Tuesday 6 October 2015

Device Fingerprints for Mobile Applications

Browser fingerprints play a useful role to make security more convenient (refer to
"Smarter Security with Device Fingerprints"). The concept can be extended to any device, especially non-browser clients.

The client (mobile application for example) itself collects and includes fingerprint information in the authentication request. The authentication server (OpenAM) matches and eventually saves the device fingerprint as it would do with the browser fingerprint.

Device Fingerprints in the Authentication Process

A custom device fingerprint can be as simple as the following :
{
  "telephoneNumber": "+33123456789"
}
Based on the authentication process in the aforementioned article, the DeviceId (Match) authentication module gets adapted to include a function for telephone number match. See the openam-telephonenumber-deviceprint-serverscript.js file for inspiration. OpenAM supports the full authentication process via REST. Refer to "REST on every side" for the detailed steps.
Note that the out-of-the-box DeviceId (Save) authentication module can be used "as-is" for for privacy and consent.

Based on that, the device fingerprint can take any form, be signed or encrypted, as long as the corresponding DeviceId (Match) module can appropriately compare with stored fingerprints.[1]


In case you want to build this example or something similar, I published scripts for the purpose of inspiration within the openam-high5 GitHub project, in particular 630-custom-deviceprint-base-config, 631-deviceid-rest-telephonenumber.

References

[1] Die drei Fragezeichen, Fingerabdrücke, Kosmos, 2010