Strong Authentication for Confident Access

Match Authentication to the Access Request

A customer signing in, an employee opening a business application and an administrator entering a production environment have different assurance needs. Hengbao supports a combination of authentication methods selected around the user, device, application and business process.

These methods connect with IAM and business authentication flows, allowing institutions to introduce stronger controls in stages while retaining a coherent registration, recovery and credential management process.

USB PKI Security Tokens

Protect digital certificates and private keys in a hardware device for certificate-based authentication, digital signatures and controlled system access. Users perform cryptographic operations with the token and a usage factor such as a PIN, while the receiving system checks the certificate chain and organisational trust policy.

PKI tokens suit bank operations, managed employee workstations, financial approvals, document signing and authorised third-party maintenance. Integration can connect enterprise PKI, directory services and endpoint policies.

• Hardware protection for certificates and private keys
• PIN controls and certificate validity, chain and revocation checks
• Issuance, renewal, loss reporting, revocation and replacement workflows

Digital and Software Tokens

Use one-time codes, cryptographic responses or push confirmations within a multi-factor authentication process. Software tokens operate through mobile or desktop authenticators, while dedicated hardware tokens provide another option for different user groups and environments.

Applications include customer sign-in, sensitive profile changes, employee remote access, back-office administration and account recovery support. Adapters can help older systems adopt token authentication as part of a phased transition.

Policies can define factors, failed-attempt limits, one-time-code validity and authenticator binding. Registration, replacement, deactivation and recovery remain part of the credential lifecycle. For higher-risk journeys requiring phishing resistance, origin-bound FIDO authentication provides a different option from manually entered one-time codes.

Passwordless Authentication

Replace traditional password sign-in with public-key credentials, passkeys, device-bound keys or certificates. After user verification, the authenticator signs a challenge and the service checks the response, reducing reliance on reusable shared passwords.

Passwordless methods can simplify access to mobile and online banking, customer portals and enterprise applications while reducing exposure to password reuse and credential stuffing. FIDO-based methods also provide origin binding to help resist phishing.

Credential policies distinguish between synced passkeys and device-bound credentials according to assurance requirements. High-assurance roles can use device-bound methods, while account continuity is addressed through registration, replacement, revocation and the credential provider's recovery process.

FIDO Authentication

Strengthen sign-in security through FIDO2/WebAuthn integration and FIDO2 security-key configurations. Authentication uses a public-key credential registered to the relevant service, allowing users to demonstrate possession of their authenticator without submitting a shared password.

Origin binding helps prevent a phishing site from capturing a credential that can be reused at the legitimate service. Platform authenticators and external security keys can support passwordless customer sign-in, employee access, administrator authentication and step-up verification before sensitive actions.

Policies can define accepted authenticator types, user verification requirements and registration rules, with stronger requirements for managed devices, privileged roles and sensitive applications.

Biometric Authentication

Use device-platform biometrics to verify the person using an authenticator. A fingerprint or face check can unlock the authenticator's public-key credential, allowing the service to verify the resulting cryptographic response.

Biometric data is handled by the device platform. Device PINs or other supported local methods can provide alternatives within the configured policy. This capability supports sign-in and authenticator use; remote document checks and liveness detection are separate identity-proofing processes.

Risk-Based Authentication Across the Journey

Authentication can adapt to the context of the request. Routine access can use a convenient method, while a new device, unusual location, repeated failures or a sensitive action can trigger stronger verification or review under institutional policy.

Sensitive actions include adding a payee, changing account information, raising a transfer limit and accessing privileged systems. Authentication events and authenticator changes can be recorded alongside the relevant business process.