April 20, 2016 at 13:00Intel's hardware security technology: a new word in protecting biometric applications. Part one
- Transfer
Biometric technologies allow computers to recognize people by unique signs for each. Progress in this area is impressive. What was previously known only in narrow scientific circles is accessible to everyone today. A fingerprint scanner in a smartphone or workplace, for example, does not surprise anyone. At first glance, biometric authentication is a reliable barrier to outsiders. Indeed, there are no two people in the world who are similar in absolutely everything. But biometric applications that can reliably protect systems from intrusions also need protection.
Today we’ll talk about Intel hardware technologies that can take biometric application security to the next level.
Username and password have been used to identify users for many years. Under this security model, a person who needs to confirm that he has the right to use a certain service, just enter a name and password. This means entering the system on a computer, and gaining access to the functionality of various online services - such as social networks and Internet banks. The disadvantages of this security model are obvious for a variety of reasons. Here is some of them.
Logging in with a password
In order to increase password resistance to hacking and make life easier for users, more and more service providers are beginning to use biometric identification technologies to organize access to their systems. Thanks to these technologies, users do not need to remember passwords. For identification, voice, face, fingerprint or iris recognition is used. Biometric identification, in comparison with traditional security systems, has certain features.
The work of a biometric personality recognition system can be divided into five steps.
The scheme of the biometric user recognition system
In biometric authentication systems, the most valuable data for an attacker is user biometric templates. These patterns can be presented in the form of raw data obtained from sensors, in the form of a set of characteristic features that are already extracted from the source data, stored in memory, in the form of registered biometric standards stored in the database.
In general, if a biometric application is designed without taking into account the need for proper data protection, an attacker can gain access to raw data or sets of characteristic features. This can be done during an attack while executing an application, using a rootkit or other malicious program. In addition, an attacker can launch an attack when the application is not running, during which he is able to obtain biometric templates registered in the system if they are saved, for example, on a local disk.
Moreover, an attacker can intercept the data stream on the data bus on the way from the sensor to the processor. Also, using a camera or microphone in the immediate vicinity of the user, an attacker can collect his biometric data - such as photographs of a person or voice recordings in order to later use replay to perform an attack.
Types of attacks on a biometric user recognition application
From the point of view of developing a biometric personality recognition service, application design principles should provide end-to-end data protection in order to ensure the safe processing of confidential information. These principles include the following.
The Intel platform offers a variety of hardware technologies to meet the security requirements of applications that perform biometric verification of users. Consider three sets of Intel technologies aimed at solving this problem: Intel Software Guard Extensions, Intel Virtual Machine Extensions, and Intel Identity Protection.
Biometric user identification technologies are used more and more widely. The thing is that they provide an increased level of security. Since biometrics are based on the unique characteristics of a person: face, voice, fingerprints, iris, identification data is very difficult to steal. Biometric technologies take the place of traditional authentication methods that use a password; they simplify and speed up the work.
However, with the widespread adoption of biometric technologies in various devices, the heterogeneity and openness of the platform has led to some potential threats. One of these threats is that developers need to consider how safe biometric identification will work on various terminal devices. In particular, the following should be considered.
In order to design highly secure solutions, developers can use the technology of creating a trusted execution environment (Trusted Execution Environment, TEE).
TEE is an isolated, trusted application runtime that is separate from the usual so-called “rich execution environment (REE)”. According to the Global Platform TEE System Architecture specification , at the highest level, TEE is an environment that meets the following requirements.
Intel Software Guard Extensions (Intel SGX) allows developers to create and deploy secure applications on open platforms. These are new features of Intel microprocessor architecture, including a set of new instructions and changes in the mechanism of access to memory.
Intel SGX works by allocating sections of memory that store code and data that are protected at the hardware level. Protected areas of memory are called enclaves. The data stored in the enclave is available only to the code that is located in it. Enclave code can be called up using special instructions. An enclave can be created and loaded as a Windows DLL.
Protected runtime embedded in the process
According to the Intel SGX design model , applications using this technology consist of two parts: untrusted and trusted. When the application is executed, it invokes Intel SGX specific instructions in order to create an enclave that resides in a trusted memory area. When a trusted function is called, the code is executed inside the enclave, unencrypted data is available only inside the enclave. Access to them from the outside is completely closed. After the trusted function completes, the enclave data will remain in the trusted memory.
Scheme of the application using Intel SGX
The purpose of the Intel SGX technology is to enable high-level protection of those parts of the application, access to which outsiders should be completely excluded. In particular, important data that the application operates on is protected.
