Setting up two-factor authentication using behavioral biometrics with Neomia Pulse

This article describes the procedure for configuring and activating Neomia Pulse artificial intelligence-based MFA.
This does not require any additional devices for the user to identify themselves based on how they type on their keyboard.

Prerequisites

Only four prerequisites are necessary to ensure that Neomia Pulse MFA works:

1. Retrieve your Neomai Pulse API key for CyberElements Bastion
2. Open TCP 443 access between the Mediation Controllers and api.neomia.ai
3. Use user authentication domains of type local or LDAP, as Neomia Pulse cannot be used with domains of type anonyme or SAML on CyberElements Bastion
4. Apply another type of MFA (OTP, TOTP, or Radius) on the same domain

Neomia Pulse MFA settings and activation

To enable Neomia Pulse MFA on CyberElements Bastion, you must edit the authentication domain and:

1. Enable at least one authentication token on the authentication domain

2. Enable the Enable Neomia Pulse authentication option

3. Set the URL for connecting to the Neomia Pulse API, which can be found in the Neomia Pulse Dashboard in Management > Services. The default value is https://api.neomia.ai/pulse

4. Define the URL for connecting to the Neomia Pulse authentication API, which can be found in the Neomia Pulse Dashboard in Management > Services. The default value is https://api.neomia.ai/pulse-auth

5. Enter your API key, which can be found in the Neomia Pulse Dashboard in Management > Services.

6. Specify the number of behavioral identification attempts the user will be subjected to, 0 indicating that there will be an infinite number of attempts

7. Configure how authentication works:

   1. Ignore OTP token: if Neomia Pulse MFA validates the user, no other MFA will be requested
   2. Strengthen the authentication with an additional factor: if Neomia Pulse MFA validates the user, they will still have to validate one of the MFAs configured in step 1

8. Configure how authentication works if Neomia Pulse fails to validate the user:

   1. Block the user: the user's account is immediately blocked on CyberElements Bastion
   2. Require an additional authentication factor: the user can still log into CyberElements Bastion if they validate one of the MFAs configured in step 1

9. Choose whether or not to display graphical components when analyzing keystrokes (after entering words):

   With graphical components	Without graphical components

10. Choose whether or not to display authentication factors and their validity for authentication on the user portal (information visible at the top left of the user portal):

    With authentication factors	Without authentication factors
    Case of Neomia Pulse validation but with additional MFA to be validated: Case of Neomia Pulse invalidation but with additional MFA validated: Case of single Neomia Pulse validation:

More information

More information about Neomia Pulse is available on its documentation website: Neomia Pulse Documentation