Security control of smart cards in banking applications

1. Features of smart cards
Compared to magnetic stripe cards, smart cards have advantages not only in significantly increased storage capacity and enhanced and expanded application functions, but more importantly, in terms of increased storage capacityIt is the security mechanism provided by the CPU. The security mechanisms of financial ICs include: authentication functions, message authentication, transaction verification, electronic signatures,Secure message transmission, application independence, a complete set of key distribution systems, key independence, advanced key algorithms, and comprehensive featuresKey management system.
Because CPU cards can store passwords and encryption algorithms within the card, and besides password verification methods, they can also use random numbers and algorithm pairsThe key is authenticated and stored on the card, preventing it from being read. These security mechanisms greatly enhance the security of cards and systems. In addition,By adopting the internal SAM module, POS and self-service terminal devices can store keys and implement algorithms, thereby ensuring system securityfurther enhancements, so offline transactions must be equipped with SAM modules or security chips to ensure system security.In teller management, due to the unique design of CPU cards for security control, teller CPU cards are used to control secure transactions at financial terminals, The teller's personal key and information are encrypted and stored on the CPU card, making it impossible to steal. During encryption, the key can not be removed from the card, ensuring securityTherefore, the promotion of CPU card security control technology in terminal applications such as POS will greatly enhance the security of terminal applications.

The security of smart cards is specifically reflected in:

Secure storage: The unique software and hardware structure of smart cards enhances the security of stored keys, and keys are stored in encrypted text on the card, it is only allowed to be used when conditions are met; otherwise, it cannot be read at all, thus preventing key leakage due to poor safekeepingAbility to do so.
Secure use: Since smart cards have built-in signature authentication and encryption/decryption algorithms, key usage can be fully completed within the card, and moreoverEach use of the key requires password verification before use, eliminating the possibility of users leaking the key during use, and the storage cardmagnetic cards cannot do this. Additionally, you can set PIN password protection on the smart card. If you enter the wrong password three times during use,PIN code: The IC card will be locked and requires an unlock code. If you enter the wrong unlock code three times in a row, the IC card will automatically become invalid. This is not allowedReuse.

1. Data confidentiality: User passwords, which are sensitive data, need to be encrypted for transmission to prevent third parties other than the recipient from intercepting the passwords.
2. Data integrity: Use message authentication codes to prevent unauthorized users from responding to financial transaction messages' accounts, amounts, transaction types, or hostsProcessing and other content are carried out unintentionally or maliciously to prevent information loss and duplication during data transmission, ensuring smooth deliveryEasy Message is complete.
3. Data identifiability: Operators electronically sign sensitive data, such as transaction account number, transaction amount, transaction date and time, and paymentEffective electronic signatures such as Yi terminal numbers and transaction transaction records, providing reliable identification methods for bank hosts.

2. The application of smart cards will address some security control issues in the financial sector

1. Operators violating rules beyond their permissions
In terms of management, personal financial terminals generally use operator passwords to control transaction security, and for convenience and personal confidentiality,sometimes the code is shared by colleagues, and in such cases, operators may overstep their permissions and violate regulations.
Financial IC cards fully utilize the "smart" features on their cards, authenticating various keys and passwords, cards, and terminals through secure settings, transaction authentication, electronic signatures, etc. As long as the financial terminal uses a gold card keyboard with IC card read/write capabilities, operators are added during the transaction processIC signature capability, and the risk of unauthorized unauthorized operations can be effectively addressed.

2. Issues encountered during the use of financial magnetic cards

Financial magnetic cards themselves have the problem of being easily copied; as long as you read the information on the magnetic card's track, you can copy one within minutesBank cards that can be used at self-service devices such as POS and ATMs in shopping malls. The personal information and keys recorded on the IC card can be used for personal passwords and passwordsand other security protections, making it impossible for illegal copying.
Additionally, from a management perspective, if a financial magnetic card is lost, the illegal cardholder can calmly report the wrong password without embarrassment or a trembling heart "Password is wrong"—try again in a different environment, and IC cards can effectively control the number of password attempts by unauthorized cardholders in offline environments.
From the transaction process, although banks can verify the cardholder's authenticity based on the password, magnetic cardholders cannot identify the silverThe authenticity and validity of the magnetic card transactions are all centrally controlled by personal passwords. Because transaction messages can be analyzed, that is, in oneIf there are issues with management or control, the password for the card holder is transparent. If the bank insider is working poorly, he can pass throughAnalyze POS or ATM transaction messages, analyze users' financial status, and analyze user passwords to achieve the goal of stealing user cards. If there is a non-complianceLegal banks or illegal bank terminal devices. Hackers can obtain the magnetic track information and personal passwords of the scammed magnetic card holders, thereby obtaining illegal money creationThe purpose of using magnetic cards and withdrawing cash in real banking environments, as reported in the second issue of the 2001 Guangdong edition <金卡工程>< >, the second fake withdrawalFinancial fraud has appeared in Taipei. This scam involves placing fake private banks in bustling areas like Shilin, Taipei, where people have a high population flowMobile ATMs fraudulently obtain magnetic card users' track information and personal passwords, illegally defrauding hundreds of people of over 4 million New Taiwan Dollars.
Financial IC cards fully utilize the "smart" features on their cards, authenticating various keys and passwords, cards and terminals through secure settings, storage, and storage, transaction authentication, electronic signatures, etc. By designing two-way authentication for IC cards, the authenticity and validity of the bank and card are verified, and the password is also usedModifications and verification are only performed within the card and do not need to be transmitted over the network.

