# Digital Identity in the EU: Promoting eIDAS Solutions Based on Biometrics
## 3 European Electronic Authentication Regulation  
The EU does already have a regulation on electronic authentication systems (eIDAS--Regulation EU No. 910/2014 on digital identity), which was issued in 2014 but has been effective since 2016 [21]. The eIDAS (electronic IDentification Authentication and Signature)  
Figure 1: The two phases of a digital identity scheme.  
is a European framework that permits secure authentication with national credentials when accessing online services in any Member State (MS). The aim is to create a standard normative framework for trusted and secure online interactions between individuals, enterprises, and government agencies, as well as to improve the efficiency and security of online services and transactions within the European Union. The MS who wants to adhere to eIDAS must notify electronic identification (eID) schemes to the European Commission. Furthermore, if a MS wants to grant access to an online public service through an eID scheme, then it must also accept the notified schemes of other countries. The national eID schemes are interoperable thanks to the eIDAS Solution, which consists of a protocol designed to convert national identification data into a standard format that MSs can understand and use, as depicted in Figure 2.  
Under the eIDAS Regulation, eID schemes are classified according to three Levels of Assurance (LoA) corresponding to the degree of trust in a person's claimed identity during an electronic identification. This parameter is useful to compare identification procedures and authentication methods, based on security, robustness, and issuance process. The three LoA levels are the following:  
1. Low (L)--refers to identification means that ensure a limited security level regarding the declared identity of a person; it comprises procedures and technical methods to reduce the risk of violation or counterfeit of the identity; for example, the one-factor, which uses username a password belongs to this level.
2. Substantial (S)--refers to identification means that ensure a substantial security level regarding the claimed or declared identity of a person; it comprises procedures and technical methods to effectively reduce the risk of abuse or counterfeit of the identity; for example, two-factor authentication belongs to this level, which uses username-password combined with a one-time password (OTP).
3. High (H)--refers to identification means that ensure a higher security level regarding the claimed or declared identity of a person than the means used at the substantial level; it comprises procedures and technical methods to avoid the risk of abuse or counterfeit of the identity; an example is two-factor authentication combined with a secure device, which uses credentials, and public-key authentication based on a chip. In 2023, 22 MSs have notified 28 eID schemes under eIDAS (as reported in Table 1).  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Title of the Scheme** & **eID Means** & **Member State** & **LoA** & **Year** \\ \hline German eID based on Extended & National Identity Card, Electronic & Germany & H & 2017 \\ AccessControl & Residence Permit & & & \\ \hline SPID—Public System of Digital Identity &
\begin{tabular}{c} SPID eID means provided by \\ private providers \\ \end{tabular} & Italy & H-S-L & 2018 \\ Italian National ID card (CIE) & Carta di Identita Elettronica (CIE) & H & 2019 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Electronic identification schema notified by Member States under eIDAS framework.  
Figure 2: High-level overview of the eIDAS solution.