Rajiv Dholakia, Nok Nok Labs Overview and insights into some of the building blocks that make a modern security and authentication stack work and why we should be optimistic about our ability to transform authentication in particular and security in general as these platforms grow and evolve, in light of the building blocks provided by modern mobile operating systems and hardware for crafting a robust authentication implementation.

1. 1
T
FINGERPRINT
SEC
U
FA
BIOME
TOKEN
RBA
ACTIVE
FINGERPRINT
SECURE
ELEMENT
NFC
BIOMETRIC
PIN
RBA
SILEFINGERPRINT
ELEME
NFFACE
BIOMETRIC
TOKENACTIVE
SILE
ELEMENT
USB
FACE
PIN
TOK
RBA
PASSIVE
SILEN
FINGERPRINT
VOICEUSB
BIOMETRIC
TPM
VOICE
NFC
FACE
TPM
FINGERPRINT
NFC
USB
RBA
ACTIV
TP
FINGERPRINT
SECURE
NFC
FACE
RBA
PASSIVE
SILENT
TPM
FINGERPRINT
VOICE
ELEMENT
ACTIVE
BIOMETRIC
PIN
PASSIVE
SILENT
TPM
FINGERPRINT
SECURE
ELEMENT
NFC
PIN
TOKEN
PASSIVE
FINGERPRINT
VOICE
SECURE
E
TOKEN
R
VOICE
SECURE
NFC
TOKEN
TPM
PIN
RBA
FINGERPRINT
SECURE
NFC
USB
VOICE
NFC
PASSIVE
USB
TOKEN
PASSIVE
TPM
SECURE
ELE
FACE
BIOMETRIC
ACTIVE
SECURE
USB
ACTIVE
TPM
VOICE
NFC
USB
FACE
PIN
RBA
ACTIVE
TPM
SECURE
ELEMENT
PIN
RBA
SILENT
USB
PIN
SILENT
ELEMENT
NFC
FINGERPRINT
USB
TPM
VOICE
RBA
PASSIVE
ACTIVE
TPM
SECURE
USB
FACE
ACTIVE
VOICE
PIN
PASSIVE
TPM
FINGERPRINT
RBA
ACTIVE
TPM
ELEMENT
ACTIVE
SILENT
TPM
USB
RBA
SECURE
BIOMETRIC
PIN
SILENT
TPM
VOICE
USB
PIN
USB
FACE
BIOMETRIC
NFC
TOKEN
RBA
PIN
RBA
SILENT
FACE
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
RBA
ACTIVE
TPM
TOKEN
ACTIVE SILENT
VOICE
USB
FACE
PIN
RBA
ACTIVE
SILENT
RBA
VOICE
NFC
USB
ACTIVE
TPM
BIOMETRIC
TOKENTPM
FACE
TOKEN
PASSIVE
PIN
TPM
TPM
FACE
TPM
FACE
PASSIVE
SILENT
BIOMETRIC
SECURE
PIN
PASSIVE
SILENT
VOICE
USB
PIN
TOKEN
PASSIVE
NFC
BIOMETRIC
RBA
SILENT
TPM
SECURE
VOICE
USB
USB
FACE
SILENT
SECURE
PIN
SILENT
ELEMENT
USB
FACE
VOICE
USB
SECURE
FACE
PIN
FINGERPRINT
SILENT
PIN
BIOMETRIC
TPM
USB
FACE
ELEMENT
TPM
VOICE
SILENT
USB
RBA
SILENT
TPM
VOICE
FACE
PASSIVE
PIN
TOKEN
ACTIVE
USB
PASSIVE
USB
FACE
TPM
PASSIVE
SECURE
USB
TPM
FACE
PIN
RBA
NFC
USB
RBA
ACTIVE
NFC
USB
PIN NFC
SILENT
VOICE
FACE
PIN
RBA
PASSIVE
NFC
USB
PIN
TPM
PASSIVE
PIN
USB
TPM
NFC
USB
FACE SILENT
FINGERPRINT
USB
USB
USB
TPM
FACE
TPM
USB
PIN
FACE
USB
FACE
USB
NFC
FACE
TPM
PIN
FACE
FACE
USB
TPM
NFC
RBA
USB
PIN
PIN
TPM
USB
RBA
RBA
PIN
USB
USB
USB
USB
NFC
FACE
PIN
NFC
VOICE
USB
USB
USB
TPM
USB
USB
TPM
FACE
NFC
RBA
USB
FACE
PIN
VOICE
USB
USB
USB
RBA
TPM
NFC
USB
TPM
USB
USB
USB
TPM
FACE
USB
FACE
USB
TPM
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
BUILDING BLOCKS
FOR MOBILE SECURITY
AND AUTHENTICATION

