UniOTP Business Solution

ABOUT THIS GUIDE

This document is intended for use by management.

UniOTP dynamic password authentication system is a dynamic password authentication product designed by SecuTech Solution Inc. The company is committed to providing superior software protection and authentication experience for the user's personal data and intellectual property.

E-commerce requires that each party cooperates closely in order to provide to the consumer a safer environment and a more comfortable and appropriate consuming platform. It will become one of the most important business models in the future. But, while having brought convenience to people’s life, e-commerce also brings several hidden security risks. Attacks are becoming more sophisticated and diverse, and cases where a consumers’ profit has been infringed are rapidly increasing. Security is one of the most important obstacles to e-commerce development.

Financial industry refers to those enterprises operating specialized financial products, including banking, insurance, trust, securities industry, leasing industry, mortgage industry etc. With the application of network technology in the financial industry, people can enjoy convenience brought by the computer network, such as online banking and online security trading. But with this convenience, user information security is facing more serious challenges. Various network attack technologies result in economic losses to customers. As the fist user information security shield, if authentication is not strong enough, it will cause severe security problem and economic loss.

Authentication is the first step in assuring safety. This safety is directly related to the consumers’ personal benefits. Dynamic authentication is a technology that provides a strong authentication method to users and is considered to be a method that can solve today’s authentication related problems. The combination of dynamic password with e-commerce greatly raises the security level of electronic transactions, and better protects consumers’ benefits.

Enterprise application refers to all kinds of information management systems which is applied by different enterprises, such as E-commerce, Enterprise resource planning (ERP), custom relationship management (CRM), etc. It will greatly improve enterprise management and manufacture efficiency by using enterprise applications to process cumbersome information.

Some of the information maintained by enterprise applications contains confidential information which may involve the core enterprises interests, so security of this information is very important. Enterprise information security can be achieved by building a defence system, including anti-virus, firewall network monitors and etc.

CURRENT SITUATION OF FINANCIAL TRANSACTION

Transaction mode

OCT (Order confirmation transaction)

When a customer goes to the counter an talks a teller to do their business directly, customers have to present their ID and bank card to tellers and provide password to complete authentication and do business.

Dedicated terminal

Customers use a dedicated terminal provided by a financial institutions (ATM and POS) to process their transactions. Customers need to present credential card (bank card), customer ID and customer password to start independent transactions.

Online transaction

Customers logon to financial institution websites to process business. In online transactions, customers normally provide an account name and password to complete the authentication process. After successfully logging on, customers can process their business on line.

Telephone transaction

Customers can process their business through calling the financial institutions hotline. Customers need to provide user credentials and password to complete authentication.

Transaction security

A variety of transaction modes bring different trading experience to customers along with different security risk.

OCT security

When customers provide their account number and passwords, there is a risk that criminals may peek at their passwords. After stealing the passwords, a criminal can log into customer accounts and perform illegal operations.

Dedicated terminal security

When a user inputs their account number and password, there is a risk that criminals may record their password. Because dedicated terminals are for public use without any special protection, it is easy for criminals to steal a users’ identification information.

Online transaction security

There is risk that online transaction user accounts and passwords are stolen by criminals, through listening, installing Trojans on a target computer, network hijack etc.

Telephone transaction security

There is risk that user accounts and passwords are stolen by recording and eavesdropping.

Common account security risks

Plagiarism leak

Attackers steal customer account information by eye, and fake user customer ID to operate customer accounts illegally. This kind of risk usually occurs when customers do their business in public.

Install Trojans

Attackers install Trojans on a target computer, and steal user accounts and passwords remotely. This security risk usually exists when users perform their business online by PC.

Network sniffing

Attackers extract a user’s confidential information through eavesdropping on the data transmission network.

Replay attack

Attackers simulate a user logon, through sending authentication request data packages which was intercepted and recorded via network, to achieve the purpose of operating a user account.

User password guess

If a users password is too simple and uses some special number, such as date of birth, anniversary and name, attackers can obtain users password by using these details easily.

Records leak

If a password is too complicated and users record it on paper, there will be a risk of password leak.

Brute force

Attacker obtain passwords by an enumerating method

Password sharing

To remember various passwords for many different accounts, users usually use the same password. If one password is stolen, criminals can try it on other accounts.