The attack surface, or Trusted Computing Base (TCB), with this approach is reduced to the application itself and the processor on which its code is executed. Even malware that can bypass the operating system, VMM, BIOS, drivers, cannot steal what the authors of the application want to keep secret.
Reducing attack surface when using Intel SGX
Before we discuss the proposal to improve the security of biometric systems, we must pay attention to what needs to be protected.
Confidential data on the biometric characteristics of the user should be treated with care: whether they are processed in the application, whether they are stored on disk, or sent to a remote service.
Modules for processing biometric data, including obtaining samples, identifying characteristic features, searching for matches, should be protected from computer viruses and other malware. In addition, it is necessary that the output of the system cannot be faked.
We offer an architectural solution, the scheme of which is shown below.
Implementing a burglar-resistant biometric system using Intel SGX
The subsystem that receives, processes, and compares biometric data is located inside the Intel SGX enclave, a trusted part of the client, and is responsible for actions on biometric data. Guaranteed data leak prevention and program integrity during its execution. Typically, such subsystems are implemented as software modules. And software implementations of anything can be hacked, for example, using malware.
In the proposed architectural solution, the protected part of the application, containing code and data, is loaded into the enclave. For both the code and the data, the procedure for calculating benchmarks is performed, the so-called "measurement" (measuring). As soon as the application code and data are loaded into the enclave, they are protected from any external program access. Thus, the implementation of biometric information processing algorithms can be considered trusted. Moreover, the proposed solution is characterized by high performance and scalability associated with the execution on the central processor. This is especially true for the implementation of those parts of biometric systems for which high performance is important. For example, for biometric data recognition functions.
Intel SGX technology offers a feature to encrypt and protect the integrity of confidential enclave content for storage outside the enclave. For example, on disk, so that the application can reuse all this later. Data can be safely transferred between enclaves using the so-called Seal Key, a hardware key that can be used to “seal” this data. Seal Key is unique to the CPU and to the existing enclave environment. In combination with other services, such as Monotonic Counter or Trusted Time, which are provided by Intel SGX platform software, this solution can be used to protect against various types of attacks.
Monotonic Counter can be used to implement security policies designed to protect against replay attacks. Trusted Time can be used to enforce time-based security policies. Both that and another - in the form of "sealed" data (Sealed Data).
The enclave is responsible for performing encryption according to the algorithm selected for it. In other words, the developer can choose any encryption platform, in accordance with the security requirements of the system. Thus, we can ensure the storage of user biometric data in the enclave and be sure that the raw biometric data will not be available outside the enclave, in the untrusted part of the application.
Sometimes, a client implementation of biometric recognition requires connecting to a remote server to perform an authentication procedure using a cloud database rather than local storage. The server can verify that it interacts with client software that has been correctly downloaded and initialized on a platform that supports Intel SGX using the Attestation mechanism. The same goes for biometric authentication. Within the framework of Intel SGX, this is a mechanism by which a certain part of the system can make sure that exactly the code that should be executed there is safely executed within the enclave, on a platform supporting such functionality.
To begin with, this module generates a report on the authenticity of the client part of the system, which can be checked, tied to a specific platform thanks to the data recorded in the CPU at the production stage. In addition, the report includes information about the user who is performing a biometric recognition session. The server checks the report to make sure that it interacts with a device that supports Intel SGX, and that the user has access to the system. The client and server, during the first connection, conduct an initialization session, during which the client part of the system safely transmits “sealed”, secret data using the appropriate Intel SGX capabilities.
This data, which can only be printed by the application that sealed it, is used to establish secure connections to the server in the future, without the need to constantly confirm the authenticity of the client platform. Among such data is “salt”, encryption key, security policy, certificate, and so on. After that, biometric data and authentication results can be transmitted over a secure communication channel between the client and server.
Attacking dynamic data is one of the most common methodologies for attacking systems. This technique can be used by rootkits and other malware to intercept specified functions and create a copy of the data or modify it in memory during program execution. In the case of biometric recognition of users, malicious code can receive biometric data taken from sensors and a biometric data template of a registered user from memory.
The traditional mechanism of software protection against unauthorized access to memory is not reliable enough. Both protected and malicious code are executed with the same privilege level (ring-0 or ring-3). Thus, malicious code can easily affect the protected code in order to disable protection.
