Phone Token

The VIDA Phone Token is at the core of VIDA’s authentication solutions, offering unparalleled security by leveraging device binding-based cryptographic keys and Public Key Infrastructure (PKI). It ensures that only authorized and trusted devices can initiate and verify transactions, protecting platforms against unauthorized access and fraud.

Phone Token Registration

Device Registration & Key Pair Generation

1. The Partner System requests to register the user in the VIDA Authentication Server.

2. VIDA generates an Unbound Credential ID and returns it to the Partner System.

3. The VIDA Credential Development Kit (CDK), integrated into the mobile app, generates a cryptographic key pair.

   1. The private key is securely stored in the device’s hardware-backed keystore.

   2. The public key is sent to the VIDA authentication Server

Secure Key Registration

1. VIDA associates the public key with the Credential ID and stores it in a secure directory of registered public keys.

2. This ensures that only the registered device can sign authentication requests and transactions.

3. The Partner System is notified of successful registration, enabling device-based authentication for future transactions.

---

Phone Token Verification & Usage

1. Transaction Signing & Verification

   • When a user initiates a transaction, the Partner System requests VIDA to authenticate it using the Phone Token.

   • The transaction message is signed locally on the user’s device using the private key.

   • VIDA validates the signed transaction by checking its authenticity against the stored public key.

   • If the validation is successful, VIDA approves the transaction.

2. User Presence & Additional Security Layers

   • Depending on configuration, user presence can be required for signing, such as:

     • Biometric authentication (e.g., fingerprint, Selfie ID)

     • Application PIN/password

   • This ensures an additional layer of security, preventing unauthorized access.

• The term password used here represents all kinds of password-like entities, namely, application password, application personal identification number (PIN), etc.

• The CDK does not provide any configurable policies around controlling the length and formats of the password. However, application developers can define and impose such restrictions for a better user experience.