FIDO & Mobile Connect

Mobile Connect
David Pollington
FIDO/Mobile Connect event
21/1/19

Copyright © 2019 GSMA. The Mobile Connectlogoisa trade markregistered and owned by the GSMA.
The key which unlocks
access to online services
119
Introducing Mobile Connect authentication
Identity – MobileConnect
• Worldwide initiative by the Mobile Network
Operators
• Utilises the mobile phone = convenient and
in the customer’s pocket
• Distributed, federated framework
utilising open standards
• Pluggable approach to embrace new
authentication mechanisms including
biometrics

Copyright © 2019 GSMA. The Mobile Connectlogoisa trade markregistered and owned by the GSMA.Identity – MobileConnect120
Mobile Connect authenticators supported
Pop-up SIM
applet
USSD
SMS+URL SAA
Notification
Zero-click
Seamless
authN
LoA2 Click
OK (or
seamless)
LoA3
PIN/Biometric
SIM
applet
USSDSMS+URL
SAA
SIM
applet SAA
3 UX types 3 levels of assurance (and
UX flows)
No user
interaction
required1
User clicks on
notification to open
authenticator
User interacts with
authenticator via
pop-up
1 only applicable if the user is accessing the SP over the mobile network
Seamless
authN
Authorise PKI
SIM
applet
Modular framework
supports a range of
network-supported
authentication methods
to match the capabilities
of mobile devices in
different markets whilst
also supporting multiple
levels of authentication
robustness to meet
Service Provider (SP)
needs

Mobile Connect achieving global momentum
473m
Mobile Connect
active users globally
Growing demand
for strong
authentication
(PSD2, GDPR)
$75billion
Market opportunity
for identity services
by 2022*
* GSMA Intelligence

• User-centric by design
• Privacy intrinsically built-in
• Support for zero-knowledge proofs
• Reduced friction for the user in
providing their identity online
• Engender trust between user and SP
Identity – MobileConnect2
…and expanding to offer a range of identity services to online
service providers
Authentication
Simple and globally
ubiquitous log-in or
step-up authentication
Network attributes
Insights about the device
and user’s mobile account
Identity
Provision or verification
of user identity
Authorisation
User authorisation of
SP requests (incl.
consent capture)

Copyright © 2019 GSMA. The Mobile Connectlogoisa trade markregistered and owned by the GSMA.123
Mobile Connect and FIDO both seeking to replace passwords via
use of the mobile phone for authentication
Something I
Know
Something I
Have
Something I Have
+
Something I
Know
Something I Have
+
Something I Am
Or

Mobile Connect can leverage FIDO to
expand its set of Authenticators
Federation
Authentication
User Management
Physical-to-digital identity
Existing MNO KYC
processes
Device-based authenticators
Existing MNO CRM databases
Network-basedauthenticators
(USSD, SIM applet etc.)

MNO
FIDO integrates into Mobile Connect as an optional authenticator
subsystem
Mobile phone
with FIDO client
(nativeapp or OS/browser)
AuthN server
User Agent
(tablet/desktop/mobile)
Service access request
Service Provider
Authentication
response
Identity GW
First mile
Second mile
FIDO server FIDO
RP
Discovery
authentication
1 2
3
4
Authentication
request
5

Provides strong authentication and a choice of authenticators based on the user’s
mobile device capabilities (e.g., fingerprint, face recognition etc.)
Expands the number of online services through which an end-user can
authenticate using FIDO via the Mobile Connect federated network
Further strengthens authentication robustness via the mobile network and using
network-derived information on the provenance of the mobile phone
e.g., flagging any change in the SIM <-> MSISDN <-> IMEI pairing that may
indicate fraudulent activity
Provides a wider set of identity services to the end-user including the ability to
assert their identity
Mobile Connect and FIDO are complementary

