KSec – Secure Multi-factor Authentication

KSec

Our project development is guided by security, simplicity, and independence from external services. If we are capable of developing and maintaining a service, why should we use one provided from the other side of the world?
This principle becomes even more relevant considering that using external services often requires unscheduled updates and maintenance, effectively transforming the advantage of cloud delegation into a constraint on the service lifecycle.
KSec best interprets our philosophy and represents a complete MFA multi-factor authentication solution based on OTP and certificates, easily integrated to protect web applications with an additional security layer.

How does it work?

The solution consists of 3 elements

1. keystore server: a secure server that enables key storage
2. web application: a web application to be installed on a device for generating OTP one-time passwords (e.g., smartphone)
3. one-time password verification module: a library or service to be integrated into the application requiring protection

Keystore Server

The server can be installed on-premises in a virtual machine or container and handles user activation, registration of applications to be protected, and OTP code generation. The service is also available as SaaS on our servers at the “De Curtis” Data center in Altamura.

Web Application

Native smartphone APPs often suffer from restrictions, updates, and changes in providers’ commercial policies. Where possible, we avoid APP development and prefer more flexible web applications. In KSEC’s specific case, it was determined that the higher maintenance cost of an APP did not result in significant improvement in security and performance.
The KSEC application is a simple URL that opens with a specific certificate: it installs in 2 quick steps and allows generating one-time passwords with a simple tap.

Application Module

Applications requiring protection, defined as relying parties, require a component that performs three functions:

• generation and storage of secret keys paired with individual users
• user activation procedure
• OTP code verification

This component can be integrated through a PHP library or via a container that provides a REST service, making it easily integratable in any environment.