WO2008128528A2

WO2008128528A2 - Anti-tapping and manipulation encoding for online accounts

Info

Publication number: WO2008128528A2
Application number: PCT/DE2008/000688
Authority: WO
Inventors: Bernd Borchert; Klaus Reinhardt
Original assignee: Bernd Borchert; Klaus Reinhardt
Priority date: 2007-04-20
Filing date: 2008-04-19
Publication date: 2008-10-30
Also published as: DE102007018802B3; WO2008128528A3

Abstract

The invention relates to a method for anti-tapping and manipulation encoding for online accounts, in particular for online banking, by means of visual cryptography. A first partial secret image is generated on a film by the server according to the method of visual cryptography. A second partial secret image is generated by the server with keypads with random characters and displayed on the screen of the client, the keypad being clickable with the mouse. In the next step, the film and the screen are superimposed by the client such that both partial secret images give the image with the clickable keypad with written characters. The client can now enter a sequence of n characters by n mouse clicks on the keypads with characters. The information about which keys the client has clicked in which sequence is then transmitted to the server and the inputted sequence of characters reconstructed in the server.

Description

Borcherti

applicant:

Bernd Borchert Ludwig-Schriever-Str. 16 D-48480 Lünne

Tapping and tamper-proof encryption for online accounts

description

The present invention relates to a method for tapping and tamper-proof encryption for online accounts, in particular for online bank accounts, using visual cryptography.

The tampering and tampering security of online accounts - especially those of online bank accounts - is jeopardized by the ever-increasing quantity and harmfulness of malware (i.e., viruses, etc.) on the PC's of bank customers. Methods that reliably prevent both the listening to the PIN and a so-called man-in-the-middle attack are technically complex and require special hardware and software on the PC used by the bank customer.

The privacy of the PIN is obvious in the PIN / TAN procedure: the malware on the client's computer secretly observes the keystroke when entering the PIN. Later, the eavesdropped PIN secretly passed through computer network to another computer. From there, at least reading the account can be accessed. Procedures in which the PIN is entered with mouse-clicks on the screen are also not tap-proof: the malware simultaneously monitors screen and mouse movement. Borcherti 2

Procedures such as HBCI-2 for bank accounts (with external number field for entering the PIN) or the clock-controlled security tokens for corporate accounts protect the PIN from eavesdropping, but are complex in terms of production and use.

The so-called man-in-the-middle attack on an online account looks like this: Bank customer X wants to transfer 50 euros to Y's account. He fills out the corresponding online form and sends it off. The malware on the machine intercepts this transfer order before it is sent to the bank, converts it into a bank transfer of € 5,000 to Z, and sends this manipulated transfer order to the bank. The demand from the bank to X for a TAN for the transfer order of 5,000 euros to Z is also intercepted by the malware in the opposite direction, and it becomes the bank customer X on the screen, the demand of the bank for a TAN for a transfer order of 50 euros Y pretended. Unknowingly, X confirms this pretested order with a TAN, and the malware sends the TAN entered by X to the bank to confirm the fraudulent transfer order of $ 5,000 to Z.

The PIN / TAN, PIN / iTAN, HBCI-1, HBCI-2, and Security Token methods do not protect against man-in-the-middle attacks. Also, the encryption of the connection (eg SSL) does not protect safely, because the malware can turn on even before the start of the connection encryption and perform the manipulation even before the connection encryption (or in the other direction: after the connection decryption) ,

Procedures that protect against man-in-the-middle attacks are those that include both a numeric keypad and a display outside the client

Attach a computer, such as HBCI-3. However, due to the physically existing cable connection between this extra hardware and the Borcherti 3

Calculator of the client still a residual risk that malware on the computer of the client spied on the actions on the extra hardware. Another possibility is to have the transfer data confirmed by the bank via SMS ("mTANs"). The disadvantage of this solution is that a mobile phone must be present and that the reception of the SMS may take a while, and it is only It's a matter of time before mobile phones are hit by malware, which makes it insecure.

