Security vendor EyeLock recently unveiled its iris-based authentication technology, which claims to be the first and only iris authenticator that complies with the recently launched FIDO Alliance 1.0 specifications. Security and device authorization are key concerns for the IoT, as rampant paranoia still frequents headlines with scares of hacked-homes and self-kidnapping cars.
Essentially, the myris service acts as a password vault which identifies users via a USB scanner. While password managers are commonplace, they still require a password to access the bank of stored complex passwords. Myris removes the password from this dynamic and instead uses an eyeball to login. Iris recognition is used in passports, border control, by some police forces, and also to verify the identity of the iconic Afghan Girl, photographed by National Geographic’s Steve McCurry.
While the myris scanner isn’t cheap, costing $280, the technology is only a few years from potentially being miniaturized into any number of devices. EyeLock were showing off a pre-production laptop that incorporated the myris tech into its design. The laptop is being built by Wistron NeWeb, which has an agreement with EyeLock to add myris to PCs, set tops, networking devices and automotive applications. That partnership claims to be the first deal to embed iris authentication into an original design manufacturer (ODM) white-label device. All that’s needed is a camera.
EyeLock and Wistron NeWeb say that their module seamlessly integrates into existing laptop architectures, and adds no weight or bulk to the design. They are confident that this means myris can be quickly adopted across a whole range of devices in 2015.
Since no two irises are alike, EyeLock claims that the chances of a false match are one in 1.5 million, meaning that the iris code can replace usernames and passwords – as long as you have the EyeLock scanner to let you into your required services. Each device can support up to five users.
EyeLock notes that voice recognition registers somewhere in the 1 in 500 range for false accepts, facial recognition at 1 in 1,000, and Apple’s Touch ID at 1 in 50,000. Only DNA scores higher than iris, with a false acceptance rate (FAR) of 1 in 800 trillion. EyeLock adds that photos or videos can’t be used to fool the scanner; an opinion that is echoed in further reading around iris recognition security.
Myris converts the iris into an encrypted code that is unique to the user, which can then be used to login to a service. Authentication occurs on the device, which means data can’t be intercepted in transit. This means that the code can’t be stolen from a database, as it acts as one part of a two-way encryption key exchange – where the public key is useless without the private key (the iris).
The Fast Identity Online (FIDO) alliance is an initiative that aims to develop technical specifications “that define an open, scalable, interoperable set of mechanisms that reduce the reliance on passwords to authenticate users.” A key part of this goal will be tying identities to individual people via biometric data – such as fingerprints, voice recognition, and iris patterns in the case of EyeLock.
In addition to reduce the need for passwords, the FIDO Alliance also hopes to encourage worldwide adoption of its specifications and programs, as well as submit its standards to other standards organizations. With a large number of influential names, such as Google, MasterCard, Microsoft, PayPal, Visa and ARM, the Alliance could make some serious headway into removing the multitude of passwords from our lives.
And this is a very good thing for the IoT, given that a week doesn’t go by without news of a major security breach at a business, in which millions of user passwords and login credentials are leaked. Being able to identify oneself to a device or service through a fingerprint or iris scan could make the IoT a much more secure place – and arguably using a much more convenient method than remembering and inputting any number of passwords.
“To be able to work with the FIDO Alliance to protect customers with the most complex biometric authentication protocol on the planet, behind DNA, is why EyeLock got into this business in the first place. We are committed to providing the next generation of security solutions and propelling the entire industry into a new era of privacy and convenience,” said EyeLock’s CMO and BDO Anthony Antolino.
At a basic level, the main idea behind the FIDO Alliance’s work is to move the mechanism of identification from an entirely software-based approach into one that incorporates some level of hardware for two-factor authentication. Essentially, instead of having to enter a username and password into a web browser, where the details could be intercepted in transit or stolen once stored on a server, the FIDO system would use new hardware to act as the unique identity, and then validate the ID via something more secure than a password.
FIDO members collaboratively have an extensive portfolio for ID management, including ‘Trusted Platform Modules’ (TPMs), USB security tokens, embedded Security Elements (eSE), Smart Cards and BLE and NFC communication protocols. With this sort of hardware, many consumer devices can be turned into secure terminals for identity verification – with nothing more than a quick finger or eye scan.
That’s a level of convenience that can be integrated into a smart home to great effect. With a smartphone’s fingerprint reader, commands issued by an app can be trusted by the devices within the home; firing up the HVAC, turning on an oven, opening a garage door, etc. Developers may be uncomfortable entrusting this kind of automation to a web browser, so more sensitive tasks could be limited to the more secure iris authorization.
The final FIDO 1.0 specification describes two elements, a universal authentication framework (UAF) and a universal second factor (U2F). Together, these can replace user names and passwords. UAF supports biometric methods to authenticate users to their devices. These can be fingerprint, voiceprint, face recognition or other emerging options. A device-based client then completes a secure connection to FIDO servers using the UAF protocol, which encrypts the transaction with a private key generated by and stored on the device. A public key sent to the server decrypts the client’s response to complete the authentication.
U2F is a small, one-time password dongle that can be inserted into the client machine’s USB port and provides the second layer of authentication. Next year the dongles will add support for Bluetooth, NFC and LTE too.
Of course, the replacement of passwords will take a long time, not least because many devices do not support biometrics (although Apple has led the way here). But some companies are already using FIDO client-server technology to protect online transactions. Samsung and Lenovo have installed the clients on some of their phones and laptops that have fingerprint readers. PayPal has implemented a FIDO server and Google has added support for U2F it in its Chrome browser.