Brendon Wilson, Director, Product Management and Dr William J. Blanke, Mobile Lead Architect, Nok Nok Labs share information the recently introduced Touch ID API and its implications for a mobile authentication strategy. This session also looks at other smartphone and tablet-based authentication solutions, plus the FIDO protocols.
4. TOUCH ID API – WHAT DOES IT DO?
4
App
1. Determine if a fingerprint
touch was recognized
2. Unlock keychain data with
successful touch
• Keychain data protected
by secure enclave
Key
Store
Secure
Enclave
5. HOW DOES THE SERVER KNOW?
THEREMOTEAUTHENTICATIONCHALLENGE
5
① Was a user successfully verified?
② Who was verified?
③ How was the user verified?
④ What assurance do we get?
?
7. LOCAL AUTHENTICATION API
7
App
Yes/No
ü Was a user successfully verified?
o Who was verified?
o How was the user verified?
o What assurance do we get?
8. PASSWORD IN IOS KEYCHAIN
8
App
ü Was a user successfully verified?
ü Who was verified?
o How was the user verified?
o What assurance do we get?
9. COOKIE IN IOS KEYCHAIN
9
App
ü Was a user successfully verified?
ü Who was verified?
o How was the user verified?
o What assurance do we get?
10. KEY IN IOS KEYCHAIN
10
App
ü Was a user successfully verified?
ü Who was verified?
o How was the user verified?
Ø What assurance do we get?
11. WHAT ABOUT OTHER DEVICES?
11
Android
52%
iOS
42%
Windows
Phone
3%
Blackberry
2%
Others
1%
Q1 ‘14
And older devices…….?
14. MFAC
UAF + IOS KEYCHAIN
14
App
ü Was a user successfully verified?
ü Who was verified?
ü How was the user verified?
ü What assurance do we get?
UAF
20. TRANSACTION CONFIRMATION
20
Initiate Transaction
Authentication Response
+ Text Hash
Validate
Response &
Text Hash
Auth Req+ Challenge +
Policy + Transaction Text
MFAS
MFAC
RelyingPartyServer
Relying
Party
App
2
4
5
Device
Relying Party
1
3
Display Text,
Authenticate User
& Unlock Key
21. The S3 Authentication Suite
21
T
FINGERPRINT
SEC
U
FA
BIOME
TOKEN
RBA
ACTIVE
FINGERPRINT
SECURE
ELEMENT
NFC
BIOMETRIC
PIN
RBA
SILEFINGERPRINT
ELEME
NFFACE
BIOMETRIC
TOKENACTIVE
SILE
ELEMENT
USB
FACE
PIN
TOK
RBA
PASSIVE
SILEN
FINGERPRINT
VOICEUSB
BIOMETRIC
TPM
VOICE
NFC
FACE
TPM
FINGERPRINT
NFC
USB
RBA
ACTIV
TP
FINGERPRINT
SECURE
NFC
FACE
RBA
PASSIVE
SILENT
TPM
FINGERPRINT
VOICE
ELEMENT
ACTIVE
BIOMETRIC
PIN
PASSIVE
SILENT
TPM
FINGERPRINT
SECURE
ELEMENT
NFC
PIN
TOKEN
PASSIVE
FINGERPRINT
VOICE
SECURE
E
TOKEN
R
VOICE
SECURE
NFC
TOKEN
TPM
PIN
RBA
FINGERPRINT
SECURE
NFC
USB
VOICE
NFC
PASSIVE
USB
TOKEN
PASSIVE
TPM
SECURE
ELE
FACE
BIOMETRIC
ACTIVE
SECURE
USB
ACTIVE
