PKI (ITU X.509) for On-line & Off-line "IoT Authentication for Emergency & Offline Payment during Earthquake, Power Disruption, Typhoon” Unho Choi, Ph.D. UNHCR

Offline e-Gov. + Disaster Situation International Donation ? UNHCR Cash ? Global Fund ? WFP electronic cards ? NGO ? ATM ? POS ? Bank ? IoT Authentication ? Copyright © Unho Choi 2015

FIDO Alliance

Bio Sensor + PKI = Secure Domain (FIDO) Tokenization with Dynamic code(OTP) = ? “B9E2995B2B7602AE825CE7DE819F10F088419E595A9AAE81919EF58” Authentication Server

APPLE PKI ?

PKI – DEVELOPING COUNTRY Mongolia Nigeria, Kenya …… Iran ICAO, e-UNLP …… Morocco Equator Vietnam Philippines Rwanda Jordan Costa Rica Brunei Iraq Egypt Cameroon Indonesia Kenya US, France, Sweden, Germany, Turkey, Norway …… Panama completed Proceeding Started

Public Key Certificate Public Key Certificate PKI (ITU X.509) Public Key Certificate Version / Serial Number / Signature algorithm / Hash algorithm / Issuer Name / Validity Period / Public Key Subject Distinguished Name / Subject Public Key Information / Issuer’s Signature Extended Validation (Empty) < Before user registration > Public Key Certificate Version / Serial Number / Signature algorithm / Hash algorithm / Issuer Name / Validity Period / Public Key Subject Distinguished Name / Subject Public Key Information / Issuer’s Signature Extended Validation Biometric Code + at least one of Additional Code < After user registration > “B9E2995B2B7602AE825CE7DE819F10F088419E595A9AAE81919EF58 Bar Code/ QR / UPC / RFID / URL /CRL / PUF/ GS1/ GSIN / IPv6 / MAC / MAC/ Cryptographic hash functions address/ unique identification information etc. Copyright © Unho Choi May 2015

Morpho – Infineon Workshop on eID 2013-08-22 Muiti Application on e-ID Multi App 1 App 3 App´s 5 App´s 10 App´s eService eService eHealth eTicketing eService eDL eGate eBanking eLibrary eID eService eHealth eTicketing ATM eDL ePurse eGates Travel document Finland FINID Italy CNS Hong Kong HKSAR Malaysia MyKad Example Copyright © Infineon Technologies AG 2013. All rights reserved.

Sample Nigeria - CHIP DESIGN

UBIQUITOUS AUTHENTICATION MANAGEMENT National ID PKI + Data Driver License Medical e-Voting Pension Passport ICAO Tax Physical Access /Smart Car PC/ Cloud Logon Smart Phone / Smart Home Physical unclonable functions IoT Authentication ? Copyright © Unho Choi May 2015

Diverse combinations of Biometrics Multi Bio Combination ? Diverse combinations of Biometrics Combination 2 more finger Combination 1 finger + IRIS Combination Iris + Vein Combination Iris + Facial Combination Finger+ Sign Combination Voice+ Facial Combination with each Palm/ Blood / Voice / DNA / Keystroke etc. Allocated purpose of use Application Services Bank/ Credit Card Payment Government Internet Cloud Car IoT 911 Emergency Allocated purpose of use Emergency Reset Recover 911 Copyright © Unho Choi May 2015

IoT Authentication Key for Smart Phone IoT Network Communication Terminal Centralized Controller IoT Service Provicer Emergency Recover Reset 911 Copyright © Unho Choi May 2015

IoT Authentication Key for National ID ? Centralized Controller IoT Network Smart Card Communication Terminal IoT Service Provicer Emergency Recover Reset 911 Copyright © Unho Choi May 2015 Copyright © Unho Choi May 2015

IoT Authentication Code ? Biometrics UPC/EPC Biometrics (b) PAN Biometrics (c) PUF Biometrics (d) Dynamic Signature Biometrics (e) Activity feature Biometrics (f) UPC/EPC Biometrics PAN (g) UPC/EPC Biometrics PAN PUF (h) UPC/EPC Biometrics PAN PUF (i) Dynamic Signature Copyright © Unho Choi May 2015

IoT Authentication Code Format B9E2995B2B7602AE825CE7DE819F10F088419E595A9AA Biometric code UPC/EPC PAN code PUF code (j) B9E2995B2B7602AE825CE7DE819F10F088419E595A9AAE81919EF58 Biometric code UPC/EPC PAN code PUF code (k) OTP Emergency Recover Reset 911 Copyright © Unho Choi May 2015 Copyright © Unho Choi May 2015

On-line & Off-line 1st Public Key for on-line at Authentication Server Online application (with GEO location / GPS) Bank Credit Card e-Government Internet Cloud 1st Public Key for on-line at Authentication Server Off-line application support for each service etc. by Government & Financial Authority Bio Sensor on ATM for cash withdrawal etc. Bio Sensor on POS for buy food etc. Bio Sensor on Centralized Controller for control IoT Devices etc. Bio Sensor on Smart Card/Phone for control Smart Car etc. 2nd Public Key for off-line for ATM, POS, Centralized Controller, Phone/Card Store with Private Key at Secure Domain (IC Chip) Copyright © Unho Choi May 2015

(Certificate Authority) Key Distribution United Nations UN CA (Certificate Authority) Public Key Private Key “B9E2995B2B7602AE825CE7DE819F10F Bank WFP Global Fund UNDP Public Key Public Key Public Key Public Key ATM, POS (Off-line) Public Key Private Key Copyright © Unho Choi May 2015

Operation Process Copyright © Unho Choi May 2015 Biometrics data acquisition module Biometrics data management module Key management module Biometric authentication module VPN management module Authentication execution module OTP generation module Device data acquisition module Copyright © Unho Choi May 2015

Q&A “ Take chain of Mountain view ” Unho Choi Ph.D., CGEIT, CRISC, ISO 27001, CISSP, PMP choi@unhcr.org