derived credentials for smartphones


How to protect data for the always connected employee

Once thought of primarily as a concern for the defense and intelligence communities, cybersecurity is now seen as a critical priority for every single government entity. In the wake of recent data breaches of both major corporations and federal agencies, government officials are now starting to fully address their own data vulnerabilities to ensure that their agencies do not suffer the same fate. In order to fight back against hackers and protect sensitive data from falling into the hands of organizations or opportunistic hackers, agencies must deploy more robust security technology to mobile devices – both agency issued and employee-owned – to enhance data security.

The advent of smartphones and tablets has killed the 9-5 mentality and transformed the federal workforce into a 24-7 culture. However, with increased access comes an increased number of digital end points for sending and receiving sensitive data. For federal employees, the rise of mobility has opened the doors to more flexible working, but has also increased the possibility for employees to access government data and networks beyond the secure networks of government buildings.

When sensitive federal data can be accessed remotely from employees’ mobile devices, it is vital for agencies to take the appropriate steps to protect digital assets and sensitive data. Failure to do so could lead to the theft of such data, causing disruption not just for the agency, but also for the data security of the entire federal government. The nature of federal data means that any damage done could have a detrimental impact on national security.

Since the government implemented measures to standardize identity and credentials across all federal agencies nearly 10 years ago, almost 5 million smartcard-based Personal Identity Verification (PIV) credentials have been issued to government employees and contractors for secure access to buildings and IT systems. The standards have been widened for non-federal and commercial use to include millions more through Personal Identity Verification Interoperable (PIV-I) and Commercial Identity Verification (CIV) cards.

The same technology can now be extended to mobile devices through derived PIV credentials – a process of taking the secure and verified PIV standard and applying it to mobile devices. This standard helps alleviate many of the vulnerabilities that are especially prevalent in the mobile environment and that are often poorly protected by users who recycle the same passwords across many personal and professional accounts. 

One of the best methods for protecting these devices is to use a secure keystore. As the ‘black box’ of security certificates and verifications for mobile devices, the secure keystore holds cryptographic keys that are tamper resistant and unique to each device. This is the same principle as the smartcard holding identity credentials, but in this case it is embedded in an individual’s mobile device – a smartphone, tablet or laptop – and is derived from the same stringent criteria that was used to issue the employee’s smartcard. 

The key to enhancing mobile security is in combining a secure digital identity with a second authentication factor, such as a PIN or fingerprint, to let people use their devices to authenticate themselves for physical and digital access. Two-factor authentication is now widely used in consumer banking and online services, and is becoming an increasingly familiar technology in the United States. Most of these schemes, however, require the user to manually transfer one-time passwords between devices, which is highly inconvenient and still not immune to subversion.  However, by using a mobile credential that first authenticates the user (with PIN or biometric) to authorize a cryptographic signature, we now have a viable alternative to passwords that is highly secure as well as convenient and simple to use. This allows agencies to have far greater confidence and control over who is accessing their networks and sensitive data.

If we have learned anything from a multitude of recent high profile cyberattacks, it is that even the largest corporations and government agencies are not safe from hackers. Federal agencies’ old-line approach of keeping employees inside agency buildings and accessing sensitive information from designated terminals isn’t in keeping with today’s mobile society. It is neither practical nor desirable. Strong authentication enables federal agencies to reap security benefits while allowing for a more mobile and flexible federal workforce.

About the Author

Chris Edwards is the chief technical officer at Intercede.

inside gcn

  • urban air mobility (NASA)

    NASA seeks partners for urban air mobility challenge

Reader Comments

Mon, Jul 13, 2015 Chris Edwards

By purely using the biometric (and most likely PIN fallback) to authorize access to the private cryptographic key on the client, you still have a much more secure system than one that puts the bio/password authentication on the server. You are right to point out that relying parties must avoid these 'back doors' for recovery; separate credential management systems should be used to re-provision in the event of lost or compromised authenticators. (This is similar to the more secure banking apps where a locked-out account takes a couple of days to reset, as they actually mail an activation code to your physical address. The right balance must be met between security and convenience, but at least here we can have high security and high convenience for the 'straight line' cases, and only suffer inconvenience for exceptional circumstances.

Sat, Jul 11, 2015 Hitoshi Anatomi

The question is how to combine fingerprint with another factor. Whether iris, face, fingerprint, typing, gesture, heartbeat or brainwave, biometric authentication could be a candidate for displacing the password if/when (only if/when) it has stopped depending on a password to be registered in case of false rejection while keeping the near-zero false acceptance. Threats that can be thwarted by biometric products operated together with fallback/backup passwords can be thwarted more securely by passwords alone. We could be certain that biometrics would help for better security only when it is operated together with another factor by AND/Conjunction (we need to go through both of the two), not when operated with another factor by OR/Disjunction (we need only to go through either one of the two) as in the cases of Touch ID and many other biometric products on the market that require a backup/fallback password, which only increase the convenience by bringing down the security. In short, biometric solutions could be recommended to the people who want convenience but should not be recommended to those who need security. It may be interesting to have a quick look at a slide titled “PASSWORD-DEPENDENT PASSWORD-KILLER” shown at

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group