TPM
VOICE
NFC
USB
FACE
PIN
RBA
ACTIVE
TPM
SECURE
ELEMENT
PIN
RBA
SILENT
USB
PIN
SILENT
ELEMENT
NFC
FINGERPRINT
USB
TPM
VOICE
RBA
PASSIVE
ACTIVE
TPM
SECURE
USB
FACE
ACTIVE
VOICE
PIN
PASSIVE
TPM
FINGERPRINT
RBA
ACTIVE
TPM
ELEMENT
ACTIVE
SILENT
TPM
USB
RBA
SECURE
BIOMETRIC
PIN
SILENT
TPM
VOICE
USB
PIN
USB
FACE
BIOMETRIC
NFC
TOKEN
RBA
PIN
RBA
SILENT
FACE
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
RBA
ACTIVE
TPM
TOKEN
ACTIVE SILENT
VOICE
USB
FACE
PIN
RBA
ACTIVE
SILENT
RBA
VOICE
NFC
USB
ACTIVE
TPM
BIOMETRIC
TOKENTPM
FACE
TOKEN
PASSIVE
PIN
TPM
TPM
FACE
TPM
FACE
PASSIVE
SILENT
BIOMETRIC
SECURE
PIN
PASSIVE
SILENT
VOICE
USB
PIN
TOKEN
PASSIVE
NFC
BIOMETRIC
RBA
SILENT
TPM
SECURE
VOICE
USB
USB
FACE
SILENT
SECURE
PIN
SILENT
ELEMENT
USB
FACE
VOICE
USB
SECURE
FACE
PIN
FINGERPRINT
SILENT
PIN
BIOMETRIC
TPM
USB
FACE
ELEMENT
TPM
VOICE
SILENT
USB
RBA
SILENT
TPM
VOICE
FACE
PASSIVE
PIN
TOKEN
ACTIVE
USB
PASSIVE
USB
FACE
TPM
PASSIVE
SECURE
USB
TPM
FACE
PIN
RBA
NFC
USB
RBA
ACTIVE
NFC
USB
PIN NFC
SILENT
VOICE
FACE
PIN
RBA
PASSIVE
NFC
USB
PIN
TPM
PASSIVE
PIN
USB
TPM
NFC
USB
FACE SILENT
FINGERPRINT
USB
USB
USB
TPM
FACE
TPM
USB
PIN
FACE
USB
FACE
USB
NFC
FACE
TPM
PIN
FACE
FACE
USB
TPM
NFC
RBA
USB
PIN
PIN
TPM
USB
RBA
RBA
PIN
USB
USB
USB
USB
NFC
FACE
PIN
NFC
VOICE
USB
USB
USB
TPM
USB
USB
TPM
FACE
NFC
RBA
USB
FACE
PIN
VOICE
USB
USB
USB
RBA
TPM
NFC
USB
TPM
USB
USB
USB
TPM
FACE
USB
FACE
USB
TPM
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
24. THE DEVIL IS IN THE DETAILS
LAYEREDSECURITYMECHANISMS
24
Authenticator
MFAC
TLS Channel
ASM
App
Web Backend
MFAS
User consent
Channel binding
Key handle access token
FacetID token match
Unique Uauth keys
Uauth keys protection
Authenticator attestation
Client-side nonces
Signature counter
Transaction confirmation
Channel binding/AppID
TLS server key
FacetID list
Round-trip integrity
Server-side nonces
Authenticator metadata
Secured verifier DB
Registration confidentiality
Uauth.pub
Keys
Metadata
Service
Certified
authenti
cators
Account
secrecy
25. AVAILABLE ON THE GALAXY S5
25
50-60M Units
Expected to ship
150
Launch Countries
World’s First FIDO
Ready Smartphone
Introducing
Fingerprint Authentication
Used by
27. CONCLUSION
27
Touch ID
Authentication
Transactions
Other Authenticators
Other Devices
Inter-Device Authentication
• Touch ID API offers
local authentication
only
• Integration options
differ in levels of
authentication
integrity
• Nok Nok Labs’
solution, built on
FIDO Alliance’s UAF
offers a turnkey
robust option
29. Any Device.
Any Application.
Any Authenticator.
