Page 37 - Informatics_January_2025

Technology Update

Key Components in Passkey
Authentication
Passkey authentication involves four critical
components working seamlessly together: the
user, user agent, relying party, and authenticator.
• User: The individual who initiates the authen-
tication process by interacting with a service or
application. The user provides a biometric input
(e.g., fingerprint or facial recognition) or a PIN to
verify their identity.
• User Agent: This is typically the web browser or
application acting as an intermediary between the
user and the service. Popular user agents include
browsers such as Google Chrome, Microsoft Edge,
Mozilla Firefox, and Apple Safari. The user agent
handles communication with the relying party and
interacts with the authenticator to facilitate se-
cure authentication. These web browsers provide
built-in support for WebAuthn through JavaScript Fig 11.1: Diagram illustrating the Passkey Registration process
APIs. These APIs enable seamless integration of
passwordless authentication into web applica- These components, supported by industry connecting the Survey, Registration, and Revenue
tions, allowing developers to securely register and leaders like Apple, Google, and Microsoft, work Departments. This SSO facilitates secure user au-
authenticate users using Passkeys. together to deliver a seamless, secure, and pass- thentication using passkeys.
• Relying Party: The service or application re- wordless authentication experience. This ensures To address the critical security needs of gov-
robust security while maintaining ease of use for
questing authentication (e.g., a government portal end users in modern digital interactions. ernment applications, the implementation of
passkeys adheres to strict measures. Authenti-
like Entebhoomi). The relying party stores the pub- cation is restricted to the specific passkey regis-
lic key generated during passkey registration and Use Case: Passkeys in the tered for the user within the application. The reg-
uses it to verify the user’s authentication response. Entebhoomi, the Integrated Land istration process is further secured through OTP
• Authenticator: The device or system that se- Information Management System verification, ensuring that only the rightful user
curely generates and stores cryptographic keys. Project can complete it. These comprehensive safeguards
Examples include: The Ente Bhoomi Project, spearheaded by the establish a robust framework for secure and effi-
• Built-in Authenticators: Modern devices such Government of Kerala, aims to modernize and cient access to digital services.
as iPhones, Android smartphones, Windows digitize land-related services across the state. As Conclusion
laptops (with Windows Hello), and macOS de- a part of the Integrated Land Information Man- The transition to Passkeys and WebAuthn in
vices (with Apple Secure Enclave) that securely agement System (ILIMS), it integrates and stream- eGovernance systems marks a paradigm shift,
handle authentication. lines services from the Survey, Registration, and
Revenue Departments. Leveraging advanced promising a future where citizens can interact
• External Authenticators: Hardware security technologies, the project provides citizens with with public services securely and effortlessly.
keys like YubiKey, Google Titan Key, or Feitian seamless access to land records, digital survey These technologies offer governments the ability
keys that connect via USB, NFC, or Bluetooth. services, and real-time updates on land activities. to safeguard sensitive data, enhance user trust,
• Cloud-based Authenticators: Services like A key innovation in the Entebhoomi Project is and reduce operational costs, making them a vital
Apple’s iCloud Keychain, Google Password Man- its integration of passkeys to enhance both secu- component of modern digital strategies.
ager, and Microsoft Authenticator that enable rity and user experience. The project employs an As governments and organizations increas-
synchronized Passkeys across multiple devices. in-house developed Single Sign-On (SSO) system, ingly embrace passwordless authentication, they
pave the way for a secure, transparent, and citi-
Fig 11.2: Diagram illustrating the Passkey based authentication process zen-centric digital ecosystem. Passkeys and We-
bAuthn are not just technological advancements
but strategic investments that ensure resilience
in an interconnected and threat-prone world. By
adopting these solutions today, eGovernance sys-
tems can position themselves at the forefront of
the digital revolution, delivering unparalleled val-
ue to citizens and stakeholders alike.

Contact for more details
Manoj P. A.
Sr. Technical Director
NIC Kerala State Centre
CDAC Building, Vellayambalam
Thiruvananthapuram, Kerala - 695033
Email: manoj.pa@nic.in, Phone: 0471-2724529

January 2025 informatics.nic.in 37