Five Considerations for Selecting a Consumer Authentication Vendor

In today's mobile-first world, consumer authentication is driven by the need of having a smooth user experience. Of course, it has to be secure and tick all of the boxes for privacy and regulation but when I talk with clients, both authentication vendors and service providers, they all say that the number one priority is having a great user experience (UX). If the authentication user experience fails then customers will simply walk away and go somewhere else or choose an alternative payment method.

I was recently asked to create a white paper for RSA and EyeVerify on key considerations for selecting a consumer authentication vendor. I identified five key considerations:

1. Consumer choice
2. Convenience
3. Demonstrable fraud reduction
4. Meeting a 'mobile first' strategy'
5. Regulation compliance

These five considerations are powerful criteria for organizations when assessing authentication solutions and vendors.

Consumers must be given a choice of convenient, easy to use authentication services. The availability of a wide range of device-based authentication technologies including multiple biometric solutions supports this requirement. Convenience and consumer choice can also be combined in a well-designed consumer authentication solution. The combination of risk based authentication (RBA) and mobile biometric authentication services (MBAS) can meet this criteria. Risk based authentication can meet a good percentage of normal authentication scenarios and mobile biometrics can be applied to authentication scenarios that require further ‘proof’ of true identity; a combination of frictionless and friction-light authentication.

Service providers are increasingly pressured to support legacy service channels including physical (bank branch and retail store) and telephony at the same time as evolving their offering to work across a wide range of new technology, first web, now mobile and moving swiftly into the Internet of Things (IoT). When choosing an agile technology partner that can support multiple delivery channels, omnichannel support, an organization must ensure that they choose an authentication solution that can operate across a wide range of these channels. The mobile first strategy can allow organizations to design and deploy effective authentication services that meet this consideration.

Fraud is rising in all sectors. A consumer authentication vendor must be able to demonstrate fraud reduction as a result of deploying the chosen authentication solution – measurable and tangible fraud reduction benefits.

Around the world, regulatory powers are adapting existing regulation or introducing new ones to ensure that consumers are protected when using the latest digital services. A trusted technology partner must be able to demonstrate:

1. It can help organizations address the latest federal and industry regulations; and
2. It actively participates in influencing regulatory bodies to ensure that convenience and ease of use are not sacrificed at the expense of over rigid security requirements.

Getting the balance between security and convenience is an essential ingredient in supporting flexible digital service delivery.

To read the white paper in full, you can download it from the Goode Intelligence website here.

Thank you - Alan

Biometrics for Banking Gets Going

I was talking with a senior manager responsible for authentication strategy at a leading retail bank recently about their views on biometrics for user authentication and whether they were thinking of adopting it. I remember a similar conversation with the same person in 2013 and remember them declaring that biometrics was simply not a possible solution for them; a combination of hardware and software OTP tokens was still the favoured solution. 

Moving forward two years and there has been quite a turn-around in their perception of biometrics for providing authentication to bank customers when accessing digital banking services. Biometrics is definitely on the agenda for them and they have a number of live and pilot projects that are leveraging biometrics on mobile devices including the support of Apple Touch ID for mobile app authentication. 

So what has changed in two years for them? 

I think the fundamental reason is the need for convenient privacy-aware authentication across a number of banking channels with the emergence of mobile as the prime banking channel (not forgetting the start of a wearable banking strategy). A hardware OTP token works well enough when a bank customer is accessing banking services from a desktop computer at home but simply does not cut it when that same customer is using their mobile phone or calling up their bank using a telephone-based service. These 1980s two-factor authentication technologies are also susceptible to Man-in-the-Middle (MitM) and Phishing/Malware attacks.

This has led banking security professionals to look for alternatives that meet the needs to strongly authenticate across a wide range of existing banking channels. The explosion of FinTech-led financial services has also meant that challenger banks are looking at other innovative ways that customers can interact with their banks; biometric authentication gives them the potential to offer their customers a usable and secure method to protect their financial assets when accessing financial services from a range of endpoints.

