Mobile app PIN per device - Cognito

To implement a device-specific PIN for your mobile app using Amazon Cognito, you can leverage Cognito's device tracking and authentication features. Here's a recommended approach:

1. Device Tracking: When a user signs up or signs in, Cognito generates a unique device key. You can use this device key to associate the PIN with a specific device.

2. Custom Attribute: Create a custom attribute in your Cognito user pool to store the PIN. However, instead of storing the PIN directly, you should store a hash of the PIN combined with the device key. This ensures the PIN is device-specific.

3. Device Confirmation: Use the ConfirmDevice API to confirm the user's device. This associates the device with the user's account in Cognito.

4. PIN Setup: When the user sets up their PIN, hash it with the device key and store it in the custom attribute you created.

5. Authentication: For subsequent sign-ins, you'll need to implement a custom authentication flow: a. The user enters their PIN in the app. b. Your app retrieves the device key (stored locally after the initial sign-in). c. Hash the entered PIN with the device key. d. Use this hash in a custom challenge in the authentication flow.

6. Custom Auth Challenge: Implement a Lambda function to verify the PIN hash against the stored value in the custom attribute.

This approach ensures that the PIN is tied to the specific device. If a user tries to use the same PIN on a different device, the authentication will fail because the device key will be different, resulting in a different hash.

Remember to implement proper security measures, such as limiting PIN attempts and implementing a secure way to reset the PIN if needed. Also, consider using Cognito's adaptive authentication features to add an extra layer of security based on risk evaluation.

While this approach leverages Cognito's device management capabilities, it's important to note that you'll need to implement custom logic to handle the PIN verification process, as Cognito doesn't natively support device-specific PINs.
Sources
Working with user devices in your user pool - Amazon Cognito
DeviceConfigurationType - Amazon Cognito User Pools
AWS Cognito device_key purpose | AWS re:Post
Use ConfirmDevice with an AWS SDK or CLI - Amazon Cognito