Skip to content

Commit

Permalink
IS-216
Browse files Browse the repository at this point in the history
  • Loading branch information
@martin-lindstrom
martin-lindstrom committed Nov 22, 2024
1 parent 2ee9b7c commit 8748a7f
Showing 1 changed file with 39 additions and 47 deletions.
86 changes: 39 additions & 47 deletions Identity_Binding.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Binding of eIDAS Identities to Records in the Swedish Population Register</title>
<title>Binding eIDAS Identities to Records in the Swedish Population Register</title>
<link type="text/css" rel="stylesheet" href="assets/css/github-markdown.css">
<link type="text/css" rel="stylesheet" href="assets/css/pilcrow.css">
<link type="text/css" rel="stylesheet" href="assets/css/eln-portrait.css" media="print" >
Expand All @@ -18,12 +18,12 @@
<img align="center" src="img/transparent.png"></img>
</p>

<h1 id="binding-of-eidas-identities-to-records-in-the-swedish-population-register">Binding of eIDAS Identities to Records in the Swedish Population Register</h1>
<h3 id="2024-05-08">2024-05-08</h3>
<p>This document contains information about the processes that bind a Swedish identification number to an eIDAS notified eID.</p>
<h1 id="binding-eidas-identities-to-records-in-the-swedish-population-register">Binding eIDAS Identities to Records in the Swedish Population Register</h1>
<h3 id="2024-11-22">2024-11-22</h3>
<p>This document outlines the process for binding an eIDAS-notified electronic identity (eID) to an individual&#39;s personal identification number in the Swedish Population Register.</p>
<hr>
<p class="copyright-statement">
Copyright &copy; <a href="https://www.digg.se">The Swedish Agency for Digital Government (DIGG)</a>,
Copyright &copy; <a href="https://www.digg.se">The Swedish Agency for Digital Government (Digg)</a>,
2023-2024. All Rights Reserved.
</p>

Expand All @@ -37,82 +37,74 @@ <h2 id="table-of-contents">Table of Contents</h2>
</li>
<li><p><a href="#identity-binding-processes"><strong>Identity Binding Processes</strong></a></p>
<p> 3.1. <a href="#population-register">Unique Record in the Population Register</a></p>
<p> 3.2. <a href="#nordic-id">Nordic Identification Number Corresponding to Population Register Record</a></p>
<p> 3.3. <a href="#user-with-swedish-eid">Use of Swedish eID</a></p>
<p> 3.4. <a href="#confirmed-by-relative">Relative Confirms Binding</a></p>
<p> 3.2. <a href="#user-with-swedish-eid">Use of Swedish eID</a></p>
</li>
<li><p><a href="#versions"><strong>Versions</strong></a></p>
</li>
</ol>
<p><a name="introduction"></a></p>
<h2 id="1-introduction">1. Introduction</h2>
<p>In Sweden, public relying parties commonly utilize the Swedish personal identity number (a.k.a. personnummer) or the Swedish coordination number (a.k.a. samordningsnummer) as the primary identifier for authorizing authenticated users. However, these identifiers are not part of an eIDAS assertion and can&#39;t be received from another country, even if the user holds such as Swedish identity number.</p>
<p>By utilizing the Sweden Connect Identity Binding Service, end-users can associate their eIDAS eID with their record in the Swedish population register. This process enables end-users to access a broader range of Swedish digital services. </p>
<p>In Sweden, public relying parties frequently use the Swedish personal identity number (a.k.a. personnummer) or the Swedish coordination number (a.k.a. samordningsnummer) as the primary identifier for authorizing authenticated users. However, these identifiers are not included in eIDAS assertions and can not be received from another country, even if the user holds such as Swedish identity number.</p>
<p>By utilizing the Sweden Connect Identity Binding Service, users can bind their eIDAS eID to their record in the Swedish population register. This process is aimed at supporting users to access a broader range of Swedish digital services, enhancing cross-border digital interactions.</p>
<p><a name="the-identity-binding-service"></a></p>
<h2 id="2-the-identity-binding-service">2. The Identity Binding Service</h2>
<p>The Identity Binding Service is a part of the Swedish eIDAS infrastructure. It supports users with eIDAS-notified eIDs by facilitating binding processes, allowing them to link their eID to a record in the Swedish population register.</p>
