QUARDIAN AUTH
No passwords, no codes to type: authentication completes with a single touch. A dual-layer architecture combining FIDO2 biometrics with one-time quantum keys.
As incidents exploiting weak authentication, such as unauthorized payments and account takeovers, keep repeating, stronger authentication is no longer optional.
Year-over-year increase in cyber breach damages
Personal records exposed in authentication-related breaches
Time for a Pixnapping attack to steal an OTP code
Stronger authentication is no longer a choice; it is a requirement.
One-time codes and biometrics both have limits when used alone.
Recent attack: Pixnapping (CVE-2025-48561)
Researchers reported intercepting OTP two-factor codes within 14–26 seconds by exploiting a GPU side-channel vulnerability in modern smartphones, and the security industry has classified it as high-risk.
SIM swapping
Attackers issue a new SIM card and intercept the SMS verification codes sent to the victim in real time. Any method that requires typing a code faces fundamental limits, because the code can be stolen, relayed, or phished.
No passwords, no codes: a single touch completes authentication automatically.
Useless if stolen, impossible to guess, because the key itself no longer exists.
Quardian KMS generates a physically unpredictable key from 1,024 bits of quantum entropy
Server and mobile device cryptographically verify the quantum key against each other to confirm identity
The quantum key is permanently deleted the moment authentication completes, leaving nothing to reuse or steal
This isn't detection and response; these attacks simply cannot work.
Conventional
There is no way to stop AI from mass-attempting logins with stolen credentials
Quardian
A new key is issued for every authentication, so old credentials cannot log in at all
Conventional
Attackers relay the verification code entered on a fake site in real time
Quardian
Authentication never starts outside registered sites, blocking fake domains at the root
Conventional
Hijacking a phone number to intercept SMS codes allows unlimited code generation
Quardian
No SMS, plus one-time keys, so a stolen key has already expired and cannot be reused
Conventional
Real case: a hacked, unmanaged admin account exposed 297,000 personal records and drew a ₩6.8B fine
Quardian
Biometrics make shared or neglected accounts impossible, and every access is written to the audit log
Text message code
NIST classifies SMS authentication as a restricted authenticator
FIDO2 + one-time quantum key
Time-based code authentication
Real-time phishing kits (AiTM) are bypassing it at a growing rate, and phishing texts impersonating financial institutions account for 46.93%
Admins only generate a QR code, and users scan it and register a passkey, with zero IT support tickets and no training required
Device enrollment
Generate QR code
Admin
Enter the user ID in the console and issue a QR code instantly
Mobile authentication
Ready to authenticate
Home screen
Device enrollment complete
Track every authentication event in real time and block threats automatically, leaving no blind spots.
| Time | User | Method | Status |
|---|---|---|---|
| 10:41:02 | u_8213 | FIDO2 + QKey | Success |
| 10:41:19 | u_5502 | FIDO2 + QKey | Blocked (stale_qkey) |
| 10:41:27 | u_1187 | FIDO2 + QKey | Success |
The figures above are sample data to illustrate the screen layout.
Connect through OIDC/OAuth 2.0 without changing existing system code, and sync IdP users automatically with SCIM.
Common questions when evaluating Quardian Auth.
Quardian Auth combines FIDO2 biometric authentication (fingerprint or Face ID) with a one-time quantum key (QKey) in a dual-lock structure. Level 1 confirms identity biometrically and Level 2 re-verifies with the quantum key, completing in a single touch.
QKey is a one-time key generated by Quardian KMS from 1,024-bit quantum entropy, and it is permanently deleted the moment authentication completes. A key that has already been used can't be reused, so intercepting it is meaningless.
Quardian Auth supports the OIDC/OAuth 2.0 standard, so it connects without changing existing code, and SCIM automatically syncs IdP user data.
An administrator can remotely deactivate the device and reset its key instantly from the admin console.
It holds a security function verification certificate from the National Intelligence Service, FIDO Alliance certification, and Public Procurement Service innovative product designation, built on patented quantum key generation and verification technology.
Need more detail or considering a deployment? Reach out any time.
