Safeguarding user identity through reliable authentication with HUAWEI FIDO - Huawei Developers

Opportunity
We are living in a very-connected and fast-paced world where everything needs to be fast, efficient, and convenient. Almost everyone uses apps to establish an online presence through different social media platforms or to take advantage of the convenience of availing online products and services. As more people go online and use multiple apps, securing user accounts and verifying user identities are becoming an utmost importance, especially in situations like account sign-in and online transactions. With the limitations and vulnerabilities of using passwords for authenticating user identities, there is a need for a secure user authentication that provides a positive user experience.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What is HUAWEI FIDO?
HUAWEI Fast Identity Online (FIDO) enables developers to provide their apps with local biometric authentication capability and online identity verification capability to complement password security. HUAWEI FIDO provides online identity verification capability via FIDO2 Client, which is based on the World Wide Web Consortium’s Web Authentication (WebAuthn) specification.
FIDO2 Client supports both roaming and platform authenticators to enable checking user validity during account sign-in and payment. FIDO2 Client enables online identity verification to help HUAWEI FIDO augment your app’s password security and optimize your app’s usage convenience. The smooth app integration of FIDO2 Client will help developers in implementing HUAWEI FIDO in their apps.
How to integrate FIDO2 Client?
The integration of the FIDO2 Client to your app involves 2 processes. One is a registration process and the other is an authentication process. The following procedures will provide a high-level guide in executing the registration and authentication processes.
Kindly remember that the listed processes must be performed before performing the integration of the FIDO2 Client:
1. Configuring App Information in AppGallery Connect
2. Integrating the HMS SDK
3. Configuring Obfuscation Scrips
To execute the registration process:
1. Acquire a challenge value and related policy from the FIDO server.
Code:
byte[] challengeBytes = SecureRandom.getSeed(16);
2. Initiate the Fido2 registration request.
Code:
PublicKeyCredentialCreationOptions.Builder builder = new PublicKeyCredentialCreationOptions.Builder();
builder.setRp(new PublicKeyCredentialRpEntity(rpId, rpId, null))
.setUser(new PublicKeyCredentialUserEntity(user, user.getBytes()))
.setChallenge(challengeBytes)
.setAttestation(AttestationConveyancePreference.DIRECT)
.setAuthenticatorSelection(new AuthenticatorSelectionCriteria(null, null, null))
.setPubKeyCredParams(new ArrayList<PublicKeyCredentialParameters>(
Arrays.asList(
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, Algorithm.ES256),
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, Algorithm.RS256))))
.setTimeoutSeconds(60L);
if (regCredentialId != null) {
builder.setExcludeList(new ArrayList<PublicKeyCredentialDescriptor>(
Arrays.asList(new PublicKeyCredentialDescriptor(PublicKeyCredentialType.PUBLIC_KEY, regCredentialId))));
3. Initiate the registration by calling Fido2Client.getRegistrationIntent() to obtain a Fido2Intent instance and start the FIDO client registration process.
Code:
fido2Client.getRegistrationIntent(request, NativeFido2RegistrationOptions.DEFAULT_OPTIONS,
new Fido2IntentCallback() {
@Override
public void onSuccess(Fido2Intent fido2Intent) {
fido2Intent.launchFido2Activity(Fido2DemoActivity.this, Fido2Client.REGISTRATION_REQUEST);
}
@Override
public void onFailure(int errorCode, CharSequence errString) {
showError("Registration failed." + errorCode + "=" + errString);
}
});
The registration starts by calling Fido2Intent.launchFido2Activity() in the callback using Fido2Client.REGISTRATION_REQUEST as requestCode.
4. Receive the registration result by calling Fido2Client.getFido2RegistrationResponse() in the callback Activity.onActivityResult()
Code:
Fido2RegistrationResponse fido2RegistrationResponse = fido2Client.getFido2RegistrationResponse(data);
if (fido2RegistrationResponse.isSuccess()) {
reusltView.append("Registration\n");
reusltView.append(fido2RegistrationResponse.getAuthenticatorAttestationResponse().toJson());
reusltView.append("\n");
regCredentialId = fido2RegistrationResponse.getAuthenticatorAttestationResponse().getCredentialId();
showMsg("Registration successful.");
} else {
showError("Registration failed.", fido2RegistrationResponse);
}
5. Send the registration result to the FIDO Server for verification.
To execute the authentication process:
1. Acquire a challenge value and related policy from the FIDO server.
Code:
byte[] challengeBytes = SecureRandom.getSeed(16);
2. Initiate the Fido2 Authentication request.
Code:
List<PublicKeyCredentialDescriptor> allowList = new ArrayList<>();
allowList.add(new PublicKeyCredentialDescriptor(PublicKeyCredentialType.PUBLIC_KEY, regCredentialId));
PublicKeyCredentialRequestOptions.Builder builder = new PublicKeyCredentialRequestOptions.Builder();
builder.setRpId(rpId).setChallenge(challengeBytes).setAllowList(allowList).setTimeoutSeconds(60L);
return new Fido2AuthenticationRequest(builder.build(), null);
3. Initiate the authentication by calling Fido2Client.getAuthenticationIntent() to obtain the Fido2Intent instance and start the FIDO Client authentication process.
Code:
fido2Client.getAuthenticationIntent(request, NativeFido2AuthenticationOptions.DEFAULT_OPTIONS,
new Fido2IntentCallback() {
@Override
public void onSuccess(Fido2Intent fido2Intent) {
fido2Intent.launchFido2Activity(Fido2DemoActivity.this, Fido2Client.AUTHENTICATION_REQUEST);
}
@Override
public void onFailure(int errorCode, CharSequence errString) {
showError("Authentication failed." + errorCode + "=" + errString);
}
});
The authentication starts by calling Fido2Intent.launchFido2Activity() in the callback using Fido2Client.AUTHENTICATION_REQUEST as requestCode.
4. Receive the authentication response by calling Fido2Client.getFido2AuthenticationResponse() in the callback Activity.onActivityResult().
Code:
Fido2AuthenticationResponse fido2AuthenticationResponse =
fido2Client.getFido2AuthenticationResponse(data);
if (fido2AuthenticationResponse.isSuccess()) {
reusltView.append("Authentication\n");
reusltView.append(fido2AuthenticationResponse.getAuthenticatorAssertionResponse().toJson());
reusltView.append("\n");
showMsg("Authentication successful.");
} else {
showError("Authentication failed.", fido2AuthenticationResponse);
}
5. Send the authentication result to the FIDO server for verification.
The Benefits
To the developers
Provides developers with a high-level guide on integrating the FIDO2 Client so that they could easily implement HUAWEI FIDO to increase the security of their apps.
Related Links
Thanks to Ibrahim Recep Serpici for this article.