An attacker can affect the security module and gain access to a buffer with sensitive information
Virtual Machine Extensions (VMX) is a set of instructions that supports the virtualization of processor hardware . The basic principle of its work is as follows.
Here's what the relationship looks like between the hardware, the operating system, and the VMX on and off application.
Different responses to system calls when VMX is on and off
Using the VMX trap feature, implemented at the hardware level, a memory protection mechanism based on hardware virtualization can provide faster and more secure memory protection than without using it. The basic idea here is to place a VMM-based memory monitoring module between the operating system and the hardware. When loading the application, a memory allocation table is built for areas containing trusted code and data. After building the table, during any memory access operations, VMM can intercept these operations, then compare the memory access instruction address (EIP) address and the memory address in the previously constructed table. Then the memory protection module can find out
Identity theft is a growing global problem that affects individuals and companies. This requires an easy-to-use but safe solution, as crackers constantly invent ways to obtain usernames and passwords. And they never stopped and will not stop in search of new methods of theft of this data. If you are a client of a certain organization and interact with it through the Internet, or as a regular computer user, Intel Identity Protection (Intel IPT) technology can give you powerful tools that will help you avoid the risk of identity theft. In particular, we are talking about the possibility of associating a user's physical device with service accounts on the Internet that use the capabilities of Intel IPT.
According to tradition, two-factor authentication uses one-time passwords (OTP). Such a scheme combines what the user knows (username and password) and what he has (usually a token, a hardware security key, or a keychain that generates six-digit numbers that are valid only for a short period of time and are accessible by request).
In the case of using Intel IPT as part of OTP technology, unique six-digit numbers that are used only once are generated every thirty seconds using the built-in processor, which is protected from unauthorized access and isolated from the operating system. Since the credentials are processed inside a secure physical device, they cannot be hacked with malware or deleted.
Application of Intel IPT technology in client-server interaction, one-time password authentication
If your company already uses two-factor authentication, you are familiar with various inconveniences and organizational problems that arise when using hardware tokens.
Intel IPT with OTP support is a hardware token built into the system's chipset. In this case, the provider of information security solutions can be selected independently. The built-in token allows you to refuse to use a separate physical device, which simplifies, for example, a two-factor procedure for connecting to a VPN. At the same time, Intel IPT works almost without delay, simplifying and facilitating the daily work of users.
Through the use of Intel ITP technology with OTP support, Intel provides the hardware root of trust, proof of authenticity of a specific device based on the Intel processor, various websites, financial organizations, network services. All these services receive an additional guarantee that the account includes the one who has the right to it, and not a malicious program or an attacker. Systems using Intel IPT with OTP provide additional protection for personal data and transaction verification methods that can be used in solutions that implement various multi-factor authentication schemes.
We talked about how Intel SGX, VMX and IPT technologies can increase the security level of biometric systems. But this is not the end of our story. Next time, read about Intel AES-NI, Secure Key, and Intel RealSense.
Today we’ll talk about Intel hardware technologies that can take biometric application security to the next level.
The advantages of biometrics over traditional security systems
Username and password have been used to identify users for many years. Under this security model, a person who needs to confirm that he has the right to use a certain service, just enter a name and password. This means entering the system on a computer, and gaining access to the functionality of various online services - such as social networks and Internet banks. The disadvantages of this security model are obvious for a variety of reasons. Here is some of them.
- Simple passwords such as “123456” or “hello” can be cracked by brute force attack or dictionary attack.
- Complex passwords are hard to remember.
- Many people use the same passwords on different systems.
- If someone forgets the password, then, after providing additional information about himself, he can reset the password.
Logging in with a password
In order to increase password resistance to hacking and make life easier for users, more and more service providers are beginning to use biometric identification technologies to organize access to their systems. Thanks to these technologies, users do not need to remember passwords. For identification, voice, face, fingerprint or iris recognition is used. Biometric identification, in comparison with traditional security systems, has certain features.
- Biometrics allows you to generate a long and complex password, which offers a higher level of protection to counter the attack by direct exhaustive search.
- Biometric systems require developers to create more secure applications that are involved in the process of recognizing biometric information. The fact is that biological information is part of the human body and cannot be easily changed. If biometric information is stolen, it is not easy for the user to cancel his “biometric password”. An attacker, using the stolen data, can create a copy of the body part of interest to him and, in the future, use it to undergo biometric verification in other user accounts.
- Some biological characteristics, such as features of the face or voice, are characterized by a high level of false matches. As a result, user biometric recognition systems typically utilize many features to improve recognition accuracy.
