A Secure Biometric Authentication Framework for iOS with Cross-Platform Extensions: Addressing OS-Level Vulnerabilities and Enhancing Real-Time Protection

The widespread use of mobile commerce, and sensitive data will require an effective multi-layered method to authenticate users beyond the simple trade-off between ease-of-use and security. On the one hand, user-friendliness is provided through the availability of on-board mobile devices of various types of biometric sensors; on the other hand, a single check of sensor level does not protect against sophisticated mobile attacks such as those utilizing memory corruption exploits (for example, mercenary spyware) and run time application tampering. In this paper we describe the development of the Secure Biometric Framework (SBF) which includes both a Hardware Roots of Trust (Secure Enclave) and Proactive Operating System (OS) integrity mechanisms (Memory Integrity Enforcement, MIE) and Continuous Runtime Assurance (App Attest, RASP), and thus provides multiple layers of defense against sophisticated mobile attacks. The architectural design of the SBF, and its ability to protect against OS-based attack vectors, is a significant improvement over documented high rates of misuse of the traditional Android Biometric Application Programming Interface (API). For example, according to recent research, it was determined that as many as 97.15% of the tested applications had serious configuration errors which could have resulted in potential loss of sensitive user information. Additionally, the SBF also utilizes the FIDO2 standard as the cross-platform authentication mechanism, which manifests itself as Passkeys. The SBF's foundational security architecture allows for the capability to provide phishing resistant authentication across all platforms, while maintaining full regulatory compliance, and ensuring full security assurance.