Interview: LoginID and Oasis Smart SIM discuss eSIM biometric solutions

In January 2021, Oasis Smart SIM announced an agreement with LoginID, targeting the integration of FIDO-certified passwordless authentication and digital identity verification capabilities into its Digital Connect eSIM provisioning platform. LoginID will work with the Oasis team to explore how integrating FIDO2 into the Consumer eSIM solution can create an enhanced mobile account activation experience for mobile phone users, ensuring identity upon activation and for the life of the customer account. Discover more on both companies how well-designed eSIM solutions combined with the latest biometric solutions can meet new requirements without compromising security

There has been much interest in biometric solutions over the last few years. In a few words, how have the drivers and market trends evolved for these solutions over the years?

Thierry Siminger, Head, Telecom Business Unit, GM MEA at LoginID: The market is being driven by a combination of factors: with the emergence of FIDO as the defacto standard for strong authentication, industry has rallied around supporting this approach - the end result it an exponential growth of FIDO enabled devices in market, likely in the range of 5B at this point in time. You also have the regulatory side of the market, where in some cases regulators are giving explicit directives on the types of authentication which are acceptable. Customers have shown acceptance around the use of biometrics as a part of their daily interactions with devices and services. Passwords have been around for decades and customers are savvy enough to understand the risks associated with account takeovers, phishing, SIM swaps and other hacks. Given the choice if there is an option for a more secure, frictionless way to authenticate, customers will migrate to that option. Remote onboarding of customers has evolved from what was typically an in-person event for new customers or upgrading for new devices. For new customers and the activation of their account and device, they want it to be simple and secure. For existing customers they want a frictionless experience moving from their existing device to a new device, without the need to reregister their existing information on a new device. By utilizing FIDO they can add this as a part of their onboarding process and utilize hardware based biometrics for any other interactions moving forward. A couple of the use cases include:

• Authenticating when a customer is making changes to their account
• Authenticating when they are transacting - making a payment, moving money etc
• Authenticating when the customer is interacting with a call centre to prove they are in fact the individual calling

For operators, eSIM is also a burning technology – with the recent announcements of both Apple and Samsung elaborate. Your company offers eSIM infrastructure and solutions to simplify its adoption. Why is there a need to simplify? What are the remaining challenges today, 5 years after the inception of eSIM?

Jonathan Kendall, CCO of Oasis Smart SIM: “Ever since Apple announced the first eSIM phone in 2018 with the iPhone XS, we've seen a bigger penetration of eSIM smartphones in the market. Today, all major handset vendors have adopted it and are making it mainstream; and the pandemic has only accelerated this switch towards digitalization - so it's a question of when rather than if for MNOs'. However, the first wave of deployment has unveiled new challenges. First, on the operator side, the first implementation of RSP infrastructures Remote Sim Provisioning, GSMA-certified infra to provision eSIM over the air are not scalable. MNOs and MVNOs have largely deployed single instance systems and are faced with the challenge of the growth of regional data security/sovereignty policies forcing them to look for new models so that they can scale and implement locally. It’s clear that on the vendor side, there needs to be the capacity to deploy high-security, fully redundant transaction infrastructure scalable within their complex hybrid-cloud environments. So we're seeing new models emerge and Oasis is strongly investing in those new models. Apart from being able to scale out, operators are also still faced with the remaining lack of massive adoption from the user side. Some still question the security aspect of eSIM. It’s the ecosystem’s job to educate users on the fact that eSIM is actually more secure than SIMs. The other principal challenge for operators worldwide is to make this eSIM activation process as easy and seamless as with traditional plastic SIM so that eSIM can naturally replace SIM cards, in the user's mind too. That’s really where we are investing with our partnership with LoginID.

LoginID and Oasis Smart SIM have recently signed a cooperation agreement to explore how FIDO and eSIM can create an out-of-the-box activation experience for Telcos’. What kind of impact do you expect this will have on MNOs and MVNOs in their search for safe and convenient ways to identify their customers?

Thierry Siminger, Head, Telecom Business Unit, GM MEA at LoginID: There will be multiple benefits from this approach. Customers will feel more confident around the security of their account (protecting from SIM swaps, account takeovers etc.). They will find it easier to migrate from one device to another, and easier to add additional devices off the same account. For MNOs/MVNOs this means they will have a seamless path for moving accounts of their customers to new devices, in a secure manner, with customers being less of a target for hacks and also reduce instances of subscriber fraud. It also means MNOs will not need to rely on the use of insecure forms of authentication such as OTPs etc. As part of MNO enterprise solutions and offers to their business partners, MNOs need to be in a position to provide a more elaborate consumer secured authentication framework. Business partners being not only the private sector, but also the public and government, the technology used must be aligned with the regulatory bodies and standardisation groups (ex: PSD-2, GDPR, ANSSI etc…)

Can you elaborate on this aspect of seamlessness of the journey? What do eSIM providers need to do today to make sure that eSIM is a resounding success and that they can gain market share in an already competitive market?

