PIN-on-Card New contact-less smart card with integrated PIN pad for secure user verification at...
-
Upload
janice-murphy -
Category
Documents
-
view
216 -
download
0
Transcript of PIN-on-Card New contact-less smart card with integrated PIN pad for secure user verification at...
PIN-on-Card
New contact-less smart card with integrated PIN pad for secure user verification at unparalleled cost effectiveness
Balancing securtiy, cost and convenience
Security• Advanced
encryption • Copying• PIN eaves-
dropping
XX = target position
Cost• Card• Reader• System
integration
Convenience• Easy to use• Contact-less• Mobility
PIN security over the Internet
• A typical PC is not secure
• PIN/Passwords entered from the computer's keyboard are easily intercepted by Trojans
• Information stored as files on a computer’s hard disc is easily copied by Trojans
• Keys must be stored outside the computer
• PINs must be entered on a device outside the computer
• Cryptographic operations must be performed outside the computer
Today - security, cost or convenience
• Smart Cards– Security: Need advanced external keypad
reader to secure PIN over the Internet– Cost: Expensive keypad readers – Convenience: Sensitive, not for outdoor use
• RFID/prox cards – Security: Information can be read out remotely
and needs advanced external keypad reader to secure PIN over the Internet.
– Cost: Expensive readers – Convenience: Robust, contact-less and
convenient
Combining security, cost and convenience
+ Smart Card– Intelligent and high security, can
not be read out remotely– Large data storage
+ RFID Card– Contact-less
+ Keypad reader– Prevents PIN interception
PIN-on-Card
• Highest level of security– Security resides on the card, not reader or system
– 128-bit AES ( RSA, 3DES )
– PIN never leaves the card
– Secure data storage (32 kBytes)
• Low cost – Robust cards and readers, no slot, no moving parts
– Low cost for readers
• High convenience– One card - multiple systems/functionality
– Contact-less
– High level of automation
Introducing PIN-on-Card
• PIN-on-Card (POC)• POC readers
– Desktop reader connects to computer’s USB port
– Wall mounted reader
– OEM components
• POC Client API
• POC controller (for physical security) – Control unit for access, control and alarm for
buildings and machinery
The PIN-on-Card system components
Cards and readers
• Cards– Integrated PIN pad– Standard ISO card size– Customized graphic design
• Readers – Multiple form factors– Reader range up to 5 mm– OEM component from 1 US– Easily integrated into non-metallic flat surfaces;
keyboard, mouse mat, Smart Phone etc.
SC Client Driver and API
• Extends functionality of the card to third-party applications
• Easy integration with event-driven COM/ActiveX interface
• Minimal coding effort required• Automatic Web-browser activation and
navigation to URL stored in card
User scenario - Internet service
1. The card is placed on a card reader connected to computer
2. Card navigates automatically to preprogrammed Internet site
3. User is verified by entering PIN on card
4. User is accepted by service
Basic challenge response
1. PIN entry2. Encrypt challenge and X with secret key Decrypt
response with secret key to determine if X is authentic
Generates longrandom numberas challenge
Card on reader
User Service
User claims to be X
User sends response
Service challenges user
Service accepted or rejected