2. ELEMENTS OF INTEGRITY & SECURITY
Device Integrity
(Is the hardware the right hardware?)
Network Integrity
(Am I talking to the right network resource,
can I trust that resource)
OS & App Integrity
(Did someone tamper with my OS, is there
malware, am I talking to the right app?)
User Integrity
(Is the user the right user?)
Data & Transaction
Integrity
2

3. SECURITY IS ONLY AS STRONG AS THE
WEAKEST LINK
3
Integrity
Hardware OS App Network User
Patch when you find a gap
Security Whack-A-Mole

4. A UNIQUE OPPORTUNITY
4
Hardware Integrity
OS Integrity
App Integrity
Network Integrity
User Integrity
Re-Architect
Computing Using
Hardware-Based Trust
Chain of Trust
Trusted Platform

5. THE MOBILE EPOCH
5

6. INTEGRITY MECHANISMS – I
• TPMs
• Backwards compatibility
requirements
• SEs
• Limited due to operator
controls
• TEEs
• Third time is a charm?
• Secureboot
- Verificationofimage
• Virtualization
- Hardwareassistedisolation
• Anti-virus
• DeviceTheftResponse
- Standardonmobiledevices
6
TEE SE TPM
Hardware OS

7. INTEGRITY MECHANISMS – II
7
App User
• Appverification
- Rise Of The App Store
• AppIsolation
- App containers
- Restricted IPC
• ProtectingData&Content
- On-device data encryption
- DRM
• IdentityProofing
- Know your customer
• StrongAuthentication
- Explicit & implicit
- First mile & Second mile

8. FOUNDATION OF A TRUSTED PLATFORM
8
Partition Partition
Partition Manager
Hardware
System
Protection
PII Handling
Evidence/
Measurement
Reporting/
Attestation
Platform
Management
Policy Engine
Hardware
Protected
Storage
Randomness
Detection &
Inspection
Sequencing
Architecture
Performance
Within Partition
Protected
Execution
Outside
External
Access
Between Partitions
Isolation
Trusted Channel

9. ISOLATION ARCHITECTURE
ARMTRUSTZONE
9
Secure
OS Boot
FP Sensor
Touchscreen
Storage
1.7 B
ARM Cortex
SoCs Shipped
18 Month
Phone Refresh
Rate

10. PROTECTED EXECUTION
TRUSTONICTEE
10
App
TEE
Normal
App
TEE
Enabled
Rich OS
Trustlet
500M
TEEs Shipped

11. TRUSTED PLATFORMS IN PRACTICE
11
iOS Samsung Knox
Trustzone-
based
Integrity
Management
Architecture
(TIMA)
Security
Enhancements
for Android

12. BUILDING BLOCKS AVAILABLE
BUTCAPABILITIESARENOTEXERCISED
• AccessLimitations
- TPM
- SE
- TEE
• Integrationpain
- Needusableabstractions,
standardization,ecosystems,
partnerships
• Inter-partyverificationof
components
- Needoperationalrelationships
12

