cis14: building blocks for mobile authentication and security
DESCRIPTION
Rajiv Dholakia, Nok Nok Labs Overview and insights into some of the building blocks that make a modern security and authentication stack work and why we should be optimistic about our ability to transform authentication in particular and security in general as these platforms grow and evolve, in light of the building blocks provided by modern mobile operating systems and hardware for crafting a robust authentication implementation.TRANSCRIPT
1!
TPM
FINGERPRINTSECURE
USB
FACE
BIOMETRIC
PIN
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURE
ELEMENT
NFC
USB
FACE
BIOMETRIC
PIN TOKEN
RBA
ACTIVE
SILENT
TPM
FINGERPRINT
VOICEELEMENT
NFC
USB
FACE
BIOMETRIC
TOKEN
RBA
PASSIVE
ACTIVE
SILENT TPM
VOICE
SECURE
ELEMENT
NFC
USB
FACE
PIN
TOKEN
RBA
PASSIVEACTIVE
SILENT
TPM
FINGERPRINT
VOICE
NFC
USB
FACE
BIOMETRIC
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURENFC
USB
FACE
PIN
PASSIVE
ACTIVE
TPM
FINGERPRINT
VOICE
ELEMENT
NFC
USB
FACE
BIOMETRIC
TOKEN
RBA
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURENFC
FACE
PIN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURE
ELEMENT
NFC
USB
FACE
PINACTIVE
SILENT
TPM
ELEMENT
NFC
USB
FACE
BIOMETRIC
PIN
PASSIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURE
ELEMENT
NFC
USB
FACE
PIN
TOKEN
PASSIVE
ACTIVE
FINGERPRINT
VOICE
SECURE
ELEMENT
USB
BIOMETRIC
PIN
TOKEN
RBA PASSIVE
ACTIVE
VOICE
SECURE
NFC
FACE
TOKEN
PASSIVEACTIVE
TPM
ELEMENT
NFC
USB
FACE
PIN
TOKEN
RBA
TPM
FINGERPRINT
SECURE
NFC
USB
FACE
PIN
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
NFC
FACE
BIOMETRIC
PIN
PASSIVE
SILENT
ELEMENT
NFC
USB
TOKEN
RBA
PASSIVE
TPM
VOICE
SECURE
ELEMENT
NFC
FACE
BIOMETRIC
PIN
ACTIVE
TPM
FINGERPRINT
SECURE
USB
TOKEN
ACTIVE SILENT
TPM
FINGERPRINT
VOICENFC
USB
FACE
PIN
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
SECURE
ELEMENT
USB
FACE
PIN
TOKEN
RBA
SILENT
TPMELEMENT
NFC
USB
FACE
PIN
TOKEN
RBA
PASSIVE
SILENT
TPM
ELEMENT
NFC
USB
PIN
TOKEN
RBA
ACTIVE
FINGERPRINT
ELEMENT
USB
TPM
VOICE
ELEMENT
USB
PIN
RBA
PASSIVE
ACTIVE
TPM
VOICE
SECURE
ELEMENT
USB
FACE
ACTIVE
FINGERPRINT
VOICE
PIN
RBA
PASSIVE
ACTIVE
TPM
FINGERPRINT
ELEMENT
FACE
TOKEN
RBA
ACTIVE
TPM
ELEMENT
NFC
USB
FACE
BIOMETRIC
RBA
ACTIVE
SILENT
TPM
FINGERPRINT
SECURE
ELEMENT
USB
FACE
PIN
TOKEN
PASSIVE
SILENT
VOICE
USB
FACE
BIOMETRIC
RBA
ACTIVE
SECURE
NFC
USB
BIOMETRIC
PIN
SILENT
TPM
VOICE
NFC
USB
FACE
PIN
USB
FACE
BIOMETRIC
PIN
RBA
ACTIVE
FINGERPRINT
NFC
TOKEN
RBA
VOICE
ELEMENT
USB
FACE
PIN
RBA
SILENT
VOICE
SECURE
FACE
PIN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
RBA
ACTIVE
TPM
FACE
TOKEN
RBA
ACTIVE SILENT
VOICE
ELEMENT
USB
FACE
PIN
RBA
ACTIVE
SILENT
PIN
TOKEN
RBA
VOICE
SECURE
NFC
USB
TOKEN
PASSIVE
ACTIVE
TPM
FACE
BIOMETRIC
TOKEN
ACTIVE
TPM
FACE
NFC
USB
FACE
BIOMETRIC
TOKEN
PASSIVE
PIN
ACTIVE
TPM
VOICE
ELEMENT
NFC
TPM
VOICE
NFC
USB
FACE
TOKEN
RBA
TPM USB
FACE
BIOMETRIC
RBA
PASSIVE
SILENT
USB
BIOMETRIC
TPM
SECURE
NFC
PIN
RBA
PASSIVE
SILENT
VOICE
SILENT
VOICE
ELEMENT
USB
PIN
TOKEN
RBA
PASSIVE
NFC
FACE
BIOMETRIC
TOKEN
RBA
SILENT
TPM
SECURE
SILENT
VOICE
USB
RBA
USB
FACE
RBA
VOICE
RBA
SILENT
SECURE
USB
PIN
RBA
SILENT
TPM
ELEMENT
USB
FACE
VOICE
NFC
USB
TOKEN
RBA
SECURE
FACE
TPM
FACE
PIN
FINGERPRINT
NFC
RBA
SILENT
USB
FACE
PIN
ACTIVE
SILENT
PIN
RBA
NFC
USB
BIOMETRIC
TPM
VOICE
USB
FACE
PASSIVE
ELEMENT
TOKEN
TPM
VOICE
SILENT
NFC
USB
PIN
RBA
SILENT
TPM
VOICE
NFC
USB
FACE
PASSIVE
TPM
VOICE
TPM
NFC
PIN
TOKEN
ACTIVE
SECURE
USB
RBA
PASSIVE
NFC
USB
FACE
RBA
TPM
TOKEN
PASSIVE
SECURE
USB
FACE
ACTIVE
TPM
FACE
PIN
RBA
VOICE
USB
PASSIVE
TOKEN
RBA
NFC
USB
SILENT
USB
RBA
FACE
PIN
ACTIVE
NFC
USB
USB
PIN
RBA
NFC
SILENT
TPM
VOICE
FACE
PIN
TPM
NFC
USB
TPM
RBA
PASSIVE
NFC
USB
PIN
TPM
PIN
PASSIVE
PIN
USB
TPM
NFC
USB
FACE
FACE
RBA
SILENT
FINGERPRINT
USB
NFC
USB
ACTIVE
VOICE
USB
TPM
PIN
RBA
FACE
TPM
TPM
USB
PIN
TPM
NFC
FACE
TOKEN
RBA
USB
PASSIVE
VOICE
NFC
PIN
USB
FACE
USB
RBA
TPM
PIN
NFC
FACE
RBA
ACTIVE
TPM
USB
USB
TPM
PIN
FACE
NFC
USB
PIN
RBA
FACE
USB
USB
RBA
NFC
NFC
TPM
NFC
RBA
USB
PIN
NFC
USB
PIN
USB
ELEMENT
PIN
PIN
TPM
USB
USB
TPM
VOICE
NFC
RBA
USB
RBA
RBA
PIN
USB
USB
USB
USB
NFC
USB
NFC
USB
TPM
FACE
USB
PIN
USB
USB
PIN
NFC
VOICE
NFC
USB
USB
USB
USB
FACE
TPM
USB
TPM
USB
USB
TPM
USB
FACE
NFC
RBA
USB
USB
USB
FACE
USB
USB
RBA
PIN
VOICE
USB
PIN
USB
USB
RBA
USB
TPM
RBA
RBA
PIN
NFC
NFC
USB
TPM
USB
TPM
USB
USB
USB
USB
NFC
TPM
NFC
FACE
USB
FACE
USB
USB
TPM
USB
USB
USB
USB
USB
FACE
USB
USB
USB
USBRBA
USB
USB
USB
USB
USB
USB
USB
RBA
USB
USB
USB
NFC
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
BUILDING BLOCKS!FOR MOBILE SECURITY!AND AUTHENTICATION!
ELEMENTS OF INTEGRITY & SECURITY !
Device Integrity!(Is the hardware the right hardware?) !
Network Integrity!(Am I talking to the right network resource,
can I trust that resource) !
OS & App Integrity!(Did someone tamper with my OS, is there
malware, am I talking to the right app?) !
User Integrity!(Is the user the right user?) !
Data & Transaction Integrity !
2!
SECURITY IS ONLY AS STRONG AS THE WEAKEST LINK!
3!
Integrity Hardware! OS! App! Network! User!
Patch when you find a gap! Security Whack-A-Mole!
A UNIQUE OPPORTUNITY !
4!
Hardware Integrity!
OS Integrity!
App Integrity!
Network Integrity!
User Integrity!
Re-Architect Computing Using Hardware-Based Trust !
Chain of Trust!
Trusted Platform!
THE MOBILE EPOCH !
5!
INTEGRITY MECHANISMS – I !
• TPMs!• Backwards compatibility requirements !
• SEs!• Limited due to operator controls!
• TEEs!• Third time is a charm?!
• Secure boot !- Verification of image!
• Virtualization!- Hardware assisted isolation!
• Anti-virus !• Device Theft Response!- Standard on mobile devices !
6!
TEE! SE! TPM!
Hardware OS
INTEGRITY MECHANISMS – II !
7!
App User
• App verification!- Rise Of The App Store!
• App Isolation!- App containers !- Restricted IPC !
• Protecting Data & Content!- On-device data encryption !- DRM !
• Identity Proofing!- Know your customer!
• Strong Authentication!- Explicit & implicit!- First mile & Second mile!
FOUNDATION OF A TRUSTED PLATFORM !
8!
Partition! Partition!
Partition Manager!
Hardware!
System Protection!
PII Handling!
!Evidence/
Measurement!!
Reporting/Attestation!
!Platform
Management!!
Policy Engine!
Hardware!Protected Storage!
Randomness!
Detection & Inspection!
Sequencing!
Architecture!Performance!
Within Partition!!Protected
Execution!
Outside!!
External !Access!
Between Partitions!!Isolation!
Trusted Channel!
ISOLATION ARCHITECTURE ARM TRUSTZONE !
9!
Secure OS Boot!
FP Sensor!
Touchscreen!
Storage !
1.7 B ARM Cortex
SoCs Shipped!
18 Month Phone Refresh
Rate!
PROTECTED EXECUTION TRUSTONIC TEE !
10!
App!
TEE!
Normal!
App!TEE Enabled!
Rich OS!
Trustlet!
500M TEEs Shipped!
TRUSTED PLATFORMS IN PRACTICE!
11!
iOS Samsung Knox
Trustzone-based Integrity Management Architecture!(TIMA)!
Security Enhancements for Android!
BUILDING BLOCKS AVAILABLE BUT CAPABILITIES ARE NOT EXERCISED!
• Access Limitations !- TPM !- SE!- TEE!
• Integration pain!- Need usable abstractions,
standardization, ecosystems, partnerships!
!• Inter-party verification of
components!- Need operational relationships!
12!
BUILDING THE PLUMBING!
13!
Hardware Integrity
User Integrity
OS & App Integrity
Network Integrity
ROUGH CONSENSUS + WORKING CODE !
14!
50-60M Units!Expected to ship!
Galaxy S5 World’s First FIDO Ready Smartphone
Any Device.!Any Application.!Any Authenticator. !
15!
TPM
FINGERPRINTSECURE
USB
FACE
BIOMETRIC
PIN
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURE
ELEMENT
NFC
USB
FACE
BIOMETRIC
PIN TOKEN
RBA
ACTIVE
SILENT
TPM
FINGERPRINT
VOICEELEMENT
NFC
USB
FACE
BIOMETRIC
TOKEN
RBA
PASSIVE
ACTIVE
SILENT TPM
VOICE
SECURE
ELEMENT
NFC
USB
FACE
PIN
TOKEN
RBA
PASSIVEACTIVE
SILENT
TPM
FINGERPRINT
VOICE
NFC
USB
FACE
BIOMETRIC
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURENFC
USB
FACE
PIN
PASSIVE
ACTIVE
TPM
FINGERPRINT
VOICE
ELEMENT
NFC
USB
FACE
BIOMETRIC
TOKEN
RBA
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURENFC
FACE
PIN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURE
ELEMENT
NFC
USB
FACE
PINACTIVE
SILENT
TPM
ELEMENT
NFC
USB
FACE
BIOMETRIC
PIN
PASSIVE
SILENT
TPM
FINGERPRINT
VOICE
SECURE
ELEMENT
NFC
USB
FACE
PIN
TOKEN
PASSIVE
ACTIVE
FINGERPRINT
VOICE
SECURE
ELEMENT
USB
BIOMETRIC
PIN
TOKEN
RBA PASSIVE
ACTIVE
VOICE
SECURE
NFC
FACE
TOKEN
PASSIVEACTIVE
TPM
ELEMENT
NFC
USB
FACE
PIN
TOKEN
RBA
TPM
FINGERPRINT
SECURE
NFC
USB
FACE
PIN
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
NFC
FACE
BIOMETRIC
PIN
PASSIVE
SILENT
ELEMENT
NFC
USB
TOKEN
RBA
PASSIVE
TPM
VOICE
SECURE
ELEMENT
NFC
FACE
BIOMETRIC
PIN
ACTIVE
TPM
FINGERPRINT
SECURE
USB
TOKEN
ACTIVE SILENT
TPM
FINGERPRINT
VOICENFC
USB
FACE
PIN
TOKEN
RBA
PASSIVE
ACTIVE
SILENT
TPM
SECURE
ELEMENT
USB
FACE
PIN
TOKEN
RBA
SILENT
TPMELEMENT
NFC
USB
FACE
PIN
TOKEN
RBA
PASSIVE
SILENT
TPM
ELEMENT
NFC
USB
PIN
TOKEN
RBA
ACTIVE
FINGERPRINT
ELEMENT
USB
TPM
VOICE
ELEMENT
USB
PIN
RBA
PASSIVE
ACTIVE
TPM
VOICE
SECURE
ELEMENT
USB
FACE
ACTIVE
FINGERPRINT
VOICE
PIN
RBA
PASSIVE
ACTIVE
TPM
FINGERPRINT
ELEMENT
FACE
TOKEN
RBA
ACTIVE
TPM
ELEMENT
NFC
USB
FACE
BIOMETRIC
RBA
ACTIVE
SILENT
TPM
FINGERPRINT
SECURE
ELEMENT
USB
FACE
PIN
TOKEN
PASSIVE
SILENT
VOICE
USB
FACE
BIOMETRIC
RBA
ACTIVE
SECURE
NFC
USB
BIOMETRIC
PIN
SILENT
TPM
VOICE
NFC
USB
FACE
PIN
USB
FACE
BIOMETRIC
PIN
RBA
ACTIVE
FINGERPRINT
NFC
TOKEN
RBA
VOICE
ELEMENT
USB
FACE
PIN
RBA
SILENT
VOICE
SECURE
FACE
PIN
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
