secure authentication and authorization transaction ... · whitepaper: comarch t - pro 3 1 comarch...
Post on 23-Aug-2020
0 Views
Preview:
TRANSCRIPT
Secure authentication and authorization
Transaction Protector Token
COMARCH T - PRO
Whitepaper: Comarch T - Pro
2
TABLE OF CONTENTS
1 COMARCH T-PRO 3
1.1 OVERVIEW 3 1.2 FEATURES OVERVIEW 3 1.3 SYSTEM FEATURES 4 1.4 THE SOLUTION 5
1.4.1 Protection against phishing 5 1.4.2 Transaction authorization using COMARCH T-Pro 6 1.4.3 Transaction authorization using COMAR CH T-Pro and COMARCH SmartCards 7 1.4.4 Secure channel for entering sensitive information 7
Whitepaper: Comarch T - Pro
3
1 Comarch T-Pro
1.1 Overview
Comarch T-PRO, transaction protector token is a solution developed by Comarch as a response to
increasingly emerging malignant software, executing ManInTheBrowser or key logging attacks. Men in the
Middle attacks are a direct cause of electronic thefts from bank client accounts. Key logging software makes
it possible to sniff-out and gather information entered by a user using a keyboard. The information gathered
is sent through invisible channels on the attacker’s email address, resulting in the exposure of passwords,
PIN codes and other sensitive information that is used to grant access to a wide range of services such as
electronic mail, internet banking, online auctions, etc. Mechanisms used in our solution, also provide security
against phishing attacks.
Comarch offers the SmartCard/SmartToken solution which is a hardware carrier of cryptographic keys and
certificates. Our solution is used in financial transaction authentication and authorization processes.
Comarch T-Pro completes that solution, by providing a secure way to input sensitive data, such as user PIN
codes.
1.2 Features overview
COMARCH T-Pro was designed to:
Secure authorization of financial transactions
Secure the input of sensitive information
You will find a detailed explanation of the device usage below.
The device consists of a display and keyboard. Using the USB connector is connected to end user computers.
It also has a built-in microprocessor cryptographic card reader.
Whitepaper: Comarch T - Pro
4
Besides hardware, our solution includes software components used on both ends of communications by end
users and servers. With financial systems on the server side, T-PRO is integrated using delivered API. The final
end users use our solution through internet browser extensions, installed automatically from financial
institution web sites.
1.3 System features
WYSIWYS (What You See Is What You Sign)
In the authorization process the user signs transaction data according to information shown on the
device’s display.
Anti-phishing
The device informs the owner that he is connected to an authorized banking service
Strong cryptography
o cryptographically secure pseudo-random number generator
o symmetric algorithm AES (Advanced Electronic Standard)
Two level authentication/authorization
The authentication and authorization process depends on:
o something you know (PIN code)
COMARCH T-PRO
Strong Cryptography
Keyboard
SmartCardReader
Display
Whitepaper: Comarch T - Pro
5
o something you have (COMARCH T-PRO device)
Transaction data is cryptographically protected from manipulations
The uniqueness of each device is cryptographically ensured
Cryptographic proof of the committed transaction for financial institutions
The physical impossibility of manipulating the content of the T-Pro device
Trusted channel for sensitive information
1.4 The Solution
1.4.1 Protec tion agains t phishing
The anti-phishing mechanism, supported by T-Pro COMARCH, works before a user even types any information
on a bank's transaction page, a step before logging in. When the user opens the bank’s login page, the
cryptographic component is loaded and a challenge is generated on the T-Pro device and sent to the bank’s
server. The server generates a response to the incoming challenge, and sends it through the cryptographic
component back to the T-Pro device. If the verification is successful, the login page is displayed and T-Pro will
show the lock symbol indicating that the page provided by the server is trusted.
Whitepaper: Comarch T - Pro
6
1.4.2 Transaction authorization using COMARCH T-Pro
Each COMARCH T-Pro device is cryptographically unique and clearly identifiable by the system.
A user enters financial transaction data on a company’s web page. Crucial transaction information is being
sent to a server. At the server, information is being encrypted with a key unique for each T -Pro device.
Encrypted information travels back to the T-Pro device, which decrypts the received informa tion and shows it
to the user on their display. The T-Pro device implements a mechanism for checking the origin of incoming
information. If T-Pro doesn’t recognize the source, then an appropriate message is shown on the display.
The user’s job is to verify the information shown and if it is correct, to accept it by pressing the OK button.
However if the information shown is incorrect, the user should press the CANCEL button.
To finalize the transaction, the user enters his PIN code on the T-Pro device, which is used to log the user in
on the T-Pro device and to sign transaction data. After user acceptance, data is signed, again encrypted
using the unique cryptographic key and sent directly to the server, where signature verification follows. In
case of a successful verification, the transaction is accepted.
The part where signing transaction data takes place can also be realized using cryptographic microprocessor
cards (like COMARCH SmartCards). The Comarch T-Pro device is supplied with a SmartCard reader. The T-Pro
device secures the PIN code entering process throughout the use of the supplied keyboard and in direct
communication with SmartCard,.
Whitepaper: Comarch T - Pro
7
1.4.3 Transaction authorization using COMARCH T-Pro and COMARCH SmartCards
The COMARCH T-Pro device has its own SmartCard reader and numeric keyboard for entering PIN codes. The
user enters the PIN to login on SmartCard, and communication between SmartCard and T -Pro takes place
inside the device. This mechanism protects against sniffing out a user’s PIN code using key loggers.
1.4.4 Secure channel for entering sensitive information
The Comarch T-Pro device, combined with Comarch’s cryptographic component, allows for securing the
process of entering sensitive information, like an account number. In this scenario, after entering the account
number on the device, it is encrypted using a unique cryptographic key and sent directly to the internet
banking server. This process prevents any alteration of the account number during tran sfer of information to
the bank.
Whitepaper: Comarch T - Pro
8
www.finance.comarch.com
top related