Idenprotect Security

White Paper

Version 1.4

Contents

Overview ... 3

Idenprotect Solution Architecture ... 4

Security Feature Highlights ... 5
Cryptographic Standards ... 5
Security Elements ... 5
Protection of Data Flows within Idenprotect ... 6

Idenprotect Slot System-Key Management ... 7
Slot System ... 7
Key Encrypting Key Generation ... 8

Idenprotect Client – Enrolment ... 9

Idenprotect Client – Secure Key Generation and Signing ... 10

Application Security Controls ... 11
Idle Lock ... 11
Application Lock ... 11
New Mobile Device ... 11
Geolocation Control ... 11
Key Sharing Between Apps on the Same Device ... 11
Device Integrity ... 11

Idenprotect for Desktop ... 12
Idenprotect for Windows ... 12
Key Encrypting Key Generation ... 12
Idenprotect Credential Provider ... 13
Idenprotect Key Storage Provider (KSP) ... 13
Idenprotect for Windows-Enrolment ... 14
Windows Online Authentication ... 14
Windows Offline Authentication ... 15

The Idenprotect Server Platform ... 17
Idenprotect Database & Database Connectors ... 17
Idenprotect Management Console ... 17
Idenprotect Certificate Management ... 17
Certificate Services CA Connector ... 17
SCEP/NDES ... 18
CA Middleware Connector ... 18
Multiple CA Connectors ... 18
Revocation ... 18
Idenprotect In-App PKI Connector for BlackBerry Dynamics ... 18
Idenprotect External PKI Connector for BlackBerry Dynamics ... 18

Apply Mobile Limited-Confidential and Proprietary Information. Content and software are subject to change.

Overview

This document provides detail about the security provided by the Idenprotect set of solutions. The intended audience of this document is CIOs, IT managers, crypto and IT risk specialists, software and solution architects, and other people with comparable levels of technical knowledge.

This document will assume that the reader already possesses some knowledge regarding symmetric and asymmetric key cryptography, PKI, authentication, single sign-on and identity management.

Idenprotect solutions enable organisations to utilise best-in-class security features such as:

  • Private key protection using the mobile device’s dedicated security mechanisms such as the iOS Secure Enclave or the Android Trusted Execution Environment (TEE).
  • End-to-end strong encryption of data in transit between mobile Clients and application servers.
  • Secure key exchanges between the Idenprotect server, Idenprotect desktop and server Clients, the Idenprotect authenticator Client and other trusted applications and services.
  • Secure on-device cryptographic key generation and key management using PKCS standards.
  • Securing and encrypting keys that are used for authentication and digital signatures with a key protected in hardware.
  • Enforcing password and device compliance policies to ensure the most robust of security controls to protect cryptographic key material.

Idenprotect has developed an SDK that incorporates the above security controls and features, enabling software developers to incorporate passwordless security into their own applications.

Idenprotect Solution Architecture

The Idenprotect platform has the following components and interfaces:

  • Idenprotect Core Server orchestrates communication between various Idenprotect components and external components such as Certificate Authorities. It manages users and devices.
  • Idenprotect Identity Management Server manages user identities beyond that within Idenprotect and allows for the creation, modification, and deletion of accounts and objects.
  • Idenprotect Enterprise Identity Client transforms mobile devices into secure authenticators and trusted smart cards, generating and protecting sensitive keys.
  • Idenprotect Access Portal authenticates users by issuing challenges signed by the Client.
  • Idenprotect User Portal supports user self-management such as enrolling a new device or requesting a password reset.

The solution can be deployed as an all-in-one server or distributed technology with components being deployed to separate servers.

Security Feature Highlights

Cryptographic Standards

The following table describes the ciphers currently in place within the Idenprotect solution.

Cipher Description
EC DH(secp256r1) (Asymmetric)Key Exchange
EC DSA(secp256r1) (Asymmetric)Digital Signature Algorithm
RSA(2048bit) (Asymmetric)Encryption and Signing Algorithm
AES128 (Symmetric)Encryption Cipher
SHA512 Hash Algorithm
Bcrypt Password Hashing Algorithm

Security Elements

The following table provides information on security aspects of the Idenprotect solution.

Type of Security Security Features
Key Storage Key Encryption Key (KEK) does not reside on the device, AES-128 encryption, Hardware-backed security
Data Transmission Mutual TLS connections for management, TLS, ECDH encryption
Authentication and Authorisation Federation protocols, Certificate Based Authentication, Digital signatures, One-time passcodes, Authorisation

Protection of Data Flows within Idenprotect

The following information describes the protection of specific data flows within the Idenprotect solution.

Data Flow Scenario Security controls applied
Application enrolment Encrypted via server authentication TLS
Data between Core Server and Client Encrypted via mutual TLS
Core server and portals TLS in distributed deployments
Connections to Directory Services TLS
Connections to Certification Authorities TLS
Connections to external databases TLS

Idenprotect Slot System - Key Management

Slot System

The Idenprotect Client employs a key slot system to protect and segregate keys and certificates for various applications. The format outlines how credentials are ordered and stored, allowing additional slots for further applications.

Key Encrypting Key Generation

The slot system is encrypted by a Key Encryption Key (KEK) generated in real-time. The KEK is temporarily stored in device memory and zeroised when the device locks.

  • Seed 1: Random value from the Secure Enclave.
  • Seed 2: Random value from the mobile OS protector.

Idenprotect Client – Enrolment

Enrolment ensures user credentials are unique to each user and device, making them tamper-proof. Users must go through secure processes to become trusted authenticators.

Steps for Enrolment:

  1. An enrolment session is created.
  2. The user receives a URL/QR code.
  3. User scans the QR code and sends session ID to the server.
  4. Mobile device uploads data for validation.
  5. Key pairs are generated within the secure environment.
  6. Certificates exchanged between server and client to bind them.
  7. Key exchanges complete the enrolment process.

Application Security Controls

Idle Lock

Idenprotect enforces idle lock requiring user authentication after inactivity.

Application Lock

The application must be deleted and reinstalled if it gets locked due to security violations.

New Mobile Device

New device enrolment requires a new enrolment code.

Geolocation Control

User location is incorporated in ephemeral certificates to authorized access.

Key Sharing Between Apps

Idenprotect allows trusted keys to be shared between signed applications.

Device Integrity

Idenprotect prevents operation on jailbroken or rooted devices.

Idenprotect for Desktop

Idenprotect for Windows

Idenprotect integrates with Windows authentication mechanisms, using KSP Engine for authentication.

Idenprotect Credential Provider

Provides a user interface for Windows Logon using Idenprotect authentication.

Idenprotect Key Storage Provider (KSP)

Integrates private key operations with Windows applications and manages certificate interactions.

The Idenprotect Server Platform

Idenprotect Database & Connectors

Supports a locally-based MariaDB database and can connect to various databases securely.

Idenprotect Management Console

Provides GUI to manage users and configurations, with security features for access control.

Idenprotect Certificate Management

Includes an internal CA for managing x.509 certificates, allowing for various certificate operations.