Some of the known encryption methods are based on the method of visual cryptography. Visual cryptography is a method of dividing a black and white image into two black-and-white images (partial secrecy images) so that both partial secrecy images individually have no information, but when one of the two partial secrecy images is printed on transparent foil and on top of that, the original image is rediscovered (with 50% loss of contrast: white turns gray) (Naor & Shamir "Visual Cryptography", Advances in Cryptology, EUROCRYPT, Springer Verlag, 1994, pp. 12, see Fig. 1). In this case, one of the two partial secret images can already be generated in advance, i. without the original image being known. The second partial secret image is then generated depending on the original image and the first partial secret image (that this second image is a noise image, ie contains no information, so in particular does not contain the information of the original image is surprising, but mathematically easy detectable).

Patents EP1472584B1 and US2005 / 0219149A1 describe an application of visual cryptography in which a transparent electronic display is mounted on the screen. A major disadvantage of this method is that the development and manufacturing costs for this technique are very high.

The patent EP1487141A1 describes the possibility to create one of the two partial secret images of visual cryptography in advance and distribute it to the recipient, even if the image to be encrypted still Borcherti 4

is not known (this possibility is given in each one-time pad method, so in particular also in visual cryptography). The method indicates applications of this principle to the secure transmission of messages, but not in the context of online accounts.

The patent US2006 / 0098841A1 describes a method by which n characters of an alphabet with m characters can be transmitted tap-proof with n mouse clicks. The method requires n times many buttons. This results in practice in a number of buttons that can no longer be displayed (example: text length n = 20, alphabet size m = 50 gives 1000 buttons).

The patent US20060020559A1 describes an encryption method for online accounts. In this method, punched paper cards are placed on the screen to show the user secret information (this principle is also known as "Richelieu board"). The method has, among other things, the drawback that the security against eavesdropping is obscured because of large parts of the card Another disadvantage of this method is that when used against the man-in-the-middle attack, the die-cut paper card would become very large.

The paper (Naor & Pinka's "Visual Authentication and Identification", CRYPTO, Springer Verlag, 1997, pp. 322-336) proposes and analyzes the use of visual cryptography for the security of smart cards.

However, there is no known method with which at low

Production costs the online accounts absolutely safe against malware interventions can be protected.

The object of the present invention is therefore to provide a secure encryption method for online accounts, in which the development and manufacturing costs are much lower compared to known methods. Borcherti 5

To solve this problem, the method of visual cryptography is used, according to the invention, the new principle "slide-on-screen" is used: one partial secret image is printed on a transparent film, the other is displayed on the screen the user can see the original information on the screen, and it is crucial that no malware on the user's computer or in the computer network can recognize the original information: there is no way for malware to "see" the slide on the screen. to scan". Fig. 4 shows the situation: the partial secrecy image on the screen and the partial secrecy image on the slide of the user superimposed indicate a number field with randomly exchanged numbers. For malware on the computer or in the computer network, there is no way to recognize the interchange of 10 digits.

The term "film" is understood here and below as meaning a thin layer of a suitable material which may be printed or punched in. In particular, a substantially transparent material such as plastic or transparent paper can be used for this purpose, which can be used with one of the partial secret images Alternatively, an opaque material is used, which is punched out according to the invention for producing a partial secret image, in which case dark, eg black, paper is particularly advantageous, so that the optical contrast is greatest.

So that printed on the slide part secret image with the on the

Screen overlaid part of the picture can be placed on top of each other, the film is fixed on the screen. For this purpose, individual films can be provided on one or more edges with adhesive tape. In this case, the foils can be stacked on top of each other in a notepad and held together by the adhesive strips analogously to sticky notes. Borcherti 6

An example of the method according to the invention for the tap-proof handling of an online account is described below. In this example, a text with n characters from an alphabet consisting of m characters with n mouse clicks is absolutely tap-proof transmitted by a client through a computer network to a server. Here and in the following, under alphabet, as usual in computer science, a finite set of characters is understood. In this sense, for example, the set of digits 0, ..., 9 is an alphabet of 10 characters.

