1

TPM

FINGERPRINTSECURE

USB

FACE

BIOMETRIC

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICEELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT TPM

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVEACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

USB

FACE

PIN

PASSIVE

ACTIVE

TPM

FINGERPRINT

VOICE

ELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PINACTIVE

SILENT

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

PASSIVE

ACTIVE

FINGERPRINT

VOICE

SECURE

ELEMENT

USB

BIOMETRIC

PIN

TOKEN

RBA PASSIVE

ACTIVE

VOICE

SECURE

NFC

FACE

TOKEN

PASSIVEACTIVE

TPM

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

TPM

FINGERPRINT

SECURE

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

ELEMENT

NFC

USB

TOKEN

RBA

PASSIVE

TPM

VOICE

SECURE

ELEMENT

NFC

FACE

BIOMETRIC

PIN

ACTIVE

TPM

FINGERPRINT

SECURE

USB

TOKEN

ACTIVE SILENT

TPM

FINGERPRINT

VOICENFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

RBA

SILENT

TPMELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

SILENT

TPM

ELEMENT

NFC

USB

PIN

TOKEN

RBA

ACTIVE

FINGERPRINT

ELEMENT

USB

TPM

VOICE

ELEMENT

USB

PIN

RBA

PASSIVE

ACTIVE

TPM

VOICE

SECURE

ELEMENT

USB

FACE

ACTIVE

FINGERPRINT

VOICE

PIN

RBA

PASSIVE

ACTIVE

TPM

FINGERPRINT

ELEMENT

FACE

TOKEN

RBA

ACTIVE

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

PASSIVE

SILENT

VOICE

USB

FACE

BIOMETRIC

RBA

ACTIVE

SECURE

NFC

USB

BIOMETRIC

PIN

SILENT

TPM

VOICE

NFC

USB

FACE

PIN

USB

FACE

BIOMETRIC

PIN

RBA

ACTIVE

FINGERPRINT

NFC

TOKEN

RBA

VOICE

ELEMENT

USB

FACE

PIN

RBA

SILENT

VOICE

SECURE

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

RBA

ACTIVE

TPM

FACE

TOKEN

RBA

ACTIVE SILENT

VOICE

ELEMENT

USB

FACE

PIN

RBA

ACTIVE

SILENT

PIN

TOKEN

RBA

VOICE

SECURE

NFC

USB

TOKEN

PASSIVE

ACTIVE

TPM

FACE

BIOMETRIC

TOKEN

ACTIVE

TPM

FACE

NFC

USB

FACE

BIOMETRIC

TOKEN

PASSIVE

PIN

ACTIVE

TPM

VOICE

ELEMENT

NFC

TPM

VOICE

NFC

USB

FACE

TOKEN

RBA

TPM USB

FACE

BIOMETRIC

RBA

PASSIVE

SILENT

USB

BIOMETRIC

TPM

SECURE

NFC

PIN

RBA

PASSIVE

SILENT

VOICE

SILENT

VOICE

ELEMENT

USB

PIN

TOKEN

RBA

PASSIVE

NFC

FACE

BIOMETRIC

TOKEN

RBA

SILENT

TPM

SECURE

SILENT

VOICE

USB

RBA

USB

FACE

RBA

VOICE

RBA

SILENT

SECURE

USB

PIN

RBA

SILENT

TPM

ELEMENT

USB

FACE

VOICE

NFC

USB

TOKEN

RBA

SECURE

FACE

TPM

FACE

PIN

FINGERPRINT

NFC

RBA

SILENT

USB

FACE

PIN

ACTIVE

SILENT

PIN

RBA

NFC

USB

BIOMETRIC

TPM

VOICE

USB

FACE

PASSIVE

ELEMENT

TOKEN

TPM

VOICE

SILENT

NFC

USB

PIN

RBA

SILENT

TPM

VOICE