3. Control of credit

Interest income from credit card overdrafts or debit card credit consumption is also an important source of income for bank card business. But currently, personal credit in ChinaThe level is relatively uneven; traditional magnetic card technology cannot transmit each cardholder's credit information to the merchant transaction process for differentiated treatment, mainly by reducing the general credit limit to control risk, which suppresses credit consumption among most creditworthy cardholders.
Compared to ordinary magnetic stripe credit cards, the balance and allowed overdraft amount can be stored on the IC card chip, giving customers a certain level of trustBy leveraging consumption power, offline consumption becomes possible, avoiding the malicious overdraft phenomenon seen with magnetic stripe cards. IC cards can securely conduct offline transactions, The IC card stores the customer's basic information (such as name, ID type, ID number), account balance, authorization limit, and customer usage informationUsing a password PIN, the validity of the bank IC card is automatically determined during transactions and the transaction process is recorded, without the need for complex manual authorizationThis simplifies the transaction process, greatly improving the security, speed, and accuracy of transactions. Additionally, transaction data can be used for centralized communicationThis method greatly reduces communication requirements, which helps increase merchants' enthusiasm for accepting bank cards, thereby expanding the bankApplication areas of the mobile card, improving usage efficiency.
Compared with traditional payment methods, financial smart cards offer unique security features, enabling payment systems to prevent cards from being forged.Keys are not leaked, transactions are not tampered with, and banking risks are minimized. In short, if you use IC cards as a long-term bank policy,From an investment perspective, the prospects for returns are very attractive.

3. Security Design of Smart Card Applications
The overall security of financial IC card application systems is controlled by the host, network, and terminals fully utilizing the security mechanisms of IC cards.
On one hand, the following issues need attention in application design:
1. The keys on personal cards are absolutely dispersed, meaning each card has a different key.
2. Deposits and debits must use different keys; deposits must be conducted online, and strict controls must be made: deposit keys must never be usedcan be stored inside the terminal, because controlling security through application software is ineffective. For engineers with terminal usage rights, if the terminal is used,The deposit key is stored at the end, which can be equivalent to a bank's vault.
3. Two-way authentication is required between the terminal and the card. The terminal must check the validity of the IC card. An expired or blacklisted IC card should be verifiedRefusing to execute transactions and locking the card function, the card also needs to be authenticated at the terminal.
4. For transactions of financial IC cards, transaction details are provided on the card, terminal, and on the financial IC card application system host for future referenceAudit.
On the other hand, POS and self-service terminal devices are not as easy to monitor in real time as the dedicated networks within hosts and banking systems.The application of IC cards can greatly enhance the security control capability of terminal devices in financial transactions. Next, let's take a look at Newland Computer Co., LtdLet's discuss smart card security control in the terminal field, with the NEWLAND 8100 POS and NEWLAND 8800 card self-service kiosk designed by the company.
Considering the unlimited future development potential of smart cards, Newland's NEWLAND 8800 card self-service device is equipped with IC cards in hardware designRead/write modules for PSAM cards and contactless smart cards, meeting the needs of query, password correction, document printing, card recharge, IC card ring storage, and automatic retrievalNeeds for self-service customer service such as fee assistance are suitable for banks, stock exchanges, telecom lounges, campuses, gas stations, shopping malls, and supermarketsand various other venues. Another carefully crafted IC premium NEWLAND 8100 new POS terminal uses a dedicated security chip and features self-destruct powerIt can simultaneously receive PSAM modules and store process keys for financial transactions, offering extremely high confidentiality; At the same time, for POS equipment and operationOperator security management has specially designed operator IC card slots to meet the application needs of teller cards, and can be designed within the application systemThe teller CPU card is used to store POS and teller personal information, as well as the sign-in authentication key, generate random numbers, and encrypt transmission keys.This achieves truly effective safety control.
For the transaction of the sign-in application key, an intelligent operator card is used. After the operator card's PIN is approved, the IC's private key exchange is usedThis ensures that transaction keys are effectively secured.
The added PSAM card control module is designed to effectively manage offline transactions, such as the security of debit keys. Because encrypted signatures generate random numbersThe process is controlled within the card, with a single transaction interface between the card and the outside world, and all transactions are securely controllable. All you need is the keyThe personalized process is effectively secured with control, and its functional features will be non-replicable and non-replicable.
For user cards, if lost, there is no security issue. Thanks to the protection of personal PIN, POS devices or self-service card terminals are everywhereDuring passbook transactions, the cardholder's personal PIN must be verified. Since the illegal cardholder does not have a valid password, it may be repeated three or six timesIf the password is entered incorrectly, the IC card will automatically lock, and unauthorized cardholders forcibly unlocking the IC will only result in the IC card being scrapped. Also, NEWLAND 8100 POS and NEWLAND 8800 Card Self-Service Terminals manage lost cards held by illegal cardholders through large-capacity blacklistsStolen card.
The authentication and deduction keys used in the NEWLAND 8100 POS and NEWLAND 8800 card self-service terminals to control the user's IC card are stored in the safeguardOn the secret chip or SAM card, during the transaction process, the key operations for authentication or deduction are all performed within the secure chip or SAM card, thus preventing thisKey leakage. The secure chip also features a self-destruct function for self-protection, preventing unauthorized operations. Regarding the security management of secure chip keys,The NEWLAND 8100 POS features a dedicated program area independent of the application software module, used for changing the POS terminal's secure chip keywithout needing to tell the app how to modify the key. At the same time, both the NEWLand 8100 POS terminal and the NEWLAND 8800 card self-service terminal are availableIt features a secure power-off protection function to ensure the secure and reliable storage of transaction records.
Before IC card transactions, the IC card can be verified for the legitimacy and validity of the POS terminal using the NEWLAND 8100 POS security chip or SAM card,At the same time, POS verifies the legality and validity of the IC card. Since POS terminals cannot illegally generate valid electronic signatures for IC card transactions, merchants also do not eitherTransaction data that has already been completed may be modified, and transaction data that does not exist or if the user's IC card fails.
For offline IC card encryption, balance inquiry, and transaction details, with support from IC and PSAM cards, the transaction process is controlled within the cardAlright.

