2019 DevDay
Strong Customer Authentication &
Biometrics Using FIDO
> Kieun Shin
> LINE Security Development Team Engineer
Slide 2
Slide 2 text
Agenda
> Do you like passwords?
> What is FIDO?
> What we’ve done? (LINE FIDO platform)
> Which services are using FIDO in LINE?
> What’s next?
Slide 3
Slide 3 text
How many accounts
do you have?
Slide 4
Slide 4 text
Do you like passwords?
Slide 5
Slide 5 text
Nobody likes passwords
Only hackers passwords!
Phishing
Social engineering Key logging
Credential stuffing
Slide 6
Slide 6 text
Passwords are the root of all most of breaches.
Passwords are not secure
From 2016 to 2017
Security incidents
279%
Supports costs
Forgotten password
20%
Among breaches
Due to passwords
81%
source: Verizon cyber crime case study 2017
Slide 7
Slide 7 text
Indeed, they’re great solutions.
We have solutions
2 Factor Authentication
(OTP, SMS codes)
Federation and SSO
(OIDC, OAuth)
Biometrics
(Fingerprint, Face)
Password Managers
(1password and etc.)
Slide 8
Slide 8 text
The best is yet to come
Slide 9
Slide 9 text
What is ?
Slide 10
Slide 10 text
Industry’s answer to the password problems.
Industry efforts for better authentication
Members
250+
Partners
30+
Hours
10000+
Slide 11
Slide 11 text
Design principles
> Strong against various attacks
> Pluggable and interoperable
> Easy to use
Design a new authentication
> Privacy preserving
Slide 12
Slide 12 text
How does FIDO work?
It’s based on the public key cryptography.
Device
(Authenticator)
RP Server
(Web Server)
User verification FIDO Protocol
User
(Device owner)
Challenge (random number)
Prompt user gesture
User gesture
Response (signature)
Success or fail
Unlock private key
Verify signature (/w public key)
Slide 13
Slide 13 text
FIDO specifications
FIDO2 is the newest set of specifications.
FIDO2 CTAP W3C WebAuthn
Platform proprietary
FIDO2
External
Authenticator
Platform
Authenticator
Relying Party
Client
Slide 14
Slide 14 text
Why FIDO matters?
Slide 15
Slide 15 text
Protect our users from attacks
Authentication is a gateway to services and one of the efficient ways to protect accounts.
Slide 16
Slide 16 text
Business expansion to Fintech area
We are now trying to provide more financial services.
Slide 17
Slide 17 text
It allows for the creation of strong, attested and scoped credentials.
> Provides MFA if the authenticator has user verification features
> Splits local authentication (user verification) and online authentication
> Provides strong assurance of device possession
What makes FIDO different?
> Supported by major browsers and platforms
Slide 18
Slide 18 text
Strong assurance of device possession
The key has following security properties.
Generated randomly
(Guess)
Stored in secure area
(Extraction)
Attested by trust root
(Emulation)
Generating the signature
(Forgery)
> Strongly assure the authentication was performed with the device
which was registered before.
Slide 19
Slide 19 text
Multi-factor authentication support
Adding something you are or something you know factor
Something you are Something you know
Something you have
OR
Slide 20
Slide 20 text
Major browser/platform support
FIDO becomes cross-platform/browser support and universal.
Platforms
(Operating systems)
Browsers
(Web engines)
Slide 21
Slide 21 text
What we’ve done?
(LINE FIDO platform)
Slide 22
Slide 22 text
LINE FIDO Server
Works with any FIDO compatible devices (supports all FIDO specifications)
> World’s first achievement for FIDO Universal Server certification as a
service provider (Dec. 2018)
Ensures interoperability with all
FIDO Certified Authenticators
Slide 23
Slide 23 text
Utilities/helpers and etc
Services
LINE FIDO Server software stack
LINE FIDO Server is built on top of Spring Boot with Reactive stack.