NFC

USB

FACE

PASSIVE

TPM

VOICE

TPM

NFC

PIN

TOKEN

ACTIVE

SECURE

USB

RBA

PASSIVE

NFC

USB

FACE

RBA

TPM

TOKEN

PASSIVE

SECURE

USB

FACE

ACTIVE

TPM

FACE

PIN

RBA

VOICE

USB

PASSIVE

TOKEN

RBA

NFC

USB

SILENT

USB

RBA

FACE

PIN

ACTIVE

NFC

USB

USB

PIN

RBA

NFC

SILENT

TPM

VOICE

FACE

PIN

TPM

NFC

USB

TPM

RBA

PASSIVE

NFC

USB

PIN

TPM

PIN

PASSIVE

PIN

USB

TPM

NFC

USB

FACE

FACE

RBA

SILENT

FINGERPRINT

USB

NFC

USB

ACTIVE

VOICE

USB

TPM

PIN

RBA

FACE

TPM

TPM

USB

PIN

TPM

NFC

FACE

TOKEN

RBA

USB

PASSIVE

VOICE

NFC

PIN

USB

FACE

USB

RBA

TPM

PIN

NFC

FACE

RBA

ACTIVE

TPM

USB

USB

TPM

PIN

FACE

NFC

USB

PIN

RBA

FACE

USB

USB

RBA

NFC

NFC

TPM

NFC

RBA

USB

PIN

NFC

USB

PIN

USB

ELEMENT

PIN

PIN

TPM

USB

USB

TPM

VOICE

NFC

RBA

USB

RBA

RBA

PIN

USB

USB

USB

USB

NFC

USB

NFC

USB

TPM

FACE

USB

PIN

USB

USB

PIN

NFC

VOICE

NFC

USB

USB

USB

USB

FACE

TPM

USB

TPM

USB

USB

TPM

USB

FACE

NFC

RBA

USB

USB

USB

FACE

USB

USB

RBA

PIN

VOICE

USB

PIN

USB

USB

RBA

USB

TPM

RBA

RBA

PIN

NFC

NFC

USB

TPM

USB

TPM

USB

USB

USB

USB

NFC

TPM

NFC

FACE

USB

FACE

USB

USB

TPM

USB

USB

USB

USB

USB

FACE

USB

USB

USB

USBRBA

USB

USB

USB

USB

USB

USB

USB

RBA

USB

USB

USB

NFC

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

A NEW AUTHENTICATION ARCHITECTURE

Avinash  Umap  (aumap@noknok.com)  Javed  Shah    (javed.shah@forgerock.com)  

WHERE WE FIT

2

Physical-to-digital Identity

User Management

Authentication

Federation

   Single

Sign-On

Strong Risk Based Passwords

NNL ADDRESSES FIRST MILE AUTHENTICATION

3

Recreated PMS

1st Mil!

Nok Nok Labs ForgeRock

Authenticate

Identity

SSO / Federate

2nd Mil!

AUTHENTICATION SILOS

4

COMPLEXITY, REDUNDANCY, COSTS

App A

App B ?  

OpenAM

?

Applications Authentication Methods

THE NOK NOK LABS UNIFIED APPROACH

5

ANY DEVICE. ANY APPLICATION. ANY AUTHENTICATOR.

App A

OpenAM

App B

NOK NOK LABS

Unified Authentication Protocol

?

Applications Authentication Methods

HOW THE FIDO ARCHITECTURE WORKS

6

Standardized Protocol

Local user verification unlocks key

Key used to authenticate to server

SOLUTION ARCHITECTURE

7

NOK NOK LABS 3RD PARTY

PROTOCOLS

Relying Party

MFAS

Web Application/Mobile App Server/ Federation Server

Risk & Identity Systems

Browser

Device

Mobile App

MFAC

Policy Rules

MFAS

Web Browser

FORGEROCK INTEGRATION

8

AUTHENTICATION MODULE INTEGRATION

USER’S DESKTOP DEVICE

Browser Extension

HTML

Javascript

MFAC

Customer Web Application

Relying Party NOK NOK 3rd party

OpenAM (SAML, OpenID, etc.)

Authentication Module

AUTHENTICATION INFRASTRUCTURE

Authen=ca=on  

Registra=on  

Authen=ca=on  

ForgeRock

J2EE Agent

Oracle/Postgres

1

2

3

SSO/Federate  

REGISTRATION

9

Initiate Provisioning

Registration Response + Public Key

Validate Response & Attestation

Registration Request + Policy

MFAS MFAC Self Service

Reg App

J2EE Agent

Protected Pages

Browser/App

2

4

5

Device Relying Party

1

3 Enroll User & Generate Keys

AUTHENTICATION

10

Initiate Authentication

Authentication Response

Validate Response

Authentication Request+ Challenge + Policy

MFAS MFAC OpenAM

Login Page

Auth Module

Browser/App

2

4

5

Device Relying Party

1

3 Authenticate User & Unlock Key

TRANSACTION CONFIRMATION

11

Initiate Transaction

Authentication Response + Text Hash

Validate Response &

Text Hash

Auth Req+ Challenge + Policy + Transaction Text

MFAS MFAC

Web App

Browser/App

2

4

5

Device Relying Party

1

3 Display Text,

Authenticate User & Unlock Key

INTEGRATION PATTERNS

12

STRONG AUTH PROVIDER

Custom  Authen=ca=on  Module  Strong  AuthN  Client  

External AuthN Servlet

REST  /  SOAP  

POST  /  GET  

Strong  AuthN  Server  

Custom  Authen=ca=on  Module  RedirectCallback  

Customized  Login  Page  

External  AuthN  Provider  

Browser  Redirect  Iden=ty  Provider  

SAML  2.0  /  OAuth  2.0  

Strong  AuthN  Client  

PasswordCallback  

OPENAM

Any Device. Any Application. Any Authenticator.

13

TPM

FINGERPRINTSECURE

USB

FACE

BIOMETRIC

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICEELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT TPM

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVEACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

