Keyless Biometric Authentication

Rising data breaches, fraud, and evolving cyber-attacks are pushing organizations to upgrade authentication in ways that increase security while improving usability. Many legacy IAM stacks struggle to keep pace with new requirements and technologies, especially in consumer contexts, prompting a modular approach that separates authentication from the broader IAM system and uses discrete MFA and risk-adaptive services. Risk-adaptive authentication evaluates contextual and behavioral signals—such as location, device, time of day, and user behavior baselines—to trigger step-up challenges (e.g., OTPs, push approvals, biometrics, hardware tokens) only when risk warrants it. Behavioral biometrics extend this model by enabling login, in-app authorization, or continuous authentication based on patterns like keystrokes, swipes, and device sensor data, typically collected via client-side agents or SDKs.

Regulatory pressure increases the need for strong authentication and careful handling of personal data. Financial services face MFA/strong authentication requirements under PSD2 and similar rules (e.g., 23 NYCRR 500), while AML/KYC obligations drive identity data collection that must still comply with privacy regulations like GDPR and CCPA/CPRA. Passwordless authentication has emerged as a practical way to improve both security and UX, including biometrics, trusted devices, and risk-based checks that avoid interrupting “happy path” flows. Account recovery remains essential; techniques include OTPs, push notifications, and device linking, while Knowledge-Based Authentication is discouraged due to weak security.

Keyless (founded 2019) provides a passwordless biometric authentication platform for workforce and consumer use cases, delivered via a multi-cloud SaaS “Keyless Network” plus an Authenticator app and SDK. Its core differentiator is privacy-preserving biometric protection: encrypted biometric templates are split using Shamir’s Secret Sharing, distributed across network nodes, and evaluated with Secure Multi-Party Computation so nodes never access unencrypted biometric data. Keyless supports standards-based SSO, remote ID document verification, liveness detection, device health checks, and has achieved FIDO2 and FIDO biometric subcomponent certifications, with stated high availability and fast transaction processing—while still lacking SIEM and external fraud-intel integrations and broader provisioning standards.

• Keyless was established in London in 2019 and has offices in Rome and Singapore.
• The Keyless solution consists of three components: Keyless Network, Authenticator, and SDK.
• The Keyless Network is hosted across AWS and Azure in APAC, EU, and North America regions, with on-premises and private cloud options.
• The Keyless Authenticator supports Android 7+, iOS 12+, and Windows devices, with macOS and web support on the roadmap.
• The Keyless SDK supports Android 7+, iOS 12+, and Windows 10 devices, with macOS support on the roadmap.
• Users can register multiple devices to a single account as a self-service feature for recovery and continuity.
• Keyless supports OAuth, OIDC, and SAML and integrates with Auth0, ForgeRock, IBM, Keycloak, Microsoft, Okta, OneLogin, and Ping Identity.
• Keyless uses Shamir’s Secret Sharing and Secure Multi-Party Computation to evaluate biometric template fragments while encrypted.
• The Keyless Network is described as providing 99.99% availability and 0.3-second per-transaction processing time.
• Keyless Biometric Authentication achieved FIDO 2.0 certification for the Authenticator in July 2021 and also obtained FIDO biometric subcomponent certification with stated FAR and FRR test results.

• “Increasing security and improving usability are the twin goals of modular authentication service upgrade projects.”
• “Risk-adaptive authentication is the process of gathering additional attributes about users and their environments and evaluating those attributes in the context of risk-based policies.”
• “Behavioral biometrics can provide a framework for login, in-app authorization (e.g. for online payments) and/or continuous authentication, by evaluating user behavior to a baseline set of patterns.”
• “Authentication and the related identity and context assurance values, then, can be considered a pre-cursor to authorization.”
• “In light of the above, one of the more recent additions to the authentication armory is ‘Passwordless’ authentication.”
• “Passwordless methods provide security advantages and usability benefits.”
• “A final, yet key consideration for authentication solutions is account recovery.”
• “Keyless is focused on improving identity assurance by eliminating the use of passwords in the authentication process and leveraging tokenized authentication events.”
• “Biometric templates on the user's device are deleted after registration.”
• “User data on the Keyless Network is therefore protected from disclosure, even in the event of a data breach, and provides the user with maximum privacy and control over their personal information.”