FIDO Authentication in the Shifting Regulatory Landscape
3 likes871 views
This document summarizes a presentation about FIDO authentication in shifting European regulatory landscapes. It discusses how FIDO helps with strong customer authentication requirements under PSD2 and GDPR regulations. FIDO simplifies the customer journey for authentication by using a single step instead of multiple steps like OTP. It also addresses privacy and data protection by design principles through storing credentials on devices instead of servers and preventing data leakage. The presentation argues that in light of security breaches and fines under regulations, service providers should replace passwords with stronger authentication like FIDO.
![FIDO Alliance © 2019 - Austin FIDO seminar Jan 201915
FIDO COMPLIANCE TO PSD2/RTS ON STRONG CUSTOMER
AUTHENTICATION
• Based on multi-factor authentication
[RTS] Articles 4, 6, 7, 8
• Protection of the “security elements”
[RTS] Articles 22, 23, 25
• Separation of execution environments
[RTS] Article 9
• Support of dynamic linking
[RTS] Article 5
… a detailed analysis of FIDO compliance is published on https://fidoalliance.org/](https://image.slidesharecdn.com/fido-authentication-in-the-shifting-regulatory-landscape-190129201822/85/FIDO-Authentication-in-the-Shifting-Regulatory-Landscape-15-320.jpg)
FIDO Authentication in the Shifting Regulatory Landscape
- 1. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20191 FIDO AUTHENTICATION IN THE SHIFTING EUROPEAN REGULATORY LANDSCAPE ALAIN MARTIN CO-CHAIR FIDO EUROPE WG VP STRATEGIC PARTNERSHIPS - GEMALTO
- 2. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20192 AGENDA • How FIDO helps with the SCA requirements under PSD2 • Compliance • The customer journey • How FIDO helps with GDPR • The need for strong authentication • The privacy by design
- 3. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20193 FIDO, PSD2 AND THE CUSTOMER JOURNEY
- 4. Open APIs FIDO Alliance © 2019 - Austin FIDO seminar Jan 20194 PSD2 IN A FEW WORDS • New Access to Account mandate Open APIs • New Strong Customer Authentication mandate • New Third Party Provider (TPP) roles : Open APIs Open APIs Payment execution Open APIs Open APIs Open APIs Gives consent Payment Initiation Service Provider (PISP) Account Information Service Provider (AISP)
- 5. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20195 THE CUSTOMER JOURNEY KEY SUCCESS FACTOR FOR THE ROLL OUT OF PSD2 IN EUROPE Authentication models have been created and… much debated by the stakeholders
- 6. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20196 AUTHENTICATION MODELS • Redirection AISPAISP ASPSP Authenticate authentication AISP AISPASPSP Authenticate
- 7. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20197 AUTHENTICATION MODELS • Decoupled • An Out of Band model PISP Merchant Merchant Authenti- cate ASPSP authentication
- 8. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20198 POTENTIAL UX ISSUES IN THE REDIRECTION/DECOUPLED MODELS • In account aggregation use cases ASPSP C Sign in with OTP ASPSP C Login Go AISP ASPSP A App AISP ASPSP B token ASPSP C OTP generator ASPSP B Login Pswd Go
- 9. FIDO Alliance © 2019 - Austin FIDO seminar Jan 20199 POTENTIAL UX ISSUES IN THE REDIRECTION MODEL • In payment initiation use cases PISP ASPSP Login Merchant Merchant Merchant PISP Bank 1 Bank 2 Bank 3 Select Bank Select account ASPSP Approve transaction ASPSP ASPSP OTP: 123456 Enter OTP: ****** Pswd
- 10. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201910 FIDO SIMPLIFIES THE CUSTOMER JOURNEY PISP Merchant ASPSP Authorise payment? ASPSP Login Pswd OTP: ****** ASPSP Enter OTP: ****** FIDO Authenticator PISP Merchant Merchant Merchant 1 step authentication 3 step authentication With FIDO With OTP by SMS
- 11. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201911 WHAT THE REGULATOR AND STAKEHOLDERS SAY • The European Commission • Added article 32-3 in the RTS on “obstacles” ASPSP may have to provide alternatives to Redirection if not properly implemented • EBA opinion paper (June 2018) • Redirection not an obstacle per se • Implementation is key, whichever the model, for a satisfactory user journey • The Fintechs • Some happy with redirection, some wanting no friction in the user experience • The Berlin Group • Are working on 2 additional authentication models: Embedded and Delegated
- 12. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201912 ALTERNATIVE AUTHENTICATION MODELS • Embedded • Delegated AISP authentication AISPAISP AISP Authenticate AISPAISP AISP Authenticate authentication
- 13. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201913 EMBEDDED MODEL = AUTHENTICATION BY THE BANK • Not in line with customer education • Difference with phishing attacks • Similar to Apple Pay • Requires enrolment • Requires trust in local user verification the FIDO approach TPPBank OTP generator Enter Pswd: ****** Enter OTP: ****** Pswd, OTP TPP Authen- ticate Bank keys generated in device Challenge/ Response
- 14. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201914 DELEGATED MODEL: FIDO/EMVCO COLLABORATION ON 3DSECURE Merchant Directory Service FIDO Authentication 3D Secure message Device ACS 3 1 2 Authenticator metadata Risk assessment Step up authentication 4
- 15. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201915 FIDO COMPLIANCE TO PSD2/RTS ON STRONG CUSTOMER AUTHENTICATION • Based on multi-factor authentication [RTS] Articles 4, 6, 7, 8 • Protection of the “security elements” [RTS] Articles 22, 23, 25 • Separation of execution environments [RTS] Article 9 • Support of dynamic linking [RTS] Article 5 … a detailed analysis of FIDO compliance is published on https://fidoalliance.org/
- 16. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201916 FIDO AND THE GDPR
- 17. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201917 GDPR – GENERAL DATA PROTECTION REGULATION • Applies since 25 May 2018 • Very large fines for infringement: Up to €20,000,000 or 4% total worldwide turnover • Data protection • Consent of data subject • Data subject rights • Adequacy, relevance, etc. of data collection • … The subject for FIDO
- 18. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201918 PROTECTION AGAINST UNAUTHORIZED ACCESS • Level of security to be appropriate to the risk FIDO recommendation: implement strong authentication to prevent phishing and hacking Data subject right to access, modify, etc.