Mobile Connect
Brian Gorman - GSMA
bgorman@gsma.com
21/1/19

Copyright © 2018 GSMA. The MobileConnectlogoisa trade markregistered and owned by the GSMA.
Single mobile operator identity solution for online
services using the mobile phone- always with customer
Verifies that the user is in control of their mobile phone providing a
single-factor authentication (Level of Assurance 2) - something I
have(the phone) - or LOA3 with pin - something I know
Secure personal data sharing.Distributed, federated framework
utilising open standards
Password-less login to online resources across any device (mobile,
tablet, laptop) reducing friction
88%
of consumers say a single securelogin
solution would be beneficial tothem
Sources: GSMA Consumer Research 2015, Cyber Streetwise
Mobile Connect Authentication

MC Authenticate/Plus
Mobile Connect login
request. Click the link
to continue
Mobilebrand.com/veri
fyme/x1459j
Clickto login using Mobile Connect
(Desktop, tablet or mobile phone)
Clicklinkto authenticate
Enter PIN to authenticate
Modular framework
supports a range of
network-supported
authentication methods to
match the capabilities of
mobile devices in different
markets whilst also
supporting multiple levels of
authentication robustness
to meet Service Provider
(SP) needs

Copyright © 2019 GSMA. The MobileConnectlogoisa trade markregistered and owned by the GSMA.8
How it works
Tablet/desktop
Service access request
Service Provider
MNO
MobileConnect
request
Mobilephone
1
2
3
Authentication/
Authorisation
Discovery
Service
2
OperatorDiscovery
•
•
•
•
SIMApplet
USSD
SMS+URL
App

Copyright © 2019 GSMA. The Mobile Connectlogoisa trade markregistered and owned by the GSMA.Identity– MobileConnect131
Over 60 operators have deployed Mobile Connect in over 30 markets
At least one Operator live with MC active users
Live Operator Identity service interoperable with Mobile Connect
Operators in market deploying Mobile Connect
Mobile Connect
interoperable identity
service now being
used by 500m
monthly users
Growing demand for
strong authentication
(PSD2, GDPR)

Identity market strategic drivers
• GDPR, PSD2, eIDAS, UNCITRAL, EU 4th and 5th Anti Money
Laundering Directives, US: NIST recommendations 800-63,
EU NIS Directive: All creating new standards, obligations and
opportunities.
• e-commerce channel share of total sales has a
substantial opportunity for growth-currently at 11.9%1
• Mobile will continue to be the leading e-commerce
channel with 52.2% of all global web pages served to
mobile phones 2
• Friction in the purchase journey is still
substantial with 77.8% of shopping carts
on mobile abandoned (67% desktop) 3
Substantial regulatory change/focus
• Passwords are now recognised as
increasingly insecure - Google and Microsoft confirmplans to
replace them4
• Increasingconcerns over data privacy withsocial login5
• The average business user has 191 password log ins 6
Increasing security concerns
regarding protection of personal
data
• Increasingdesire from national governments
to create accessto public servicesvia digital
channelse.g. France Connect
Digitisation of public services
Fraud costs continue to grow
• Now 2.1% of m-commerce merchants
annual revenues7
Increasing market activity is creating a market
valuation of $34bn by 20228 e.g.
• Acquisitions-Facebook /.io
• Launches- Verimi, Itsme, WeChat national
identity
• New entrants Yoti
Drive for digital transformation

Company Mobile Connect
solution
Use case Detail
LOA2 - SIM applet
Header enrichment
Digital transformation Mobile Connect was crucial to Turkcell’s transformation from a network operator
to a digital services provider. 12m registered customers;24m+ transactions per
month
LOA3 - SIM applet plus pin NPD Working with the French Government Orange has created “Mobile Connect et
Moi”, a secure mobile authentication solution to access France Connect – its
public services digital services platform. This allows customers to register and
login with their mobile. 65k registered with 1k joining per week.
(Turkey)
LOA2 - SIM applet Digital commerce login With Facebook only log in,40% of downloads did not activate. Now 65% of
logins are via Mobile Connect and a further 5% use Mobile Connect to verify
MSISDN after login with Facebook.
(India)
LOA2 - USSD Digital commerce login Replaced SMS OTP as login process reducing login to a 2 step process driving
162% increase in use of the app.
Vedomosti (Russia)
Verified MSISDN Digital commerce login Vedomosti is a daily news portal. Mobile Connect was added as a log in in late
2017 and is now 25% of all logins exceeding Vkontakte (500m social accounts
in Russia),Twitter and Google
LOA2 - SMS-URL; SIM
applet
Single login to multiple
applications
Both America Movil and Telefonica have rolled out Mobile Connect as a login
process across multiple territories. It has replaced user name and password on
their main consumer portals but also for multiple digital propositions driving
rapid take up due to an enhanced customer experience.
What value is it creating? Case study summary