SECURITY ANALYSIS

A general overview of the hidden security risks with e-commerce:

Falsification

Business related information is falsified as it is been transferred over a network.

Information destruction

Due to network devices or software malfunctioning, some data loss can happen.

Identification

A third party who uses weak methods of identification could be used to gain another party’s identity and achieve illegal operations.

Information leaking

Information of a transaction between two parties is read by a third party.

UniOTP dynamic authentication system helps solve identification related risks. Below are the common patterns of identification security risks:

• Consumer’s account name and password are stolen.
• The attacker installs a trojan horse on a user’s computer to steal personal information such as bank account numbers.
• The attacker listens on the network, intercepts user information and gets the bank account number.
• For more convenience, a consumer chooses an easy password such as their

birth date, wedding anniversary, name, etc. making the password easy to guess for the attacker.

• The consumer stores password information in a certain place (file or notebook), that might lead to password leaking.
• The attacker uses brute force attack.
• The consumer uses the same password for different accounts, which creates

a vulnerability concerning password cracking.

DYNAMIC PASSWORD TECHNOLOGY

Dynamic password overview

Dynamic passwords, also called one time passwords, are considered to be one method capable to solve authentication existing security problems. It is widely used for many situations and users such as Banks, Bourse, e-commerce. A Dynamic password generation algorithm, user’s private key and dynamic elements constitute the 3 elements used to generate the dynamic password. When you authenticate yourself, besides from your account name and your password, you have to provide the dynamic password to be able to pass the authentication process.

Time based dynamic password generation creates a new unpredictable random password automatically every 60 seconds. This password can only be used once.

Event based dynamic password generates a new unpredictable random password every time you press its button. This password can only be used once.

Challenge response dynamic password uses a challenge code to generate a new unpredictable password. When the user requests authentication, the server will return a challenge code, this challenge code will be used to generate this time’s password.

Dynamic password characteristics

Dynamic

Depending on the dynamic factor changes, the password generated by dynamic password token will change. Every password generated is different from each other.

Valid only one time

Password generated by the dynamic password token can only be used one time, after that it will become invalid.

Random

Passwords are randomly generated, and cannot be predicted based on statistics.

Easy to use

Dynamic password is easy to use, no need for the user to remember the password, he only needs to read the password from the token at authentication time.

Loss report

As the user always keeps the token with him, he can notice the loss of the device immediately and report it as lost to the administrator who will disable the token, reducing risks caused by the loss.

Protection against Trojans/Network interception

As the password is only valid one time, it is a way to protect oneself from peeking, Trojans, network interception.

Protection against brute force attack

The fact that the password is dynamic, and so, that it always changes every time is a good protection against brute force attack. (The attacker has less than 60seconds to crack the password and use it before it becomes invalid or before the user himself uses it)

Economic

One token can be used for more than 3 years, and allow to lower the initial cost.

Computer-independent

The dynamic password Token has a LED display, you do not need to connect it to your computer through the USB port. In this case , it is very safe to use, as there is no connection with the computer as it doesn’t have the same security risks as USB based token products and certificate based products (In the case of USB products, there is some risks to get infected by Trojans performing unwanted online transactions).

Static password weak points

• In Order to make it easier to remember, users often use birth date, phone number, etc. as a password. Hackers can use automated programs to constantly attempt the passwords in order to crack the password.

• If a password is used many times, hackers can calculate the password easily, by identifying the encrypted authentication information transmitted through network by using a interception and reply technique, which will cause unintentional information leak.

• Because most of the current authentication information transmitted through a network is unencrypted, hackers can obtain important information about users through eavesdropping on the network data stream. They identify authentication information and intercept passwords from the network or telephone line.

• Hackers often intercept a user’s password by using spies, deception and

other methods.

Dynamic password usage procedure

• User requests connection to the web server
• Web server asks the user to authenticate
• User’s computer displays a login interface, asking user to input account name, password and dynamic password.
• User’s computer sends user authentication information to the web server
• Web server requests to the Authentication Server to authenticate user’s identity.
• Authentication server returns authentication information to the web server.
• Web Server decides if the user can log in or not based on authentication results.

