Secure Element Access from a Web browser W3C Workshop on Authentication, Hardware Tokens and Beyond JAVARY Bruno Oberthur Technologies – Identity BU 11 September 2014 1 Agenda • 01. INTRODUCTION • 02. EXISTING : WHAT ARE THE DRAWBACKS • 03. USE CASE : PIV • 04. PERSPECTIVE AND PROPOSAL 11 September 2014 2 Agenda • 01. INTRODUCTION • 02. EXISTING : WHAT ARE THE DRAWBACKS • 03. USE CASE : PIV • 04. PERSPECTIVE AND PROPOSAL 11 September 2014 3 History : OT experience • June 20th 2013, London, Workshop on Web Applications and Secure Hardware • July 2013 : for eSE finalist • October 15th 2013, Oberthur Technologies joins FIDO Alliance OT founding member of SIA • November 2013 : Presentation of PIV for eSE on OT booth demonstrating eservices. “my voice is my password” winner in the Trusted internet/ Authentication category • February 24-27th 2013, Barcelona, GSMA Mobile World Congress : 1st worldwide demonstration of a FIDO authentication secured by the SIM • March 2014 : Mobile ID study starts with dedicated workforce with objective : “Smartcard Access from Web Browser” • Summer 2014, w3C call for papers, submission of position paper, result of internal study 4 POSITION SUMMARY • To enable a common access for every single user to trusted services thanks to a secure element, the best candidate is the web browser • By consequence HTML and JavaScript will be the standard to access a secure element • Many examples already exist to access hardware o Video, webcam, geolocation, file system o Thanks to evolutions of standards 11 September 2014 5 POSITION SUMMARY Several topics are to be considered • Authentication : o For Payment / Internet banking / Corporate network access / Social media o FIDO is an answer • Access to cryptographic operations : « Secure Operations Execution » o Web crypto api o Issue : define use cases exhaustively • Low level access to the secure element or hardware token o Access the closest possible to the hardware o Close to sysapp considerations 11 September 2014 6 Agenda • 01. INTRODUCTION • 02. EXISTING : WHAT ARE THE DRAWBACKS • 03. USE CASE : PIV • 04. PERSPECTIVE AND PROPOSAL 11 September 2014 7 EXISTING Middleware • Software application that enhances the capacities of our computer applications by creating an abstraction layer • Implements standard • Good solution for a local use, it provides secure features established on standards in a controlled IT configuration. However it can’t be used as an online solution or in an opened device. Web browser extension • Program integrated into a web browser and which provides new features • Can be : plug-in, java applet, ActiveX • The only solution right now but many drawbacks : o Heterogeneity of methods to access Smart Card o Security 11 September 2014 8 EXISTING Mobility • Most of the apis are proprietary (eg OT Micro SD) • There are some promising technologies o NFC o Open Mobile API • These communications layers remain low level • Middleware and web browser extensions do not fit in a mobile environment 11 September 2014 9 Agenda • 01. INTRODUCTION • 02. EXISTING : WHAT ARE THE DRAWBACKS • 03. USE CASE : PIV • 04. PERSPECTIVE AND PROPOSAL 11 September 2014 10 PIV - PERSONAL IDENTITY VERIFICATION Definition • US federal employee or contractor wears a PIV card defined by the National Institute of Standards and Technology (NIST). • The card is required to enter a governmental building and to log on to computers (Physical and Logical Access Control). • The federal employee can also sign emails or documents and authenticates to remote web sites in HTTPS. Limitations • File decryption or signing must be done locally. In a world of cloud computing and “Software as a Service” it represents a real inconvenience. • The agent must have an already configured PC or be granted with specific rights, which prevents from using devices “on the go” or “away from office” (in a hotel, an airport, at home). • To use a Smartphone or a tablet, specific software and hardware (card reader) have to be set up. 11 September 2014 11 Agenda • 01. INTRODUCTION • 02. EXISTING : WHAT ARE THE DRAWBACKS • 03. USE CASE : PIV • 04. PERSPECTIVE AND PROPOSAL 11 September 2014 12 PROMOTE A STANDARDIZATION Position • As a solution provider, we would like to push the standardization of a JavaScript API which allows web browser to communicate with Smart Card • Objective is to open trusted services with secure element to the mainstream market • In order to be implemented in all browsers and to ensure its liability, the API should be endorsed by W3C. Secure Element API • This api is complete and well documented. It presents in details the technical background and use cases and gives a good visibility of Security, Permissions, Access Control and Conformance • Security is at the heart of OT’s concerns; the proposed solution combines validation of the feature by the user and a specific access control mechanism • The idea beyond is to propose a trusted access to a secure element from a service provider, preventing from unauthorized use. 11 September 2014 13 PERSPECTIVE Action Plan Let’s follow, jointly with all companies and associations sharing the same opinion and interest, action plan below: • Identify a charter to carry the project • Define use cases and for each of them demonstrate the impact and validate the consistency of the current proposal. • Meeting all stakeholders interested in the subject, be aware of each of them interest and create a common basis of communication and strategy • Establish interactions with other standardizations (eg Open Mobile API) • Gather work forces to create a proof of concept and decline it to use cases examples (eg eServices) 11 September 2014 14 Thank you for your attention 11 September 2014 15
© Copyright 2024