the technical developments. Austria is involved in the pilot area Doing Business Abroad and demonstrates the automated registration of European companies (in the pilot: Netherlands, Romania and Sweden) at the Austrian Business Service Portal (USP). The technical focus is on the implementation of the eIDAS identification of natural and legal persons (including representation) and the OOP for the use of data available in the countries involved in the pilot.
The specific challenges of the project lie in the fact that it accompanies a European regulation that is in an ongoing process to be technically shaped. In the contrary, the DE4A project faced the advantage that technical concepts already existed that could be adopted from previous projects, so technical applications such as the AS4-Gateway (for the Access Point, https://en.wikipedia.org/wiki/AS4) have been available and well known in European Interoperability undertakings since several years. The following section provide an overview on the main challenging areas of the project.
DE4A project introduced three variants of (initial) diferent architecture patterns to be piloted 1: 1 Intermediation Pattern: Used in the Doing Business Abroad pilot; all user-centric processes take place on the data consumer side (in SDGR terminology: data requester, DR); 2 User Supported Intermediation Pattern: Used in both the Moving Abroad and Studying Abroad pilots; most user-centric processes take place on the data consumer side, however the preview business process takes place on the data provider side (in SDGR terminology: Data Provider, DP), which requires a handover of the user from DR to DP (and then back again); and 3 Verifiable Credential Pattern: Used in the Studying Abroad pilot, here the exchange of data/evidence is dealt with in a very user-centric manner via the exchange of secure attributes and using blockchain technology. The introduction and availability of these three initial patterns in the DE4A project became a significant influence factor for the development of OOTS and the regarding discussions on the ist definition on European level.
The semantic research focus in DE4A deals with several technical concepts that enable structured data exchange 2. The DE4A semantic framework comprises three main areas: 1 an Information Exchange Model (IEM); 2 the Technical Information Desk (IDK) and 3 the pilot-specific ontologies . The IEM provides the specification of the message format that is exchanged between the competent authorities; it is independent of the technical implementation and specifically designed 1DE4A: Deliverable 2.4 - Project Start Architecture (PSA), first iteration 2DE4A: Deliverable 3.3 - Semantic Framework – Initial version for the respective pilot requirements and the underlying architecture. The IEM also takes into account existing concepts such as TOOP EDM and other national models. The IDK provides information for the DR and the DP that is required for a smooth cross-border exchange of data/evidence within the framework of DE4A. The IDK consists of the following core components: 1 a service that supports the DR in finding the issuing authority that can provide the necessary data/evidence in a specific country (Issuing Authority Locator); 2 a service that assists the DR in locating the organisation to obtain data/evidence from a specific issuing authority; 3 an ontology repository to understand the meaning of canonical proof of attributes; and 4 a component for the preview, which gives the user the data/evidence for release for further use in the public procedure or process for which he/she needs the data/evidence. In addition, data models are developed through the ontologies, which are available for the domain-specific information needs of the DE4A pilots. They were defined as the maximum set of concepts and attributes, so that the specific necessary data models for the individual pilot applications can result from them.
The trust research in DE4A aims to create a general picture of a valid trust framework. It focuses on specifications from various regulatory frameworks, such as eIDAS or SDGR 3. National technical concepts have shown that there is a heterogeneous landscape of trust models. With regard to eIDAS, there is an overlap between national strategies and the illustrations at European level; nonetheless, a high degree of implementation of eIDAS are of great importance for the implementation of the OOTS, both in E-ID and in the Trust Services. Also, the trust models of the CEF Building Blocks (Connecting European Facilities) are given specific consideration. In this regard, CEF eID and CEF eDelivery, both applications with delegated trust models that are relevant for DE4A, since both have nodes that serve as trustworthy proxies in the member states; whereby the national systems involved request or provide the data with these central endpoints serving as trust systems. In order to create trust in CEF eDelivery, it is necessary that the digital certificates can be exchanged across systems as a trust anchor to create the necessary confidentiality, integrity and non-repudiation of the data. After these investigation, an introduction of a Dedicated Domain PKI 4 for DE4A was suggested from several implementation variants. Finally, a blockchain-supported solution is analysed in order to validate the possibility of using this technological approach in relation to trust. Blockchain is used to implement the ”Verifiable Credentials” pattern. In this regard, a generic blockchain approach is preferred to ensure broad utilization and to facilitate usability.
DE4A exhibits three pilot areas, with each two iterations. The three pilot areas are: 1 Doing Business Abroad: The pilot aims to reduce the administrative burden for a company to start doing business in another EU Member State. First, a representative of a company is identified 3DE4A: Deliverable 2.2 - Initial DE4A Trust Management Models and Blockchain Support Framework 4On dedicated Domain PKI: “the digital certificates are associated to single trust anchors, and each trust anchor serves a single domain.” - DE4A: Deliverable 2.2, Page 16 via eIDAS and the right of representation is determined. Using OOP, additional data about the company is exchanged across borders, which shortens the time for a - fully online - registration in an e-government portal in the respective country; 2 Studying Abroad: Mobility in education is very important in Europe and has been formalised in EU programmes, e.g. ERASMUS. This pilot area supports users through the digital provision of study documents according to the OOP. The regarding use cases will show how the administrative burden can be reduced by reusing data/evidence, increasing the security and the use of electronic identities; and 3 Moving Abroad: This pilot area aims to support EU citizens who are moving within EU by creating a digitised process for OOP data/evidence exchange required for moving across borders. In this area, also three diferent use cases are defined.
