Evidian

FIDO
Authenticationin DirX Access
Enables enterprises to face contemporary cybersecurity
threats and enhance their security
The recent, rapid rise of data breaches andsophisticated cyberattacks has exposed thecurrent state of security information
technology systems, forcing systemproviders to search for an innovative andmore secure authentication mechanism.
Standards issued by the Fast Identity Online(FIDO) Alliance represent the next generation
in authentication technologies by addressing
the general need for stronger authentication.
These technologies mitigate the issues
connected with legacy authentication
methods and stand up to contemporary
cyberthreats by shifting the authentication
model from traditional password-based
authentication to easy-to-use multi-factor
authentication.
DirX Access, part of Atos’ DirX product suite,
is a comprehensive solution forauthentication and authorization for identity
federation. Beginning with version 8.7, DirX
Access has been extended with FIDO-based
authentication mechanisms.

Motivation
There is a good reason for thisauthentication model shift in modern
enterprise applications: passwords havebeen one of the weakest links in IT security
for a long time. Generally, stolen credentials
and phishing take up the first slots of the top
20 actions in breaches. Passwords are
clumsy, hard to remember and need to be

Trusted partner for your Digital Journeychanged all the time. As recognition
technologies are introduced, the use ofpasswords and tokens in medium-risk use
cases will drop, encouraging companies tolook for products that focus on developing
an environment of continuous trust with agood user experience.
FIDO standards concentrate on improving
the major aspects of mature security-related
solutions: strong security, better user
experience, and reduced costs. The security
aspect is achieved (among other things) byemploying public key cryptography, while
the user experience and cost-effectiveness ofthe solution stem from using FIDO
authenticators, which typically use different
factors of user authentication such as
hardware tokens (something you have) orbiometrics (something you are). Issued by
the FIDO Alliance, the overall solution has
strong support from major market players,
including Google, Intel, Lenovo, MasterCard,
Microsoft, and PayPal.
DirX Access incorporates a FIDO server
implementation that supports all of the FIDObased standards: Universal Authentication
Framework (UAF), Universal Second Factor(U2F), and W3C Web Authentication. As aresult, it can address any customer’s
infrastructure parameters and provides foreasy integration with other enterprisesystems. DirX Access integrates the FIDO-

based authentication internally with its
other product features, such as single
sign-on, identity federation, and riskbased authentication. Support for a wide
range of other authentication methods
and high configurability makes DirX
Access a mature solution that can be
successfully deployed in a variety ofdemanding scenarios.
This paper provides a brief introduction
to the FIDO-based standards (in thesection “What is FIDO?”) and theirbenefits (in the section “Benefits”). The
section “FIDO-based Authentication with
DirX Access” describes how DirX Accessintegrates the FIDO standards into its richand extensive feature set.

What is FIDO?
The FIDO Alliance was formed in 2012 asa response to the need for better andstronger authentication methods. Its
mission is to change the nature of online
authentication by developing technicalspecifications that define an open,
scalable and interoperable set ofmechanisms that reduce the reliance on
passwords. FIDO standards define boththe authentication protocols and the(security) requirements for the
infrastructure in which these protocols
operate.

Benefits
The main ideas behind FIDO are ease of use, privacy, security
and standardization. Thanks to its design, FIDO brings a
number of benefits into the world of authentication
mechanisms:
 End users benefit from improved user experience.
 Enterprises and organizations benefit from stronger security
and reduced costs.
Improved User Experience

Stronger Security

Reduced Costs

No need to remember passwords
This primary security vulnerability can finallybe removed from the authentication process.

Identity cannot be stolen
Identity cannot be stolen when server-side
credentials are stolen.
The relying party stores only the public key
part of each related FIDO credential. This partdoes not provide the attacker with anymeans of impersonating the user.

Little or no provisioning costs
Provisioning system users with a newkind of authentication selection typicallyinvolves completing two tasks: procuringa (hardware) authenticator for each user
and registering related credentials at theserver side. FIDO decreases costs in bothof these cases: the former with thepossibility to reuse a user’s personalauthenticator (BYOD) and the latter withthe enablement of auto-registration –users can typically use self-service
credential management portals.

Simple action to sign in
To perform local authentication on a device,a user can simply swipe a finger, look into thecamera, plug in a USB stick, or similar.
Transferable user experience
The same authenticator device can be
securely used for multiple services, providing
a consistent user experience across multiple
services.
Fast and convenient
The nature of FIDO enables authentication
methods that are faster and moreconvenient than contemporary strong
authentication methods to be brought tomarket. For example, compare a PIN-based
FIDO authenticator to the OTP method: inthe former case, the challenge is hidden fromthe user; in the latter case, the user needs toprocess it manually.
Biometrics, if used, never leave the device
Biometrics used during the authentication
process are stored on the user’s device,typically in a secure storage. The user’s
biometric data are only compared in the
FIDO authenticator; the proof of identity isthen communicated to the requesting third
party using public key cryptography. Thisapproach has two beneficial consequences:
the user does not need to worry about
identity theft, and the FIDO server provider
does not need to worry about the credentials
theft in the sense that they do not containany personal data.

