# The eIDAS Regulation: A Survey of Technological Trends for European Electronic Identity Schemes
## 2 Methodology
### Research Questions  
Regulation 1501/2015 [2; 7] sets out the technical and operational requirements for the eIDAS European interoperability framework. Note that the documents mentioned above only highlight the technical requirements without providing technical details on how to fulfill these requirements. This work aims to cover this gap by looking into the adopted technologies by the eID schemes. An eID scheme, or more precisely, its related eID means, is used for authenticating citizens in online services. As defined in the NIST Special Publication 800-63 [8], authentication is the process of \"verifying the identity of a user, process, or device, often as a prerequisite to allowing a system's resource\". eID schemes follow authentication protocols to perform the user authentication. The authentication protocols specify how the entities involved exchange messages and establish that a person attempting to access an online service has possession and is in control of one or more valid authenticators (typically a cryptographic module or password). Every authenticator can attest to one or more authentication factors (something you know, something you have, and something you are). The strength of an authentication process is characterized by an ordinal measurement known as authentication assurance level (or Level of Assurance-LoA). In particular, different LoAs provide different security levels based on the difficulty one would have trying to use someone else eID to access online services. With the first research question (RQ1), we will detail the different authentication means chosen by the MSs to comply with the notified LoA. Different authentication protocols and standards have been defined based on the authentication process. They provide a way to achieve interoperability while facilitating the definition of a set of best practices securing the deployments in different use-case scenarios. The second research question (RQ2) will discuss the different authentication standards adopted in the eID schemes. Recently, the OpenID Connect authentication standard [3] has gained lots of attraction due to its benefits compared with older standards such as SAML, including using JSON format instead of heavy XML data format for data transition or more straightforward implementation due to its API-based nature. The OpenID Connect Foundation published different OpenID Connect profiles to provide specific guidelines for various scenarios and different kinds of deployments (such as Open Banking and eGovernment) that require a different level of security and privacy. In the third research question (RQ3), we will explore  
Figure 2: eIDAS notified eID schemes (24 notified eID schemes with 40 eID means). the different OpenID Connect profiles chosen by MSs within their OpenID Connect-based eID schemes. The secure implementation of eID schemes based on OpenID Connect is highly dependent on the implementation choices adopted by the MSs. In the fourth research question (RQ4), we will check the adopted implementation choices by the MSs within their OpenID Connect-based eID schemes. Finally, as mobile use has overtaken desktop users worldwide, transactions via mobile devices are on the rise and require a secure authentication process. In the fifth research question (RQ5), we will compare mobile-based solutions that provide simplicity and security by leveraging capabilities provided by mobile devices, such as biometric characteristics. Summarizing, we organize our investigation of the technological trends in notified eID schemes around the following five main research questions:  
* RQ1. Based on the LoA (Low, Substantial, and High), what are the supported authentication methods in notified eID schemes? * RQ2. Which standards are used to implement authentication solutions in notified eID schemes? * RQ3. For the solutions based on OpenID Connect, which are the profiles followed by the notified eID schemes? * RQ4. For the solutions based on OpenID Connect, which are the implementation choices considered by the notified eID schemes? * RQ5.