Case study overview
Country Turkey
Company Turkcell
Case study focus
Digital transformation – grow business by
transforming into a digital services provider
Use case
• Log in -Single,simplified authentication
solution across multiple applications (LOA2)
both Turkcell and 3rd party owned properties
• Verification -MSISDN Verification -
Identity – Mobile Connect134
Case study(1)

to continue
fyme/x1459j
Modular framework
supports a range of
network-supported
markets whilst also
(SP) needs

Copyright © 2019 GSMA. The Mobile Connectlogoisa trade markregistered and owned by the GSMA.Identity – Mobile Connect136
Turkcell digital transformation strategy
MC Authenticator
Turkcell 1 Turkcell 2 Turkcell 3 3rd party
Mobile Connect provides
a consistent log in
experience across multiple
applications
powering rapid adoption
• Turkcell strategy-1440 strategy- is to increase share of
customers daily digital experience from c.25 minutes
by developing new Turkcell digital propositions and
partnering
• A single authentication experience is central to this

Case Study: Turkcell: Driving value through digital transformation
Kaan Terzioglu, CEO Turkcell - October 2018
“Mobile Connect is a crucial part of our strategy…
By developing digital services we have extended our
relationship in a way that meets the security needs of
customers-
Our services have created a compelling reason to use
mobile number to connect whilst also having peace of
mind..”
• Turkcell has 10m Turkcell SIM customers registered for Mobile
Connect and 2m non-Turkcell, accessinga wide range of
digital services in excess of 24m times per month.

Copyright © 2019 GSMA. The Mobile Connectlogoisa trade markregistered and owned by the GSMA.Personal Data – Mobile Connect138
Mobile Connect powering partner growth(1)
•Hadi is one of Turkcells partners
•It is a general knowledge quiz broadcast twice per
day on mobile
•It uses Mobile Connect as the authentication
solution.
•This has helped power growth to 1m unique users
•Experience is based on sim applet with non Turkcell
sim using an OTT sms OTP for authentication.

Mobile Connect powering partner growth(2)
•Kimboo social discovery
•Customers concerns over data
security impacting commercial
performance
• Mobile Connect authentication (Fast
Login)improving log in experience
• MSISDN verification creating a
stronger proposition through verifying
numbers

Case study overview
Country
France
Company Orange
Case study focus
Digital transformation-New product
development to enter new sector
Use case
Simplified access to digital public services-
France Connect- from a fully mobile
authentication proposition (LOA3)
Case study (2)

to continue
fyme/x1459j
Modular framework
supports a range of
network-supported
markets whilst also
(SP) needs

Orange France:Digital transformation
•The French Government is driving the
digitisation of public services through
France Connect the public services
digital platform.400 public services are
accessible.
•The goal is that every citizen will have
a digital identity which would drive the
digital transformation of France –
reducing costs, simplifying life through
the “say it once” initiative, where public
bodies have to share information rather
than ask citizens for data already held.

France Connect- Mobile Connect et moi account set up
Standard
Authentication to
enter driving licence
agency with user
name and password
1.Authentication
via France
Connect
2.Select
authentication
via Mobile
Connect et moi
3.Create
an account
4.Start
5.MC and KYC
enrolment process

•Working with the French Government, Orange
has created “Mobile Connect et Moi” a secure
mobile authentication solution to access France
Connect.This allows customers to register and
login with their mobile device.
•The citizens’ identity is verified on registration
using an ID document scan. They can then access
all available public services using their mobile
device and a PIN stored on the SIM card as part
of an LOA3 level proposition utilising a SIM
applet.

