NEC enable biometrics authentication for mobile workers

March 12, 2006

NEC Europe announced that it is demonstrating a new, convenient and secure way for remote access to a VPN (virtual private network), using a combination of biometric identification of the user and authentication via a mobile SIM card at CeBIT in Hanover, Germany.

A common procedure for identifying oneself to a computer system involves entering a user name and password. This process harbours a number of risks because it is based on knowledge. A user may chose a complicated password hoping that it is secure, but writes it down somewhere in workplace because this person can't remember it, or choose a simple password which can be easily guessed.

There are additional procedures involving tokens, like a smart card, but these are also problematic. As soon as the user tells someone else his password or gives away his smart card, the potential for abuse rises greatly. Compared to these solutions, NEC provides a biometric solution with the extra security you need: users are identified according to individual physical features. The demonstration is using an NEC laptop PC with built-in fingerprint reader and a NEC 3G mobile phone.

The benefits for telephone operators are a better user experience encouraging more usage. The VPN and SSL require the user to be on-line which means more air time. It also delivers additional services to subscribers through the USIM: value added services that can be charged for.

The benefits for users are secure access to the office LAN from anywhere with no tokens or passwords (1024 bit encryption). It will be more comfortable for the user as there will be fewer components to carry. Also, no additional hardware is needed. This solution works with a vast number of off-the-shelf applications (VPN, SSL authentication, Windows Logon, etc) and results in a better user experience.

Strong authentication is cryptography based on Public Key Infrastructures (PKI) and certificates. These certificates can be stored on SIM cards. When users access the office network via VPN connection (over internet), a secure connection is established using the certificates. The connection is not limited to the office network; it is possible to provide this technology for any secure connection (e.g. for banking). All the user needs is a compatible mobile handset and PC.