Project ‘Eximius Hardware Key’ Takes Hardware Security Keys to the Next Level
By: Berkeley I School
Tags: Cybersecurity, Cybercrime, Ischoolprojects, Security, Authentication

Project ‘Eximius Hardware Key’ Takes Hardware Security Keys to the Next Level

‘Eximius Hardware Key’ is the winner of the Summer 2020 Lily L. Chang MICS Capstone Award.

According to statista.com, in 2019, the number of data breaches in the United States amounted to 1,473 with over 164.68 million sensitive records exposed. Of the data breaches studied in the 2019 Cost of a Data Breach Report, 24% are caused by human error, including the use of malware-infected devices, phishing attacks, and social engineering.

MICS students Jorge Montanez, Daniel Omeh, and Yu Qiao set out to prevent these data breaches with Eximius Hardware Key, which takes the state-of-the-art hardware security keys to the next level.

Eximius Hardware Key Logo

Tell us about Eximius Hardware Key.

Jorge: The Eximius Hardware Key is the next generation of hardware security keys. Leveraging technologies such as Contextual Authentication and Trusted Computing Group Remote Attestation, this key can avert the proliferation of malware-infected devices and mitigate the risks posed by the loss or theft of devices. It utilizes more than two-factors of authentication, raising the bar for hackers to not just having to steal your key, but your systems and possibly you as well.

Yu: The Eximius Hardware Key takes the state-of-the-art Multi-Factor Authentication (MFA) security key to the next level by implementing Trusted Platform Module (TPM) key attestation and contextual authentication. It provides better theft protection for the users.

Daniel: The Eximius Hardware Key is different from the current state-of-the-art hardware keys because it bakes in threat modeling and secure-by-design principles, thereby making it difficult for bad actors to compromise it when lost or stolen for instance.

Secure your Accounts with Eximius Hardware Key

What inspired your project?

Jorge: Traditional Hardware Keys that only require a PIN are significantly vulnerable to theft. This limitation of standard keys inspired the search for a more secure solution. Also, Berkeley’s research into the Feasibility of One-step Three-factor Authentication with Ear-EEG inspired this project with the idea of having more than just two factors of authentication. The Eximius Hardware Key can also provide three-factor authentication by requiring a PIN (“something you know”), by having the key on hand (“something you have”) and by validating the context of the authentication (“something you are”).

Yu: During the second to last semester, Jorge, Gopal, and I designed a survey on How Knowledge of Account Recovery May Affect Multi-Factor Authentication Adoption as our final project for our class, W215: Usable Security & Privacy. I read some really interesting research papers during that time, and when Jorge later contacted me about this capstone project idea I was hooked. The contextual authentication piece was eye-opening, and I was stoked to be part of the journey.

Daniel: I currently work as a Senior Security Engineer for a consulting firm and specialize in Network Security and providing network access level security by means of Identity & Access Management, so I see the need for this kind of security as the current methods available doesn’t always do a great job. When Jorge approached me with this idea, I immediately jumped on it and dropped my own project idea.

What was the timeline or process like from concept to final project?

Jorge: The process from conception to final deliverable was hectic given the time constraints. However, it was a great learning experience and lots of fun. We had fourteen weeks to get familiar with TPMs, Remote Attestation, OpenSSL crypto library, Windows/Linux drivers, WebAuthn, CTAP, Azure, and more.

Yu: It was a continuous learning experience and a very technically challenging one. Personally I wasn’t familiar with any of the core technologies (i.e. WebAuthn & CTAP2, TPM, .NetCore, etc.). I found myself trying to catch up constantly and exploring other ways that I could better contribute to the project. I think we have always had a clear objective despite the roadblocks.

Daniel: It was a tough journey trying to complete this project within the short time frame allotted for the semester, we put in a lot of effort, and it was a major learning curve for me and the team.

User Registration Sequence Diagram

How did you work as a team? How did you manage to work on your project as members of an online degree program?

Jorge: As a team, we managed our work using Azure DevOps. With the program being online we had the flexibility to meet at a moment’s notice as ideas came about, as we ran into issues, and as we made progress.

Yu: Communication was definitely the key. We met on average about twice a week outside of class, and almost every day when the final presentation was around the corner. We communicated our concerns and contributed to the best of our abilities.

Daniel: I think good communication was one of the major keys for us, we always stuck to time and met regularly.

Trusting New Authentication Context Sequence Diagram

How did your I School curriculum help prepare you for this project?

Jorge: The I School curriculum exposed us to many ideas and technologies that inspired the work on this project. For instance, we discussed ideas such as trusted computing, trusted platform modules, and remote attestation in our Operating System Course. In the Usable Security course, we were introduced to the Trusted Path Problem. In addition, in the Cryptography course, we became familiar with Elliptic Curve Cryptography.

More importantly, it was the community at the I School that served as a catalyst for this project.

Yu: It really has paved the way for this project. Like I mentioned earlier, the Usable Security & Privacy course prompted me to look deeper into Multi-Factor Authentication (MFA) technology, and the concept of Trusted Platform Modules (TPMs) was introduced in Operating System Security. We also received really good guidance from Professor Matthew Garrett on this topic. The problem solving and team collaboration skills developed over the course were definitely crucial to the success of this project.

Daniel: The MICS curriculum definitely played a major role in helping us put this project together as it comprised multiple areas of the courses we took during the course of the program. Network Security, Operating Systems Security, Software Security, and the Capstone course itself just to mention a few.

Do you have any future plans for the project?

Jorge: Currently we are in the patenting process.

How could this project make an impact, or, who will it serve?

Jorge: According to the Cost of a Data Breach report by Ponemon Institute, approximately a fourth of all data breaches are due to human error, these are things such as using infected devices and falling prey to social engineering. The Eximius Hardware Key can help mitigate these human errors making it costlier to carry out cybercrime.

Yu: On a broad scale, the Eximius Hardware Key serves everyday internet users. As more people become well versed in the cyber world, better security products need to be in place to protect personal information and to prevent data breaches caused by human errors. MFA hardware key adoption should also increase over the years as the younger generation gets educated in cybersecurity.

Daniel: Eximius is designed for anyone needing additional security that gives them peace of mind knowing that their key isn’t trusted in the hands of an adversary.