- Some biometric characteristics of a person can be copied. For example - record a voice, print a photo, make a fake finger from gelatin, silicone or latex with a fingerprint. It is important that in the biometric identification system there is a survivability test module, that is, recognition of a person as a living object. This is necessary so that the system can distinguish between biometric information coming from a real person and fake.
How biometric identification works
The work of a biometric personality recognition system can be divided into five steps.
- Biometric information is collected using sensors that are connected to a computer through an input / output port.
- The format and speed of data entry is controlled by the device driver. A driver working with a privilege level of Ring-0 processes the data, brings it to a form that meets the requirements of the operating system. The data is then sent to the biometric verification application, which runs with the Ring-3 privilege level.
- As soon as the application receives the source data, it performs their preliminary processing, extracting from them the characteristic features - biometric templates.
- The extracted templates are sent to the recognition system, which compares them with those registered in the database.
- As soon as a match is found, the recognition system sends the main application a message about this (MATCH). The user is notified of a successful login, he gets the opportunity to work with its private resources.
The scheme of the biometric user recognition system
Attack model
In biometric authentication systems, the most valuable data for an attacker is user biometric templates. These patterns can be presented in the form of raw data obtained from sensors, in the form of a set of characteristic features that are already extracted from the source data, stored in memory, in the form of registered biometric standards stored in the database.
In general, if a biometric application is designed without taking into account the need for proper data protection, an attacker can gain access to raw data or sets of characteristic features. This can be done during an attack while executing an application, using a rootkit or other malicious program. In addition, an attacker can launch an attack when the application is not running, during which he is able to obtain biometric templates registered in the system if they are saved, for example, on a local disk.
Moreover, an attacker can intercept the data stream on the data bus on the way from the sensor to the processor. Also, using a camera or microphone in the immediate vicinity of the user, an attacker can collect his biometric data - such as photographs of a person or voice recordings in order to later use replay to perform an attack.
Types of attacks on a biometric user recognition application
From the point of view of developing a biometric personality recognition service, application design principles should provide end-to-end data protection in order to ensure the safe processing of confidential information. These principles include the following.
- Providing a trusted runtime for the application to maintain the integrity of its code.
- Protect a memory area that contains biometric templates from other applications.
- Storage of sensitive data using cryptographic strong encryption methods. Encryption must be applied at all stages of working with such data. Namely, when they are in memory or in local storage, when data is exchanged with other applications running on the same computer or on a remote server.
Intel Security Hardware Technology in Biometrics
The Intel platform offers a variety of hardware technologies to meet the security requirements of applications that perform biometric verification of users. Consider three sets of Intel technologies aimed at solving this problem: Intel Software Guard Extensions, Intel Virtual Machine Extensions, and Intel Identity Protection.
Organizing a trusted runtime with Intel Software Guard Extensions
Biometric user identification technologies are used more and more widely. The thing is that they provide an increased level of security. Since biometrics are based on the unique characteristics of a person: face, voice, fingerprints, iris, identification data is very difficult to steal. Biometric technologies take the place of traditional authentication methods that use a password; they simplify and speed up the work.
However, with the widespread adoption of biometric technologies in various devices, the heterogeneity and openness of the platform has led to some potential threats. One of these threats is that developers need to consider how safe biometric identification will work on various terminal devices. In particular, the following should be considered.
- How to safely execute on a terminal device modules for taking biometric samples, extracting characteristic features, comparing patterns.
- How to secure the storage of biometric data templates.
- How to establish a secure communication channel between the end device and the cloud database of biological characteristics in order to perform the authentication procedure or other operations.
In order to design highly secure solutions, developers can use the technology of creating a trusted execution environment (Trusted Execution Environment, TEE).
Trusted Application Runtime
TEE is an isolated, trusted application runtime that is separate from the usual so-called “rich execution environment (REE)”. According to the Global Platform TEE System Architecture specification , at the highest level, TEE is an environment that meets the following requirements.
- It is guaranteed that any code running inside TEE is genuine and consistent.
- The resources operated by this code are protected against leaks. Namely, a trusted runtime of applications must prevent all known types of attacks on software, whether performed locally or remotely, as well as some external attacks on hardware.
- Resources and code are protected from unauthorized tracing; the application cannot be influenced externally by means of debugging and testing tools.
