13-01-2012, 03:00 PM
Usability and interface
[attachment=16071]
The ATM user inserts his debit card in the card insert slot; the ATM immediately recognises
that this customer is a TellerPass user. Optionally, a 5 digit number is projected on
the ATM kiosk's screen (ATM check code) prompting the user to enter this number as a
launch code in his TellerPass application. Since most ATMs do not perform a video
capture of their user, this is an additional security feature, which helps to certify that a
legitimate user is present in-front of the ATM, and not somebody spoofing the transaction.
The theory
Having described the user interface, it would be quite interesting to discuss how this
miniature application works. TellerPass and the Bank's ATM login server use a shared
secret to provide security. TellerPass is downloaded wirelessly and is installed on the
user's cellphone just like any other sim-card applet. Immediately afterwards, TellerPass
generates a Public-Private key pair inside the SIM Card. TellerPass sends its public key
with an SMS message to the OTA server. The OTA server sends back an SMS message
containing a secret bank-assigned subscriber ID, encrypted with the TellerPass public
RSA key.
Time-clock granulation
In the TellerPass time-world, the real time clock of 24 hours is granulated in 2880 halfminute
slots, which are used in our time calculations to allow our distributed system to
work even if the clocks of the login server and the user's cellphone
Practicability and business aspects
TellerPass is a mass market mobile application. It strong-holds over an established
hardware base, the SIM card, and aims to provide to cellphone users a fuss-free security
gadget that will make their transactions with universal eBanking services bulletproof and
transparent.
[attachment=16071]
The ATM user inserts his debit card in the card insert slot; the ATM immediately recognises
that this customer is a TellerPass user. Optionally, a 5 digit number is projected on
the ATM kiosk's screen (ATM check code) prompting the user to enter this number as a
launch code in his TellerPass application. Since most ATMs do not perform a video
capture of their user, this is an additional security feature, which helps to certify that a
legitimate user is present in-front of the ATM, and not somebody spoofing the transaction.
The theory
Having described the user interface, it would be quite interesting to discuss how this
miniature application works. TellerPass and the Bank's ATM login server use a shared
secret to provide security. TellerPass is downloaded wirelessly and is installed on the
user's cellphone just like any other sim-card applet. Immediately afterwards, TellerPass
generates a Public-Private key pair inside the SIM Card. TellerPass sends its public key
with an SMS message to the OTA server. The OTA server sends back an SMS message
containing a secret bank-assigned subscriber ID, encrypted with the TellerPass public
RSA key.
Time-clock granulation
In the TellerPass time-world, the real time clock of 24 hours is granulated in 2880 halfminute
slots, which are used in our time calculations to allow our distributed system to
work even if the clocks of the login server and the user's cellphone
Practicability and business aspects
TellerPass is a mass market mobile application. It strong-holds over an established
hardware base, the SIM card, and aims to provide to cellphone users a fuss-free security
gadget that will make their transactions with universal eBanking services bulletproof and
transparent.