The use of integrated fingerprint sensors is just one method of providing convenient banking user authentication and will continue to grow as more devices become available. However, I believe that the solutions will evolve and increasingly incorporate other authentication factors and biometric modalities to provide strong security and convenience. For instance, by combining face and voice in a multi-modal biometric authentication solution that can work across a range of banking channels. USAA's recent deployment of Daon's IdentityX multi-modal mobile authentication platform is a great example of this. 

Depending on the context of the transaction/interaction then you can either use a single modality - voice in an IVR interaction - or a combination of modalities - face and voice for mobile or desktop banking services. The combination of context and security risk will dictate the most-appropriate modality or factor to use.

There has also been a lot of debate as to the choice of biometric architecture that a bank should adopt; device-centric, where the biometric data never leaves the device, or server-centric, where the user enrols their biometric and then is stored by the financial institution. For verification; the matching is performed on the device for the device-centric model and against a stored template within a network database (Cloud) for the server-centric model. I think that both models have their merits. I believe that the decision to adopt one over the other (and there will be scenarios where a mixture of both will be adopted) will be driven by a combination of privacy/trust requirements and specific business drivers (some of which will be moulded by culture decisions, i.e. availability of national biometric database). 

For on-device biometric authentication services, I believe that the best approach that meets privacy and trust requirements is to utilise embedded security within mobile devices; Secure Enclave for iOS and TrustZone in ARM-based devices. A great example of this is voice biometric specialist AGNITiO's KIVOX Mobile solution that leverages TrustZone embedded hardware security using a FIDO-Ready implementation developed by Nok Nok Labs. In this model, the bank customer would enrol their biometric voice print on their smart mobile device and then be able to access mobile banking services securely using their voice for authentication. AGNITiO also support the server-centric and IVR-based models ticking the boxes to support multi-channel banking. 

Apple's Touch ID has certainly changed the perceptions of the decision makers in banking security, allowing biometrics to be a serious contender in providing authentication for banking services. There is also a role that biometrics could play in reducing the amount of fraud that is occurring for Apple Pay. There seems to be no problem with Apple's biometric authentication services itself, rather a problem with the card activation (provisioning) process that allows fraudsters to enrol stolen credit cards into Apple Pay and then cash out by purchasing thousands of Dollars worth of Apple kit in-store. Biometrics could close this loophole by allowing the card issuer to validate a legitimate card and its owner using an enrolled voice biometric. Tied in with the card issuer's fraud management system, a customer who was attempting to enrol a credit card into Apple Pay would receive an automated voice call that could verify the legitimacy of the card holder by verifying an enrolled biometric voice print. I don't feel that it would add much friction to the process and have the positive result of reducing this type of credit card fraud. 

I expect to see a lot of innovation in this space where bank-controlled multi-modal biometrics will compliment integrated mobile biometric solutions that have been deployed by the mobile OEM to enable customers to securely access full-banking services from a wide variety of end points. 

Improving the first mile of authentication – how the FIDO Alliance and Nok Nok Labs are helping to create the building blocks of trusted identity

There has been a lot of media attention attracted by the FIDO Alliance, an organisation that is attempting to change the nature of online authentication through standards and I have been following the developments with interest.

FIDO has had a successful start to its history with some of the largest names in technology, PayPal, Google, Microsoft, Synaptics (Validity Sensors), Lenovo, RSA and MasterCard to name a few, playing a role in developing the standards that were recently made public.

A number of the FIDO members have already showcased FIDO Ready™ devices at this year’s trade shows including CES, MWC and RSA Conference 2014. Solutions from AGNITiO, GO-Trust, Infineon, Fingerprint Cards, Yubico, Synaptics (Validity Sensors) and Nok Nok Labs have all been shown to demonstrate how FIDO can be implemented at the endpoint.

And with Samsung announcing its new flagship S5 smartphone at MWC 2014 with an integrated fingerprint sensor linked to PayPal’s FIDO Ready™ mobile payments app we will soon see how the FIDO standards operate in the real world.

