Settembre 18, 2020

Using biometrics for authentication in Android

Joel Snyder

Mobile device users are now favoring biometric authentication such as fingerprint sensors to unlock their smartphones and tablets, mainly because they speed and simplify the unlocking process while reducing the cognitive burden of remembering multiple long passwords.

Additionally, proper use of biometrics increases security: passwords are easy to steal, while faking biometrics is much more difficult. The result is a technology that is ideal for providing role-based access controls and high levels of trust for business users.

Here’s a detailed look at how biometrics work, how data encryption fits in, and what business leaders should look for to keep security high while delivering the convenience that users want. How exactly do all of the elements of biometrics come together in Android to provide a heightened security offering?

 

How biometrics work

The first step to understanding biometrics is to realize the biometrics are not being saved in the network or passed around between devices and servers. Instead, biometrics are used to lock up and protect other authentication information — usually a digital certificate private key — and it’s the “protected” information that is actually being used to authenticate the user.

Android v6 (“Marshmallow”) introduced a standardized API for biometrics, focusing on fingerprint readers. Companies looking to leverage biometrics as part of authentication can depend on having a common set of services, a high level of security, and a consistent user experience across platforms.

The key requirement in Android is that fingerprint biometrics have to be stored in the Trusted Execution Environment (TEE). This means that the biometric information is encrypted and stored in a separate part of the smartphone, completely inaccessible to the regular operating system. They can’t even be exported. Android can ask the TEE to validate an identity using biometrics, but cannot extract the biometric information. This means that when the user stores their biometric information, such as a fingerprint, they are not sharing that information outside of their own smartphone or tablet. They are just establishing a way to identify themselves to their device.

 

Implementing biometrics in the enterprise

Using fingerprints to authenticate the user to their own phone is just one use of biometrics. Companies can think beyond unlock screens for their employees. For example, some types of password vaults can be unlocked with biometrics, simplifying the process and encouraging their use.

An even more advanced use combines the TEE, biometrics, and application-specific authentication information to give users the experience of using their fingerprint to log onto online services. The FIDO (Fast Identification Online) Alliance has developed a standard to optimize exactly that: converting biometric authentication of an end-user to application-friendly user authentication. Android 7.0 (“Nougat”) is certified as compatible with FIDO2, which means that most Android devices are ready, out of the box or with a quick software update, to use biometrics (or other FIDO-compatible security hardware) to eliminate the use of passwords for many websites and applications.

While Android, the client, is important, it’s even more critical that FIDO Alliance’s FIDO2 protocols are supported by online services and browsers. Major vendors, including Google, Dropbox, Facebook, Paypal, Salesforce, Bitbucket and GitHub, and major browsers such as Google Chrome, all support FIDO2.

Samsung Pass is an example of a service that is based on the FIDO specifications. Samsung Pass enables strong authentication across applications using biometrics combined with a cloud-based service provided by Samsung. With Samsung Pass, smartphone users can lock up multiple sets of authentication credentials (from both public and private enterprise services) with their fingerprint, facial recognition or iris scan. Samsung Pass simplifies the user experience, but uses highly secure authentication systems based on digital certificates so that end users can keep their strong authentication credentials locked up with biometrics, reduce their use of insecure passwords, and speed authentication to applications.

 

Advancing and evaluating biometric technology

Of course, fingerprints are only the first biometric that came to smartphones. Vendors such as Samsung have added other biometrics such as face and iris scanning to their devices.

For iris scanning, Samsung smartphones like the Galaxy S9 and Note9 made use of a separate infrared camera and “flash” for the iris that is only connected to the TrustZone-based TEE. This eliminates the possibility that untrusted software can grab an iris scan. The scans are processed by a trusted application in the TEE, and only the processed hash of the scan is stored, eliminating the possibility that the raw data can be extracted by any software running outside of the TEE.

Fingerprint readers are getting their own innovations too. For example, Samsung’s Galaxy S10, Note10 and S20 series include an ultrasonic fingerprint sensor. Built into the display, the sensor detects the ridges and valleys of the fingerprint directly through the glass by bouncing off ultrasonic pulses. This new style of reader is fast and popular with users, because they no longer have to find the capacitive sensor on the back.

