Usably secure, low-cost authentication for mobile banking
Usably secure, low-cost authentication for mobile banking
复制标题
适用于移动银行的安全且低成本的身份验证
DOI：
--
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
Edward Cutrell
中科院分区：
文献类型：
--
作者：
S. Panjwani;Edward Cutrell
本文探讨了在发展中国家通过移动电话网络实施的银行系统的用户身份验证方案。我们分析了印度一家移动银行服务提供商目前部署的一种身份验证方案，该方案结合使用PIN和打印的码本来对用户进行身份验证。作为第一步，我们报告了该方案中的安全漏洞，并表明它容易受到简单而有效的PIN恢复攻击。然后，我们提出了一个新的方案，它在保持原方案的简单性和可扩展性的同时，提供了更好的PIN的保密性。最后，我们以银行系统的34个现有和潜在客户为样本，研究了这两种方案的可用性。我们的研究结果表明，新方案更有效率，更不容易受到人为错误的影响，更受目标消费者的青睐。
This paper explores user authentication schemes for banking systems implemented over mobile phone networks in the developing world. We analyze an authentication scheme currently deployed by an Indian mobile banking service provider which uses a combination of PINs and printed codebooks for authenticating users. As a first step, we report security weaknesses in that scheme and show that it is susceptible to easy and efficient PIN recovery attacks. We then propose a new scheme which offers better secrecy of PINs, while still maintaining the simplicity and scalability advantages of the original scheme. Finally, we investigate the usability of the two schemes with a sample of 34 current and potential customers of the banking system. Our findings suggest that the new scheme is more efficient, less susceptible to human error and better preferred by the target consumers.