First, the server creates for each client a set of sub-secret images, which he names and stores (e.g., numbers). He then prints these images on clear transparencies, additionally prints their respective name (number) visibly on them, and physically sends these transparencies, e.g. by mail, to the client. Initially, all of these partial secret images have the status "unused", which can later change to "used up". This status is managed by the server.

Client X now has these slides and wants to send the server a secret message of n characters (example: he wants to send him an 8-digit bank code). To do this, he contacts the server online via the computer network on his computer and presents himself to the server as Client X.

The server takes note of this and then creates an original image for transferring n characters from an alphabet with m characters in the following manner. At least n + m-1 buttons are created on the image. The buttons serve as surfaces for later clicking through the mouse and do not overlap. The buttons carry labels. Each character of the alphabet appears as a caption on at least one of the buttons. In addition, there are n-1 buttons, each for a reference to a character that has already occurred. Ideally, these references are numbered with the positions 1 to n-1 (if the numbers themselves are part of the alphabet, these numbers are specially marked, Borcherti 7

e.g. preceded by P for "position") Fig. 2A shows an image with

Buttons for the numbers 0 9 and text length n = 8, Fig. 2B shows an image for an alphabet with the letters A ..., Z, the numbers 0, .., 9 plus a few special characters, and text length n = 10. The assignment of labels and buttons is generated randomly. The server remembers this random assignment.

A special case occurs when the text to be transmitted is guaranteed to have no character repetition (a plausible example: only PINs consisting of the digits 0, ..., 9 are permitted, in which no digits occur multiple times). In this case, the buttons with the references to the previous position can be omitted, and one button is enough for each character of the alphabet. Figure 2C shows an image with a randomly generated array of buttons for the digits 0, ..., 9.

After the server has generated such an original image, it takes a not yet used stored partial secret image for the client X, makes these two images according to the method of visual cryptography a second (electronic) partial secret image, which he then through the computer network online on the client's screen. Also, the name (number) of the stored partial secret image is sent to the client's screen. The stored partial secret image gets the status of the server "used up".

Client X sees the partial secret image and its name (number) on the screen, see Fig. 3A. He puts the slide with the same name (number) on the screen, exactly on the partial secret picture on the screen. Because the two partial secret images were generated by the method of visual cryptography, client X can see the original image. Borcherti 8

In practice, the two pictures are not the same size. The image on the screen must therefore be adapted by the client (e.g., stretched), preferably by mouse.

The client sees the original image with its buttons and their labels, see Fig. 3B. He can now enter his secret text via mouse clicks, according to the following rules.

A text with n or less characters is entered character by character as follows. For each character that has not previously existed, the button on which the character is located is clicked. If a character has already occurred, the largest position in the text where the character already stood is determined: the button whose label represents a reference to this position is clicked. For example, in Fig. 3, bank sort code 20041111 is entered by clicking the following buttons: 2, 0, P2, 4, 1, P5, P6, P7.

Following these simple rules, it is guaranteed that each button will only be clicked once. The software on the client computer can therefore potentially assist the user and specifically display all buttons once clicked, e.g. In the partial secrecy picture on the screen, invert all pixels of the button clicked. So the user sees which buttons he should not click, the privacy is not affected.

Another possible support for the user - as he knows it from the bank machine - provide a correction key and a progress bar, which indicates with "asterisks" how many characters have already been entered.

The information about the clicked buttons and their order is sent to the server, for example by the pixel positions of the n mouse clicks being transmitted relatively in the sub-secret image, or another unique one Borcherti 9

Description of clicked buttons is transmitted. For example, the buttons labeled in Figure 3B with the labels 2, 0, P2, 4, 1, P5, P6, P7 could be coordinates of the displayed 4x5 matrix (with (0,0) at the top left and (3,4) at the bottom right ), thus: (3,2), (3,1), (0,0), (3,4), (1, 0), (0,1), (3,0), ( 1, 1).

