For quite a long time, we have been following the routine of typing in a password for accessing our computers. Strong password requirements make us set complex passwords which we often tend to forget, and then we frantically chase the administrator to reset our forgotten passwords. More importantly, even the most secure network is vulnerable to security breaches and the network credentials could easily end up in the wrong hands. Users could also easily fall prey to replay or phishing attacks and end up exposing their passwords. Isn’t it time for a change? What if we could have something more unique than passwords for authentication? Well, Microsoft Hello helps us do just that.
It provides instant access to our Windows 10 devices using biometric authentication i.e., we can log in to our computer using fingerprint, iris, or facial recognition. It offers us a more secure, convenient, and personal way of authenticating to our devices. The biometric data for Microsoft Hello authentication is stored on the local device only and is not shared with a server. Hence, a user can’t use this data for authenticating to a different device. Many users sharing a device can log in to the device using their own individual biometric data.
Microsoft Hello for Business
In order to help a user log in to cloud-based Microsoft Azure Active Directory or on-premise Windows Server Active Directory, amongst other types of identity providers, Microsoft provides the Hello for Business. Microsoft Hello for Business is a certificate or public/private key-based authentication method that replaces passwords with PIN, biometrics, or remote devices, which can be used for authentication.
Microsoft Hello for Business authentication: How it works?
The working of Microsoft Hello for Business can be described in the following steps:
- The user unlocks the account by means of PIN, biometrics, or remote devices.
- This information is sent to the Active Directory or other Identity Providers (IDP).
- The device creates a key and sends the public portion of the key to the IDP for registration.
- The IDP registers the public key and sends a challenge to the device.
- The device signs the challenge using the appropriate private key and returns the original challenge, the signed challenge and the ID of the key used to sign the challenge to the IDP.
- The IDP verifies the sign on the challenge using the public key associated with the key ID specified above. After verifying that the challenge returned matches the original, the IDP returns a symmetric key encrypted using the device’s public key and a security token encrypted using the symmetric key.
- The device decrypts the symmetric key using the private key. This symmetric key is used to decrypt the security token. The device uses this security token in order to access a resource.
We live in times where data is considered to be the new oil. Every individual and organization is highly worried about the security of their data. Microsoft Hello for Business offers a compelling option for data security using biometrics and multi-factor authentication. This ensures protection to our existing infrastructure against breaches and thefts.
