Financial Security Solution

OTP Seed Programming Solution

Background

OTP tokens (and OTP cards) are already widely used for 2FA by banks, government agencies and end users in their daily lives to protect bank accounts, work environments and online services such as Facebook and Dropbox. The 6- or 8-digit ever-changing code (usually refreshed every 30 or 60 seconds) efficiently proves the user's identity. More importantly, because each code can be used only once, OTPs are not vulnerable to replay attacks.

Each OTP token/card usually has a pre-loaded secret key (also called a seed), from which the 6- or 8-digit code is generated. However, some customers (such as government agencies and banks) have security concerns about allowing token vendors to access the seed information (especially after the RSA SecurID incident).

Solution

FEITIAN, as a world-leading identity provider, solves these security concerns by offering not one but three onsite seed programming solutions for different customer requirements, giving them full control over their seed data:

1) Programming seeds to FEITIAN OTP tokens/cards with a dedicated contactless Seed Programmer

With the reader-like FEITIAN Seed Programmer you can (re)program FEITIAN OTP tokens/cards entirely by yourself, without disassembling the tokens. The Seed Programmer uses FEITIAN's proprietary contactless protocol to communicate with the tokens/cards, program the seeds and validate them. Combined with the FEITIAN Seed Management system, you can manage the whole seed life cycle — from seed generation, storage and distribution to transport and programming — giving you full control of the seed production process and the highest level of security.

This solution suits banks, government agencies and large corporations with dedicated administrators or operators to handle seed generation, seed programming and token/card distribution.

2) Programming seeds to FEITIAN OTP cards with an NFC-enabled Mobile Phone or Card Reader

More and more professional software and online services use 2FA with OTP to protect their users and customers. They usually generate a QR code containing the seed information; a user can scan that QR code with an NFC-enabled Android phone and then program the seed data into a FEITIAN NFC OTP card, after which the OTP card can be used as the second factor to identify the user.

For people who do not have an NFC-enabled Android phone, FEITIAN also offers self-programming using an NFC card reader. The process is similar to the phone method — the only difference is that, instead of scanning the QR code with a smartphone, you use PC software provided by FEITIAN to retrieve the seed data.

This solution supports a long list of services, such as SWIFT Alliance Access, Citrix Netscaler, IBM Verify, DocuSign, TeamViewer, Facebook, Dropbox and Gmail.

3) Programming seeds to FEITIAN OTP tokens without extra devices

The FEITIAN optical OTP token is a revolutionary device with eight embedded optical sensors. It reads seed information from a flickering image displayed on a PC or smartphone, then performs the seed programming entirely by itself.

That flickering image can be easily integrated into online banking pages or a corporate web portal, and one optical token can support up to five applications/accounts. This means a user can use a single token to protect their bank account, work environment and daily online services.

Because the FEITIAN optical token requires no extra device for seed programming, it is the perfect solution for customers who do not want to (or are not allowed to) use their personal mobile phones.

DCVV Solution

Background

A card-not-present transaction (CNP) is a payment card transaction in which the cardholder does not or cannot physically present the card for the merchant's visual examination when the order is placed and the payment is processed. It is most commonly used for payments made over the Internet.

Card-not-present transactions are a major route for credit card fraud, because it is difficult for a merchant to verify that the actual cardholder is indeed authorizing a purchase.

The card security code (CVV in most cases) system was set up to reduce CNP fraud, but it is still insecure to rely on a static 3- (or 4-) digit number to protect the cardholder's property.

In this case, a constantly-changing CVV code solution greatly improves protection against CNP fraud.

Solution

The DCVV (or DCSC) card is a credit card with a screen that displays a time-based one-time password. Unlike normal OTP tokens/cards that use the OATH standard, the DCVV follows the VISA/MasterCard/UnionPay Dynamic CVV requirements.

Bringing a DCVV solution to market requires 3 key parts:

1) Physical card

The physical DCVV card is a security device in the standard ID-1 card form, which contains:

A smart card chip for downloading the financial applets;
Complete card surface printing (without embossed fonts);
A hologram and signature panel;
A flexible circuit board with a battery and screen to display the DCVV value;
A cold lamination process for the manufacturing stage.

FEITIAN handles the entire manufacturing process and provides the physical card.

2) Personalization

Normally, all credit cards require personalization before final issuance. At this stage, the bank chooses a personalization provider to download the sensitive data into the card.

For a standard credit card, this process downloads the credit card applet with the cardholder information into the card and applies the embossing. For a DCVV card, it also requires downloading the dynamic CVV information into the card, including the secret key and the time.

Because the card uses a special communication protocol, FEITIAN provides the devices and guidance to help the personalization provider interact with the card.

