The Ausweisapp2 promises a revolution, but it also makes the highest demands on data protection. It is nothing less than a quantum leap that the digital ID card app2 - an ambitious and at the same time overdue federal project - promises.
The app has been available for some time, but so far too few citizens have taken notice of its existence, let alone used its functions.
Ausweisapp2 for identification on the Internet
We in Germany have had to wait far too long to receive a practical solution for identification on the Internet. While digital pioneers such as Estonia can already handle 99 percent of their official “corridors” conveniently via smartphone or PC, the German administration is still lagging significantly behind in terms of digitization. After all, the federal government committed itself in 2017 with the Online Access Act to digitize public administration by the end of 2022 at the latest. The Ministry of Interior's Ausweisapp2 is still in its infancy, but it also lays the foundation for dealing with authorities and doing business on the Internet.
The digital proof of identity as a key
The German population is already many steps ahead of their authorities when it comes to digitization and is literally thirsting for a rapid expansion of the local digital infrastructure. But the public mills in this country unfortunately grind a little more slowly than elsewhere, both in terms of fiber optic expansion and in overcoming the public paper industry.
The focus of all official online activities is the digital identity and the possibility of providing evidence. Every conclusion of a contract presupposes that the contracting parties can identify themselves unequivocally and legally. In this respect, the Ausweisapp2 promises to give the paralyzing digitization a welcome boost.
Great opportunities vs. data protection
Without a doubt, a digital ID opens up undreamt-of possibilities for the German population and their economy. It releases one of the last brakes that have stood in the way of the development of the digital society so far. But the associated risks are no less important. The more we go about our business online, the deeper the consequences of identity theft. Should cyber criminals gain control of someone else's digital identity, for example, the possibilities for serious abuse are almost unlimited. Starting with purchases at the victim's expense to judicial activities on the Internet, a criminal hacker can cause immense damage if he is able to gain access to the digital identity of others due to inadequate IT security measures.
Therefore, a seamless and well thought-out IT security strategy is the indispensable cornerstone for the success of any app for digital proof of identity and should be given top priority, especially in the conception phase.
Confidential Computing as a Solution
Data can be effectively protected by encryption when it is stored and transmitted. However, according to the current state of the art, in order to process them it is still essential to decrypt them beforehand. Resourceful cyber criminals are aware of this fact and target the servers on which the data processing takes place.
In order to put a stop to the desires that arise from the extensive possibilities of misuse of an ID card, the data can be protected from unauthorized access using various approaches. Three techniques have proven to be effective:
- Confidential Computing at the processor level: The technology developed by Intel, Google & Co. enables code to be outsourced to separate memory slaves on the specially designed processors before it is processed. There it is securely protected from unauthorized access.
- Confidential computing at the server level: With "Sealed Computing", the data are transferred to a sealed server ("Sealed Cloud") before they are processed. There they can be decrypted and processed, safe from unauthorized access. In this way, manipulation or theft are excluded from the start.
- Access protection using blockchain: This approach will be used, for example, in the planned digital proof of vaccination, in which the collected and anonymized data is encrypted and stored on a total of five different blockchains.
The fact that the political leaders have recognized that complete data protection must also cover vulnerable data processing gives hope that future projects at federal level will also be provided with comparable security measures.
Ausweisapp2: powerful instrument
Especially with the central personal data and such a powerful instrument as a digital ID function, no unnecessary risks should be taken. Instead, every possible precaution should be taken and the most effective techniques for securing the digital identity implemented. Should the ambitious Ausweisapp2 project turn out to be a success story, it could strengthen German trust in public digitization projects and consolidate the laboriously developed progress for future projects.
More on this at Uniscon.com
About uniscon Uniscon GmbH is a member of the TÜV SÜD Group. As part of TÜV SÜD's digitization strategy, uniscon offers highly secure cloud applications and solutions for secure and legally compliant data traffic. TÜV SÜD is a leading global technical service company with over 150 years of industry-specific experience and today more than 24.000 employees at around 1000 locations in 54 countries. In this strong network, uniscon is able to reliably implement major international projects in the areas of IoT and Industry 4.0 with the Sealed Cloud and its products. Further information on the company and the solutions: www.uniscon.com