Because each button is clicked at most once and the label of the buttons was chosen randomly, malware on the computer of the client or in the computer network can not provide any information about the transmitted text: the malware would have to spy on the launched slide, which is not possible.

The information sent to the server can then be decrypted there: the server knows the original image and knows which labels the buttons have clicked on. So he can be transmitted from the n

Descriptions of buttons to reconstruct the message of n characters entered by the client. In the example from above in which the matrix coordinates (3,2), (3,1), (0,0), (3,4), (1, 0), (0,1), (3 Because of the knowledge of the original image, the server can directly extract the message 20041111 from it. The message was therefore transferred tap-proof from the client to the server.

Conversely, a secret text from the server to the client to be sent: The server writes the text on a black and white picture, takes an unused slide, and generates from both a corresponding second, electronic partial secret image, which he uses the computer network Sends clients to the video, including name of the slide. The client places the corresponding slide on the screen and can read the text. In the event that the client can even recognize a text, he knows for sure that the text is from the server, because no one else knows his slide, and therefore no one can fake a message to him. Borcherti 10

According to the invention, the screen of the client can either be a screen of a computer or a screen of a mobile terminal, in particular a display of a mobile phone (FIG. 7).

The advantage of the method described is thus that an online account can be securely protected from eavesdropping on the PIN and secure against the man-in-the-middle attack. The reason is that malware (on the computer of the bank customer or in the computer network) does not know the slide to be placed and definitely can not spy (a "scanning" the slide via screen is absurd!).

In comparison to the method described in US2006 / 0098841A1, the method according to the invention requires only n + m-1 buttons. For the o.g. Example (text length n = 20, alphabet size m = 50 results in 1000 buttons) means: 69 buttons in the present method instead of 1000, which are required in US2006 / 0098841A1.

Another advantage consists in relatively low production costs, since this only the corresponding films have to be produced and printed, no expensive devices are necessary.

Further advantages, features and applications of the invention will be described below with reference to the embodiments with reference to the

Drawings described. In the drawings show:

Fig.1: Principle of visual cryptography (Naor & Shamir): two slides alone do not contain any information, but on top of each other they give away information.

(Note: Figure 1 is useful for demonstrating visual cryptography: Copy Figure 1 onto the slide, and then place the picture on top of the one in the

Place middle: you can see the bottom picture.) Borcherti 11

Fig. 2: three original pictures with buttons to click for the mouse.

Fig. 3: Interception-proof exchange of information with repetition of symbols, example: Entering a bank code with 8 digits.

Fig. 4: Interception-proof exchange of information in which no repetitions of symbols occur, example: PIN entry (assumption: only PINs without numerical repetition are assigned)

Fig. 5: Counterfeit-proof confirmation of a transfer including a TAN (which can then be entered in plain text on the keyboard). It is important for anti-counterfeiting security that the information is not in a fixed location, e.g. In Figure B, the numbers displayed are horizontally randomly offset.

Fig. 6: Tamper-proof online confirmation of debits via visual cryptography.

Fig. 7: Tamper-proof online confirmation of debits via visual cryptography on a mobile device.

Fig. 8: Secure transmission of general text, including repetition of characters.

Working Example

The above procedure for sending secret messages between server and client is applied to the specific case of online banking (Figures 4 and 5). The method prevents PIN interception and man-in-the-middle attack. Borcherti 12

The bank server generates a lot of sub-secret images for the bank customer X, numbers them, stores them, and sends them printed out on slides to the bank customer by mail (in much the same way as TAN lists are sent). In addition, the customer will receive a PIN as with the PIN / TAN procedure, assuming that no digit appears twice in the PIN (the number of options is still enough to make it futile to guess the PIN).

