Preventing Simultaneous Windows Logins

Secure Passwordless Authentication with FIDO2 Security Key

FIDO2 security keys with biometric authentication enables user-attributability and offer a strong, passwordless authentication mechanism. However, sensitive organizations such as the healthcare sector require stricter access controls to ensure that these keys can only be used on a specific Windows PC or browser. This prevents unauthorized use on other machines or browsers, enhancing security.

In this blog, we’ll explore how to enforce this restriction using the XSense IdP Server platform and the ThinC-AUTH biometric FIDO2 security key.

Why Restrict FIDO2 Key Access to One-User One-System/Browser?

While biometric FIDO2 keys provide high security, allowing them to be used on multiple devices or browsers can pose risks such as:

Data Breaches: Prevents users from accessing sensitive healthcare data from unapproved devices or browsers.
Regulatory Compliance: Healthcare and other sensitive industries must enforce strict authentication policies to meet legal and security requirements.

By binding a biometric FIDO2 key to a specific PC and browser, organizations can effectively mitigate these risks and implement "One-User One-PC" accessibility.

💡The Solution: Restricting Access Using XSense IdP Server & ThinC-AUTH

1. XSense IdP/AMS Server for Identity and Access Management

The XSense IdP Server provides a centralized authentication framework that allows organizations to enforce device and browser-specific authentication policies. It can:

- Bind FIDO2 key registration to a specific Windows PC and browser.
- Enforce device trust policies for secure access.
- Enforce device trust policies for secure access.

2. XSense (AMS) Agent for User Workstation

The XSense (AMS) Agent is a standalone application service that will installed on the User Workstation. It performs:

- Computes the SystemID of the User Workstation.
- Validates FIDO2 Key Serial Number with the XSense IdP/AMS Server for the logged-in User Account.

3. ThinC-AUTH Biometric FIDO2 Key for User Authentication

ThinC-AUTH is a FIDO2-certified biometric security key that ensures only the registered user can authenticate. It supports:

- Local Biometric Authentication: Ensuring the User to physically authenticating on to the Fingerprint Sensor on the FIDO2 Key. The sensor works only with live fingerprint templates and protects from any spoofed fingerprint for authentication.
- Device & Browser Binding: Can be configured to work only with a specific Windows PC and browser.
- Hardware-Based Security: Prevents Key cloning or unauthorized duplication.

Implementation Steps

Step 1: Configure XSense IdP/AMS Server Policies

Enable Secure Authentication with FIDO2 Key

1. : Configure the XSense Server to allow FIDO2 Key based authentication to the specific Windows PC.
2. Enforce MFA and Biometric Checks: Ensure that the FIDO2 authentication is mandatory with the ThinC-AUTH Biometric Key.

Step 2: Register ThinC-AUTH Key on a Specific Windows PC

1. Connect the ThinC-AUTH biometric FIDO2 key to the designated User Workstation.
2. Controlled Environment for Enrolling User Fingerprints: Provide a controlled environment to enroll User Fingerprint(s) on to the assigned Biometric FIDO2 Key.
3. Enable Device Binding: Using XSense Agent on the User Workstation, compute the SystemID and bind it with the User's ThinC-AUTH Biometric FIDO2 Key.

Conclusion

Restricting Enterprise User's biometric FIDO2 key accessibility to a single Windows PC significantly enhances security for sensitive sectors like healthcare. By leveraging XSense IdP/AMS Server and ThinC-AUTH biometric FIDO2 keys, organizations can implement strict access control policies that prevent unauthorized usage.

This approach ensures that sensitive data remains protected, complying with security regulations while maintaining a seamless authentication experience.

Next Steps

For further security enhancements, consider integrating zero-trust authentication models, FIDO2 key attestation, and endpoint security measures.

Explore our Recent Blogs

Insights and innovations shaping the future of secure access.

Beyond Passwords: How FIDO2 is Redefining Enterprise Security

Restricting Biometric FIDO2 Key Access to a Single Windows PC/Browser

Why FIDO2 is the Future of Frictionless and Secure Logins

From Vulnerability to Victory: The Case for Going Passwordless with FIDO2

Restricting Biometric FIDO2 Key Accessto a Single Windows PC/Browser

Table of Contents