Presentation
Ubiqu
Implementation of EUDIW Assurance Level HighWe envision a world where digital identity is the cornerstone of a
thriving society, where people can securely and confidently
interact, access services, and contribute to the common good.
We believe that securing digital identity is the highest priority forenabling trust, privacy, and empowerment in the digital age.
We are committed to providing innovative and reliable solutions
for creating and verifying digital identities that are aligned withthe highest standards of security, ethics, and human rights.

EU regulation accelerates Qualified Trust Services from 2024
eIDAS 2.0 impacts, enriches and secures all digital interactions

1) Identity verification
ISSUERS2) Digital signatures3) Banking and Payments
Other:

Identity and Access management
Blockchain and Self-Sovereign Identity

WALLETSQUALIFIERS

Qualified Trust Services needs eIDAS high compliant wallets

eIDAS High “sole control”
requires a(hardware) security solutions
And identity proofing

Use cases requiring Qualified trust services and walletCreating a scalable solution means• Remote unattended issuing if a wallet and Identity
credentialMobile Wallet• Remote unattended identity proofing

What is a wallet

Source enisa: https://www.enisa.europa.eu/publications/digital-identity-standards/

Two Challenges for scale
1.Cryptographic components
2.linking a wallet to an
identity proofing event

Source enisa: https://www.enisa.europa.eu/publications/digital-identity-standards/

Cryptographic components
for mobile phones

Mobile Wallet

Source enisa: https://www.enisa.europa.eu/publications/digital-identity-standards/

hardware security elements: 5 options
Physical secure
elements

Local trust
environment

Secure software
solution

Cloud Hardware
security module

Secure, but complex
ecosystem, logistics andhigh cost

Lack features such as
recovery and introduces
serious vulnerabilities intime thus cannot provide
100% coverage.

Great UX, Feature rich andflexible and crypto agile,
but lacks security

Ubiquitous application, but
only for signing and stillneeds an authentication
solution(smart card, usb token,Embedded Secure element)(secure enclave, Trustzone, TEE)

(HSM, QSCD, eSeal, payload
signing systems)(wallet, DRM, encrypted
computation, obfuscation)

Mobile Wallet

Secure software solution
dependency on deviceplatform security
Cloud Hardware security module(HSM)
Only for signing

USB key
Smart card
NFC Recuired expensive
Local trust environment
No key management,
dependency on device
manufacturer andplatform security

Remote Secureelement from ubiqu Secure Unlimited
 Unhindered Ubiquitous(hardware) security elements : Option 1 - External
1. eIDAS 2.0 compliant
2. Scalable
3. User friendly
4. Robust- crypto agile
5. Independent
6. Fast Roll-out

Physical secureelements(smart card, usb token,
Embedded Secure element)

Secure, but complex
ecosystem, logistics andhigh cost

Mobile Wallet

USB key

Smart card
NFC Required

V?

XXVVlocal hardware elements : Option 2a TEE/ eSE
Local trustenvironment(secure enclave, Trustzone, TEE)

Lack features such as
recovery and introduces
serious vulnerabilities intime thus cannot provide
100% coverage.

Mobile Wallet

Local trust environment
No key management,dependency on device
manufacturer andplatform security

1. eIDAS 2.0 compliant
2. Scalable
3. User friendly
4. Robust- crypto agile
5. Independent
6. Fast Roll-out

XVVXXX

Current Apple, Samsung and Google only FIPS
Will take at least a decade to roll-out

Currently only IOS 13 and older newer in process

Currenty only Pixel phones

Currenty only one or two models

Hardware secure elements : Option 2b – SIM/eSIM/eSE
1. eIDAS 2.0 compliant
2. Scalable
3. User friendly
4. Robust- crypto agile
5. Independent
6. Fast Roll-out

Local trustenvironment(SIM, eSIM, eSE)

Complex eco-system.

Mobile Wallet

Local trust environment
No key management,dependency on device
manufacturer andplatform security

VVV?
X?

Option 3 – No hardware Whitebox crypto software
Secure softwaresolution(wallet, DRM, encrypted
computation, obfuscation)

Great UX, Feature rich andflexible and crypto agile,
but lacks security

Mobile Wallet

Secure software solution
dependency on device
platform security

1. eIDAS 2.0 compliant
2. Scalable
3. User friendly
4. Robust- crypto agile
5. Independent
6. Fast Roll-out

XVVVVVOption 4: Remote hardware security module (QES)
Cloud Hardware
security module(HSM, QSCD, eSeal, payload
signing systems)

Needs an authentication solutionUbiquitous application, but
only for signing and stillneeds an authenticationsolution

Mobile Wallet?