13. BUILDING THE PLUMBING
13
Hardware
Integrity
User
Integrity
OS & App
Integrity
Network
Integrity

14. ROUGH CONSENSUS + WORKING CODE
14
50-60M Units
Expected to ship
Galaxy S5
World’s First FIDO Ready Smartphone

15. Any Device.
Any Application.
Any Authenticator.
15
T
FINGERPRINT
SEC
U
FA
BIOME
TOKEN
RBA
ACTIVE
FINGERPRINT
SECURE
ELEMENT
NFC
BIOMETRIC
PIN
RBA
SILEFINGERPRINT
ELEME
NFFACE
BIOMETRIC
TOKENACTIVE
SILE
ELEMENT
USB
FACE
PIN
TOK
RBA
PASSIVE
SILEN
FINGERPRINT
VOICEUSB
BIOMETRIC
TPM
VOICE
NFC
FACE
TPM
FINGERPRINT
NFC
USB
RBA
ACTIV
TP
FINGERPRINT
SECURE
NFC
FACE
RBA
PASSIVE
SILENT
TPM
FINGERPRINT
VOICE
ELEMENT
ACTIVE
BIOMETRIC
PIN
PASSIVE
SILENT
TPM
FINGERPRINT
SECURE
ELEMENT
NFC
PIN
TOKEN
PASSIVE
FINGERPRINT
VOICE
SECURE
E
TOKEN
R
VOICE
SECURE
NFC
TOKEN
TPM
PIN
RBA
FINGERPRINT
SECURE
NFC
USB
VOICE
NFC
PASSIVE
USB
TOKEN
PASSIVE
TPM
SECURE
ELE
FACE
BIOMETRIC
ACTIVE
SECURE
USB
ACTIVE
TPM
VOICE
NFC
USB
FACE
PIN
RBA
ACTIVE
TPM
SECURE
ELEMENT
PIN
RBA
SILENT
USB
PIN
SILENT
ELEMENT
NFC
FINGERPRINT
USB
TPM
VOICE
RBA
PASSIVE
ACTIVE
TPM
SECURE
USB
FACE
ACTIVE
VOICE
PIN
PASSIVE
TPM
FINGERPRINT
RBA
ACTIVE
TPM
ELEMENT
ACTIVE
SILENT
TPM
USB
RBA
SECURE
BIOMETRIC
PIN
SILENT
TPM
VOICE
USB
PIN
USB
FACE
BIOMETRIC
NFC
TOKEN
RBA
PIN
RBA
SILENT
FACE
RBA
PASSIVE
ACTIVE
SILENT
TPM
FINGERPRINT
RBA
ACTIVE
TPM
TOKEN
ACTIVE SILENT
VOICE
USB
FACE
PIN
RBA
ACTIVE
SILENT
RBA
VOICE
NFC
USB
ACTIVE
TPM
BIOMETRIC
TOKENTPM
FACE
TOKEN
PASSIVE
PIN
TPM
TPM
FACE
TPM
FACE
PASSIVE
SILENT
BIOMETRIC
SECURE
PIN
PASSIVE
SILENT
VOICE
USB
PIN
TOKEN
PASSIVE
NFC
BIOMETRIC
RBA
SILENT
TPM
SECURE
VOICE
USB
USB
FACE
SILENT
SECURE
PIN
SILENT
ELEMENT
USB
FACE
VOICE
USB
SECURE
FACE
PIN
FINGERPRINT
SILENT
PIN
BIOMETRIC
TPM
USB
FACE
ELEMENT
TPM
VOICE
SILENT
USB
RBA
SILENT
TPM
VOICE
FACE
PASSIVE
PIN
TOKEN
ACTIVE
USB
PASSIVE
USB
FACE
TPM
PASSIVE
SECURE
USB
TPM
FACE
PIN
RBA
NFC
USB
RBA
ACTIVE
NFC
USB
PIN NFC
SILENT
VOICE
FACE
PIN
RBA
PASSIVE
NFC
USB
PIN
TPM
PASSIVE
PIN
USB
TPM
NFC
USB
FACE SILENT
FINGERPRINT
USB
USB
USB
TPM
FACE
TPM
USB
PIN
FACE
USB
FACE
USB
NFC
FACE
TPM
PIN
FACE
FACE
USB
TPM
NFC
RBA
USB
PIN
PIN
TPM
USB
RBA
RBA
PIN
USB
USB
USB
USB
NFC
FACE
PIN
NFC
VOICE
USB
USB
USB
TPM
USB
USB
TPM
FACE
NFC
RBA
USB
FACE
PIN
VOICE
USB
USB
USB
RBA
TPM
NFC
USB
TPM
USB
USB
USB
TPM
FACE
USB
FACE
USB
TPM
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB
USB

16. Appendix
PRIVATE & CONFIDENTIAL 16