Intel Software Guard Extensions Technology Overview
Intel Software Guard Extensions (Intel SGX) allows developers to create and deploy secure applications on open platforms. These are new features of Intel microprocessor architecture, including a set of new instructions and changes in the mechanism of access to memory.
Intel SGX works by allocating sections of memory that store code and data that are protected at the hardware level. Protected areas of memory are called enclaves. The data stored in the enclave is available only to the code that is located in it. Enclave code can be called up using special instructions. An enclave can be created and loaded as a Windows DLL.
Protected runtime embedded in the process
According to the Intel SGX design model , applications using this technology consist of two parts: untrusted and trusted. When the application is executed, it invokes Intel SGX specific instructions in order to create an enclave that resides in a trusted memory area. When a trusted function is called, the code is executed inside the enclave, unencrypted data is available only inside the enclave. Access to them from the outside is completely closed. After the trusted function completes, the enclave data will remain in the trusted memory.
Scheme of the application using Intel SGX
The purpose of the Intel SGX technology is to enable high-level protection of those parts of the application, access to which outsiders should be completely excluded. In particular, important data that the application operates on is protected.
The attack surface, or Trusted Computing Base (TCB), with this approach is reduced to the application itself and the processor on which its code is executed. Even malware that can bypass the operating system, VMM, BIOS, drivers, cannot steal what the authors of the application want to keep secret.
Reducing attack surface when using Intel SGX
Enhancing Security for Biometric Applications with Intel SGX
Before we discuss the proposal to improve the security of biometric systems, we must pay attention to what needs to be protected.
Confidential data on the biometric characteristics of the user should be treated with care: whether they are processed in the application, whether they are stored on disk, or sent to a remote service.
Modules for processing biometric data, including obtaining samples, identifying characteristic features, searching for matches, should be protected from computer viruses and other malware. In addition, it is necessary that the output of the system cannot be faked.
We offer an architectural solution, the scheme of which is shown below.
Implementing a burglar-resistant biometric system using Intel SGX
The subsystem that receives, processes, and compares biometric data is located inside the Intel SGX enclave, a trusted part of the client, and is responsible for actions on biometric data. Guaranteed data leak prevention and program integrity during its execution. Typically, such subsystems are implemented as software modules. And software implementations of anything can be hacked, for example, using malware.
In the proposed architectural solution, the protected part of the application, containing code and data, is loaded into the enclave. For both the code and the data, the procedure for calculating benchmarks is performed, the so-called "measurement" (measuring). As soon as the application code and data are loaded into the enclave, they are protected from any external program access. Thus, the implementation of biometric information processing algorithms can be considered trusted. Moreover, the proposed solution is characterized by high performance and scalability associated with the execution on the central processor. This is especially true for the implementation of those parts of biometric systems for which high performance is important. For example, for biometric data recognition functions.
Intel SGX technology offers a feature to encrypt and protect the integrity of confidential enclave content for storage outside the enclave. For example, on disk, so that the application can reuse all this later. Data can be safely transferred between enclaves using the so-called Seal Key, a hardware key that can be used to “seal” this data. Seal Key is unique to the CPU and to the existing enclave environment. In combination with other services, such as Monotonic Counter or Trusted Time, which are provided by Intel SGX platform software, this solution can be used to protect against various types of attacks.
Monotonic Counter can be used to implement security policies designed to protect against replay attacks. Trusted Time can be used to enforce time-based security policies. Both that and another - in the form of "sealed" data (Sealed Data).
The enclave is responsible for performing encryption according to the algorithm selected for it. In other words, the developer can choose any encryption platform, in accordance with the security requirements of the system. Thus, we can ensure the storage of user biometric data in the enclave and be sure that the raw biometric data will not be available outside the enclave, in the untrusted part of the application.
Sometimes, a client implementation of biometric recognition requires connecting to a remote server to perform an authentication procedure using a cloud database rather than local storage. The server can verify that it interacts with client software that has been correctly downloaded and initialized on a platform that supports Intel SGX using the Attestation mechanism. The same goes for biometric authentication. Within the framework of Intel SGX, this is a mechanism by which a certain part of the system can make sure that exactly the code that should be executed there is safely executed within the enclave, on a platform supporting such functionality.
To begin with, this module generates a report on the authenticity of the client part of the system, which can be checked, tied to a specific platform thanks to the data recorded in the CPU at the production stage. In addition, the report includes information about the user who is performing a biometric recognition session. The server checks the report to make sure that it interacts with a device that supports Intel SGX, and that the user has access to the system. The client and server, during the first connection, conduct an initialization session, during which the client part of the system safely transmits “sealed”, secret data using the appropriate Intel SGX capabilities.