<p>Once records are successfully associated to the user&#39;s eID, this identity binding can be leveraged by the Swedish eIDAS node when an end-user attempts to log in to a Swedish digital service using their foreign eID. The resulting assertion provided to the relying party includes attributes from eIDAS, as well as attributes
from the Identity Binding Service.</p>
<p>The Identity Binding Service can be used by end-users, who are authenticated through eIDAS under specific conditions:</p>
<p>The Identity Binding Service is a part of the Swedish eIDAS infrastructure. It supports users with eIDAS-notified eID:s to bind their eID to a record in the Swedish population register.</p>
<p>Once the binding is successfully completed, the Swedish eIDAS node can deliver this association when the user logs in to a Swedish digital service using their foreign eID. The assertion provided to the relying party includes both attributes from eIDAS eID and the Identity Binding Service.</p>
<p>To use the Identity Binding Service, the following conditions must be met:</p>
<ul class="list">
<li>The end-user must have a registered record in terms of Swedish personal identity number (a.k.a. personnummer) or Swedish coordination number (a.k.a. samordningsnummer) in the Swedish population register.</li>
<li>The end-user must opt to associate this record to his or hers eIDAS notified eID.</li>
<li><p>The ser must have a registered record in the Swedish Population Register, either as a Swedish personal identity number (a.k.a. personnummer) or Swedish coordination number (a.k.a. samordningsnummer).</p>
</li>
<li><p>The user must choose to bind this record to his or hers eIDAS-notified eID.</p>
</li>
</ul>
<p>Once an end-user&#39;s Swedish record is linked to hir or her foreing eID, the Swedish eIDAS node can include this information in the assertion provided to the relying party.</p>
<p>Once a user&#39;s Swedish record is bound to their foreign eID, the Swedish eIDAS node can include this information in assertions provided to Swedish relying parties.</p>
<p><a name="making-a-binding"></a></p>
<h3 id="21-making-a-binding">2.1. Making a Binding</h3>
<p>A user can make an identity binding through various <a href="#identity-binding-processes">Identity Binding Processes</a>. These processes are run independently or in combination, aimed at achieving a clear and unambiguous identity binding.</p>
<p><a name="eidas-node-queries"></a></p>
<h3 id="22-eidas-node-queries">2.2. eIDAS-node Queries</h3>
<p>The identity bindings that are created and stored by the end-user in a private area of the Identity Binding service can be accessible from the Swedish eIDAS node through a query API. </p>
<p>During a process of eIDAS authentication, the Swedish eIDAS node will use this API to check for a binding between the attributes presented in the assertion received from the eIDAS node outside Sweden. If such a binding exists, two attributes will be included in the resulting assertion provided to the Swedish relying
party (service provider). These attributes are:</p>
<p>The identity bindings created by the user are stored in a private storage area. This private area is accessible only to the user and, with explicit user consent, to the Swedish eIDAS node through a protected query API.</p>
<p>During the eIDAS authentication process, the Swedish eIDAS node will, with the user&#39;s consent, use this API to check for a binding between the attributes presented in the assertion received from another member state&#39;s eIDAS node. If such a binding exists, an attribute set will be included in the resulting assertion provided to the Swedish relying party (service provider). These attribute set includes the following attributes:</p>
<ul class="list">
<li><p><code>urn:oid:1.2.752.201.3.16</code> (mappedPersonalIdentityNumber) - Contains the Swedish
personal identity number that is associated to the eIDAS identity.</p>
<li><p><code>urn:oid:1.2.752.201.3.16</code> (mappedPersonalIdentityNumber) - Contains the Swedish personal identity number that is associated to the eIDAS identity.</p>
</li>
<li><p><code>urn:oid:1.2.752.201.3.6</code> (personalIdentityNumberBinding) - Contains URI:s that represents the <a href="#identity-binding-processes">Identity Binding Processes</a>.</p>