Samsung is also planning to open up the fingerprint sensor to third parties using its new Pass API and there is a possibility that the FIDO components will be available for developers to build mobile-based multi-factor authentication enabled applications; a very promising move.

I expect to see more clients and devices being launched throughout 2014 that are FIDO Ready™. These FIDO enabled devices will run a Multifactor Authentication Client (MFAC) that supports FIDO’s Universal Authentication Framework Protocol (UAF) and interfaces with a FIDO server.

Currently, Nok Nok Labs is the only provider of both the FIDO Ready™ client and server components with its S3 Authentication Suite.

The device OEM (could be a smartphone, a tablet or a Windows PC) would pre-install the MFAC and then a service provider, the Relying Party, (could be a financial services provider or a mobile network operator running it on an Authentication as a Service basis) would run the MFAS.

The MFAS has the capability of interfacing with policy and risk engines (including Risk Based Authentication) and also federated identity providers to link the client identity with multiple online services – brokering identity using strong mobile based MFA.

Over the past five years, we have witnessed a lot of development in the ‘last mile’ of authentication and identity assurance; standards such as SAML and OpenID have introduced a framework in which user identities can be shared amongst online services.

The FIDO Alliance and Nok Nok Labs are attempting to standardise the ‘first mile’ of authentication – an event at the beginning of the authentication process proving that an authorised person is allowed access to a digital service or to authorise a transaction.

These are early days for FIDO and Nok Nok Labs but I firmly believe that they are establishing the building blocks for agile omni-channel authentication and identity verification that will have an important part to play in improving the levels of trust in an open connected world.

From Swipe to Touch to Invisible Touch - The Evolution of Fingerprint Sensors in Smart Mobile Devices

From Swipe to Touch to Invisible Touch - The Evolution of Fingerprint Sensors in Smart Mobile Devices

Readers of a certain age will possibly remember Genesis, the English prog-rock band that featured first Peter Gabriel and then Phil Collins on vocals. In the 1980s they released a rather poor 13^th album called ‘Invisible Touch’. Little did they know that we would use that title in a rather obscure pun in an article on the evolution of fingerprint sensors in smart mobile devices (SMD) – the album cover is rather relevant though! And if you hear ‘Invisible Touch’ wafting over the speakers at a product launch at MWC 2014 – you know where they got their idea from.

This blog explores the evolution of fingerprint sensors designed for consumer electronic devices including smart mobile devices; from swipe to touch to ‘invisible touch'. This blog first appeared in the January 2014 edition of the Goode Intelligence Market Intelligence publication; "Fingerprint Biometrics Market Intelligence" (published 28 January 2014). 

Smartphone OEMs rush to embed fingerprint sensors

Despite the intense media attention that accompanied Apple’s launch of Touch ID embedded fingerprint sensors on mobile phones have been around since 1998. Ever since Siemens developed its prototype device back in 1998 there has been steady stream of handsets being biometric-enabled.

Fingerprint sensors are becoming a common-feature of flagship smartphones with an increasing number of mobile device OEMs joining Apple in launching high-end devices during the latter part of 2013. This included HTC, Fujitsu and Pantech. So far, all these Android-based devices have used swipe fingerprint sensors, sourced from either Fingerprint Cards (FPC) or Validity Sensors. For these android devices, the sensor is being located on the rear of the smartphone (see image of HTC One max below).

HTC One max (with Validity swipe sensor located underneath rear camera)

Apple Touch ID - leader for smartphone touch sensor

Apple is so far the only mobile device OEM to have launched a device with an embedded Touch Capacitive sensor (shown below). The sensor uses capacitive touch technology to take a high resolution (500 pixels per inch or ppi) from small sections of a fingerprint (from the subepidermal layers of the skin).