USB

FACE

PIN

PASSIVE

ACTIVE

TPM

FINGERPRINT

VOICE

ELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PINACTIVE

SILENT

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

PASSIVE

ACTIVE

FINGERPRINT

VOICE

SECURE

ELEMENT

USB

BIOMETRIC

PIN

TOKEN

RBA PASSIVE

ACTIVE

VOICE

SECURE

NFC

FACE

TOKEN

PASSIVEACTIVE

TPM

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

TPM

FINGERPRINT

SECURE

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

ELEMENT

NFC

USB

TOKEN

RBA

PASSIVE

TPM

VOICE

SECURE

ELEMENT

NFC

FACE

BIOMETRIC

PIN

ACTIVE

TPM

FINGERPRINT

SECURE

USB

TOKEN

ACTIVE SILENT

TPM

FINGERPRINT

VOICENFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

RBA

SILENT

TPMELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

SILENT

TPM

ELEMENT

NFC

USB

PIN

TOKEN

RBA

ACTIVE

FINGERPRINT

ELEMENT

USB

TPM

VOICE

ELEMENT

USB

PIN

RBA

PASSIVE

ACTIVE

TPM

VOICE

SECURE

ELEMENT

USB

FACE

ACTIVE

FINGERPRINT

VOICE

PIN

RBA

PASSIVE

ACTIVE

TPM

FINGERPRINT

ELEMENT

FACE

TOKEN

RBA

ACTIVE

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

PASSIVE

SILENT

VOICE

USB

FACE

BIOMETRIC

RBA

ACTIVE

SECURE

NFC

USB

BIOMETRIC

PIN

SILENT

TPM

VOICE

NFC

USB

FACE

PIN

USB

FACE

BIOMETRIC

PIN

RBA

ACTIVE

FINGERPRINT

NFC

TOKEN

RBA

VOICE

ELEMENT

USB

FACE

PIN

RBA

SILENT

VOICE

SECURE

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

RBA

ACTIVE

TPM

FACE

TOKEN

RBA

ACTIVE SILENT

VOICE

ELEMENT

USB

FACE

PIN

RBA

ACTIVE

SILENT

PIN

TOKEN

RBA

VOICE

SECURE

NFC

USB

TOKEN

PASSIVE

ACTIVE

TPM

FACE

BIOMETRIC

TOKEN

ACTIVE

TPM

FACE

NFC

USB

FACE

BIOMETRIC

TOKEN

PASSIVE

PIN

ACTIVE

TPM

VOICE

ELEMENT

NFC

TPM

VOICE

NFC

USB

FACE

TOKEN

RBA

TPM USB

FACE

BIOMETRIC

RBA

PASSIVE

SILENT

USB

BIOMETRIC

TPM

SECURE

NFC

PIN

RBA

PASSIVE

SILENT

VOICE

SILENT

VOICE

ELEMENT

USB

PIN

TOKEN

RBA

PASSIVE

NFC

FACE

BIOMETRIC

TOKEN

RBA

SILENT

TPM

SECURE

SILENT

VOICE

USB

RBA

USB

FACE

RBA

VOICE

RBA

SILENT

SECURE

USB

PIN

RBA

SILENT

TPM

ELEMENT

USB

FACE

VOICE

NFC

USB

TOKEN

RBA

SECURE

FACE

TPM

FACE

PIN

FINGERPRINT

NFC

RBA

SILENT

USB

FACE

PIN

ACTIVE

SILENT

PIN

RBA

NFC

USB

BIOMETRIC

TPM

VOICE

USB

FACE

PASSIVE

ELEMENT

TOKEN

TPM

VOICE

SILENT

NFC

USB

PIN

RBA

SILENT

TPM

VOICE

NFC

USB

FACE

PASSIVE

TPM

VOICE

TPM

NFC

PIN

TOKEN

ACTIVE

SECURE

USB

RBA

PASSIVE

NFC

USB

FACE

RBA

TPM

TOKEN

PASSIVE

SECURE

USB

FACE

ACTIVE

TPM

FACE

PIN

RBA

VOICE

USB

PASSIVE

TOKEN

RBA

NFC

USB

SILENT

USB

RBA

FACE

PIN

ACTIVE

NFC

USB

USB

PIN

RBA

NFC

SILENT

TPM

VOICE

FACE

PIN

TPM

NFC

USB

TPM

RBA

PASSIVE

NFC

USB

PIN

TPM

PIN

PASSIVE

PIN

USB

TPM

NFC

USB

FACE

FACE

RBA

SILENT

FINGERPRINT

USB

NFC

USB

ACTIVE

VOICE

USB

TPM

PIN

RBA

FACE

TPM

TPM

USB

PIN

TPM

NFC

FACE

TOKEN

RBA

USB

PASSIVE

VOICE

NFC

PIN

USB

FACE

USB

RBA

TPM

PIN

NFC

FACE

RBA

ACTIVE

TPM

USB

USB

TPM

PIN

FACE

NFC

USB

PIN

RBA

FACE

USB

USB

RBA

NFC

NFC

TPM

NFC

RBA

USB

PIN

NFC

USB

PIN

USB

ELEMENT

PIN

PIN

TPM

USB

USB

TPM

VOICE

NFC

RBA

USB

RBA

RBA

PIN

USB

USB

USB

USB

NFC

USB

NFC

USB

TPM

FACE

USB

PIN

USB

USB

PIN

NFC

VOICE

NFC

USB

USB

USB

USB

FACE

TPM

USB

TPM

USB

USB

TPM

USB

FACE

NFC

RBA

USB

USB

USB

FACE

USB

USB

RBA

PIN

VOICE

USB

PIN

USB

USB

RBA

USB

TPM

RBA

RBA

PIN

NFC

NFC

USB

TPM

USB

TPM

USB

USB

USB

USB

NFC

TPM

NFC

FACE

USB

FACE

USB

USB

TPM

USB

USB

USB

USB

USB

FACE

USB

USB

USB

USBRBA

USB

USB

USB

USB

USB

USB

USB

RBA

USB

USB

USB

NFC

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

NOK NOK LABS AUTHENTICATION MODULE

14

AUTHENTICATION CHAIN

15

OPENAM POLICIES

16