This data, which can only be printed by the application that sealed it, is used to establish secure connections to the server in the future, without the need to constantly confirm the authenticity of the client platform. Among such data is “salt”, encryption key, security policy, certificate, and so on. After that, biometric data and authentication results can be transmitted over a secure communication channel between the client and server.
Memory Protection Scheme Using Virtual Machine Extensions
Attacking dynamic data is one of the most common methodologies for attacking systems. This technique can be used by rootkits and other malware to intercept specified functions and create a copy of the data or modify it in memory during program execution. In the case of biometric recognition of users, malicious code can receive biometric data taken from sensors and a biometric data template of a registered user from memory.
Weakness of traditional software protection mechanism against unauthorized access to memory
The traditional mechanism of software protection against unauthorized access to memory is not reliable enough. Both protected and malicious code are executed with the same privilege level (ring-0 or ring-3). Thus, malicious code can easily affect the protected code in order to disable protection.
An attacker can affect the security module and gain access to a buffer with sensitive information
Virtual Machine Extensions Based Memory Protection
Virtual Machine Extensions (VMX) is a set of instructions that supports the virtualization of processor hardware . The basic principle of its work is as follows.
- Ignoring basic CPU operations, such as loading / saving, branching instructions, arithmetic and logical operations.
- Monitoring (trapping) privileged instructions, such as manipulating the memory control block, I / O instructions, or updating the associative translation buffer.
- If a privileged instruction is executed, aborting and setting the processor to root VMX mode for further processing.
Here's what the relationship looks like between the hardware, the operating system, and the VMX on and off application.
Different responses to system calls when VMX is on and off
Using the VMX trap feature, implemented at the hardware level, a memory protection mechanism based on hardware virtualization can provide faster and more secure memory protection than without using it. The basic idea here is to place a VMM-based memory monitoring module between the operating system and the hardware. When loading the application, a memory allocation table is built for areas containing trusted code and data. After building the table, during any memory access operations, VMM can intercept these operations, then compare the memory access instruction address (EIP) address and the memory address in the previously constructed table. Then the memory protection module can find out
Multi-Factor Authentication with Intel Identity Protection Technology and One-Time Passwords
Identity theft is a growing global problem that affects individuals and companies. This requires an easy-to-use but safe solution, as crackers constantly invent ways to obtain usernames and passwords. And they never stopped and will not stop in search of new methods of theft of this data. If you are a client of a certain organization and interact with it through the Internet, or as a regular computer user, Intel Identity Protection (Intel IPT) technology can give you powerful tools that will help you avoid the risk of identity theft. In particular, we are talking about the possibility of associating a user's physical device with service accounts on the Internet that use the capabilities of Intel IPT.
According to tradition, two-factor authentication uses one-time passwords (OTP). Such a scheme combines what the user knows (username and password) and what he has (usually a token, a hardware security key, or a keychain that generates six-digit numbers that are valid only for a short period of time and are accessible by request).
In the case of using Intel IPT as part of OTP technology, unique six-digit numbers that are used only once are generated every thirty seconds using the built-in processor, which is protected from unauthorized access and isolated from the operating system. Since the credentials are processed inside a secure physical device, they cannot be hacked with malware or deleted.
Application of Intel IPT technology in client-server interaction, one-time password authentication
If your company already uses two-factor authentication, you are familiar with various inconveniences and organizational problems that arise when using hardware tokens.
Intel IPT with OTP support is a hardware token built into the system's chipset. In this case, the provider of information security solutions can be selected independently. The built-in token allows you to refuse to use a separate physical device, which simplifies, for example, a two-factor procedure for connecting to a VPN. At the same time, Intel IPT works almost without delay, simplifying and facilitating the daily work of users.
Through the use of Intel ITP technology with OTP support, Intel provides the hardware root of trust, proof of authenticity of a specific device based on the Intel processor, various websites, financial organizations, network services. All these services receive an additional guarantee that the account includes the one who has the right to it, and not a malicious program or an attacker. Systems using Intel IPT with OTP provide additional protection for personal data and transaction verification methods that can be used in solutions that implement various multi-factor authentication schemes.
Summary
We talked about how Intel SGX, VMX and IPT technologies can increase the security level of biometric systems. But this is not the end of our story. Next time, read about Intel AES-NI, Secure Key, and Intel RealSense.