In the following chapter two aspects of the Austrian pilot in DE4A will be introduced, the functional and the technical aspects.
The Austrian partners are involved in the pilot area Doing Business Abroad. Functionally it is about the registration of a foreign company in USP using OOP. According to the Intermediation Pattern, all user interactions in the OOP process - incl. explicit request, preview - take place on the DR side. The complexity not only lies in the implementation of the OOP processes and the national digital procedural processes, but first and foremost in the integration of a representation regulation (person →company) in the identification process via eIDAS. This extension will be integrated and demonstrated in the respective national eIDAS application. For the second iteration in the DBA pilot, it is planned to expand this function in the Austrian pilot by integrating the SEMPER functionalities 5 - i.e. a refinement of the content of the representation rights (”finegrained” electronic powers of representation and mandates). Subsequently, the entries in the Austrian registers ERnP (Supplementary Register for Natural Persons) and ERsB (Supplementary Register for Non-Natural Persons) take place on the basis of the eIDAS identification. Through the integrated OOP process, additional data (attributes) of the company from the respective member state are queried and transmitted. This additional data is added to the eIDAS data (minimal data sets for natural/non-natural persons) when it is entered in the respective register. Finally, the registration takes place in the USP, whereupon the identification features (IDs) from the above mentioned registers are used. To date, the registration process for using the USP for foreign companies involves manual processes; copies of documents on the entities and representation are sent by e-mail and professionally acknowledged. In this regard, online identification/authentication is not planned to date. This is where the first innovation by the DE4A pilot comes in, namely in the eIDAS identification including the power of representation. Further, the implementation of the OOP processes (additional company data) according to 5https://graz.pure.elsevier.com/en/projects/eu-semper-crossborder-semantic-interoperability-of-powers-and-man or https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-eu-ia-0032 the evidence model are introduced. Furthermore, the mechanisms of the explicit request and preview according to SDGR are also implemented and piloted.
In order to enable the technical implementation within the Austrian infrastructure, the authentication via eIDAS Test Node was implemented. eIDAS eID defines that an authentication request contains those attributes of a natural or legal subject (the person who is primarily concerned in this registration process) that the requesting authority would like to have. These are additionally marked per attribute with ”isRequired=true/false”, whereby the eIDAS specification partly defines how the ”isRequired” flag is to be set (must be ’true’ for “Minimum Data Set” [MDS] attributes). In the case of representations, the information about the represented person is transferred in these requested attributes and additional attributes are attached which contain information about the representative. In sum, a response can contain a maximum of two identities, namely the represented natural or legal person and the representative. The MDS attributes for a legal entity and a natural person in the authentication request is required, which must be set with ”isRequired=true” according to the eIDAS specification. In the first stage of the implementation, this validation was bypassed by setting the attributes of the natural subject (which actually does not exist) when a legal subject is represented, whereby the information about the representative is transmitted a second time in addition to the representative attributes - a measure necessary to ensure eIDAS compatibility across diferent partners and their status of notification. According to specification three MDS data of three identities are contained (legal subject, natural subject, natural representative). Up to and including version 2.4 of the eIDAS Node, there was no check in the eIDAS Node whether more than two identities were contained in the response. However, this check was introduced with version 2.5, and will be available in the second phase of project iteration. After successful authentication via eIDAS the pilot foresees the registration process following national procedures according to specific portal and register requirements. In the case of the USP and the Austrian registers, the data set requested via eIDAS is stored in the register for natural persons and a unique identifier is assigned. Later this identifier is used to enrich the the minimal data set with additional data concerning the powers each natural person has according to their domestic register.
The use of knowledge and technical developments from EU projects has already turned out to be an important element for e-government implementations, as experience has shown on a number of occasions; this applies all the more if the projects represent a distributed technical system across Europe (OOTS of the SDG) and are also based on the obligation of legal requirements (the SDGR). From the research-oriented results, as well as from the findings from the pilot application, the following advantages for the partners, and thus for Austria, can be expected from DE4A: 1 In DE4A, the pilots are near the real eGovernment solutions, so these can be used as a blueprint for further national interoperability measures (also with Europe connection); 2 the architectural concepts and developments in DE4A produce concrete functions/components/systems that can represent important consideration elements for the subsequent implementation of the SDGR in Austria; 3 the research results from Semantics and Trust will influence the preparations of respective concepts in Austria; 4 the Austrian pilot specific achievements in DE4A will pave the way to the technical SDGR realisation, and moreover, it will also provide technical artefacts, which will be useable as such, and 5 the exchange with experts on all aspects of architecture development, component development and pilot implementation has a positive impact on the technical (and organizational) implementation of the OOP for SDG in Austria.
DE4A has received funding from the European Union’s Horizon 2020 research and innovation program, under G.A. No. 870635