2019 FIDO Authentication Seminar - Seoul

1. All Rights Reserved | FIDO Alliance | Copyright 20191
Enhancing Security with FIDO
2019 FIDO Authentication Seminar - Seoul
SEP 23, 2019

2. All Rights Reserved | FIDO Alliance | Copyright 20192
AGENDA
 FIDO deploying history of Samsung Mobile
 Focused on “Inter Operability”
 NEXT : Focus on “Security Enhancement”
 NEXT : Focus on “Deployment”

3. All Rights Reserved | FIDO Alliance | Copyright 2019333333

4. All Rights Reserved | FIDO Alliance | Copyright 2019444444
FIDO deploying history of Samsung Mobile
Dec.
2013
Jul.
2014
Jul.
2012
FIDO
Founded
Jul.
2015
Dec.
2015
Dec.
2014
Dec.
2016
Jul.
2017
Jun.
2016
Jul.
2018
Dec.
2018
Dec.
2017
Jul.
2019
First FIDO
Authentication
Phone ( S5 )
1.0 Spec Published
K(orea)FWG
First FIDO Biometric
Component Certified
Phone ( S10 )
Samsung
Join as BoD
FIDO Ready
Certified
FIDO UAF
Certified
FIDO U2F
Certified
Samsung Pass
FIDO2 Spec Published

5. All Rights Reserved | FIDO Alliance | Copyright 2019555555
Focused on “Introduction & Inter Operability”
~ 2017 ~2020 2020 ~

6. All Rights Reserved | FIDO Alliance | Copyright 2019
Focused on “Security” – Officially tested
~ 2017 ~2020 2020 ~
FIDO Biometric Requirements
 Test Crew’s Age/Gender/Group Distribution
 Operation Process, internal QA process, Test Plan …
 FAR : False Accept Rate (less 1:10,000 of 80% confidence interval)
 FRR : False Reject Rate(less 3:100 of 80% confidence interval)
 IAPMR : Impostor Attack Presentation Match Rate (less 20%)
 PAD : Presentation Attack Detection (Paper/ Print / Tape / Mold / PCB / Gel / Gummy)
February 20, 2019
New Samsung Galaxy Ultrasonic
Fingerprint System World’s First to
Achieve FIDO Biometric Certification
 Official Biometric Testing Lab. Of FIDO
 Audit and testing by trusted 3rd party
 Overall testing of biometric sensor quality
 Biometric evaluation report (each model)
Bio Testing Lab. available from now

7. All Rights Reserved | FIDO Alliance | Copyright 2019
NEXT : focus on “Deploy” - Web friendly, phishing-resistant
~ 2017 ~2020 2020 ~
Statcounter / GlobalStats , `19.04
6.83%
* Considering variable deployment challenge

8. All Rights Reserved | FIDO Alliance | Copyright 2019
NEXT : focus on “Security” – (upward) Evaluation Level
~ 2017 ~2020 2020 ~
Functional
Compliance
Biometric
Enhanced
Security
Evaluation
(High)
L3/L3+ : Protection against chip fault injection
Defends against captured devices
L2/L2+ : Restricted Operating Environment
Defends against device OS compromise

9. All Rights Reserved | FIDO Alliance | Copyright 2019
NEXT : focus on “Security” – Hybrid (enhanced secure)
~ 2017 ~2020 2020 ~
Invasive HW Attacks
• Well resourced and funded
• Unlimited time, money & equipment.
Non-invasive HW Attacks
• Side channels (DEMA, DPA)
• Physical access to device
• JTAG, Bus Probing, IO Pins, etc.Software Attacks
• Malware & Viruses
• Social engineering
Cost/Effort
To Attack
Cost/Effort to
Secure
Trustzone (TEE)
Smartcard
EAL5+/6+
eSE(embedded Secure Element)
Certified
TrustZone OS

10. All Rights Reserved | FIDO Alliance | Copyright 2019
NEXT : focus on “Security” – eID+FIDO for Public Sectors
~ 2017 ~2020 2020 ~
{ Device } Requirements on Authentication
 High/Substantial Levels of Assurance
 QSCD (qualified signature creation device)
 i.e. 2 factor Authentication, against attack
potential like duplication, tampering
* Electronic identification and trust services
for electronic transactions
Regulation of EU committee
for eGovernment
{ Benefits }
 Cross-border recognition
 Interoperability
 legal certainty
High/
Substantial
Default Security
High Security
Very
High
{ Server } National ID system
 eID authentication ( issuer/verify)
 Binding the FIDO system
 Using the FIDO protocol to auth.

11. All Rights Reserved | FIDO Alliance | Copyright 2019111111111111
Focus on “Security” & “Deploy” - IoT
Guess what? 90% of ourTVs, appliances,
smartphones, and tablets are
now IoT-ready.
– President at CES 2018
NOT ONLY Mobile, BUT ALSO IoT-ALL
WE ARE Looking for good FIDO use-case for user convenience on IoT

12. All Rights Reserved | FIDO Alliance | Copyright 201912
Thank you!
Jong-Su Kim // Principal Engineer
(Samsung Mobile Security S/W)
js365.kim@samsung.com