UniOTP Business Solution

ABOUT THIS GUIDE

This document is intended for use by management.

UniOTP dynamic password authentication system is a dynamic password authentication product designed by SecuTech Solution Inc. The company is committed to providing superior software protection and authentication experience for the user's personal data and intellectual property.

E-commerce requires that each party cooperates closely in order to provide to the consumer a safer environment and a more comfortable and appropriate consuming platform. It will become one of the most important business models in the future. But, while having brought convenience to people’s life, e-commerce also brings several hidden security risks. Attacks are becoming more sophisticated and diverse, and cases where a consumers’ profit has been infringed are rapidly increasing. Security is one of the most important obstacles to e-commerce development.

Financial industry refers to those enterprises operating specialized financial products, including banking, insurance, trust, securities industry, leasing industry, mortgage industry etc. With the application of network technology in the financial industry, people can enjoy convenience brought by the computer network, such as online banking and online security trading. But with this convenience, user information security is facing more serious challenges. Various network attack technologies result in economic losses to customers. As the fist user information security shield, if authentication is not strong enough, it will cause severe security problem and economic loss.

Authentication is the first step in assuring safety. This safety is directly related to the consumers’ personal benefits. Dynamic authentication is a technology that provides a strong authentication method to users and is considered to be a method that can solve today’s authentication related problems. The combination of dynamic password with e-commerce greatly raises the security level of electronic transactions, and better protects consumers’ benefits.

Enterprise application refers to all kinds of information management systems which is applied by different enterprises, such as E-commerce, Enterprise resource planning (ERP), custom relationship management (CRM), etc. It will greatly improve enterprise management and manufacture efficiency by using enterprise applications to process cumbersome information.

Some of the information maintained by enterprise applications contains confidential information which may involve the core enterprises interests, so security of this information is very important. Enterprise information security can be achieved by building a defence system, including anti-virus, firewall network monitors and etc.

CURRENT SITUATION OF FINANCIAL TRANSACTION

Transaction mode

OCT (Order confirmation transaction)

When a customer goes to the counter an talks a teller to do their business directly, customers have to present their ID and bank card to tellers and provide password to complete authentication and do business.

Dedicated terminal

Customers use a dedicated terminal provided by a financial institutions (ATM and POS) to process their transactions. Customers need to present credential card (bank card), customer ID and customer password to start independent transactions.

Online transaction

Customers logon to financial institution websites to process business. In online transactions, customers normally provide an account name and password to complete the authentication process. After successfully logging on, customers can process their business on line.

Telephone transaction

Customers can process their business through calling the financial institutions hotline. Customers need to provide user credentials and password to complete authentication.

Transaction security

A variety of transaction modes bring different trading experience to customers along with different security risk.

OCT security

When customers provide their account number and passwords, there is a risk that criminals may peek at their passwords. After stealing the passwords, a criminal can log into customer accounts and perform illegal operations.

Dedicated terminal security

When a user inputs their account number and password, there is a risk that criminals may record their password. Because dedicated terminals are for public use without any special protection, it is easy for criminals to steal a users’ identification information.

Online transaction security

There is risk that online transaction user accounts and passwords are stolen by criminals, through listening, installing Trojans on a target computer, network hijack etc.

Telephone transaction security

There is risk that user accounts and passwords are stolen by recording and eavesdropping.

Common account security risks

Plagiarism leak

Attackers steal customer account information by eye, and fake user customer ID to operate customer accounts illegally. This kind of risk usually occurs when customers do their business in public.

Install Trojans

Attackers install Trojans on a target computer, and steal user accounts and passwords remotely. This security risk usually exists when users perform their business online by PC.

Network sniffing

Attackers extract a user’s confidential information through eavesdropping on the data transmission network.

Replay attack

Attackers simulate a user logon, through sending authentication request data packages which was intercepted and recorded via network, to achieve the purpose of operating a user account.

User password guess

If a users password is too simple and uses some special number, such as date of birth, anniversary and name, attackers can obtain users password by using these details easily.

Records leak

If a password is too complicated and users record it on paper, there will be a risk of password leak.

Brute force

Attacker obtain passwords by an enumerating method

Password sharing

To remember various passwords for many different accounts, users usually use the same password. If one password is stolen, criminals can try it on other accounts.

SECURITY ANALYSIS

A general overview of the hidden security risks with e-commerce:

Falsification

Business related information is falsified as it is been transferred over a network.

Information destruction

Due to network devices or software malfunctioning, some data loss can happen.

Identification

A third party who uses weak methods of identification could be used to gain another party’s identity and achieve illegal operations.

Information leaking

Information of a transaction between two parties is read by a third party.

UniOTP dynamic authentication system helps solve identification related risks. Below are the common patterns of identification security risks:

• Consumer’s account name and password are stolen.
• The attacker installs a trojan horse on a user’s computer to steal personal information such as bank account numbers.
• The attacker listens on the network, intercepts user information and gets the bank account number.
• For more convenience, a consumer chooses an easy password such as their

birth date, wedding anniversary, name, etc. making the password easy to guess for the attacker.

• The consumer stores password information in a certain place (file or notebook), that might lead to password leaking.
• The attacker uses brute force attack.
• The consumer uses the same password for different accounts, which creates

a vulnerability concerning password cracking.

DYNAMIC PASSWORD TECHNOLOGY

Dynamic password overview

Dynamic passwords, also called one time passwords, are considered to be one method capable to solve authentication existing security problems. It is widely used for many situations and users such as Banks, Bourse, e-commerce. A Dynamic password generation algorithm, user’s private key and dynamic elements constitute the 3 elements used to generate the dynamic password. When you authenticate yourself, besides from your account name and your password, you have to provide the dynamic password to be able to pass the authentication process.

Time based dynamic password generation creates a new unpredictable random password automatically every 60 seconds. This password can only be used once.

Event based dynamic password generates a new unpredictable random password every time you press its button. This password can only be used once.

Challenge response dynamic password uses a challenge code to generate a new unpredictable password. When the user requests authentication, the server will return a challenge code, this challenge code will be used to generate this time’s password.

Dynamic password characteristics

Dynamic

Depending on the dynamic factor changes, the password generated by dynamic password token will change. Every password generated is different from each other.

Valid only one time

Password generated by the dynamic password token can only be used one time, after that it will become invalid.

Random

Passwords are randomly generated, and cannot be predicted based on statistics.

Easy to use

Dynamic password is easy to use, no need for the user to remember the password, he only needs to read the password from the token at authentication time.

Loss report

As the user always keeps the token with him, he can notice the loss of the device immediately and report it as lost to the administrator who will disable the token, reducing risks caused by the loss.

Protection against Trojans/Network interception

As the password is only valid one time, it is a way to protect oneself from peeking, Trojans, network interception.

Protection against brute force attack

The fact that the password is dynamic, and so, that it always changes every time is a good protection against brute force attack. (The attacker has less than 60seconds to crack the password and use it before it becomes invalid or before the user himself uses it)

Economic

One token can be used for more than 3 years, and allow to lower the initial cost.

Computer-independent

The dynamic password Token has a LED display, you do not need to connect it to your computer through the USB port. In this case , it is very safe to use, as there is no connection with the computer as it doesn’t have the same security risks as USB based token products and certificate based products (In the case of USB products, there is some risks to get infected by Trojans performing unwanted online transactions).