Search

The article presents an innovative approach for secure authentication in internet banking transactions, utilizing an Out-of-Band visual two-factor authorization protocol. With the increasing rise of cyber attacks and fraud, new security models are needed that ensure the integrity, authenticity, and confidentiality of financial transactions. The identified gap lies in the inability of traditional authentication methods, such as TANs and tokens, to provide security in untrusted terminals. The proposed solution is the Dynamic Authorization Protocol (DAP), which uses mobile devices to validate transactions through visual codes, such as QR codes. Each transaction is assigned a unique associated code, and the challenge must be responded to within 120 s. The customer initiates the transaction on a computer and independently validates it on their mobile device using an out-of-band channel to prevent attacks such as phishing and man-in-the-middle. The methodology involves implementing a prototype in Java ME for Android devices and a Java application server, creating a practical, low-computational-cost system, accessible for use across different operating systems and devices. The protocol was tested in real-world scenarios, focusing on ensuring transaction integrity and authenticity. The results show a successful implementation at Banco do Brasil, with 3.6 million active users, demonstrating the efficiency of the model over 12 years of use without significant vulnerabilities. The DAP protocol provides a robust and effective solution for securing banking transactions and can be extended to other authentication environments, such as payment terminals and point of sale devices.

Cloud storage has gained increasing attention from the industry and research communities with concerns about data stored in cloud computing environments, despite its many advantages. The reasons come from economic viability to the latency along with behavioral changes that may affect the applications that use data stored remotely. Among those challenges, there is the problem of ensuring the integrity and retrievability of users' data in the cloud. Several schemas have been proposed: proof of data possession (PDP), proof of retrievability (PoR), and proof of ownership (PoW) that differ on the approach to guarantee the effective retrieval of data stored remotely. In this paper, a novel PoR protocol is proposed: hyper-scalability, availability, and integrity layer (Hy-SAIL), where a new PoR scheme adds higher availability to data stored and a flexible manner to perform integrity checks. It is demonstrated that Hy-SAIL leads to an efficient and scalable cryptographic system that meets near-optimal bounds in terms of communication and storage complexities. It is also proposed a new adversarial model that aggregates the main functionalities of a realistic adversary in cloud computing environments. Hy-SAIL operates on data that are not affected by any kind of incremental change or update, which is the characteristic of various file types stored in clouds, such as stored video and audio streams. When compared to other systems, such as HAIL, Hy-SAIL is more scalable and efficient. The results collected with an unoptimized implementation of Hy-SAIL point to a better perspective than other approaches.

As smart devices have become commonly used to access internet banking applications, these devices constitute appealing targets for fraudsters. Impersonation attacks are an essential concern for internet banking providers. Therefore, user authentication countermeasures based on biometrics, whether physiological or behavioral, have been developed, including those based on touch dynamics biometrics. These measures take into account the unique behavior of a person when interacting with touchscreen devices, thus hindering identitification fraud because it is hard to impersonate natural user behaviors. Behavioral biometric measures also balance security and usability because they are important for human interfaces, thus requiring a measurement process that may be transparent to the user. This paper proposes an improvement to Biotouch, a supervised Machine Learning-based framework for continuous user authentication. The contributions of the proposal comprise the utilization of multiple scopes to create more resilient reasoning models and their respective datasets for the improved Biotouch framework. Another contribution highlighted is the testing of these models to evaluate the imposter False Acceptance Error (FAR). This proposal also improves the flow of data and computation within the improved framework. An evaluation of the multiple scope model proposed provides results between 90.68% and 97.05% for the harmonic mean between recall and precision (F1 Score). The percentages of unduly authenticated imposters and errors of legitimate user rejection (Equal Error Rate (EER)) are between 9.85% and 1.88% for static verification, login, user dynamics, and post-login. These results indicate the feasibility of the continuous multiple-scope authentication framework proposed as an effective layer of security for banking applications, eventually operating jointly with conventional measures such as password-based authentication.