If the customer X has received the slides and his PIN, he can start online banking. To log in, he goes to the web page of the bank and there gives his account number. at. The account no. will be sent to the bank server. The bank server now checks the authenticity of X as follows:

The bank server generates an original picture with 10 buttons, e.g. in such a way that the arrangement of the buttons corresponds to the arrangement of the buttons of the number field on a keyboard, see Fig. 2C. Randomly, the 10 digits 0, ..., 9 are distributed to these buttons. The server remembers this random permutation. An unconsumed stored slide is taken for the bank customer X and, according to the method of visual cryptography, a second partial electronic secret image is generated from it and the original image. This is sent to the bank customer X in his browser window, including the number of the stored partial secret image. The situation arises as in Fig. 4A.

The bank customer sees the partial secret picture and its number and places its appropriate foil on it. He can then recognize the number field, see Fig. 4B. He clicks the corresponding buttons with the mouse. Assuming that his PIN is 41629, he then clicks on the buttons in Fig. 4B one after the other, representing the digits 0, 5, 2, 9, 6 on the normal number pad. This digit sequence 05296 is sent to the bank server. Borcherti 13

The bank server receives the digit sequence 05296. Because the bank server itself has created the original image with the exchanged numbers and remembered the exchange, he can now conclude directly from the fact that by the mouse clicks the number sequence 41629 was entered , He compares this number sequence with the PIN for bank customer X (which of course is also stored). If that was the correct PIN, bank customer X will get access to the account.

Listening malware (on the computer used by bank customer X, or on the Internet) has no chance to intercept the PIN: the positions of the mouse clicks and the numbers sent to the server have no meaning unless the interchanging of the numbers on the number field is known , However, this only knows the bank server and the one who can hang up the corresponding slide on the browser.

Bank customer X thus gets access to his bank account with the knowledge of the PIN and the physical ownership of the slide. Only one of them is not enough. The method thus protects the PIN twice: firstly, it can not be heard, and if somebody else comes into their possession in another way, it needs the right foil: without it, it will not get into the account.

The following shows how the method thwarts a man-in-the-middle attack. The bank customer X has successfully logged in and would like to make a transfer of 50 euros to Y. He types in plain text in an appropriate form name, account number, bank code and amount and sends this information to the bank server.

The bank server writes this information to a black and white image. In order to guarantee the security against forgery, he does not write every single piece of information to a fixed point in the picture, but only to a certain defined area of the picture. In addition, he writes a randomly generated number sequence ("TAN") in a certain specified area of the image. He remembers this TAN. Then he takes an unused foil and Borcherti 14

generates from this and the generated image according to the method of visual cryptography, the second partial secret image, which he sends including its number to the browser window in which the bank customer X sits. The situation shown in Fig. 5A arises.

Bank customer X places the corresponding slide on the partial secrecy screen and sees the transfer data confirmed again, see Fig. 5B. If the data is correct, he types in the displayed TAN in clear text in a designated input field and sends it to the bank server.

The bank server compares the transmitted number with the previously assigned TAN. If both agree, he releases the transfer.

The process protects against the man-in-the-middle attack: While it is easy for malware to intercept the transfer data, but malware has no chance to falsify the confirmation of the transfer data displayed to the bank customer: This would be the knowledge of the pixels on the required by the bank customer slide needed. For the same reason, malware has no chance to recognize the TAN displayed to the bank customer.

Thus, if the bank server receives the correct TAN, the information about the actual transfer has reached the bank customer X, and no pre-mirrored information. A man-in-the-middle attack is thus repulsed with this method.

In a similar way, as the bank customer can confirm a transfer forgery-proof by means of visual cryptography, the bank customer can also confirm debits from his account forgery-proof, eg when debiting his own account when shopping online: if the bank server the debit order from the seller the bank server sends (eg via email, or via link from the web page on which the purchase was made) a confirmation message to the account holder, see Fig. 6. Only if this Borcherti 15

there the debit confirmed with his PIN, the debit is carried out. For the same reasons as the transfer confirmation, the procedure is forgery-proof.

