Mobile devices: A better route to ID security

In the federal government, Common Access Cards and personal identity verification cards for employees and contractors incorporate biometrics and give agencies a better foundation for security and ID management than many private-sector organizations enjoy.

But that wasn’t always the case. A few years ago, Kayvan Alikhani, senior director of technology at RSA Security, would have recommended against using most biometrics as the front line in authentication.

The technology returned too many false positives and false negatives to be reliably used. Yet today, he said, "with iris detection, we're at one out of 5 million when it comes to false acceptance or rejection rates."

And it's not just irises. Fingerprint scans are now a central part of many mobile phones' login process, and some devices are capable of hand scans, vein detection, facial recognition and voice recognition as well. It's even possible to identify individuals by the way they walk or hold their phones.

Mobile devices, in fact, are emerging as promising replacements for traditional identification cards and other physical security devices.

"Smartphones, tablets and phablets are becoming more and more equipped with sensors," Alikhani said. "You can do a good job of mixing and matching."

Plus, standards-based bodies such as the FIDO Alliance -- which was formed in 2012 to address the lack of interoperability among strong authentication devices -- are striving to make sure that all the different authentication methods can work well together.

Another advantage of using smartphone-based biometrics for authentication is that the scans never leave the device. Agencies can easily issue new passwords to employees if the old ones are compromised, but fingerprints and eyeballs are significantly more difficult to refresh.

"By storing those attributes on the device, you don't have a honeypot of millions of records," said Patrick Clancey, senior director of federal programs at MorphoTrust USA.

Nok Nok Labs CEO Phillip Dunkelberger agrees that putting trust in a purely software-based solution is riskier, and the hardware component that identification cards offer is a significant advantage. In addition, the latest smartphones have built-in hardware-based security features, Dunkelberger said, and that "secure element hardware...is the most secure way you can do it."

Clancey said adoption of biometric security is likely to come first in the private sector. "Once it is proven and commoditized, you'll see adoption by state, federal and local agencies," he added.

Yet although mobile-based biometrics are a great addition to security, they should not be the only component, Prescient Solutions CIO Jerry Irvine said. "There's still a lot of concern about the security of mobile devices because they're still consumer-grade devices," he added.

Context-based authentication

With multiple forms of authentication to improve security, verification no longer has to be annoying and intrusive for users.

Instead, "people are looking at contextual-based indicators of authentication or trust," Clancey said.

Those indicators are passive, which means the user isn't even aware the verification is happening. For example, an employee’s location when he or she logs in could factor into the authentication process.

If an employee is at his or her work computer, for example, that's one level of authentication. Logging in from home is another. Logging in from, say, North Korea might lower the trust level of that particular connection.

Another type of passive authentication verifies employees by the fact that they have their phones with them. Although by itself this is no guarantee of identity, it does make it more likely that individuals are who they say they are.

A person's walking gait or typing pattern can also help verify users, without he or she having to jump through any additional hoops.

"The general trend that we see... is toward more passive, contextual authentication," said Paul Madsen, principal technical architect at Ping Identity. "Rather than having the user go through this overt, explicit login ceremony, our systems get better at being able to recognize the user passively."

Only when the risk profile requires it would employees be asked to take additional steps, such as a biometric scan of some kind, he added.

Behavior-based authentication

Even with context-based passive authentication backing up the biometrics, the security process should not end when an employee logs in.

"The third piece is behavior analytics," said Mike Wyatt, leader of the identity access management practice at Deloitte Advisory.

Agencies can use pattern analysis to look for atypical interactions, he said. If something unusual is detected, the system can require a higher level of authentication. For example, if an employee suddenly access a database he’s never used before, he could be asked for additional identity confirmation -- or an alert could be sent to his manager.

Access points

Another advantage of mobile-based authentication is that today's smartphones don't require any specialized readers or other technology.

Most modern phones, for example, come with several types of wireless connectivity. In addition to voice and data connections to cellular carriers, phones can also connect to local Wi-Fi networks, Bluetooth devices and touch-and-go near-field communication (NFC) readers at point-of-sale terminals for mobile payments. Any one of those channels could also be used to authenticate an employee walking into a building.

For example, in addition to transmitting identity confirmation, an app could use a cellular or Wi-Fi network to send location information that confirms the employee's GPS coordinates. And Bluetooth and NFC signals could be used to authenticate employees walking through particular doors or accessing individual desktop PCs, servers or other equipment.

Mobile authentication could also be used to allow employees to access websites. Today, that is usually done by sending a one-time password to a mobile device, but there are other options. For example, MorphoTrust, which makes 80 percent of the driver's licenses in the United States, is in the process of launching an eID service that allows users to authenticate themselves to any website by using a credentialed app on their phones to scan a QR code shown on the screen.

Web application developers could have their users download the app to do the phone-based authentication or include the eID technology in their own mobile apps.

MorphoTrust officials are hoping to get enough traction with the system that the eID becomes a ubiquitous form of alternative authentication, just as "sign in with Facebook" and "sign in with LinkedIn" have become.