The Universal Personal Authenticator

1
The Universal Personal Authenticator
2
What is FireID?
3
Universal Personal Authenticator

• A singular, comprehensive solution for the
  worlds authentication needs in the online age.
• A framework for easily, conveniently and securely
  identifying users for access to VPNS, online
  applications and any application or service that
  requires authentication.
• A cost effective, convenient solution for both
  the end user and the institution.

4
What is FireID?

• 2-factor strong authentication on your mobile
  phone
• Replaces static passwords
• Alternative to hardware tokens/fobs, SMSs,
  biometrics
• Generates one-time-passwords (OTPs) on thousands
  of different mobile phones
• Passwords are generated instantaneously out of
  band

5
What is FireID?

• Highly secure, conforms to US FIPS and OATH
  standards
• Uses multiple segregated OTP tokens for
  authenticating to multiple different systems
• Simple and easy deployment
• Easy integration into existing infrastructure
• Built on latest trends in sustainable technology
  such as Java and Glassfish
• Patent applications filed for certain core
  technologies
• Fixed cost solution (per user per annum with
  volume discounts)

6
Background

• Founded 2005 under the umbrella of 4D
  Innovations Group
• Initially to cater for internet banking security
• Expanded to a framework for comprehensive global
  authentication
• Based in Technopark, Stellenbosch
• Version 1.0 officially launched July 2008
• Version 1.1 released October 2008
• Major funding in place by March 2009
• Multiple token version available April 2009

7
Why OTPs?
8
Why OTPs (One Time Passwords)?

• Conventional authentication relies on static
  passwords
• Static passwords are weak
• Simple or repeated passwords easy to crack
• Users write down or store passwords near to their
  computer
• Key-loggers can capture a users key strokes
• Tempest methods can capture a users key
  strokes remotely from 20m away
• An OTP is randomly generated for the user every
  time the user needs to login
• Expires immediately once used
• OTPs cannot be predicted

9
Solutions so far
10
Solutions so far

• Physical hardware token device to generate OTPs
• Expensive and not durable
• Inconvenient and cumbersome
• Easily lost or forgotten
• Battery life problems
• Deployment a logistical nightmare
• Limited to one OTP token (one company) per device

11
Solutions so far

• SMS OTP
• Not secure as can be easily intercepted over the
  air
• Rely on cellular network connectivity
• Frequently delayed
• Sent in the clear as plain text
• SIM cards are easy to copy
• Costs are not fixed

12
How does FireID work?
13
How does FireID work?

• Three components
• FireID Mobile Application
• FireID TKS Authentication Server
• FireID Deployment System

14
FireID Mobile Application

• The FireID Mobile Application uniquely deploys
  in phone specific format to 1000s of different
  phones
• Generates secure one-time-passwords for one or
  many different applications
• Easily deployed and simple to use
• Two OTP generation methods
• Fast Login
• Interactive Login

15
FireID with one installed token generating a
one-time-password
16
FireID with multiple installed tokensgenerating
a one-time-password
17
FireID Mobile Application

• Generates a modified OATH OTP Seven character
  alphanumeric (78 billion possible passwords)
• After an OTP is generated, the user types the
  password into the computer or device
• The FireID Authentication Server verifies the
  users OTP
• Example shown is a common VPN client

18
FireID Mobile Application

• Native versions of the FireID mobile application
  allow unique handset OS integration
• Example shown direct Today screen integration
  on Windows Mobile 5 and 6 to generate OTPs
  without first launching the application

19
FireID Authentication Server

• The FireID Authentication Server allows an
  organisation to deploy and manage the FireID
  mobile application and OTP tokens and to
  authenticate FireID users via various vectors
• The FireID server is installed
• inside the organisations network
• or hosted by FireID online as a virtual
  web-service (Amazon EC2 cloud)
• Automatically updates itself to latest version

20
FireID Authentication Server

• Managed via easy to use web interface, or
  directly integrated SOAP API
• Server integrates via
• RADIUS
• SOAP API
• Real time data links to single or multiple user
  databases
• No synchronisation or importation of the user
  database is performed
• The user base continues with existing management
  tools (no dual user management)
• Deployed with FireID mobile tokens with a few
  simple clicks
• High Availability and Load Balancing with
  Glassfish technology

21
FireID Deployment System

• Deploys the FireID Mobile Application to client
  user base
• Layers of segregation offer organisational
  security
• Centralised , online provisioning platform
• Deploys to existing and new FireID end-users
• Individual users or groups deployed automatically
  with a few clicks
• FireID Authentication Server sends deployment
  request
• The Deployment System interacts with the
  Authentication Server
• SMS can be used with or without the online
  tutorial

22
FireID end user experience

• Users receive welcome, branded e-mail, containing
  a web link
• Web link opens on PC
• Simple, online interactive tutorial begins in
  browser
• Guides the user through simple steps and tracks
  the users progress
• Users phone make, model and platform is
  automatically detected
• Appropriate version of the application delivered
  to phone

23
(No Transcript)
24
FireID Deployment System - benefits

• Self-driven - reduces overhead and administration
• SMS deployment useful for unseen user base e.g
• Online shopping sites
• Internet banking
• Online customer portals
• Users can self-deploy and activate online from
  website or during signup.
• Immediate activation to generate OTPs for logon

25
What can FireID be used for?
26
FireID Applications

• Wherever authentication is required
• Any device, system, application, website username
  password
• VPN / Remote Access / Remote control
• Network switches, routers, firewalls, servers
• E-commerce / online shopping sites
• Webmail, social networking, news media and other
  sites
• Online document repositories
• Internet banking
• Credit card transaction verification
• Customer portals (insurance, medical aid, etc)

27
Why FireID?
28
Convenient, cost effective and secure solution to
universal personal authentication

• Convenience
• end-users always carry their mobile phones
• No need for additional hardware
• Easy to re-deploy
• Easy to use
• One solution for multiple applications
• Cost effective
• No logistical overhead
• Per user, per annum fee
• No ongoing maintenance fee
• No server fee
• Simple and easy reduced call centre interaction
• Secure
• Mobile phones always present

29
(No Transcript)