Source: Apple

There are advantages in using a touch sensor over a swipe sensor on a mobile device:

• The user experience is usually superior
• Greater accuracy;  there appears to be fewer failures as the finger is better positioned for touch. For swipe, the finger has to be swiped accurately over the sensor to ensure that the fingerprint is read correctly. On some smartphone implementations, especially on larger devices (phablets), the location of the sensor on the rear of the device makes this difficult when holding the device with one hand 
• The sensor can be built into a hard button on the front of the mobile device, e.g. home/power button

Non-Apple smartphones - first swipe then touch

Goode Intelligence believes that for the first quarter of 2014 a number of Tier 1 mobile device OEMs will launch flagship models that incorporate a swipe sensor. This will include further HTC models and releases from LG, Lenovo and Samsung (Samsung may want to launch with a touch sensor to match the user experience of Apple’s Touch ID).

The three remaining fingerprint sensor manufacturers who can supply to the mobile device industry, Fingerprint Cards, Idex and Validity Sensors (part of Synaptics) are all in the process of commercialising their versions of the mobile-ready touch sensor.

Fingerprint Cards is probably in a more advanced state of commercialisation and has gone on record to say that their touch sensor (FPC1020) has been sold to a “Tier 1 OEM” for a “flagship smartphone with a targeted launch date in the summer of 2014”[1]

Idex and Validity will follow FPC in launching their own touch sensors during 2014 and GI expects to see them appear in smart mobile devices and other consumer electronic devices.

Next generation consumer fingerprint sensors - Invisible Touch

The third stage to the evolution of mobile device-based fingerprint sensors is driven by the need for greater user convenience combined with a trend to remove physical buttons from smart mobile devices. Partly as a result of the reduction of the bezel-size and driven by the trend for larger touch screen sizes.

The elimination of physical buttons creates a problem for component suppliers including fingerprint sensor manufacturers as it removes an obvious place to position the sensor. It also provides them with an opportunity for new markets for their products.

The positioning of the fingerprint sensor underneath, or within the touch screen, is the next stage in the evolution of consumer fingerprint biometrics and enables mobile device OEMs to remove physical buttons. It also ensures that the convenience of identification, touching a finger on the front of a mobile device, is maintained.

GI believes that all of the fingerprint sensor manufacturers currently operating in the consumer and mobile space are well advanced in their research and development efforts to make this a reality:

• Idex released this video after demonstrating a proof-of-concept device that placed the fingerprint sensor within the touch screen display
• Validity Sensors is now part of Synaptics who are one of the world’s largest suppliers of touchscreen technology. Synaptics are also developing fingerprint sensors built into the touchpads that are embedded into laptops and notebooks
• FPC has demoed demoed touch sensor capabilities with Windows for integration into Windows 8 (8.1) products and also works with CrucialTec, manufacturer of the optical TrackPad (OTP)

This includes Apple and the resources that were integrated as a result of the AuthenTec acquisition.

‘Invisible Touch’ is not only suitable for smart mobile devices; any consumer electronic device that uses a screen has the potential to integrate a touch fingerprint under or within the screen. This could include smart TVs, single-use gaming handhelds, tablets, touchscreen monitors, hybrid notebooks and touchscreens integrated into domestic appliances and smart house control technology. Whether anybody would want to authenticate using their fingerprint for their fridge is debatable (although perhaps if you wanted to stop a young child from turning on an oven or keeping your teenager out of your wine cooler?).

This is a potentially huge market and is part of the wider Consumerisation of biometrics that will revolutionise how we interact with technology.

This opportunity will be explored in an upcoming analyst report published by Goode Intelligence; "Emerging Markets for Fingerprint Biometrics".

---

[1] FPC wins first 1020 touch sensor DW from Global Tier 1 OEM for their flagship smartphone. 20 December 2013: http://www.fingerprints.com/blog/2013/12/20/fpc-wins-first-1020-touch-sensor-dw-from-global-tier-1-oem-for-their-flagship-smartphone/

A Smart Mobile Identity for our smart mobile lifestyle

I must admit that I didn’t come up with the term Smart Mobile Identity. For that I have to thank Joey Pritikin at AOptix who I was lucky enough to meet at the recent Biometrics exhibition and conference in London during the last week of October 2012. I first came across the term in a presentation that Joey gave at last year’s Biometrics conference where he discussed how standard smart phones can be leveraged for biometric purposes, including user authentication and  identity verification [Presentation: Smart Mobile Identity – Beyond Single Purpose Handheld Biometric Devices].

