Publication Details

E-Banking Authentication - Dynamic Password Generators and Hardware Tokens

HUJŇÁK, O.; MALINKA, K.; HANÁČEK, P. E-Banking Authentication - Dynamic Password Generators and Hardware Tokens. Sborník příspevků z 54. konference EurOpen.CZ, 28.5.-1.6.2022. Radešín: Czech Open Systems User's Group, 2022. p. 211-221. ISBN: 978-80-86583-34-1.
Czech title
Autentizace v elektronickém bankovnictví - Dynamické generátory hesel a hardwarové tokeny
Type
conference paper
Language
English
Authors
Hujňák Ondřej, Ing., Ph.D. (RG-3-02)
Malinka Kamil, Mgr., Ph.D. (DITS)
Hanáček Petr, doc. Dr. Ing. (DITS)
URL
Keywords

Online banking, PSD2, Multi-factor authentication, Cybersecurity, Secure
hardware, FIDO2, WebAuthn, CTAP2

Abstract

In our recent work we presented an overview of current authentication methods,
their properties with respect to international standards, and their resistance
against attacks from defined attacks taxonomy (compatible with NIST Digital
Identity Guidelines). With the Payment Services Directive (PSD2) for European
Union coming into force, we believe it is necessary to revise compliance of
currently available schemes.

The concepts enforced by PSD2 to the area of client authentication are two factor
authentication (with requested factor independence), strong customer
authentication (SCA), the dynamic linking of the authentication code to the
transactions beneficiary and amount, and cloning protection. The most common
means of achieving the compliance is the usage of Dynamic Password Generators
(DPG) or dedicated Hardware Tokens. DPG is usually a mobile application
generating one-time passwords (OTP) and often implementing a challenge-response
protocol. We discuss the features of possible DPG implementations both when
included in the e-banking application or as a stand-alone, and look into usage of
special cryptographic chips in mobile phones - secure enclaves.

Hardware Tokens are less frequent in e-banking nowadays, but start to get more
traction especially in web services which require two factor authentication.
FIDO2 protocol consisting of W3C (World Wide Web Consortium) open web standard
WebAuthn and CTAP2 is becoming the de facto standard for using secure hardware
and biometrics for authentication in a web environment as it is implemented in
all major browsers. We present the key features of FIDO2 protocol and how it can
be utilized in e-banking or other web services and illustrate examples of some
banking institutions using the FIDO standards for e-banking authentication.

Published
2022
Pages
211–221
Proceedings
Sborník příspevků z 54. konference EurOpen.CZ, 28.5.-1.6.2022
Conference
54. konference EurOpen.CZ, Radešín, CZ
ISBN
978-80-86583-34-1
Publisher
Czech Open Systems User's Group
Place
Radešín
BibTeX 
@inproceedings{BUT179366,
  author="Ondřej {Hujňák} and Kamil {Malinka} and Petr {Hanáček}",
  title="E-Banking Authentication - Dynamic Password Generators and Hardware Tokens",
  booktitle="Sborník příspevků z 54. konference EurOpen.CZ, 28.5.-1.6.2022",
  year="2022",
  pages="211--221",
  publisher="Czech Open Systems User's Group",
  address="Radešín",
  isbn="978-80-86583-34-1",
  url="https://europen.cz/Anot/54-1/sbornik-54.pdf"
}
Back to top