Personal Data – Mobile Connect
•400 public services.All new public services must be
delivered digitally through France Connect
•10 private SP’s following law change May 2018 with
ambitions to grow in this sector
•6m registered citizens with goal of 10m early 2019
•4 IDP’s
•160k uses each day
“Orange sees digital identity as the key to unlocking value from digital transformation.There is an ambitious vision for France
Connect and we are delighted to have created a fully mobile proposition to support this vision.”
Serge Llorente- Orange Mobile Connect Director.

Case study overview
Country Russia
Company Vedomosti
Case study focus Optimising digital subscriptions
Use case Verified mobile number MSIDN
Case study (3)

Vedomosti Mobile Connect customer experience

Vedomosti digital subscriptions
• This is the first Russian mobile network x-industry solution.
• At registration the Operator confirms the customer’s MSISDN
creating a verified digital communication channel through which
to upsell premium content.
• Pilot rolled out – preferred method for new registrations;
overtaken Russian social media network VK for log ins;strong
contribution to optimisation of upsell programme

• The case studies illustrate that interest in solutions from
Mobile Network Operators (MNOs) is growing
• Mobile Connect is providing a digital identity standard
that enables service providers to leverage MNO capabilities
• Scope can include B2C authentication, B2B fraud
solutions and payment authorisation
Executive summary (1)

Network security
Contextual
information
Business
processes
• Risk factors to support transaction risk monitoring and Transaction Risk Analysis exemption
• Upgrade SMS OTP used as 2
nd
factor for account login or payment authorisation
• Two-factor solution for login to account and payment authorisation
Leveraging the whole mobile ecosystem to support a range of
PSD2 use cases

SCA under PSD2- summary of where MC could support
Scenario Use case MC Products
Payment authorisation Support Transaction Risk Analysis exemption from SCA. Account takeover ATP
Know your customer KYC
Verified msisdn
Payment authorisation Payment authorisation- Strengthen existing SMS OTP
2FA process where SCA is required.
Account takeover ATP
Know your customer KYC
Verified msisdn
Payment account
authentication
Step up authentication replacing sms otp as 2nd factor Verified msisdn
MC Authenticate
Payment authorisation Payment authorisation- needs SCA but not dynamic
linking code e.g. payment from bank account-
MC Authorise plus
Payment authorisation Replace sms -for remote electronic transactions where
the requirement is to dynamically link the transaction to a
specific amount and a specific payee,issuing a unique
code.
MC Authorise plus with dynamic link

Executive summary (2)
• We are contracting with global SPs who are looking to integrate into their own digital solutions
across territories and hence global standard can unlock this
• Complexity of the eco system can create barriers hence to entry/speed of development
• Hence GSMA has developed Mobile Connect Link, a commercial federation model

MC Link-removing barriers to entry and speeding up deployment
Identity– Mobile Connect
Problem statement
Service providers need to contract
with each MNO individually to
deliver a proposition.
Solution Why MC Link?
• This is slow and costly and is a
significant barrier to entry
MC Link –
• GSMA contracts with MNOs for
the supply of Mobile Connect
solutions- authentication,
attributes
• GSMA then creates a standard
contract for Service Providers to
contract with the GSMA
• This creates a consistent,
standardised product removing
major barriers to entry and
speeding up deployment
• MC Link can speed up commercial federation in a market
and allows any MNO or channel partner to sell Mobile
Connect with full market coverage
• MC Link opens up international reach and facilitates cross-
border Mobile Connect services between MNOs
MNO 1 SP 1
SP 2
SP 3
MNO 2
MNO 3
SP 1
CP 1
MNO 1
MNO 2
MNO 3
MC
Link
Country A
Country B
MNO JV
SP 2
SP 3
SP 4
MNO 1
SP 5MNO JV
Supply Demand

If you would like more information, please contact the GSMAvia:
mobileconnect@gsma.com
+44 (0) 20 73560600
www.gsma.com/identity
Followthe GSMA on Twitter: @GSMA
GSMA London Office
The Walbrook Building, 25 Walbrook, London EC4N 8AF

FIDO & Mobile Connect

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to FIDO & Mobile Connect

Similar to FIDO & Mobile Connect (20)

More from FIDO Alliance

More from FIDO Alliance (20)

Recently uploaded

Recently uploaded (20)

FIDO & Mobile Connect