In my opinion, the term Smart Mobile Identity really sums up the next generation of mobile-based authentication and identity verification solutions – something that I have been involved in for the best part of ten years through various roles including my current one as Managing Director of Goode Intelligence.

To me, Smart Mobile Identity is about leveraging the capabilities of a modern smart mobile device (SMD) to ensure that our identities are proven or verified when identity proof (authentication if you like) is required. Not only for proving identity when accessing digital services through a desktop computer but also for mobile initiated access and even when we present ourselves in the physical world; at a country border or when accessing health or social security services. I also include proving our identity when accessing digital services using other connected devices, such as gaming consoles, automobiles, smart TVs etc; adaptive and agile authentication and identity verification to support the Internet of things. As someone who owns an Xbox 360 Kinect device, the idea of using a voiceprint or a facial scan to access Xbox LIVE is a realistic possibility.

For mobile device-based authentication and identity verification solutions, the simplest scenario is being sent a one-time-password (OTP) via SMS when authenticating ourselves into a network-based service, e.g. Google’s Authenticator or 2-step verification process. However, this is changing rapidly and we are in the midst of an evolution in mobile-based authentication and identity verification solutions; moving away from porting existing, non-mobile centric, services to the mobile to designing solutions specifically for mobile. Using the microphone for voice biometrics, a GPS sensor for Geo-location, a combination of the accelerometer and touchscreen for continuous behavioural assessment, securely storing digital certificates in the SIM or Secure Element (SE) and the camera for facial and eye vein biometrics (take a look at start-up EyeVerify for this). All these examples work with standard SMDs now; no need for any specialist equipment.

In addition to these examples, new opportunities are being presented with the next generation of SMDs that contain new types of embedded sensors, including NFC, embedded fingerprint and voice recognition sensors. You can also adapt existing SMDs with add-on sleeves that enable fingerprint recognition (Precise Biometrics Tactivo sleeve) and can support smart cards and NFC. The need for single-purpose devices to capture and verify biometrics in the field may become obsolete as a result of these developments.

Smart mobile devices offer so many opportunities for authentication and identity verification and this blog can only scratch at the surface of what can and will be offered – some of the solutions even encroach into the realms of science fiction. I was fascinated to come across the iTravel patent from Apple detailing what the Cupertino tech giant believes to be the possibility of using a mobile wallet for travel purposes. Managing the end-to-end travel process from reservation, to ticket receipt/validation, check-in and baggage claim through to identification at border control. I think all but the last scenario achievable now but I believe that we are far off from using our mobile devices as virtual passports.

That said, perhaps we are seeing pieces of the jigsaw that tell us how Apple will integrate the recently acquired fingerprint sensor technology from AuthenTec – an agile, and very personal, way to protect our wallets or in Apple’s case our Passbook. Swiping a finger to lock and unlock our digital wallets.

Every discussion that I have with technology companies involved in this space, and this includes many of the major authentication and biometric vendors, involves how best to utilise the smart mobile device for authentication and identity verification purposes. My recent attendance at the RSA Europe conference and Biometrics Conference, both held in London, was largely occupied with meetings with clients and tech vendors that were investing serious R&D resources into this area of technology.

A number of forward looking organisations and technology vendors are already leveraging the capabilities of the smart mobile device for authentication and identity verification purposes. Through my work at Goode Intelligence I have been exploring the capabilities of mobile devices for authentication and identity verification and this includes the recent publication of two free-to-download white papers; Two-Factor Authentication Goes Mobile and The Case for Mobile MFV.

Goode Intelligence will continue to track this market and you can expect some new publications covering smart mobile identity in the coming months.

Please get in touch if you want to discuss this further or are a technology innovator working in this exciting field.