# The eIDAS Regulation: A Survey of Technological Trends for European Electronic Identity Schemes
## 7 RQ5: Mobile-Based Authentication Solutions  
This section analyzes the adopted technologies by notified eID schemes to implement authentication solutions based on mobile applications. As a result, we can determine the technological trends concerning the authentication mechanisms based on mobile applications. Given that, we identified the following features based on the analysis of notified eID means:  
**Mobile app protection:**: indicates whether the mobile application is protected with a security mechanism, such as biometrics (fingerprint, face recognition), and/or PIN;
**Secure storage for mobile apps:**: in the cases in which the mobile application leverages a cryptographic authenticator, we analyzed the storage location of the user's private key. In our analysis, after the investigation of notified eID means, we identified the following locations:  
* Keystore (Key SW): the private key of the user is stored in the user's mobile phone within Keystore;
* SIM (crypt SIM): it is used to store secrets and electronic certificates to be used during authentication processes or, in this case, they embed additional applets than the ones used by network operators, for instance, to have a PKI-based SIM that stores authentication and signature certificates;
* Smart card: the NFC reader or Bluetooth connectivity of the mobile phone is used to interact with the smart card, which stores the private key;
* Security key: the user's private key is stored in the hardware security key (e.g., FIDO security key). During the authentication, the user inserts the security key into the device and provides access to the private key by entering a PIN or using biometrics.
**Mobile browser to app to mobile browser (MB2 App2 MB):**: it represents the scenario where the user starts the authentication process within the mobile browser. S/he performs the login on the mobile browser and is redirected to an app for  
Figure 5: Overview of OIDC profiles and OIDC implementation choices adopted by MSs.  
2 nd-factor authentication (e.g., using a national eID card). After the user successfully finishes this step, the app will redirect the user to the mobile browser to complete the authentication process and obtain the token to access the services.  
Based on our analysis, 18 out of 40 notified eID means, and the eID scheme of Baltic countries (SMART-ID) provide mobile-based solutions for authentication. We report the main results per each eID means within columns 21-26 of Table 2. From the results, we have that:  
* 4 eID means that provide card reader mobile applications do not have any mobile app protection mechanism;
* Concerning the secure storage solution used by mobile applications:
* Estonian Mobil-ID and Belgian itsme eID means are the only solutions that use cryptographic SIM to secure the PKI keys;
* 8 eID means use the Mobile NFC or Bluetooth connectivity to read the information from the smart card;
* 8 eID means for which we could find the information use the SW Keystore to secure the private key within their solutions;
* None of the eID means for which we could find information uses either Secure Enclave/Element (SE) or Trusted Execution Environment (TEE) to secure the private key; SE would provide CPU hardware-level isolation and memory encryption by isolating application code and data; similarly, TEE would offer a secure area of the main processor, protecting the confidentiality and integrity of the executed data;
* None of the eID means for which we could find information uses the security key to store the private key within their solutions;
* 10 eID means support the MB2 App2 MB scenarios.