Cloud Hardware security module(HSM)
Only for signingRemote Secure Element – Cryptographic backend for wallets
Remote Secure
element from ubiqu••••SecureUnlimited
Unhindered
UbiquitousMobile Wallet

Secure software solution
dependency on device
platform security
Remote Secure elemens(HSM)
Key storage(Authentication and signing)

Local trust environment
No key management,
dependency on device
manufacturer andplatform security
16

1. eIDAS 2.0 compliant
2. Scalable
3. User friendly
4. Robust- crypto agile
5. Independent
6. Fast Roll-out

VVVVVVWhy does it work –Separation of “device key” from user “cryptographic keys”

Separation of “device key”

from user cryptographickeys

Device key protects user keys and vice- versa
Source GSMA: https://www.gsma.com/gsmaeurope/resources/architecture-considerations-for-eidas-2-0/
17

linking a wallet to an
identity proofing event
for mobile phones+Mobile Wallet

Source enisa: https://www.enisa.europa.eu/publications/digital-identity-standards/

ETSI TS 119 461 Use cases for identity proofing of natural person

1.Physical presence of the applicant
2.Attended remote
3.unattended remote
4.by authentication using eID means
5.using digital signature with certificate

Most Scalable

Linking a wallet to identity proofing event using “NFC + selfie”
to a wallet bu issuing a “identity” credential+

Mobile Wallet

All components:• NFC read of ICAO ID Document• Liveliness/biometric• Issuing of identity credential

must be part an integrated part of
the wallet and cannot be separate
services, from a security andlinkability point of viewSummary: Creating a scalable solution means• Remote unattended issuing if a wallet and Identity
credential
Mobile Wallet• Remote unattended identity proofing

At a minimum but also other options, for edge cases

What happens once e have rolled-out our scalable digital
identity?

Orchestration of attributes to Identities and wallets
Mobile base wallets: Physical to digital mobile transformation
Physical tokens have a secureelement
From physical tokens

A secure element is needed on
mobile phones, but all current
solution fall short
Digital wallet

Mobile Wallet

Introducing…
a remote secure element for any (mobile) device
For scale
Secured by a remote secure element

Mobile WalletGoal – Globally scalable digital identities and data
provenance
12345

TrustWallet

Digital Identity use(sign-in and sign)

Digital Trustflow

Digital Wallet(online and offline
attributes)

Uniquely link an action
to a person using the device
and the KYC event

Build better
digital systems
using data
provenance

Use Digital walletto play in any
context:
1. mDL 18013-5
2. ISO 23220
3. eIDAS
4. Open ID
5. PSD2/SCA/KYCEnter PINubiquIdentity verification

Digital Identity issuanceUniquely link a person
to a device,
the KYC event

Uniquely link a newaccountto a person using thedevice
and the previous KYC
eventubiqu

Real world Example: From identity to access
The opening of the door has provenance in the identity checking.

Staat derNederlanden

Identity
service

Authentication
service

Signing
servicePhysical accessservice

Door opens

Passpoort

RVIG database

Open IDJWT - RT, AT

Wallet andPID

OCSP/CRL

Offline Accesstickets

Signature on
Authorization

Time

Verifiable data registry

OCSP/CRLTimeReal world Example: Real estate transaction
PersonalWallet
Personal
WalletSign

Seller =? ownerBuyer√

Contract with buyer and seller signatures√EsealLand registry --> Owner

Eseal

Bank mortgage offer of proof of means

Personal
WalletAttribute service√

Value appraisal
Value appraiser
Value appraiser registry√√√

Introducing Data provenance - Zero trust for data and content
Zero trust for data and content

27

Secure connections

Federation

Zero trust for data

PKI

Zero trust

Trust in secured data

Create secure connections
using PKI, TLS, IPSEC, VPN
etc.

Trust another connections.
i.e SAML, Oauth, Kerberos.
Verify everything but
content and data.

Secure the provenance ofthe data, AI accelerated theneed for content and dataprovenanceIntroducing Data provenance
Data track and trace and audience management

Onboarding and Recovery

ID Verification(KYC) andissuing of wallets andCredentials to wallets

Issuer API’s

Transaction and Data integrity

Signing API

Qualified eSeal andelectronic attribute API

Verification API’sAudience management

Encryption API

Sharing API

Wallet SDKInfra structure: CA,OCSP, CRL, TSS, Remote Secure element etc.(products specific etsi 319 411-1/2 etc)

Platform for trustworthy systems (ETSI 319 401, ISO 27001/2)

28

Decryption API

Thank youCEOBoris Goranov

www: www.ubiqu.com
Email: boris@ubiqu.com
Tel:+31 642 521 605