 

Addressing standards

Businesses with BYOD or CYOD policies should carefully evaluate biometrics on Android smartphones when choosing vendors and technologies. This will help reduce the risk of introducing the kinds of security vulnerabilities that came with the initial implementations of fingerprint readers. Following standards such as FIDO’s U2F will help reduce the risk of insecure implementation.

When enabling newer biometrics, look for a clear statement from the manufacturer on how the data is stored and verified. Data should be stored in an encrypted or hashed format eliminating the possibility of decryption, even by privileged applications.

Android devices should make use of specialized hardware and TEE with live biometric data, to ensure that malware can’t tamper with the data or interfere with the process, creating safer options for businesses interested in top security measures for their growing workforce.

 

Learn more about how Samsung mobile devices are Secured by Knox. And read about businesses that are succeeding with Knox solutions.

[Icon] chiudi

Comincia a utilizzare Samsung Knox

[Icona] valigia
Sei un rivenditore, un provider di soluzioni o un provider di servizi?

Diventa un partner Knox e fai crescere la tua azienda oggi.

[Icon] info

Seleziona un prodotto Knox per iniziare:

Soluzione completa
Knox Suite
Rebranding e personalizzazione
Knox Configure
Protezione da frodi e furti
Knox Guard
Piano di protezione dei dispositivi
Samsung Care+ for Business
Altri prodotti e servizi

Inizia a utilizzare

[Image] Knox Suite

Una soluzione completa in bundle, appositamente concepita per la mobilità aziendale.

  • Ottieni una prova gratuira di 90 giorni per un massimo di 30 dispositivi.
  • Un set di strumenti completo per proteggere, distribuire, gestire e analizzare i dispositivi della tua azienda.
  • Prova le straordinarie funzionalità di Knox Suite

Knox Suite comprende:

Knox Mobile Enrollment Gratuito
Knox Manage
Knox E-FOTA
Knox Asset Intelligence
Knox Platform for Enterprise Gratuito
Supporto remoto Knox
Knox Capture
Knox Authentication Manager

Inizia a utilizzare

[Image] Logo Knox Configure

Consenti il rebranding e la personalizzazione dei tuoi dispositivi Samsung.

  • Ottieni una prova gratuira di 90 giorni per un massimo di 30 dispositivi.
  • Configura da remoto i dispositivi Samsung in blocco e personalizzali in base alle tue esigenze specifiche per un uso immediato.
  • Configura i tuoi dispositivi per la singola distribuzione o aggiornali tutte le volte che vuoi.

Inizia a utilizzare

[Icon] Logo Knox Guard

Protezione da frodi e furti per i dispositivi Samsung.

  • Ottieni una prova gratuira di 90 giorni per un massimo di 30 dispositivi.
  • Riduci i rischi finanziari e proteggi gli asset controllando in remoto i dispositivi Samsung.
  • Prova tutte le funzionalità di Knox Guard, inclusi controllo della SIM e blocco del dispositivo.

Inizia a utilizzare

[Image] Logo Samsung Care Plus For Business

Piano di protezione per i dispositivi Samsung.

  • Limita le interruzioni delle attività con riparazioni e sostituzioni rapide dei dispositivi. Contatta l'ufficio vendite Samsung per iniziare.
  • Visualizza tutte le informazioni sulla copertura del tuo dispositivo e sul reclamo in un unico luogo.
  • Hai già acquistato Samsung Care+ for Business? Crea un account e attiva il piano nella console Samsung Care+ for Business.

Altri prodotti e servizi

[Image] Logo di altri prodotti

Soluzioni moderne per soddisfare le tue esigenze specifiche.

  • Ricevi supporto tecnico efficiente da parte di un account manager dedicato con Enterprise Tech Support.
  • Crea dispositivi su misura per la tua azienda utilizzando Samsung Software Customization Service.
CONTATTA L'UFFICIO VENDITE