- 19. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201919 RECENT HEALTHCARE DATA BREACHES July 2018 – Singapore “Hackers stole data of PM Lee and 1.5 million patients in 'major cyberattack' on SingHealth” October 2018 – USA “US Center for Medicare & Medicaid Services says 75,000 individuals' files accessed in data breach” July 2018 – USA “1.4M records breached in UnityPoint Health phishing attack” July 2018 – USA “Patient data exposed for months after phishing attack on Sunspire” August 2018 - USA “3 phishing hacks breach 20,000 Catawba Valley patient records”
- 20. 20 SPECIAL CATEGORIES OF DATA • Processing of this data prohibited, unless allowed in specific cases • If allowed, requires • Explicit consent • Suitable safeguards to protect personal data • Data protection impact assessment • Assessment of the measures, safeguards and mechanisms envisaged for mitigating risk and ensuring the protection of personal data Special Categories of data Political opinions Racial or ethnic origin Healthcare Sexual life Religious beliefs Biometric data FIDO Alliance © 2019 - Austin FIDO seminar Jan 2019
- 21. 21 USER CONSENT • Data subject must give consent to processing of his/her personal data • For special categories: explicit consent FIDO Alliance © 2019 - Austin FIDO seminar Jan 2019 FIDO recommendation: Strong authentication is a good practice to properly identify the data subject providing consent
- 22. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201922 THE CONTROLLER SHOULD BE ABLE TO DEMONSTRATE THIS CONSENT • FIDO authenticators are capable of signing transaction data • Server message can include consent information • Signed response is a non forgeable proof • Can be used in case of dispute Do you agree to providing your health data to ABCHealth ? Authenticate to confirm
- 23. 23 EXEMPTION • GDPR does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity • Biometrics on smartphone can be exempted • e.g. French Data Protection Authority (CNIL) exemption IF ON DEVICE STORAGE AND MATCHING • If remote storage and matching, there must be an impact assessment FIDO Alliance © 2019 - Austin FIDO seminar Jan 2019
- 24. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201924 FIDO’S USE OF BIOMETRICS • With FIDO, biometrics can only be stored and matched on a consumer’s device • FIDO prohibit biometrics from being stored or matched in servers No Data Protection Impact Assessment for the use of biometric data
- 25. 25 DATA PROTECTION BY DESIGN PRINCIPLE • Proactive • Embedded from the start in design • For authentication solutions, this would mean, by design: Protection of user authentication credentials and biometric data Protection against phishing or MITM attacks FIDO Alliance © 2019 - Austin FIDO seminar Jan 2019
- 26. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201926 FIDO EMBRACES PROTECTION/PRIVACY-BY-DESIGN Based on public key cryptography No server-side shared secrets Keys generated and stored on device Verification of web origin /channel id Biometrics, if used, never leave device No link-ability between services or accounts
- 27. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201927 IN SUMMARY In light of the heavy fines and ever increasing attacks from hackers Service providers should consider replacing passwords with stronger means of authentication Password Data protection measures
- 28. FIDO Alliance © 2019 - Austin FIDO seminar Jan 201928 RESOURCES: PSD2 HTTPS://FIDOALLIANCE.ORG/HOW_FIDO_MEETS_THE_RTS_REQUIREMENTS/ HTTPS://FIDOALLIANCE.ORG/.../FIDO-PSD2_CUSTOMER_JOURNEY_WHITE_PAPER.PDF GDPR HTTPS://FIDOALLIANCE.ORG/.../FIDO_AUTHENTICATION_AND_GDPR_WHITE_PAPER_ MAY2018-1.PDF HTTPS://FIDOALLIANCE.ORG/EVENT/WEBINAR-FIDO-AUTHENTICATION-GDPR/