Windows Unlock with IoT Devices Microsoft Build 2016 11/23/2018 6:12 PM Windows Unlock with IoT Devices Anoosh Saboori Senior Program Manager © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

MICROSOFT CONFIDENTIAL

Demos Microsoft Band Sign In 11/23/2018 6:12 PM Demos Microsoft Band Sign In © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/23/2018 6:12 PM © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Passport & Windows Hello A two-factor authentication system built for you and your users Achieve higher levels of security while reducing costs Increase user convenience with simple unlock gestures

Private keys secured in TPM Second Factor in Previous Release Second Factor Windows Hello Biometric First Factor or PIN Private keys secured in TPM

Private keys secured in TPM Second Factor in Upcoming Release Second Factor Windows Hello Biometric First Factor or PIN or Private keys secured in TPM Companion Devices

11/23/2018 6:12 PM Overview © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Make Companion Device Sociable via Signals  Intent signal a signal that allows the user to show his intent for unlock Disambiguation signal a signal to disambiguate which Windows 10 desktop the user wants to unlock when multiple options are available to the Companion Device User presence signal a signal that proves presence of user, like a device PIN

User Flow Overview Set up a PC PIN Download and run the companion app on each of target Windows 10 desktop she wants to unlock with that Companion Device. Download and run the companion app on Windows 10 desktop to register the Companion Device with Windows 10 desktop Collect the signals and unlock PC when PC is in locked state

Messaging

Protocol Overview 11/23/2018 6:12 PM © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Register Unlock

Security Principles PC unlock requires registered companion device being present Companion device only talks to PC with which it was registered HMAC key 1 (stored on Companion Device) HMAC key 2 (stored on both PC and Companion Device)

11/23/2018 6:12 PM Register © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Register background task Prepare Register background task Establish two HMAC keys, signals, and device capabilities Start Call RequestStartRegisteringDeviceAsync Finish Call FinishRegisteringDeviceAsync Clean up Companion Device stores HMAC keys Companion app discards its copies

Code Walkthrough Register 11/23/2018 6:12 PM Code Walkthrough Register © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

RequestStartRegisteringDeviceAsync API 11/23/2018 6:12 PM RequestStartRegisteringDeviceAsync API HRESULT RequestStartRegisteringDeviceAsync( [in] HSTRING deviceId, [in] SecondaryAuthenticationFactorDeviceCapabilities capabilities, [in] HSTRING deviceFriendlyName, [in] HSTRING deviceModelNumber, [in] Windows.Storage.Streams.IBuffer* deviceKey, [in] Windows.Storage.Streams.IBuffer* mutualAuthenticationKey, [out, retval] Windows.Foundation.IAsyncOperation<SecondaryAuthenticationFactorRegistrationResult*>** operation); © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

FinishRegisteringDeviceAsync API 11/23/2018 6:12 PM FinishRegisteringDeviceAsync API HRESULT FinishRegisteringDeviceAsync( [in] Windows.Storage.Streams.IBuffer* deviceConfigurationData, [out, retval] Windows.Foundation.IAsyncAction** result); © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/23/2018 6:12 PM Unlock © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Two API calls should be made within 20 seconds Microsoft Build 2016 11/23/2018 6:12 PM Wait WaitingForUserConfirmation, OR CollectingCredential Start Call StartAuthenticationAsync Compute Communicate with Companion Device to perform required HMAC operations Finish Call FinishAuthenticationAsync Wait for CredentialAuthenticated to start success flow Wait for StoppingAuthentication to kill your background task PC was locked All signals collected Two API calls should be made within 20 seconds © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Code Walkthrough Unlock 11/23/2018 6:12 PM Code Walkthrough Unlock © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

StartAuthenticationAsync API 11/23/2018 6:12 PM StartAuthenticationAsync API HRESULT StartAuthenticationAsync( [in] HSTRING deviceId, [in] Windows.Storage.Streams.IBuffer* serviceAuthenticationNonce, [out, retval] Windows.Foundation.IAsyncOperation<SecondaryAuthenticationFactorAuthenticationResult*>** operation); © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

FinishAuthenticationAsync API 11/23/2018 6:12 PM FinishAuthenticationAsync API HRESULT FinishAuthenticationAsync( [in] Windows.Storage.Streams.IBuffer* deviceHmac, [in] Windows.Storage.Streams.IBuffer* sessionHmac, [out, retval] Windows.Foundation.IAsyncOperation<SecondaryAuthenticationFactorFinishAuthenticationStatus>** result); © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Security, Management, and Policy 11/23/2018 6:12 PM Security, Management, and Policy © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

A Word on Security Protect HMAC keys, at rest and on fly offline attack cloning exportability Verify user presence securely anti spoofing uniqueness anti hammering reliable

Management Via Windows Via app Windows performs A/AD or MSA authentication Windows does not provide a portal to view, audit, revoke, or manage these devices Windows does not provide roaming Via app From the app, user can unregister a Companion Device MICROSOFT CONFIDENTIAL

IT Admin Concepts Policy Revocation An on/off switch for Companion Devices Allowed list of Companion Device apps via Windows app locker Revocation Remove a device type from companion app allowed list when a breach is detected in that device type MICROSOFT CONFIDENTIAL

Call to Action Send email to CDFOnboard@Microsoft.com to get started

11/23/2018 6:12 PM © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.