29
T
FINGERPRINT
SEC
U
FA
BIOME
TOKEN
RBA
ACTIVE
FINGERPRINT
SECURE
ELEMENT
NFC
BIOMETRIC
PIN
RBA
SILEFINGERPRINT
ELEME
NFFACE
BIOMETRIC
TOKENACTIVE
SILE
ELEMENT
USB
FACE
PIN
TOK
RBA
PASSIVE
SILEN
FINGERPRINT
VOICEUSB
BIOMETRIC
TPM
VOICE
NFC
FACE
TPM
FINGERPRINT
NFC
USB
RBA
ACTIV
TP
FINGERPRINT
SECURE
NFC
FACE
RBA
PASSIVE
SILENT
TPM
FINGERPRINT
VOICE
ELEMENT
ACTIVE
BIOMETRIC
PIN
PASSIVE
SILENT
TPM
FINGERPRINT
SECURE
ELEMENT
NFC
PIN
TOKEN
PASSIVE
FINGERPRINT
VOICE
SECURE
E
TOKEN
R
VOICE
SECURE
NFC
TOKEN
TPM
PIN
RBA
FINGERPRINT
SECURE
NFC
USB
VOICE
NFC
PASSIVE
USB
TOKEN
PASSIVE
TPM
SECURE
ELE
FACE
BIOMETRIC
ACTIVE
SECURE
USB
ACTIVE
TPM
VOICE
NFC
USB
FACE
PIN
RBA
ACTIVE
TPM
SECURE
ELEMENT
PIN
RBA
SILENT
USB
PIN
SILENT
ELEMENT
NFC
FINGERPRINT
USB
TPM
VOICE
RBA
PASSIVE
ACTIVE
TPM
SECURE
USB
FACE
ACTIVE
VOICE
PIN
PASSIVE
TPM
FINGERPRINT
RBA
ACTIVE
TPM
ELEMENT
ACTIVE
SILENT
TPM
USB
RBA
SECURE
BIOMETRIC
PIN
SILENT
TPM
VOICE
USB
PIN
USB
FACE
BIOMETRIC
NFC
TOKEN
RBA
PIN
RBA
SILENT
FACE
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
RBA
ACTIVE
TPM
TOKEN
ACTIVE SILENT
VOICE
USB
FACE
PIN
RBA
ACTIVE
SILENT
RBA
VOICE
NFC
USB
ACTIVE
TPM
BIOMETRIC
TOKENTPM
FACE
TOKEN
PASSIVE
PIN
TPM
TPM
FACE
TPM
FACE
PASSIVE
SILENT
BIOMETRIC
SECURE
PIN
PASSIVE
SILENT
VOICE
USB
PIN
TOKEN
PASSIVE
NFC
BIOMETRIC
RBA
SILENT
TPM
SECURE
VOICE
USB
USB
FACE
SILENT
SECURE
PIN
SILENT
ELEMENT
USB
FACE
VOICE
USB
SECURE
FACE
PIN
FINGERPRINT
SILENT
PIN
BIOMETRIC
TPM
USB
FACE
ELEMENT
TPM
VOICE
SILENT
USB
RBA
SILENT
TPM
VOICE
FACE
PASSIVE
PIN
TOKEN
ACTIVE
USB
PASSIVE
USB
FACE
TPM
PASSIVE
SECURE
USB
TPM
FACE
PIN
RBA
NFC
USB
RBA
ACTIVE
NFC
USB
PIN NFC
SILENT
VOICE
FACE
PIN
RBA
PASSIVE
NFC
USB
PIN
TPM
PASSIVE
PIN
USB
TPM
NFC
USB
FACE SILENT
FINGERPRINT
USB
USB
USB
TPM
FACE
TPM
USB
PIN
FACE
USB
FACE
USB
NFC
FACE
TPM
PIN
FACE
FACE
USB
TPM
NFC
RBA
USB
PIN
PIN
TPM
USB
RBA
RBA
PIN
USB
USB
USB
USB
NFC
FACE
PIN
NFC
VOICE
USB
USB
USB
TPM
USB
USB
TPM
FACE
NFC
RBA
USB
FACE
PIN
VOICE
USB
USB
USB
RBA
TPM
NFC
USB
TPM
USB
USB
USB
TPM
FACE
USB
FACE
USB
TPM
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB