Protecting IDAAS with FIDO Authentication

All Rights Reserved | FIDO Alliance | Copyright 20171

NEOWAVE + TRUSTELEM

PROTECTING IDAAS* (WEB/CLOUD SSO*)

WITH FIDO U2F

* IDAAS: IDENTITY AS A SERVICE SSO: SINGLE SIGN ON


Deployment Case Study: Trustelem & NeowaveProtecting IDAAS with FIDO U2F

Gregory Haïk, CEO, Trustelem

Frederic Martin, Security Architect, NEOWAVE


FIDO U2F TO PROTECT IDENTITY AS A SERVICE


NEOWAVE: SMART CARD BASED SECURITY PRODUCTS

NEOWAVE mission is to address these issues through strong authentication, encryption and digital

signatures based on secure smart card based products.

Identity theft (phishing), fraud, data theft and cyber attacks are on the rise


EASY PHISHING ATTACKS AGAINST SMS CODES

User Real website

usernamepassword

SMS

usernamepassword

SMS

Send SMS3

1

4 5

2

Fake website or MITM attack


EASY PHISHING ATTACKS AGAINST OTP / TOTP

usernamepassword

OTP

usernamepassword

OTP

OTP generator2

1

3 5

4

User Real websiteFake website or MITM attack


EASY PHISHING ATTACKS AGAINST SCANNED QR CODE VALIDATION

User Real websiteFake website or MITM attack

Give access

Read QR Code

2

3

1

Validate (wrong) access4

5


FIDO U2F: SIMPLE / SECURE SOLUTION AGAINST PHISHING ATTACKS

2 – Data to be signed(challenge, hashed url, etc.)

4 – Signed Data

3 – Digital Signature

(built-in smart card)

6 – Signature

Verification

1 – Data to be signed(challenge, hashed url, etc.)

5 – Signed Data

SSL Token Binding

MITM protection


FIDO U2F USB SECURITY KEY

PLUG KEYDO

SECURITY KEY IN

ENTER USERNAME

& PASSWORDTHAT’S IT


FIDO U2F NFC CARD

APPROACH

BADGEO NFC CARD

THAT’S IT

ENTER USERNAME

& PASSWORD


TRUSTELEM: IDENTITY AS A SERVICE

Company

Corporate applications

Trustelem enables your IT users to go from

one application to another, without the need to

re-authenticate.

Trustelem manages digital identities of your

IT users (IDaaS - Identity-as-a-Service Cloud

Single Sign-On, SSO).


FIDO U2F ADVANTAGES FOR WEB SSO LOGON

• No driver installation requirement

• Web browser built-in support

• Multi-platform / multi-channel protocol

• High security level (built-in smart card)

• Ultimate solution against identity theft


SIMPLE /SECURE WEB SSO LOGON

Password then

FIDO U2F


ALL-IN-ONE USER DASHBOARDS ACCESSPROTECTION

Now you don’t have to

wait for Microsoft to

integrate FIDO U2F

authentication :)


APPLICATIONS ACCESS

e.g. facebook workplace


ADMIN CONSOLE

Setup directories, users,

apps, permissions…

Logs, deployment audit


MORE FIDO U2F ADVANTAGES

• FIDO U2F devices are anonymous (no user

information, just anonymous keys, association

is done on the server side)

• FIDO U2F devices can be filtered, web

services can be locked only for our own

customized devices (attestation certificate)


CONCLUSION

• FIDO U2F strongly recommended

for Web SSO users and/or administrators

• Secure but easy to use and deploy

Internet

Protecting IDAAS with FIDO Authentication