Towards Cross-Border Authorization in European eID Federations

Identification, authentication, and authorization
are essential processes in various areas of applications, where
access to sensitive data needs to be protected and regulated.
To achieve this, usually identity-management systems are put
into place, where an identity provider manages digital identities
and handles the identification and authentication process for a
service provider, which hosts the protected data and regulates
access to this information. Due to increasing mobility of citizens
and cross-border public administration, interoperability across
the border of national electronic identity management systems
in the European eID landscape becomes more and more important.
While there were several European initiatives ongoing for
achieving cross-border identification and authentication in the
last couple of years, there was actually no initiative to enable
cross-border authorization in Europe. Hence, in this paper we
propose an advanced architectural design towards cross-border
authorization in Europe. This proposed solution extends the existing
cross-border eID federation implementations, which are
actually in place across Europe, to bring up also cross-border
authorization support into these European eID infrastructures.
The proposed architecture follows a modular and plug-in based
approach to ease the integration into various heterogeneous eID
infrastructures, which are actually deployed in European countries.
We illustrate the practical applicability of the proposed
architecture by implementing an Authorization Gateway for
the Austrian eID infrastructure. This Authorization Gateway
meets all national legal and technical requirements to transfer
authorization information across borders.