Let's Get Connected!

Using Personal Devices For Authentication PDF Print E-mail
User Rating: / 0
PoorBest 
Innovation
Written by Cholena Deb   
Monday, 25 August 2008 00:00
Article Index
Using Personal Devices For Authentication
Page #
All Pages

Contrary to what many people believe, it is perfectly possible to make a counterfeit ATM and siphon money out of customers' accounts. A group of students is looking at ways to counter this danger!

The automated teller machine (ATM) has now become an integral part of our cities. Indeed, it has emerged as the preferred option for depositing and withdrawing money from bank accounts. However, in the present scenario, users have no choice but to trust the ATM. However, there can be a bogus ATM too, which can read the users' details from the card and even take their personal identification number (PIN), without dispensing services. The identification details thus stolen can be misused to transfer money from the bank account of such gullible users. A group of students and their professor have come up with a system to tackle this problem.

The invention is based on a system where your personal device (such as a mobile phone, PDA or a laptop) is used for authentication and secure communication with the service provider's equipment (for example, a bank ATM) for access to the services (such as a money transaction). {quotes}Employing strong cryptographic technology that is built using Java-enabled mobile phones with Bluetooth or near field communication (NFC) technology, the system works both ways; it helps the ATM/ bank to identify the users and also confirms the genuineness of the ATM machine.{/quotes} Once authenticity is established, both sides are sure about the identity of the other party and can go ahead with the transaction.

The invention is a combined effort of Ankit Sharma, Vikas Gelara, Abhishek Gaurav, Nitin Munjal and Professor Rajat Moona of IIT Kanpur.

A matter of security

Currently, mobile phones are used to authenticate the service provider's equipment in order to pass the information related to the user's identity. At the time of registration, users are supposed to carry their mobile phone to the bank, and the bank enables their mobile phone with a software that includes strong cryptographic technology. The users thereafter, get a public key. This public key can be used to establish contact with a genuine ATM. After the authentication, the mobile phone's display and keyboard can be used to access ATM services.

From the user's perspective, keeping account information on the phone may also prove risky as the phone may get lost or accessed by someone else. A smart card provides greater security, as even if the smart card is lost, the information is protected, as the keys cannot be deduced from the card.

If a smart card is used, the phone just acts as a smart card reader and an extension to the ATM. Otherwise, the phone has to be kept safely so that the keys and other information are not leaked out.

Thus for enhanced security, the user is also provided with a smart card (if NFC technology is used, it can be a contactless smart card) by the service provider such as a bank, for using its services. The smart card carries the user's information, which is digitally signed by the bank. Only a genuine ATM would be able to read the card and save the user from being taken for a ride.


 
+/-
Write comment
Name:
Email:
 
Website:
Title:
UBBCode:
[b] [i] [u] [url] [quote] [code] [img] 
 
 
:angry::0:confused::cheer:B):evil::silly::dry::lol::kiss:
:D:pinch::(:shock::X:side::):P:unsure::woohoo:
:huh::whistle:;):s:!::?::idea::arrow:
 
Please input the anti-spam code that you can read in the image.
+/- Comments
Add New Search RSS

3.25 Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."