Protect your business from unauthorized access
With the only solution that eliminates credential theft
Users are protected:
- Phishing – there are no usernames
- Keyloggers – no username and password to capture
- Pharming – the website is authenticated by WWPass
- MITM/MITB – end-to-end encryption and strong authentication
Your business is protected:
- Usernames are eliminated
- User identity is encrypted, fragmented, and dispersed in the cloud
- Identity data can only be accessed with user consent
- Hackers cannot impersonate your users
Application & Website Authenticity
Hackers are very creative in developing schemes to steal user credentials. Creating fake websites or redirecting traffic to realistic looking log on pages are some of the many ways that they achieve success. When using WWPass authentication, users are protected from the various tricks the criminals use to steal their identities.
An application, website, or domain are registered with WWPass and provided with a Service Provider ID (SPID) and a digital certificate. Applications that are enabled with a SPID are part of the authentication solution. When the user chooses to log on to the application, the application authenticates with WWPass first. Once the application is verified, the user receives proof that the application is legitimate from WWPass. This is important, because the user now knows that he is not being duped into logging on to a fake website or application.
When the user completes the log on by entering his access code, he is authenticated by WWPass and the credential data that proves the identity of the user is sent to the application. The credential data is retrieved from our cloud based Distributed Data System where the data us encrypted, fragmented and dispersed.
Encryption, Fragmentation, and Dispersion
When data is stored in an encrypted file it is very difficult to hack. But when the encrypted file is broken up into many pieces that are randomly distributed to as many as 12 different locations, it becomes virtually impossible. This is how the WWPass Distributed Data System ensures the credential data associated with the user and the application can never be accessed by the cyber thieves.
The only way that the encrypted data can be retrieved is through the mutual authentication of the application and the user through our patented solution. Once both parties are verified, the encrypted data is shared by the user with the application. There are no back-doors, which means that nobody, WWPass, the hackers, or even government agencies can access the data.
The storage system was designed to be highly flexible. You choose what data is stored to validate and identify the user to your applications. You can use the unique identifier assigned to the PassKey for the user, you can use an account number, or any other data that meets your specific validation requirements. If you have a Public Key Infrastructure (PKI) you can even store the user’s digital certificates and never worry about lost certificates and recovery again.
One Key to Many Doors
The PassKey can be used to provide secure authentication into more than just one organization or application. We’ve designed our authentication solution so that the user can access multiple systems, internal or external, with only one PassKey. No need to try and remember multiple passwords or fumble for the right device to access differing systems.
The credential data for each application is stored in a separate ‘Data Container’ in the WWPass Distributed Data System. Each data container is encrypted using a cryptographic algorithm that is unique to the specific user-to-application relationship. The data container can only be decrypted when accessed and shared between these two entities. This ensures that there is no cross-pollination of data between the various Service Provider applications and further enhances the security of the credential data.