Kookmin Bank FIDO Case Study by Sangwook Kim, CrossCert - Presented at FIDO Seoul Public Seminar on December 5th, 2018

1. -0-
December 2018

2. -1-
Ⅰ

3. -2-
1. Overview
A. Global Authentication Trends
Top 5 Authentication Trends (RSA)
Source : RSA (https://www.rsa.com/en-us/blog/2017-09/top-5-authentication-trends-in-2017)
Modern
methods
for modern
workstyles
SSO keeping
pace with growth
in cloud
and mobility
Standards-based
authentication
Biometrics that
live up
to the hype
Device-level
Trust
Need for a consumer-simple experience
FIDO is the best practice as recent authentication technology

4. -3-
1. Overview
B. CrossCertFIDO®
What is CrossCertFIDO® ?
Component Features
CrosscertFIDO Client
(Android)
CrosscertFIDO
Authenticator
(Android)
CrosscertFIDO
Client&Authenticator
(iOS)
CrosscertFIDO
Server
CrosscertFIDO Server Admin
FIDO Deregistration
FIDO Transaction Confirmation
FIDO Authentication
FIDO Registration
Supports Easy, Fast and Secure Authentication to End-User
CrosscertFIDO

5. -4-
1. Overview
B. CrossCertFIDO®
What is CrossCertFIDO® ? – K-FIDO
FIDO Client FIDO Server
Certificate Authority (CA)
Issue Accredited Certificate
FIDO Authentication
(incl. signed data generated by accredited certificate)
Verify Accredited Certificate
Easy-Using Accredited Certificate without password

6. -5-
Ⅱ

7. -6-
2. Challenge
A. Trend
On-line banking service trend in Korea
69 Millions
Internet Banking
Subscribers
66 Millions
Mobile Banking
Subscribers
Source : The Bank of Korea (2018) Source : Korea Consumer Agency (2016.12)

8. -7-
2. Challenge
B. Issue
Hard to use Accredited Certificate in National PKI (NPKI)
highly susceptible theft and misuse
(such as for account hijacking)
User Authentication
inputting a password in
mobile device is very difficult
and time consuming
Password Memorization Inconvenience
Message Integrity
Non-Repudiation
NPKI

9. -8-
2. Challenge
B. Issue
Not changeable when biometric credentials was stolen
User Auth.
Server
Register biometric
credentials
Cracker
Cracker can disguise as user permanently.

10. -9-
Ⅲ

11. -10-
3. Case-Study : Kookmin Bank
A. Overview
Overview of Kookmin Bank mobile banking service
< KBStar >
Managed PKI based User Authentication
Password based User Authentication
Accredited Certificate based User Authentication

12. -11-
3. Case-Study : Kookmin Bank
A. Overview
Seeking No-Password based Authentication
No-Password?
(incl. NPKI)
Not stored
Biometric
credentials

13. -12-
3. Case-Study : Kookmin Bank
B. CrossCertFIDO® in Kookmin Bank
Implement CrossCertFIDO® in Kookmin Mobile Bank
FIDO Server
RP Server SDK
KBStar APP
(incl. RP Client SDK)
Smartphone
WAS
(RP Server)
FIDO Server
CA
Crosscert FIDO Client
Crosscert FIDO ASM /
Authenticator
FingerprintUser Kookmin Bank CrossCert’s Datacenter
HTTPS
Accredited
Certificate Proc
Server
Management
System
Dedicated
line Logging
Statistics
Management
Authenticator
Management
Policy
…

14. -13-
3. Case-Study : Kookmin Bank
B. CrossCertFIDO® in Kookmin Bank
CrossCert Global Datacenter
❖ Core Infrastructure for Our Security Services
❖ Has Been Passing Symantec’s Web Trust Audit since 2012
❖ Retained Information Security Management System Certificate Through Annual Review by Korea Internet &
Security Agency Since 2013

15. -14-
3. Case-Study : Kookmin Bank
B. CrossCertFIDO® in Kookmin Bank
Screenshot (FIDO Authentication)

16. -15-
3. Case-Study : Kookmin Bank
B. CrossCertFIDO® in Kookmin Bank
CrossCertFIDO® K-FIDO in Kookmin Mobile Bank
CrosscertFIDO®
Authenticator
CrosscertFIDO
Server
CA
KBStar Authentication
Server
① Local(Bio)
Authentication
& generate
signature(PKCS#1)
② Send signature(PKCS#1)
④ Request to verify Accredited
Certificate (CRL or OCSP)
③ Verify signature
⑤ Response status result⑥ Generate and send
SignedData(PKCS#7)
⑦ Send SignedData (PKCS#7) ⑧ Verify SignedData
Provide user authentication, data integrity and non-repudiation based on K-FIDO technology

17. -16-
3. Case-Study : Kookmin Bank
B. CrossCertFIDO® in Kookmin Bank
Screenshot (Money Transfer by K-FIDO Transaction Confirmation)

18. -17-
Ⅳ

19. -18-
4. Result
A. Statistics
FIDO-based authentication across various KBStar mobile banking apps
16 Million
FIDO Transactions
Per Month
Over 260 Million
Total FIDO
Transactions
(as of Oct 2018)
KBStar Liiv KBStar Mini KBStar Alarm KB LiivOn KB MyMoney

20. -19-
4. Result
B. Roadmap
Set the stage for similar adaptation in other industries
E-Commerce
Banking
Insurance
Education
Government
Goodbye Password ! Hello FIDO & FIDO2 !

21. -20-
Thank you