2

Client-side credentials cannot be stolen
FIDO’s intention is to leverage authenticators
capable of storing user credentials (privatekey) in a hardware-backed trusted
environment such as Trusted Platform
Module, Trusted Execution Environments or
Secure Elements. These environments
ensure that even if the attacker steals thedevice, the stored credentials are prevented
from abuse. Specific authentication methods(such as biometrics) keep credentials frombeing stolen and also prevent the attacker
from using the authenticator.
Protection against phishing, man-in-themiddle and replay attacks
The challenge-response aspect of the
protocol in connection with the public key
cryptography protects against phishing andreplay attacks. Each protocol run is bound toa (server) origin and a (communication)
channel which allows the server to detect
MITM attacks.

Lower breach risks and potential
damages
The protocol design itself mitigates thecosts connected with attack damages bysolely preventing the possibility of an
attack or by allowing an inexpensive
remedy process.
Broad choice of authenticators for
users
FIDO standardization allows vendors tooffer a wide variety of authenticators,
both embedded and pluggable.

Services and accounts cannot be linked
The authenticator produces a unique key
pair for each server; as a result, even if anentity possesses all the public keys frommultiple servers, it cannot link these publickeys to a single user.

FIDO Authentication in DirX Access ---- White PaperFIDO Infrastructure
To enable FIDO-based authentication, twocomponents are necessary: a FIDO
authenticator connected to or built into aclient device possessed by the user to beauthenticated, and a FIDO server thatprovides the authenticated state to theapplication it protects.
Although it is solely under the user’s control,
the FIDO authenticator that provides proof of
the user’s identity is trusted by the serverside. This relationship stems from
employment of the authenticator attestation,
one of the main principles on which FIDO is
built.
The FIDO infrastructure can consist ofcomponents manufactured by different
vendors whose cooperation is ensured by
the interoperability aspects of the issued
standards.

FIDO Protocols
Topologically, FIDO-based protocols belong
to a group of protocols based on thechallenge-response model. This model
ensures that each protocol run differs
sufficiently from all the other runs.
Asymmetric (public key) cryptography
serves as the identity proof-providing
mechanism.
Typically, the protocols from the FIDO suiteenable the following actions:Registration
The registration process enrolls a new FIDO
credential (public and private key) binding anauthenticator held by the user with the user’s
account at the server side. It enables easy
and cost-free user credentials provisioning.
Authentication
Authentication via the FIDO protocol is, fromthe user’s perspective, a simple andtransparent task leading to a state in which
the server side obtains the user’s identity.
Transaction Confirmation
An extension to the authentication action
provided by the FIDO UAF is represented bya transaction confirmation use case. Whendealing with sensitive transactions (likebanking), the transaction data can be boundto a FIDO authentication request andsubsequently credibly displayed to the user.
This process makes both sides indisputably
aware of the entire action.
Deregistration
To provide the user with complete credential
management possibilities, FIDO covers thederegistration protocol flow.

Authentication Flow
Figure 1 depicts the authentication
process using the FIDO protocol.
 The user accesses a protectedresource (web page, mobile
application) and wants to sign in.
 The protected resource informs the
FIDO server component of the serverside application, which in turn sends achallenge to the user’s device with thebuilt-in/connected FIDO authenticator.
 The authenticator locally verifies theuser’s identity based on something theuser has (a device), something the useris (biometrics, such as fingerprint, irisscan or voice pattern), or something
the user knows (a PIN). Any data thatoriginates in the verification process(such as the digitalized fingerprint) do
not leave the device. Instead, if
successful, the authenticator signs theserver-issued challenge with a private
key relevant to that given server anduser account.
 The signed response is sent back to
the FIDO server, which verifies it using
the corresponding public key.
Different standards from the FIDO suite
focus on different authentication use
cases. FIDO UAF, Windows Hello and
Web Authentication standards provide a
password-free user experience
represented predominantly by biometricbased authentication methods (but notlimited to them). A second-factor user
experience is then provided by FIDO U2F,
which enables the addition of the secondfactor authentication aspect to theexisting infrastructure.

Figure 1: Authentication Flow
FIDO Authentication in DirX Access ---- White Paper

3

FIDO-based Authentication with DirX Access
DirX Access acts as an identity provider to third-party
applications, making it the perfect system component tocontain a FIDO server implementation. Therefore, its rich suiteof supported authentication methods has been extended withall of the currently issued FIDO standards.
Authentication Application
In DirX Access, the authentication methods
are typically made accessible through the
Authentication Application web application.
This deployment-ready application is highly
customizable via the standard web
technologies to combine the possibility ofout-of-box deployment with the ability foradaptation to any customer’s requirements. It
now provides a front end to FIDO operations
and workflows that both enables theauthentication process and acts as a selfservice credential-management portal
providing self-registration/deregistration of
FIDO credentials.

