Security Overview

BlokSec is a passwordless authentication platform that replaces shared secrets (passwords) with public-key cryptography and device-bound credentials. This section explains the security architecture for teams evaluating BlokSec’s trust model.

Platform architecture

BlokSec consists of three components that work together:

1. BlokSec API — The authentication server that implements OIDC, SAML, and WS-Federation protocols. Hosted on AWS (Lambda + API Gateway), with MongoDB for data storage and Redis for session management.

2. BlokSec Authenticator — A mobile app (iOS and Android) that holds the user’s cryptographic identity. The app generates and secures key material in the device’s hardware security (secure enclave / TPM), receives push notifications, and presents authentication requests for user approval.

3. BlokSec Admin Console — A web application where IT administrators configure applications, manage users, and monitor authentication requests.

Trust model

BlokSec is built so that no single party holds enough to authenticate on a user’s behalf. How that’s achieved depends on the sign-in method:

• BlokKey (mobile authenticator) — The user’s private key is generated and stored on their own device, protected by the device’s secure enclave or TPM. BlokSec’s server keeps only the public key, which it uses to verify signatures. There are no central secret credentials to steal.

• BlokBadge (split-key QR) — The cryptographic material needed to authenticate is split between the BlokSec server and a QR code, and can only be reassembled with both parts plus the user’s PIN/passcode. No single component is sufficient on its own.

Note

In both methods, compromising BlokSec’s database alone cannot forge an authentication: with BlokKey the private key isn’t stored there at all, and with BlokBadge the server holds only one part of a multi-factor split.

Security properties

• No shared secrets — BlokSec never stores or transmits passwords. Authentication uses digital signatures.
• Phishing-resistant — Users approve sign-ins on their own device. There is no password to type into a fake login page.
• Device-bound credentials — With BlokKey, keys live in the device’s secure enclave / TPM and never leave it. With BlokBadge, key material is split across multiple factors and is only usable when all are present.
• Tenant isolation — Each organization (tenant) has fully isolated data. A compromise of one tenant has no effect on others.

Learn more

Security FAQ

Answers to common security questions from CISOs and security architects.

Authentication Flow

How BlokKey and BlokBadge sign-ins work at a conceptual level.