UNIOTP DYNAMIC PASSWORD AUTHENTICATION

Overview

UniOTP dynamic password authentication system is a dynamic password product developed by SecuTech Solution Inc. UniOTP dynamic password authentication products can efficiently reduce losses caused by password leaking, and offer a powerful protection for user information and intellectual property. UniOTP dynamic password authentication system can be integrated with many kinds of systems, providing a dynamic password authentication service fitting any users’ needs.

The enterprise server uses Agent SDK to perform the integration with UniOTP dynamic password authentication system and unify user authentication service. UniOTP dynamic password system open architecture and module based tiered structure provides convenience for UniOTP dynamic password system and enterprise server integration. UniOTP dynamic password authentication system robustness, flexibility, high availability and easy maintenance provide the best dynamic password authentication experience to the user.

Solution Description

E-commerce’s web structure mainly uses a server/browser setup. UniOTP dynamic password system provides two integration methods:

First Solution:

Use Agent SDK (or Agent software) to perform integration of Web server and UniOTP dynamic password authentication systems, providing a unified authentication for the consumer. UniOTP’s dynamic password system open architecture, high stability and user-friendly interactivity provides the best dynamic password authentication and user experience possible.

Authentication process:

After having integrated the dynamic password authentication as above, the consumer login process is the following:

• The consumer uses their browser to display the login page
• The consumer fills in their username, password, dynamic password and sends the login request
• The web server authentication module receives the data submitted by the user and uses UniOTP Agent to send this data to the UniOTP authentication server.
• UniOTP authentication server processes user authentication information to complete the authentication, and returns authentication results to UniOTP Agent.
• UniOTP Agent returns the authentication results to the Web server

authentication module

• The web server decides if the user can login or not depending on the authentication results sent by UniOTP Agent.
• The consumer is able to log in, or receives a log in error message if the authentication failed.

Second solution:

User Server SDK to add dynamic password authentication function to the web server and perform integration of the Web Server System and UniOTP dynamic password authentication system. By using Server SDK integration to perform web application dynamic password authentication, you don’t need to rely on a UniOTP authentication server, but, compared to the two precedent methods, this method requires the user to have strong development skills.

Authentication process

Once you’ve integrated UniOTP dynamic password authentication according to the picture above, the authentication process is the following:

• The consumer opens the login page in their browser
• The consumer fills in their username, password, dynamic password and sends the login request
• The Web server receives authentication information submitted by the user and calls UniOTP Authentication Module to complete user authentication
• The Web server decides to allow or refuse consumer login depending on authentication results.
• Consumer is allowed to log in, or receives an error message if authentication failed.

UniOTP Dynamic password increases user authentication security

UniOTP dynamic password is only valid once and cannot be predicted by any statistical means, the attacker cannot deduce what will be the next password from the previous ones, and moreover already used passwords will immediately be disabled after being used once. By using dynamic passwords, you can avoid the potential safety problems which are caused by plagiarism, Trojans, network monitoring and password leaking by the consumers.

UniOTP dynamic password authentication solution analysis

• UniOTP dynamic password authentication helps financial institutions provide

customers with a securer authentication service, and satisfy customers who require higher account security.

• The features of easy integration and maintenance reduce cost effectively.
• Help financial institutions reputation improves with better account protection.
• Secure transaction environments will attract more customers.
• Reduce maintenance cost caused by password theft.
• Easy to use, does not need require any software or connection to a computer by using an interface.
• Reduce users cost effectively. Every UniOTP can be used for 3-5 years.
• Improve account security and reduce customer economic risk.

UniOTP Dynamic password authentication benefits analysis

• UniOTP Dynamic authentication system helps financial organizations to strengthen its authentication method in order to satisfy consumer security exigencies.
• UniOTP dynamic password authentication system can be integrated simply and maintained easily, thus it will reduce your costs effectively.
• UniOTP dynamic password authentication system will assist E-business

service provider to build a more secure platform for consumers and increase credit and reputation of the E-business operator.

• UniOTP Dynamic password authentication protects consumers’ information from being stolen, and increases your users’ feeling of security.
• One token can be used from 3 to 5 years, reducing initial cost for the consumer.