Configurability
One of the main principles that DirX Accessfollows is high configurability. Applying thisprinciple to the FIDO server implementationmeans that the administrator is able to set up
the entire system according to thecompany’s security policies. The
configuration allows the administrator tochoose which FIDO standards will besupported and in addition allows for theassignment of fine-grained policies to eachsupported standard.
FIDO UAF defines a vocabulary of FIDO
policies that determines the supported
authenticators (for example, by exact
denomination or according to someauthenticator properties). DirX Accessextends the employment of thisstandardized mechanism to all the other
FIDO standards. The policies are evaluatedagainst the corresponding authenticator’s
properties – a metadata statement – that are
distributed via the FIDO Alliance metadata
service (Figure 2).

This design helps to establish a trust
between an authenticator model and
DirX Access as the authenticators listed in
the metadata service have been certified
by the FIDO Alliance. To fulfill therequirements calling for employment ofcustom authenticators or authenticators
which for some reason haven’t beencertified, DirX Access provides a way tosupply custom certificates that enable theuse of these authenticators.
The configuration of each respective
authentication method is completed by
setting up the assurance level parameter.
This parameter reflects theadministrator’s trust in the configured
method and helps in defining step-up andrisk-based authentication mechanisms.

Figure 2: Authenticator Attestation
4

FIDO Authentication in DirX Access ---- White Paper

Integration with Single Sign-on
Single sign-on (SSO) is a property of anaccess control mechanism ensuring that thesign-on process is performed only once per
single session and enabling access tomultiple applications typically within thesame domain. This property creates aconvenient user experience as switchingfrom one application to the next appears to
be seamless to the user. DirX Accesssupports SSO in the web environment, where
the FIDO authentication methods can beused during the initial authentication process
to harden the security and simplify theprocess.

FIDO Authentication in DirX Access ---- White Paper

Integration with Identity Federation
Identity federation in DirX Access is a process
which extends SSO to the multi-domain
environment. Identity federation
technologies enable authentication andauthorization across applications fromdifferent domains that share trust with DirX
Access. Nowadays, this is the easiest
approach to protect online applications andservices, as these packages do not need to
be altered and need only to communicate
via standardized means to an identity
provider which informs them about theuser’s authenticated session. The moresecure the authentication process is on theside of the identity provider, the moreguarantees can be given to the relying
services, which again pinpoints theimportance of supporting FIDO standards. As
DirX Access supports SAML, OAuth 2.0based (OpenID Connect, UMA 2.0), and WSFederation standards, it is a complete tool
implementing a strong and reliable identity
provider.

Integration with Risk-based and Stepup Authentication
DirX Access was one of the first products
to employ the machine learning andpattern recognition techniques in its
process of user authentication. Internallycalled risk-based authentication(sometimes referred to as adaptive
authentication), this mechanism assesses
risks connected with a real-time context
of a user session and compares themwith the assurances given by the user,
typically the authentication methods
already performed. If the risks are too
high, the mechanism requires the user toprovide stronger proof of its identity tobalance the risks. The FIDO server
implementation widely extends the rangeof possible proofs as the FIDO
authentication methods provide a highdegree of security.

5

Highlights and Conclusion
By implementing DirX Access, new authentication options
based on FIDO2 and W3C standards enable businesses andusers to move beyond passwords for stronger, simpler
authentication leveraging devices they use every day.
Integrated with its other product features, such as single signon, identity federation, and risk-based authentication, DirX
Access provides a mature solution that can be successfully
deployed in demanding access management scenarios in allindustries. Security based on FIDO specifications makes online
security a simpler and better user experience while providing
stronger security and reducing risks for the enterprise.

6

FIDO Authentication in DirX Access ---- White Paper

White Paper

About Atos
Atos is a global leader in digital transformation
with over 110,000 employees in 73 countries
and annual revenue of over € 11 billion.
European number one in Cloud, Cybersecurity
and High-Performance Computing, the Group
provides end-to-end Orchestrated Hybrid
Cloud, Big Data, Business Applications andDigital Workplace solutions. The group is theWorldwide Information Technology Partner
for the Olympic & Paralympic Games andoperates under the brands Atos, Atos Syntel,
and Unify. Atos is a SE (Societas Europaea),
listed on the CAC40 Paris stock index.
The purpose of Atos is to help design the
future of the information technology space.
Its expertise and services support thedevelopment of knowledge, education
as well as multicultural and pluralistic
approaches to research that contributeto scientific and technological excellence.
Across the world, the group enables its
customers, employees and collaborators,
and members of societies at large to live,
work and develop sustainably and confidently
in the information technology space.
Find out more about us
atos.net
atos.net/careers

DirX_Access_FIDO-White-Paper-en2

Let’s start a discussion together

For more information: www.evidian.com/dirx
Atos, the Atos logo, Atos Syntel, Unify, and Worldline are registered trademarks of
the Atos group. August 2019. © 2019 Atos. Confidential information owned by
Atos, to be used by the recipient only. This document, or any part of it, may not be
reproduced, copied, circulated and/or distributed nor quoted without prior written
approval from Atos.