hPIN/hTAN: A Lightweight and Low-Cost E-Banking Solution against Untrusted Computers

Abstract

Abstract. In this paper, we propose hPIN/hTAN, a low-cost hardware token based PIN/TAN system for protecting e-banking systems against the strong threat model where the adversary has full control over the user's computer. This threat model covers various kinds of attacks related to untrusted terminal computers, such as keyloggers, screen scrapers, session hijackers, Trojan horses and transaction generators. The core of hPIN/hTAN is a secure and easy user-computer-token interface. The security is guaranteed by the user-computer-token interface and two underlying security protocols for user/server/transaction authentication. The hPIN/hTAN system is designed as an open framework so that the underlying authentication protocols can be easily reconfigured. To minimize the costs and maximize usability, we chose two security protocols dependent on simple cryptography (a cryptographic hash function). In contrast to other hardware-based solutions, hPIN/hTAN depends on neither a second trusted channel nor a secure keypad nor external trusted center. Our prototype implementation does not involve cryptography beyond a cryptographic hash function. The minimalistic design can also help increase security because more complicated systems tend to have more security holes. As an important feature, hPIN/hTAN exploits human users' active involvement in the whole process to compensate security weaknesses caused by careless human behavior.

CTL: A Platform-Independent Crypto Tools Library Based on Dataflow Programming Paradigm

“…While RVC itself is platform independent, "wrappers" [62] can be developed to bridge the platform-independent FUs with physical I/O devices/channels (e.g., a device attached to USB port, a host connected via LAN/WLAN, a website URL, etc.). Although there are many candidate protocols that can be considered, as a first step we plan to implement the hPIN/hTAN e-banking security protocol [42], which is a typical (but small-scale) heterogeneous system involving a hardware token, a web browser plugin on the user's computer, and a web service running on the remote e-banking server. We have already implemented an hPIN/hTAN prototype system without using RVC, so the new RVC-based implementation can be benchmarked against the existing system.…”

Authentication and Transaction Verification Using QR Codes with a Mobile Device

“…However, it has been highlighted that this approach does not defend against session hijacking or online phishing [11]. Li et al [17] propose a low-cost hardware token based PIN/TAN system for protecting e-banking systems. This hardware takes the form of a physical USB token that has to be inserted into an untrusted computer to perform user/server/transaction authentication.…”

Boosting Usability for Protecting Online Banking Applications Against APTs

“…The Zeus Trojan used in the Eurograbber is a MitB attack, since it injects malicious code into the browser that is activated when the user starts an online banking session. Shujun Li et al [17] also identify a fourth category that they term Man in the Computer (MitC), which is best exemplified by an APT that takes full control of a users PC. This is more pernicious, since it can control all the input and output channels including the keyboard, screen, network, filestore etc., meaning that nothing in the PC can be trusted.…”

“…hPIN/hTAN [17] is similarly designed with cost and usability in mind, but this is a mechanism for securely sending a transaction to the bank, rather than an OOB confirmation of it. This USB device only uses HMAC as the core cryptographic method and requires neither a second trusted channel nor a secure keypad nor a trusted third party nor encryption, so it is very cheap to manufacture, the estimated cost of this USB device e(3-5).…”