</li>
</ul>
<p>See also sections 2.5, &quot;eIDAS Natural Person Attribute Set&quot;, and 3.3.2, &quot;The mappedPersonalIdentityNumber and personalIdentityNumberBinding Attributes&quot;, of <a href="https://docs.swedenconnect.se/technical-framework/updates/04_-_Attribute_Specification_for_the_Swedish_eID_Framework.html">Attribute Specification for the Swedish eID Framework</a> for more information about attribute release during an eIDAS authentication.</p>
<p><a name="identity-binding-processes"></a></p>
<h2 id="3-identity-binding-processes">3. Identity Binding Processes</h2>
<p>This section contains a detailed description of the matching processes that are used by the Identity Binding Service. Each process is identified with an URI.</p>
<p>The prerequisites for all bindings described below are the following: The end-user has been authenticated using a foreign eID. Attributes provided via eIDAS, along with the end-user&#39;s statement of her/his Swedish identity number, meet the prerequisites for user registration. This verification includes:</p>
<p>This section contains a detailed description of the binding processes that are used by the Identity Binding Service. Each process is identified with an URI.</p>
<p>To perform the identity binding process, a user must meet the following requirements:</p>
<ul class="list">
<li><p>The user must be authenticated using an eIDAS eID at an assurance level of Substantial or High.</p>
</li>
<li><p>The combination of attributes from the eIDAS assertion and the data returned from the Swedish Population Register, based on the user&#39;s declaration of their Swedish identity number, must meet the following criteria:</p>
<ul class="list">
<li>confirming the record in the Swedish population register,</li>
<li>ensuring it belongs to a living natural person,</li>
<li>validating that attribute values from eIDAS assertion correspond to the date of birth and names registered in the record. </li>
<li>The record in the Swedish Population Register must exist,</li>
<li>the record must belong to living natural person, and,</li>
<li>the attribute values from eIDAS assertion must correspond with the date of birth and names registered in the record.</li>
</ul>
</li>
<li><p>The user must accept the terms of use and consent to creation of a private storage area that belongs to the user.</p>
</li>
</ul>
<p>Moreover, the end-user has accepted the terms of use and created a private storage in the Identity Binding Service.</p>
<p><strong>Note:</strong> If the above steps uniquely corresponds to exactly one record in the Swedish population register, the binding <code>http://id.swedenconnect.se/id-binding/process/populationregister</code> (<a href="#population-register">3.1</a>) will be created, but, if the birth date and name information from the eIDAS assertion matches more than one record from the population register, other processes (as described below) need to be applied for a binding to be completed.</p>
<p><a name="population-register"></a></p>
<h3 id="31-unique-record-in-the-population-register">3.1. Unique Record in the Population Register</h3>
<p><strong>URI:</strong> <code>http://id.swedenconnect.se/id-binding/process/populationregister</code></p>
<p><strong>Description:</strong> The provided date of birth and name information from the eIDAS assertion uniquely matches only one record in the population register. </p>
<p>A detailed search in the population register confirms that there is a low risk of confusion, with no other records found that could potentially lead to ambiguity. The end-user holds a
machine-readable copy of the record retrieved from the Swedish population register. It is stored in the user&#39;s private storage and can be securely bound to end-user&#39;s eID in an unambiguous manner.</p>
<p><a name="nordic-id"></a></p>
<h3 id="32-nordic-identification-number-corresponding-to-population-register-record">3.2. Nordic Identification Number Corresponding to Population Register Record</h3>
<p><strong>URI:</strong> <code>http://id.swedenconnect.se/id-binding/process/nordicid</code></p>