3) Authentication System

A back-end server is required for DCVV authentication — normally an extra authentication step compared to a standard credit card transaction.

When the bank server receives the payment request, it sends the related information to the authentication server and waits for the reply. The authentication system is a modified FEITIAN OTP server that supports the DCVV algorithm.

FEITIAN helps the bank deploy the authentication system and provides guidance for any customization of the bank's existing system.

System Logon Solution

Background

PKI tokens are already widely used for 2FA in many fields — by banks, enterprises, government agencies and end users — to protect online transactions, document signing, online tax and other services. Another important feature is protecting user system logon.

Logging on to a system may be the most common task users perform every day. Users must enter a password each time and may worry about losing it or about weak security if the password is too simple. Traditional passwords are therefore inefficient and offer a low security level, so a more secure and easier method helps users improve both efficiency and security. FEITIAN's system logon solution brings such a method to users.

Solution

FEITIAN, as a world-leading identity authentication provider, solves users' concerns by offering a system logon solution for PKI products on Windows and Mac OS. The solution works together with third-party software:

Windows system

Works with EIDAuthenticate (from https://www.mysmartlogon.com/). While most logon programs require a specific smart card driver, storage on the smart card itself or user-process authentication, EIDAuthenticate performs authentication inside the Windows security kernel (lsass.exe), so even with a signature-only card your data stays safe. For example, EIDAuthenticate is the only solution that natively supports the Windows "force smart card logon" policy, used to secure local administrator accounts in data centers or to comply with HSPD-12.

FEITIAN ePass PKI tokens provide a secure medium for storing the system logon digital certificate generated by EIDAuthenticate, and implement Windows system logon with a token PIN after the EIDAuthenticate configuration is completed. A smart card account appears in the Windows logon interface after restarting the system and plugging in the ePass PKI token — simply click the account and enter the token PIN to log on.

Mac OS with FEITIAN PIV

Mac OS already supports PIV natively. Simply enable the pairing function in the system and plug the PIV token/card into the system to complete pairing. After that, restart or log off, and the logon interface will show the logon option with PIN.

Mac OS with FEITIAN GIDS

Works with OpenSCToken (rebuilt by FEITIAN) to implement macOS smart card logon. OpenSCToken uses CryptoTokenKit, Apple's framework for programmatic access to smart cards and other tokens. It provides both low-level access to tokens (comparable with PC/SC) and high-level access for system-wide token integration (comparable with the Windows Smart Card Minidriver).

The FEITIAN GIDS token/card works with the OpenSCToken application. Simply install the OpenSCToken rebuilt by FEITIAN on macOS, enable the pairing function, and plug the GIDS token/card into the system to complete pairing. After that, restart or log off, and the logon interface will show the logon option with PIN.

Online Remote PIN Unlocking Solution

Background

PKI tokens are already widely used for 2FA in many fields — by banks, enterprises, government agencies and end users — to protect online transactions, document signing, online tax and other services. The PIN is the most basic and commonly used protection for a PKI token, guarding access to the certificates and key pairs stored inside the token.

A PIN can be set with different levels of complexity according to the user's habits, using letters, digits and special symbols. However, a more complicated PIN is harder to remember, so some users forget their PIN and lock the token. The traditional way to unlock a PIN requires the user to bring the token to an administrator or an appointed location, which can be time-consuming and inconvenient. The remote PIN unlock solution solves this problem and provides a quick and convenient way for users.

Solution

FEITIAN, as a world-leading identity authentication provider, solves users' concerns by offering an online remote PIN unlock solution for ePass series products. The solution consists of a remote unlock client tool and a backend server. The unlock process is as follows:

Remote unlock client tool

When the token PIN is locked, the user can download and start the tool. The tool reads the serial number and certificate file (.cer file) from the token, generates a session key, and sends all of this to the backend server in cipher text.

*Note: The remote unlock client tool is for Windows only.

Backend server

The server receives the information from the client tool, decrypts it to obtain the token serial number and certificate file, and calculates the SO PIN from the token serial number. It then encrypts the SO PIN with the session key. Meanwhile, the server parses the user's email address from the certificate file and sends a generated verification code to that email.

*Note: Each token has a different SO PIN, calculated from its unique token serial number.

User

The user checks their email for the verification code, enters it into the client tool and clicks Unlock. The client tool sends the verification code to the backend server in cipher text; after successful verification on the server side, the server sends the encrypted SO PIN to the client tool, and a reset-PIN window pops up. The user can then reset the PIN and complete the unlock procedure.

*Note: During the entire unlock procedure, the token must remain connected and must not be accessed by other applications; otherwise the unlock will fail and must be redone.