Resembling a memory stick with an integrated display, a prototype USB device developed at IBM's Zurich Research Lab brings a new level of security to online banking for consumers.
Pilot devices are ready and available to banks for trials.
The Zone Trusted Information Channel (ZTIC) plugs into the USB port of any computer and creates a direct, secure channel to a bank's online transaction server, bypassing the PC which could be infected by malicious software (malware) or susceptible to hacker attacks.
The consumer can use the security stick to logon and validate all transactions via a display, while the USB device is securely connected to the server, safeguarding against today's ever more fiendish forms of attacks that can manipulate data in the background, hidden from the consumer and the bank. The USB device adds an extra level of security to the existing authentication solutions provided by smart card, PIN or one-time validation code, in order to counter the newest and most highly manipulative security threats.
Hackers are becoming increasingly inventive in their attempts to attack financial transactions on the Internet. Among the increasingly prominent threats are so called "Man-In-The-Middle" attacks, where a hacker inconspicuously intercepts and modifies the messages flowing between a user and a financial institution. The modified messages appear to be official transactions from the financial institution, and the messages going to the financial institution appear to be from the consumer.
Malware is an even more fiendish form of attack, where the hacker manages to install a virus or Trojan Horse in a user's personal computer and is then free to manipulate the messages seen by and sent by the user. This allows the attacker to redirect communications and manipulate the data displayed by the internet browser in real-time during the user's e-banking session and totally unnoticeable to the user's eyes.
IBM stated that ZTIC provides an extra layer of security in the presence of both of these attacks.
"In the presence of an ever more professionally operating e-crime scene, it became obvious that PC-software based authentication solutions were potentially vulnerable and that we needed to innovate to stay ahead. That was the starting point for developing the ZTIC," said Dr. Peter Buhler, Manager Computer Science at IBM's Zurich Research Lab. "The design of the solution was governed by and is based on the analysis of pros and cons of present and announced alternative solutions."
This solution effectively moves all the cryptographic and critical user-interface processes away from a consumer's PC onto the ZTIC device, creating a trusted communication endpoint between the banking server and the user. With the new device, a user can then communicate securely with sensitive online services such as a banking server. In combination with a smart card, which can be inserted into the device, this new solution brings a new level of end-to-end security to online banking.
