Your SlideShare is downloading. ×
CIS14: Building Blocks for Mobile Authentication and Security
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×

Saving this for later?

Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime - even offline.

Text the download link to your phone

Standard text messaging rates apply

CIS14: Building Blocks for Mobile Authentication and Security

369
views

Published on

Rajiv Dholakia, Nok Nok Labs …

Rajiv Dholakia, Nok Nok Labs

Overview and insights into some of the building blocks that make a modern security and authentication stack work and
why we should be optimistic about our ability to transform
authentication in particular and security in general as these
platforms grow and evolve, in light of the building blocks
provided by modern mobile operating systems and hardware for crafting a robust authentication implementation.

Published in: Technology

0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
369
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
38
Comments
0
Likes
1
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. 1 T FINGERPRINT SEC U FA BIOME TOKEN RBA ACTIVE FINGERPRINT SECURE ELEMENT NFC BIOMETRIC PIN RBA SILEFINGERPRINT ELEME NFFACE BIOMETRIC TOKENACTIVE SILE ELEMENT USB FACE PIN TOK RBA PASSIVE SILEN FINGERPRINT VOICEUSB BIOMETRIC TPM VOICE NFC FACE TPM FINGERPRINT NFC USB RBA ACTIV TP FINGERPRINT SECURE NFC FACE RBA PASSIVE SILENT TPM FINGERPRINT VOICE ELEMENT ACTIVE BIOMETRIC PIN PASSIVE SILENT TPM FINGERPRINT SECURE ELEMENT NFC PIN TOKEN PASSIVE FINGERPRINT VOICE SECURE E TOKEN R VOICE SECURE NFC TOKEN TPM PIN RBA FINGERPRINT SECURE NFC USB VOICE NFC PASSIVE USB TOKEN PASSIVE TPM SECURE ELE FACE BIOMETRIC ACTIVE SECURE USB ACTIVE TPM VOICE NFC USB FACE PIN RBA ACTIVE TPM SECURE ELEMENT PIN RBA SILENT USB PIN SILENT ELEMENT NFC FINGERPRINT USB TPM VOICE RBA PASSIVE ACTIVE TPM SECURE USB FACE ACTIVE VOICE PIN PASSIVE TPM FINGERPRINT RBA ACTIVE TPM ELEMENT ACTIVE SILENT TPM USB RBA SECURE BIOMETRIC PIN SILENT TPM VOICE USB PIN USB FACE BIOMETRIC NFC TOKEN RBA PIN RBA SILENT FACE RBA PASSIVE ACTIVE SILENT TPM FINGERPRINT RBA ACTIVE TPM TOKEN ACTIVE SILENT VOICE USB FACE PIN RBA ACTIVE SILENT RBA VOICE NFC USB ACTIVE TPM BIOMETRIC TOKENTPM FACE TOKEN PASSIVE PIN TPM TPM FACE TPM FACE PASSIVE SILENT BIOMETRIC SECURE PIN PASSIVE SILENT VOICE USB PIN TOKEN PASSIVE NFC BIOMETRIC RBA SILENT TPM SECURE VOICE USB USB FACE SILENT SECURE PIN SILENT ELEMENT USB FACE VOICE USB SECURE FACE PIN FINGERPRINT SILENT PIN BIOMETRIC TPM USB FACE ELEMENT TPM VOICE SILENT USB RBA SILENT TPM VOICE FACE PASSIVE PIN TOKEN ACTIVE USB PASSIVE USB FACE TPM PASSIVE SECURE USB TPM FACE PIN RBA NFC USB RBA ACTIVE NFC USB PIN NFC SILENT VOICE FACE PIN RBA PASSIVE NFC USB PIN TPM PASSIVE PIN USB TPM NFC USB FACE SILENT FINGERPRINT USB USB USB TPM FACE TPM USB PIN FACE USB FACE USB NFC FACE TPM PIN FACE FACE USB TPM NFC RBA USB PIN PIN TPM USB RBA RBA PIN USB USB USB USB NFC FACE PIN NFC VOICE USB USB USB TPM USB USB TPM FACE NFC RBA USB FACE PIN VOICE USB USB USB RBA TPM NFC USB TPM USB USB USB TPM FACE USB FACE USB TPM USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB BUILDING BLOCKS FOR MOBILE SECURITY AND AUTHENTICATION
  • 2. ELEMENTS OF INTEGRITY & SECURITY Device Integrity (Is the hardware the right hardware?) Network Integrity (Am I talking to the right network resource, can I trust that resource) OS & App Integrity (Did someone tamper with my OS, is there malware, am I talking to the right app?) User Integrity (Is the user the right user?) Data & Transaction Integrity 2
  • 3. SECURITY IS ONLY AS STRONG AS THE WEAKEST LINK 3 Integrity Hardware OS App Network User Patch when you find a gap Security Whack-A-Mole
  • 4. A UNIQUE OPPORTUNITY 4 Hardware Integrity OS Integrity App Integrity Network Integrity User Integrity Re-Architect Computing Using Hardware-Based Trust Chain of Trust Trusted Platform
  • 5. THE MOBILE EPOCH 5