Olivier Leroux, CEO of Oasis Smart SIM: As we mentioned earlier, eSIM is a step forward with security - but there was a tradeoff between security and user friendliness. Today, operators need to assemble all the digital blocks so that their user’s journey is as easy as the one they had with plastic SIMs. So the onboarding process needs to be improved, from the delivery of eSIM to some daily use cases of users that were not tackled by the GSMA. How can we make sure the delivery of an eSIM is as swift as a delivery from Amazon? Is it normal to ask the user to wait 24h for its digital identity to be verified? Is QR code the best onboarding technique? How do we make the process of changing eSIM from one phone to the user as swift as possible, without compromising on security? It's up to us and vendors in the eSIM space to make sure we're delivering the best enabling platform beyond the Remote SIM Provisioning infrastructure. If we manage to make this eSIM activation process as easy and seamlessas with traditional plastic SIM - then we'll witness a natural replacement of traditional SIM cards by eSIM. That's what we are trying to achieve with our platform Digital Connect - a platform that enhances the DP+ enabling experience by leveraging on strategic alliances so that MNOs' can benefit from a cutting-edge and flexible platform completely modular to their needs. And to build that trust - we need to work with experts in domains such as authentication like LoginID to make sure our eSIM Consumer Platform has the best level of efficiency without compromising on security.

One of the big use cases tackled here is FIDO for Telcos’ consumers. Do you see this technology applicable for other types of clients in the Telco industry?

Thierry Siminger, Head, Telecom Business Unit, GM MEA at LoginID: The way FIDO is architected, it is strongly aligned with different regulatory frameworks such as PSD2, Open Banking, GDPR etc. By this nature, it is a natural fit for being supported in the government/public sector. As part of the digitalisation of government services, ex: smartID and smart Driving licenses, we see more and more involvement of the private sector in the citizen onboarding and vetting processes. As an example, in South Africa, banks start to provide SmartID application and delivery services on behalf of the department of home affairs. As such, there is an obvious need for a standardised and trusted strong authentication framework that all parties should comply with.

Is Oasis Smart SIM ready to answer to the needs of these clients with eSIM solutions?

Olivier Leroux, CEO of Oasis Smart SIM: Thanks to Tata Communication's acquisition in December 2020 The Indian Telecommunication Giant became Oasis' majority shareholder last year, we were really able to experience steep growth and position ourselves within the Tier 1 MNO/ MVNO space, as being the right kind of certified and flexible agent to help operator to digitally transform with eSIM and retain new digitally-savvy users. We have operated more than 50+ instances of RSP solutions across the world, and with a variety of GTM. Moreover, even if we've witnessed that the Consumer growth was steeper than M2M over the past years, there is a real trend of interest of eSIM for Enterprises & Private Networks - that require a different set of requirements than those of Consumer. That requires vendors from our space to acknowledge how to deal with enterprise complexity: enterprise customers have multiple operator relationships, they operate under their own business rules and need a single pane of glass to manage their interaction between the different providers. Together with Tata Communications, we've developed their IoT eSIM management platform at scale to achieve the service levels required by Service Providers' while lowering the total cost of ownership of eSIM and lowering complexity barriers of adoption of eSIM. So we’re ready to offer that platform to other enterprise-focused operators and integrators in the space.

How do you think biometric will evolve in the next few years and what is your roadmap to make sure Login ID follows this trajectory?

Thierry Siminger, Head, Telecom Business Unit, GM MEA at LoginID: There are multiple areas where we are focusing our efforts. One of the main areas revolves around payments. The use of identity and authentication as a part of a payment process is a standard requirement for almost all commerce. By combining these components together we get what LoginID is calling ‘Authenticated Payments’ - which is a payment where you have definitive confidence that it is the person you are in fact dealing with. Imagine if your payment credentials, credit card or bank account detail, could be securely set up upon account activation and any time moving forward you use FIDO biometric authentication to authorize a payment being made. Once you have biometric authentication dynamically linked to a transaction you create transactions that cannot be repudiated by the customer.

About LoginID:

LoginID is a San Mateo/Toronto based company focused on bridging the gap around authenticating users and securing their information. This is facilitated through its FIDO2 and UAF certified strong customer authentication, privacy and tokenization platform. The team is funded by strategic investors such as Visa, and is composed of seasoned executives with decades of experience, across global brands, helping commercialize products around security, cryptography, payments and mobile.