E-Banking Authentication - Dynamic Password Generators and Hardware Tokens

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F22%3APU145736" target="_blank" >RIV/00216305:26230/22:PU145736 - isvavai.cz</a>

Result on the web

<a href="https://europen.cz/Anot/54-1/sbornik-54.pdf" target="_blank" >https://europen.cz/Anot/54-1/sbornik-54.pdf</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

E-Banking Authentication - Dynamic Password Generators and Hardware Tokens

Original language description

In our recent work we presented an overview of current authentication methods, their properties with respect to international standards, and their resistance against attacks from defined attacks taxonomy (compatible with NIST Digital Identity Guidelines). With the Payment Services Directive (PSD2) for European Union coming into force, we believe it is necessary to revise compliance of currently available schemes. The concepts enforced by PSD2 to the area of client authentication are two factor authentication (with requested factor independence), strong customer authentication (SCA), the dynamic linking of the authentication code to the transactions beneficiary and amount, and cloning protection. The most common means of achieving the compliance is the usage of Dynamic Password Generators (DPG) or dedicated Hardware Tokens. DPG is usually a mobile application generating one-time passwords (OTP) and often implementing a challenge-response protocol. We discuss the features of possible DPG implementations both when included in the e-banking application or as a stand-alone, and look into usage of special cryptographic chips in mobile phones - secure enclaves. Hardware Tokens are less frequent in e-banking nowadays, but start to get more traction especially in web services which require two factor authentication. FIDO2 protocol consisting of W3C (World Wide Web Consortium) open web standard WebAuthn and CTAP2 is becoming the de facto standard for using secure hardware and biometrics for authentication in a web environment as it is implemented in all major browsers. We present the key features of FIDO2 protocol and how it can be utilized in e-banking or other web services and illustrate examples of some banking institutions using the FIDO standards for e-banking authentication.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

Sborník příspevků z 54. konference EurOpen.CZ, 28.5.-1.6.2022

ISBN

978-80-86583-34-1

ISSN

—

e-ISSN

—

Number of pages

11

Pages from-to

211-221

Publisher name

Czech Open Systems User's Group

Place of publication

Radešín

Event location

Radešín

Event date

May 29, 2022

Type of event by nationality

CST - Celostátní akce

UT code for WoS article

—