  • 6. INTEGRITY MECHANISMS – I •  TPMs •  Backwards compatibility requirements •  SEs •  Limited due to operator controls •  TEEs •  Third time is a charm? •  Secureboot - Verificationofimage •  Virtualization - Hardwareassistedisolation •  Anti-virus •  DeviceTheftResponse - Standardonmobiledevices 6 TEE SE TPM Hardware OS
  • 7. INTEGRITY MECHANISMS – II 7 App User •  Appverification - Rise Of The App Store •  AppIsolation - App containers - Restricted IPC •  ProtectingData&Content - On-device data encryption - DRM •  IdentityProofing - Know your customer •  StrongAuthentication - Explicit & implicit -  First mile & Second mile
  • 8. FOUNDATION OF A TRUSTED PLATFORM 8 Partition Partition Partition Manager Hardware System Protection PII Handling Evidence/ Measurement Reporting/ Attestation Platform Management Policy Engine Hardware Protected Storage Randomness Detection & Inspection Sequencing Architecture Performance Within Partition Protected Execution Outside External Access Between Partitions Isolation Trusted Channel
  • 9. ISOLATION ARCHITECTURE ARMTRUSTZONE 9 Secure OS Boot FP Sensor Touchscreen Storage 1.7 B ARM Cortex SoCs Shipped 18 Month Phone Refresh Rate
  • 10. PROTECTED EXECUTION TRUSTONICTEE 10 App TEE Normal App TEE Enabled Rich OS Trustlet 500M TEEs Shipped
  • 11. TRUSTED PLATFORMS IN PRACTICE 11 iOS Samsung Knox Trustzone- based Integrity Management Architecture (TIMA) Security Enhancements for Android
  • 12. BUILDING BLOCKS AVAILABLE BUTCAPABILITIESARENOTEXERCISED • AccessLimitations - TPM -  SE -  TEE • Integrationpain - Needusableabstractions, standardization,ecosystems, partnerships • Inter-partyverificationof components - Needoperationalrelationships 12
  • 13. BUILDING THE PLUMBING 13 Hardware Integrity User Integrity OS & App Integrity Network Integrity
  • 14. ROUGH CONSENSUS + WORKING CODE 14 50-60M Units Expected to ship Galaxy S5 World’s First FIDO Ready Smartphone
  • 15. Any Device. Any Application. Any Authenticator. 15 T FINGERPRINT SEC U FA BIOME TOKEN RBA ACTIVE FINGERPRINT SECURE ELEMENT NFC BIOMETRIC PIN RBA SILEFINGERPRINT ELEME NFFACE BIOMETRIC TOKENACTIVE SILE ELEMENT USB FACE PIN TOK RBA PASSIVE SILEN FINGERPRINT VOICEUSB BIOMETRIC TPM VOICE NFC FACE TPM FINGERPRINT NFC USB RBA ACTIV TP FINGERPRINT SECURE NFC FACE RBA PASSIVE SILENT TPM FINGERPRINT VOICE ELEMENT ACTIVE BIOMETRIC PIN PASSIVE SILENT TPM FINGERPRINT SECURE ELEMENT NFC PIN TOKEN PASSIVE FINGERPRINT VOICE SECURE E TOKEN R VOICE SECURE NFC TOKEN TPM PIN RBA FINGERPRINT SECURE NFC USB VOICE NFC PASSIVE USB TOKEN PASSIVE TPM SECURE ELE FACE BIOMETRIC ACTIVE SECURE USB ACTIVE TPM VOICE NFC USB FACE PIN RBA ACTIVE TPM SECURE ELEMENT PIN RBA SILENT USB PIN SILENT ELEMENT NFC FINGERPRINT USB TPM VOICE RBA PASSIVE ACTIVE TPM SECURE USB FACE ACTIVE VOICE PIN PASSIVE TPM FINGERPRINT RBA ACTIVE TPM ELEMENT ACTIVE SILENT TPM USB RBA SECURE BIOMETRIC PIN SILENT TPM VOICE USB PIN USB FACE BIOMETRIC NFC TOKEN RBA PIN RBA SILENT FACE RBA PASSIVE ACTIVE SILENT TPM FINGERPRINT RBA ACTIVE TPM TOKEN ACTIVE SILENT VOICE USB FACE PIN RBA ACTIVE SILENT RBA VOICE NFC USB ACTIVE TPM BIOMETRIC TOKENTPM FACE TOKEN PASSIVE PIN TPM TPM FACE TPM FACE PASSIVE SILENT BIOMETRIC SECURE PIN PASSIVE SILENT VOICE USB PIN TOKEN PASSIVE NFC BIOMETRIC RBA SILENT TPM SECURE VOICE USB USB FACE SILENT SECURE PIN SILENT ELEMENT USB FACE VOICE USB SECURE FACE PIN FINGERPRINT SILENT PIN BIOMETRIC TPM USB FACE ELEMENT TPM VOICE SILENT USB RBA SILENT TPM VOICE FACE PASSIVE PIN TOKEN ACTIVE USB PASSIVE USB FACE TPM PASSIVE SECURE USB TPM FACE PIN RBA NFC USB RBA ACTIVE NFC USB PIN NFC SILENT VOICE FACE PIN RBA PASSIVE NFC USB PIN TPM PASSIVE PIN USB TPM NFC USB FACE SILENT FINGERPRINT USB USB USB TPM FACE TPM USB PIN FACE USB FACE USB NFC FACE TPM PIN FACE FACE USB TPM NFC RBA USB PIN PIN TPM USB RBA RBA PIN USB USB USB USB NFC FACE PIN NFC VOICE USB USB USB TPM USB USB TPM FACE NFC RBA USB FACE PIN VOICE USB USB USB RBA TPM NFC USB TPM USB USB USB TPM FACE USB FACE USB TPM USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB USB
  • 16. Appendix PRIVATE & CONFIDENTIAL 16