Skip to main content
UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
FIDO Alliance, profile picture
Uploaded byFIDO Alliance
PDF, PPTX1,984 views

2019 FIDO Tokyo Seminar - LINE PayへのFIDO2実装

This document summarizes LINE's deployment of FIDO2 authentication for its LINE Pay service. It discusses how passwords are insecure and the root of many breaches. FIDO2 provides a stronger alternative using public/private key attestation and is designed to be privacy-preserving. LINE joined the FIDO Alliance in 2017 and certified its universal server in 2018. It has implemented FIDO2 authentication flows for iOS using Touch ID/Face ID and for Android. Future plans include expanding FIDO2 to more financial services and LINE applications to encourage password-less authentication.

Software◦
Related topics:
Online Security•
Deploying FIDO2 in LINE Pay Naohisa ICHIHARA,
How many accounts do you have?
Do you like passwords?
Nobody likes passwords Only hackers ❤ passwords! Phishing Social engineering Key logging Rainbow table
Passwords are the root of all most of breaches. Passwords are not secure From 2016 to 2017 Security incidents 279% Supports costs Forgotten password 20% Among breaches Due to passwords 81% source: Verizon cyber crime case study 2017
Indeed, they’re great solutions. We have solutions 2 Factor Authentication (OTP, SMS codes) Federation and SSO (OIDC, OAuth) Biometrics (Fingerprint, Face) Password Managers (1password and etc.) and,
Why matters?
> Strong against various attacks > Pluggable and interoperable > Easy to use Design Principles > Privacy preserving
Strong assurance of “device possession” The key has following security properties. Generated randomly (Guess) Stored in secure area (Extraction) Attested by trust root (Emulation) Generating the signature (Forgery) > Strongly assure the authentication was performed with the device which was registered before.
What about LINE?
2017 > LINE joined FIDO alliance X
2018 > FIDO Universal Server certification Ensures interoperability with all FIDO Certified Authenticators
2019 +
High-level architecture LINE Pay App LINE Pay RP Server (for LINE Pay Japan) LINE Pay Central Server LINE FIDO2 Server (for LINE Pay Japan) Passcode authentication (or old biometric authentication) FIDO Operations FIDO Operations LINE FIDO2 Combo (iOS) Compat (Android) Authentication management
LINE FIDO2 Combo for iOS Uses Touch ID and Face ID as UV and leverages WBC (Whitebox cryptography) for attestation RP App (View) LINE FIDO2 Combo (FIDO2 Client, Authenticator Logic) LTSM (LINE Trusted Security Module) WAL (Whitebox Abstraction Layer) KAL (KeyChain Abstraction Layer) Touch ID/Face ID (Apple) signing attestation User’s private key Whitebox Encryption KeyChain
LINE FIDO2 Compat for Android Abstraction layer supporting both Android native authenticator and LINE authenticator RP App (Activity) LINE FIDO2 Glue Layer (Abstraction) LINE Authenticator FIDO2 GMS Core Single API entry point FIDO Play service API CTAP2 LTSM Native Authenticator (google) External Authenticator Biometric API (google) signing attestation User’s private key Whitebox Encryption
Utilities/helpers and etc Services LINE FIDO Server software stack LINE FIDO Server is built on top of SpringBoot with React stack. Repositories Mongo DB Redis Routers/ Handlers Framework (Library) Challenge Response Attestation Metadata SessionCertificate SpringBoot Spring Webflux Crypto COSE X509 Validator Mapper Config SL4J PrometheusNetty Metadata client MDS client Deserializer Verifier Convertor Spring Security Elastic search
Registration flow Generates a key pair and registers the public part of the key to the server iOS (Face ID, Touch ID) Android (Fingerprint, Face)
Authentication flow Generates a digital signature and verifies it on the server with the public key App launching Payment User scans the QR code for payments and confirms the transaction .
What’s next?
Re-authentication User tries to authenticates to a service again LINE is trying to verify your identity. Verify your identity with biometric. Confirm access to your accountClova is requesting access to your account
more Financial services We are now trying to provide more financial services.
Go password-less Mitigate password usecases Integrate FIDO to more LINE services. Encourage users to enroll multiple authenticators. Introduce multiple FIDO authenticators Introduce FIDO to LINE Login and LINE Pay. Educate users for the convenience. FIDO authentication for user convenience
Stay tuned!
2019 FIDO Tokyo Seminar - LINE PayへのFIDO2実装