Storage
Mongo DB Redis
Routers/
Handlers
Framework (Library)
Challenge Response Attestation
Metadata Session
Certificate
Spring Boot Spring Webflux
Crypto COSE X509
Validator Mapper Config
Lettuce
Reactive Mongo
Reactive Netty
Metadata client
MDS client
Serializer
Deserializer
Verifier
Spring Security
Bouncy Castle
Slide 24
Slide 24 text
LINE FIDO Server deployment models
Supports both models depending on the conditions (e.g., regulation)
AaaS (Authentication-as-a-Service) On Premise
Slide 25
Slide 25 text
LINE FIDO2 Combo for iOS
Uses Touch ID and Face ID as UV and leverages WBC (Whitebox cryptography) for attestation
RP App (View)
LINE FIDO2 Combo
(FIDO2 Client, Authenticator Logic)
LTSM
(LINE Trusted Security Module)
WAL
(Whitebox Abstraction Layer)
KAL
(KeyChain Abstraction Layer)
Slide 26
Slide 26 text
LINE FIDO2 Compat for Android
Abstraction layer supporting both Android native authenticator and LINE authenticator
RP App (Activity)
LINE FIDO2 Glue Layer
(Abstraction)
LINE Authenticator FIDO2 GMS Core
Native
Authenticator
External
Authenticator
Single API entry point
FIDO Play service API
CTAP2
LTSM
Slide 27
Slide 27 text
Which services are using
FIDO in LINE?
Slide 28
Slide 28 text
LINE Pay is now using FIDO
Slide 29
Slide 29 text
Why LINE Pay adopts FIDO?
Motivations
FIDO
Industry standards
Best
Security
Frictionless UX
Zero incidents
Customer
Trust
Slide 30
Slide 30 text
High-level architecture
LINE Pay iOS App
(TALARIA)
LINE Pay RP Server
(for JP)
LINE Pay Central
Server
LINE FIDO2 Server
(for JP Pay)
Passcode authentication
(or old biometric authentication)
FIDO Operations FIDO Operations
LINE FIDO2 Combo
for iOS
Authentication management
LINE FIDO2 Server
(for TW Pay)
LINE Pay RP Server
(for TW)
FIDO Operations
Future works
Slide 31
Slide 31 text
Registration flow
Generates a key pair and registers the public part of the key to the server
iOS (Face ID, Touch ID) Android (Fingerprint, Face)
Slide 32
Slide 32 text
Authentication flow
Generates a digital signature and verifies it on the server with the public key
App launching Payment
User scans the QR code for payments and confirms the transaction .
Slide 33
Slide 33 text
LINE Pay deployment plan
Expands FIDO adoptions across countries
Released in Sept. Release in Nov. 2020 2020
Standalone
App (Android) In-app (LINE) Other
countries
Standalone
App (iOS)
Slide 34
Slide 34 text
What’s next?
Slide 35
Slide 35 text
Bootstrap with your phone or watch
User authenticates to a service with new device for the first time
LINE Desktop is trying to
verify your identity on
Macbook.
Verify your identity with biometric.
Login with your phone
Slide 36
Slide 36 text
Re-authentication
User tries to authenticates to a service again
Login with your phone
LINE is trying to verify your
identity.
Verify your identity with biometric.
LINE is trying to verify your
identity.
Verify your identity with biometric.
Confirm access to your
account
LINE is requesting access to your
account
Slide 37
Slide 37 text
Identity binding
Bind government-issued identity document authentication (KYC) with FIDO credential
Identity documents Selfie
KYC (Know Your Customer)
User devices
AND
FIDO
Slide 38
Slide 38 text
Go password-less
Remove passwords from all LINE services.
Stop using passwords
Integrate FIDO to all LINE services. Users can
authenticate with FIDO for all LINE services.
Integrate FIDO to all LINE services
Encourage users to enroll multiple
authenticators.
Introduce multiple FIDO authenticators
Introduce FIDO to LINE Login and LINE Pay.
Educate users for the convenience.
FIDO authentication for user convenience