VOICE
RBA
ACTIVE
TPM
FACE
TOKEN
RBA
ACTIVE SILENT
VOICE
ELEMENT
USB
FACE
PIN
RBA
ACTIVE
SILENT
PIN
TOKEN
RBA
VOICE
SECURE
NFC
USB
TOKEN
PASSIVE
ACTIVE
TPM
FACE
BIOMETRIC
TOKEN
ACTIVE
TPM
FACE
NFC
USB
FACE
BIOMETRIC
TOKEN
PASSIVE
PIN
ACTIVE
TPM
VOICE
ELEMENT
NFC
TPM
VOICE
NFC
USB
FACE
TOKEN
RBA
TPM USB
FACE
BIOMETRIC
RBA
PASSIVE
SILENT
USB
BIOMETRIC
TPM
SECURE
NFC
PIN
RBA
PASSIVE
SILENT
VOICE
SILENT
VOICE
ELEMENT
USB
PIN
TOKEN
RBA
PASSIVE
NFC
FACE
BIOMETRIC
TOKEN
RBA
SILENT
TPM
SECURE
SILENT
VOICE
USB
RBA
USB
FACE
RBA
VOICE
RBA
SILENT
SECURE
USB
PIN
RBA
SILENT
TPM
ELEMENT
USB
FACE
VOICE
NFC
USB
TOKEN
RBA
SECURE
FACE
TPM
FACE
PIN
FINGERPRINT
NFC
RBA
SILENT
USB
FACE
PIN
ACTIVE
SILENT
PIN
RBA
NFC
USB
BIOMETRIC
TPM
VOICE
USB
FACE
PASSIVE
ELEMENT
TOKEN
TPM
VOICE
SILENT
NFC
USB
PIN
RBA
SILENT
TPM
VOICE
NFC
USB
FACE
PASSIVE
TPM
VOICE
TPM
NFC
PIN
TOKEN
ACTIVE
SECURE
USB
RBA
PASSIVE
NFC
USB
FACE
RBA
TPM
TOKEN
PASSIVE
SECURE
USB
FACE
ACTIVE
TPM
FACE
PIN
RBA
VOICE
USB
PASSIVE
TOKEN
RBA
NFC
USB
SILENT
USB
RBA
FACE
PIN
ACTIVE
NFC
USB
USB
PIN
RBA
NFC
SILENT
TPM
VOICE
FACE
PIN
TPM
NFC
USB
TPM
RBA
PASSIVE
NFC
USB
PIN
TPM
PIN
PASSIVE
PIN
USB
TPM
NFC
USB
FACE
FACE
RBA
SILENT
FINGERPRINT
USB
NFC
USB
ACTIVE
VOICE
USB
TPM
PIN
RBA
FACE
TPM
TPM
USB
PIN
TPM
NFC
FACE
TOKEN
RBA
USB
PASSIVE
VOICE
NFC
PIN
USB
FACE
USB
RBA
TPM
PIN
NFC
FACE
RBA
ACTIVE
TPM
USB
USB
TPM
PIN
FACE
NFC
USB
PIN
RBA
FACE
USB
USB
RBA
NFC
NFC
TPM
NFC
RBA
USB
PIN
NFC
USB
PIN
USB
ELEMENT
PIN
PIN
TPM
USB
USB
TPM
VOICE
NFC
RBA
USB
RBA
RBA
PIN
USB
USB
USB
USB
NFC
USB
NFC
USB
TPM
FACE
USB
PIN
USB
USB
PIN
NFC
VOICE
NFC
USB
USB
USB
USB
FACE
TPM
USB
TPM
USB
USB
TPM
USB
FACE
NFC
RBA
USB
USB
USB
FACE
USB
USB
RBA
PIN
VOICE
USB
PIN
USB
USB
RBA
USB
TPM
RBA
RBA
PIN
NFC
NFC
USB
TPM
USB
TPM
USB
USB
USB
USB
NFC
TPM
NFC
FACE
USB
FACE
USB
USB
TPM
USB
USB
USB
USB
USB
FACE
USB
USB
USB
USBRBA
USB
USB
USB
USB
USB
USB
USB
RBA
USB
USB
USB
NFC
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
Appendix!
PRIVATE & CONFIDENTIAL! 16!