September 18, 2020

Using biometrics for authentication in Android

Joel Snyder

Mobile device users are now favoring biometric authentication such as fingerprint sensors to unlock their smartphones and tablets, mainly because they speed and simplify the unlocking process while reducing the cognitive burden of remembering multiple long passwords.

Additionally, proper use of biometrics increases security: passwords are easy to steal, while faking biometrics is much more difficult. The result is a technology that is ideal for providing role-based access controls and high levels of trust for business users.

Here’s a detailed look at how biometrics work, how data encryption fits in, and what business leaders should look for to keep security high while delivering the convenience that users want. How exactly do all of the elements of biometrics come together in Android to provide a heightened security offering?


How biometrics work

The first step to understanding biometrics is to realize the biometrics are not being saved in the network or passed around between devices and servers. Instead, biometrics are used to lock up and protect other authentication information — usually a digital certificate private key — and it’s the “protected” information that is actually being used to authenticate the user.

Android v6 (“Marshmallow”) introduced a standardized API for biometrics, focusing on fingerprint readers. Companies looking to leverage biometrics as part of authentication can depend on having a common set of services, a high level of security, and a consistent user experience across platforms.

The key requirement in Android is that fingerprint biometrics have to be stored in the Trusted Execution Environment (TEE). This means that the biometric information is encrypted and stored in a separate part of the smartphone, completely inaccessible to the regular operating system. They can’t even be exported. Android can ask the TEE to validate an identity using biometrics, but cannot extract the biometric information. This means that when the user stores their biometric information, such as a fingerprint, they are not sharing that information outside of their own smartphone or tablet. They are just establishing a way to identify themselves to their device.


Implementing biometrics in the enterprise

Using fingerprints to authenticate the user to their own phone is just one use of biometrics. Companies can think beyond unlock screens for their employees. For example, some types of password vaults can be unlocked with biometrics, simplifying the process and encouraging their use.

An even more advanced use combines the TEE, biometrics, and application-specific authentication information to give users the experience of using their fingerprint to log onto online services. The FIDO (Fast Identification Online) Alliance has developed a standard to optimize exactly that: converting biometric authentication of an end-user to application-friendly user authentication. Android 7.0 (“Nougat”) is certified as compatible with FIDO2, which means that most Android devices are ready, out of the box or with a quick software update, to use biometrics (or other FIDO-compatible security hardware) to eliminate the use of passwords for many websites and applications.

While Android, the client, is important, it’s even more critical that FIDO Alliance’s FIDO2 protocols are supported by online services and browsers. Major vendors, including Google, Dropbox, Facebook, Paypal, Salesforce, Bitbucket and GitHub, and major browsers such as Google Chrome, all support FIDO2.

Samsung Pass is an example of a service that is based on the FIDO specifications. Samsung Pass enables strong authentication across applications using biometrics combined with a cloud-based service provided by Samsung. With Samsung Pass, smartphone users can lock up multiple sets of authentication credentials (from both public and private enterprise services) with their fingerprint, facial recognition or iris scan. Samsung Pass simplifies the user experience, but uses highly secure authentication systems based on digital certificates so that end users can keep their strong authentication credentials locked up with biometrics, reduce their use of insecure passwords, and speed authentication to applications.


Advancing and evaluating biometric technology

Of course, fingerprints are only the first biometric that came to smartphones. Vendors such as Samsung have added other biometrics such as face and iris scanning to their devices.

For iris scanning, Samsung smartphones like the Galaxy S9 and Note9 made use of a separate infrared camera and “flash” for the iris that is only connected to the TrustZone-based TEE. This eliminates the possibility that untrusted software can grab an iris scan. The scans are processed by a trusted application in the TEE, and only the processed hash of the scan is stored, eliminating the possibility that the raw data can be extracted by any software running outside of the TEE.

Fingerprint readers are getting their own innovations too. For example, Samsung’s Galaxy S10, Note10 and S20 series include an ultrasonic fingerprint sensor. Built into the display, the sensor detects the ridges and valleys of the fingerprint directly through the glass by bouncing off ultrasonic pulses. This new style of reader is fast and popular with users, because they no longer have to find the capacitive sensor on the back.


Addressing standards

Businesses with BYOD or CYOD policies should carefully evaluate biometrics on Android smartphones when choosing vendors and technologies. This will help reduce the risk of introducing the kinds of security vulnerabilities that came with the initial implementations of fingerprint readers. Following standards such as FIDO’s U2F will help reduce the risk of insecure implementation.

When enabling newer biometrics, look for a clear statement from the manufacturer on how the data is stored and verified. Data should be stored in an encrypted or hashed format eliminating the possibility of decryption, even by privileged applications.

Android devices should make use of specialized hardware and TEE with live biometric data, to ensure that malware can’t tamper with the data or interfere with the process, creating safer options for businesses interested in top security measures for their growing workforce.


Learn more about how Samsung mobile devices are Secured by Knox. And read about businesses that are succeeding with Knox solutions.

[Icon] close

Get the right solution for your business

Join 25,000+ organizations around the world.

[Icon] suitcase
Are you a reseller or solution partner?

Get access to the Knox Partner Program for helpful partner tools, such as the Knox Deployment Program portal, Knox MSP portal, partner SDKs, and more.

[Icon] info
Unified Endpoint Management
Knox Suite
Rebranding and customization
Knox Configure
Fraud and theft protection
Knox Guard
Device protection plan
Samsung Care + for Business
Other products & services

Get started with

[Image] Knox Suite

All-in-one solution bundle for enterprise mobility.

[Icon] Check mark

Join us and get a 90-day free trial for Knox Suite and other Knox products. *Approval required

[Icon] Check mark

A complete set of tools to secure, deploy, manage, and analyze your enterprise's corporate mobile devices.

[Icon] Check mark

Try powerful features bundled with Knox Suite, such as Knox Remote Support.

Knox Suite include:

[Icon] Knox Platform for Enterprise Knox Platform for Enterprise
[Icon] Knox E-FOTA Knox E-FOTA
[Icon] Knox Mobile Enrollment Knox Mobile Enrollment
[Icon] Knox Asset Intelligence Knox Asset Intelligence
[Icon] knox manage Knox Manage
[Icon] knox capture Knox Capture

Get started with

[Image] Knox Configure Logo

Remotely configure Samsung devices in bulk and tailor them to specific needs, right out of the box.

[Icon] Check mark

After approval, you can try both the:

  • Setup edition — designed for a one-time deployment
  • Dynamic edition — deploy and update policies as many times without a factory reset.
[Icon] Check mark

Try either the Setup edition or Dynamic edition of Knox Configure on up to 30 devices.

[Icon] Check mark

Get a free Knox Suite trial upon approval to try our UEM.

Get started with

[Icon] Knox Guard Logo

Remotely control Samsung devices to reduce financial risks and protect assets.

[Icon] Check mark

After you get approved, generate your free trial license for 90 days.


Try all the features of Knox Guard on up to 30 devices, including SIM control and device locking.

[Icon] Check mark

Get a free Knox Suite trial upon approval to try our UEM.

Get started with

[Image] Samsung Care Plus For Business Logo

Protect your business devices against accidental damage and mechanical breakdowns.

[Icon] Check mark

Are you already a Samsung Care+ for Business customer? Create an account and access the Samsung Care+ for Business console.

[Icon] Check mark

Contact the Samsung sales team and get peace of mind for your devices.

Other products & services

[Image] Others logo
[Icon] Check mark

Samsung offers additional solutions to serve the unique needs of your business. Talk to a Samsung expert today.

Back to top