<p><strong>Description:</strong> The end-user holds a machine-readable copy of the record retrieved from the Swedish population register. This record includes an identification number from a Nordic country, which corresponds to the number found in the eIDAS assertion.</p>
<p><strong>Description:</strong> The provided date of birth and name information from the eIDAS assertion uniquely matches one, and exactly one, record in the population register. </p>
<p>A detailed search in the population register confirms that there is a low risk of confusion, with no other records found that could potentially lead to ambiguity. The end-user holds a machine-readable copy of the record retrieved from the Swedish population register. It is stored in the user&#39;s private storage and can be securely bound to user&#39;s eID in an unambiguous manner.</p>
<p><a name="user-with-swedish-eid"></a></p>
<h3 id="33-use-of-swedish-eid">3.3. Use of Swedish eID</h3>
<h3 id="32-use-of-swedish-eid">3.2. Use of Swedish eID</h3>
<p><strong>URI:</strong> <code>http://id.swedenconnect.se/id-binding/process/swedish-eid</code></p>
<p><strong>Description:</strong> The end-user has digitally signed an attestation connecting an eIDAS identity number to a record retrieved from the Swedish population register using a Swedish eID. Using this process the user proves the he or she holds both the eIDAS identity (received from the eIDAS authentication) and the Swedish identity number (received from the digital signature).</p>
<p><strong>Additional requirements:</strong> Assurance level for the eID must be minimum at level 3 in accordance of the
<a href="https://www.digg.se/digitala-tjanster/e-legitimering/tillitsnivaer-for-e-legitimering/tillitsramverk-for-svensk-e-legitimation">Swedish Trust Framework</a>
(a.k.a. <a href="https://www.digg.se/digitala-tjanster/e-legitimering/tillitsnivaer-for-e-legitimering/tillitsramverk-for-svensk-e-legitimation">Tillitsramverk för Svensk e-legitimation</a>).
Using the eID for this purpose must also be approved by the eID provider.</p>
<p><a name="confirmed-by-relative"></a></p>
<h3 id="34-relative-confirms-binding">3.4. Relative Confirms Binding</h3>
<p><strong>URI:</strong> <code>http://id.swedenconnect.se/id-binding/process/relative</code></p>
<p><strong>Description:</strong> A relative of the end-user logs in to the Identity Binding Service and vouches for the end-user to retrieve a machine-readable copy of the record from the Swedish population register. The relative digitally signs this attestation.</p>
<p>The relationship must be officially registered in the Swedish population register, and valid examples of such relationships include spouses, parents, and children.</p>
<p><strong>Additional requirements:</strong> The relative must be at least 18 years old and use an eID that meets the same requirements as in section <a href="#user-with-swedish-eid">3.3</a> above.</p>
<p><strong>Description:</strong> The user has digitally signed an attestation connecting an eIDAS identity number to a record retrieved from the Swedish population register using a Swedish eID. Using this process the user proves the he or she holds both the eIDAS identity (received from the eIDAS-notified eID) and the Swedish identity number (received from the digital signature).</p>
<p><strong>Additional requirements:</strong> Assurance level for the Swedish eID must be minimum at level 3 in accordance of the <a href="https://www.digg.se/digitala-tjanster/e-legitimering/tillitsnivaer-for-e-legitimering/tillitsramverk-for-svensk-e-legitimation">Swedish Trust Framework</a> (a.k.a. <a href="https://www.digg.se/digitala-tjanster/e-legitimering/tillitsnivaer-for-e-legitimering/tillitsramverk-for-svensk-e-legitimation">Tillitsramverk för Svensk e-legitimation</a>). Using the eID for this purpose must also be approved by the eID provider.</p>
<p><a name="versions"></a></p>
<h2 id="4-versions">4. Versions</h2>
<ul class="list">
<li><p>2024-11-22: Updated version where the bindings for Nordic eID:s and relative confirmation were removed due to legal reasons.</p>
</li>
<li><p>2024-05-08: Updated according to the latest legal agreements. The binding level is no longer used. Instead a set of identity binding process URL:s represent the binding.</p>
</li>
<li><p>2023-06-09: First version.</p>
Expand Down

0 comments on commit 8748a7f

Please sign in to comment.