4. Current Industry Status and Application Prospects

Bank informatization construction is not just about acquiring computers and setting up networks; in fact, it involves the smart card sector and the smart card environment for terminal devicesConstruction is also a very important part of informatization development.
IC card systems that store data using a card that is easy to carry can replace many users' complex tasks. Stored within the IC cardData enables it to serve as a substitute for banknotes, identity authentication, passwords, and other things, combining multiple functions for personal useHouseholds cannot refuse.
IC card systems are actually nothing new in the domestic market. As early as 1993, the construction of the "Gold Card Project" began domesticallyThe goal is to realize a smart card-style "electronic money" system for banks. So far, the "Gold Card Project" has shown considerable results, with bank cards being readThe system has been widely adopted by bank branches and retail enterprises, and the financial card itself has also been accepted by individual consumers.
Thanks to the security features of smart cards, they will bring several changes to banking operations: 1. Secure offline transactions without complex manual laborAuthorization simplifies the transaction process, reduces communication requirements, and helps boost merchants' enthusiasm for accepting cards; 2. Improved control of credit risk, which is conducive to market development and the promotion of bank card business; 3. The security system of smart cards covers online consumption, online wealth management, online securities, etcBusiness security controls provide strong guarantees, creating more business opportunities for online personal banking.
According to optimistic forecasts from relevant authorities, by 2003, about half of online transactions will use smart card technology to ensure security. MovePhones have already adopted smart cards, and in the banking sector, banks, retailers, and individual users are all concerned about secure and reliable transaction confirmation。 The initial reason that prompted France to switch from magnetic cards to smart cards was a fraud disaster, as shown by the smart card organization in May 1999 since the lawOver the past decade, the fraud rate in using smart cards has dropped tenfold, from 0.18 in 1998 to 0.018 in 1999. Number of trades during this periodFrom 1.197 billion in 1998 to 3.137 billion in 1999, about 33 million smart cards are now in circulation in France. Switch to smart cardsTechnology will reduce card fraud, especially forgery fraud, while smart cards will provide more opportunities for cardholder identity verification.
We look forward to the day when our wallets are no longer filled with all kinds of cards, and we can use the same dual-interface card (contactless) for smart useThe card starts the car, physically enters the office, securely logs into the computer with this card, and uses the e-wallet to buy cakes from the cafeteria, using this card to prove his identity at the gymnasium. Of course, all of the above are just some of the possibilities and broader applications smart cards bring us in the new millenniumTo achieve future prospects, we all need to work together.