Protecting medical data with passwordless authentication Carl - - PowerPoint PPT Presentation

▶

Sep 06, 2023 209 likes •450 views

Protecting medical data with passwordless authentication Carl Svensson, KRY/LIVI @ PasswordsCon 2018 1 / 16 Background Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail (private):

SLIDE 1

Protecting medical data

with passwordless authentication Carl Svensson, KRY/LIVI @ PasswordsCon 2018 1 / 16

SLIDE 2

Background

Biography

MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail (private): calle.svensson@zeta-two.com E-mail (work): carl@kry.se Twitter: @zetatwo 2 / 16

SLIDE 3

Background

Agenda

1. KRY/LIVI, Background
2. Authentication so far
3. Expanding to other countries
4. Design process
5. Our solution
6. Results: 6 months in

3 / 16

SLIDE 4

Background

Disclaimers, this talk:

About constraints About business About process Not about technology 4 / 16

SLIDE 5

Background

KRY/LIVI, Healthcare online

Online healthcare provider Healthcare data Possibly the most sensitive "Patient first", UX/UI important 500 000+ users 3% of primary care in Sweden 5 / 16

SLIDE 6

Background

Authentication in Sweden

BankID, digital identity Issued and validated by banks Private but used in public Well-established 6 / 16

SLIDE 7

Background

Authentication in Norway

Pretty much the same as Sweden 7 / 16

SLIDE 8

Background Problem

Expanding to Europe

In UK, no personal ID number In France, typically no ID at doctor "Passwords suck" - Our CEO "We are launching in 3 months" - Also our CEO 8 / 16

SLIDE 9

Background Problem

Problem statement

Challenges Authenticate without passwords No digital ID available User friendly User friendly User friendly Secure Consolation Users are valuable 9 / 16

SLIDE 10

Background Problem Process

Understand the data model

A person is not a phone People have kids Device (1-*) User (*-*) Patient 10 / 16

SLIDE 11

Background Problem Process

Understanding the scenarios

New device Access to old No access to old Old device Reinstall Strong authentication Onfido Empty account? Allow weak authentciation Revokation? 11 / 16

SLIDE 12

Background Problem Process Solution

Public key challenge-reponse with tiered identity

Registration Create a device If no user, create If user is patient: Onfido First medical interaction Create patient Link user to patient On create patient Onfido verification Multiple devices per patient Register new user Link users 12 / 16

SLIDE 13

Background Problem Process Solution

Results: Pros

No password! (mostly) Seamless (pretty) User friendly (fairly) Secure 13 / 16

SLIDE 14

Background Problem Process Solution

Results: Cons

Breaks conventional mental model Overloads words Revokation not fast enough 14 / 16

SLIDE 15

Background Problem Process Solution

Evaluation: How did it go?

Users are registering Users are staying No known incidents Iterative process 15 / 16

SLIDE 16

Thank you for listening!

Questions? 16 / 16

SLIDE 17

16 / 16

SLIDE 18

16 / 16

SLIDE 19

16 / 16

SLIDE 20

16 / 16

SLIDE 21

16 / 16

SLIDE 22

16 / 16