The illustrated method for online bank accounts is also safe against the so-called Pharming: no attacker can pretend by web page successfully to be the bank, because the partial secrecy image, which is shown to the user when entering the PIN, can not can be faked: without knowledge of the pixels on the foil to be placed, no partial secret image can be created on which anything can be recognized together with the foil, because a fake partial secrecy image on the screen and the foil of the user result in a superimposed noise ( ie a picture without information).

The procedure described makes the so-called phishing for cheaters uninteresting: emails or web pages that fraudulently ask the bank customers for the PIN, in the event that the bank customer naively reveals the PIN, do not do anything with this PIN: to get into the account , they still lack a slide.

Claims

Borcherti 16

claims

1) A method for secure transmission of a string of characters from a client through a computer network to a server, characterized by the following steps:

a) generating a first partial secret image according to the method of visual cryptography on a slide by the server,

b) by the server, generating an image with buttons randomly labeled with characters;

c) generating a second partial secret image according to the method of visual cryptography for the image generated in b) by the server, which is displayed on the screen of the client, wherein the buttons of the image generated in b) corresponding areas of the second partial secret Image as buttons are clickable through a mouse,

d) the overlaying of the slide and the screen by the client, whereby the image with the clickable and labeled buttons becomes visible to the client,

e) the input of a series of n characters by the client via n

Mouse clicks on the labeled buttons,

f) transmitting the information about which buttons the client has clicked in which order to the server,

g) the reconstruction by the server of the string of characters entered by the client. Borcherti 17

2) A method for the tamper-proof transmission of a string of characters from a server through a computer network to a client characterized by the following steps:

b) generating an image associated with the image to be transmitted

Character string is labeled by the server,

c) generating a second partial secret image according to the method of visual cryptography for the image generated in b) by the server, which is displayed on the screen of the client,

d) the overlay of the slide and the screen by the client, whereby the image with the character string becomes visible to the client.

3) Method according to one of the preceding claims, characterized in that the screen of the client is the screen of a computer or a mobile terminal.

4) Method according to one of the preceding claims, characterized in that the film consists of plastic or paper.

5) Method according to one of the preceding claims, characterized in that the film is printed to produce the partial secret image with color. Borcherti 18

6) Method according to one of the preceding claims, characterized in that the film for producing the partial secret image is printed with black or colored paint.

7) Method according to one of the preceding claims, characterized in that the film is punched out to produce the partial secret image.

8) Method according to one of the preceding claims, characterized in that the film is provided for fixing on the screen with at least one adhesive strip.

9) Method according to one of the preceding claims, characterized in that the characters in the image with buttons numbers, letters and / or special characters.

10) Method according to one of the preceding claims, characterized in that the image with the clickable and labeled with characters buttons represents a number field, wherein the number between 0 and 9 are each assigned to the individual buttons.

11) Method according to one of the preceding claims, characterized in that the labels on the buttons on the image include a reference to the position of the button to be clicked.

12) Method according to one of the preceding claims, characterized in that the number of buttons is n + m-1, where m is the number of all available characters for the input. Borcherti 19

13) Method according to one of the preceding claims, characterized in that the series of characters a password, a PIN, a TAN o.a. is.

14) Computer program product for performing the method according to one of claims 1 to 12, when the computer program is executed on a processor.

15) film for performing the method according to one of claims 1 to 12, characterized in that it is a partial secret image according to the

Method of visual cryptography includes and is provided for fixing on the screen with at least one adhesive strip.

16) A film according to claim 14, characterized in that it consists of a transparent material.

17) A film according to any one of claims 14 to 15, characterized in that it is printed with color.

18) A film according to any one of claims 14 to 16, characterized in that it is printed with black or colored paint.

19) A film according to any one of claims 14 to 17, characterized in that it is punched out.

20) Use of the method, the computer program product or the film according to one of the preceding claims in online accounts.