Disposable PIN Usage
From Net2MAX
| More Information | |
|---|---|
|
1. Disposable PIN Features | |
is Patent Protected |
Contents |
1 Main Module
Disposable PIN Main Module is responsible for the core Authentication and Encryption processes involving the Sender and Receiver of the Disposable PIN. Like a normal PIN, both sides must agree on the SAME Disposable PIN before use.
1.1 Authentication
Generating a Disposable PIN for Authentication can consists of up to four steps for the Sender:
- Step 1: Get Time Digits
- Step 2: Get Counter Digits
- Step 3: Perform Operations e.g. multiply, sum, rotate, replacement, swapping with a number (called the Operator).
- Step 4: Random Digits are added in front and behind of the result from Step 3.
The user can trade-off ease of use with security by varying the number of steps used in generating the Disposable PIN. More steps can be included as required to increase security of the authentication.
- Using TWO steps - steps 1 & 4 or steps 2 & 4 - less security
- Using THREE steps - steps 1 & 3 & 4 or 2 & 3 & 4 - average security
- Using FOUR steps - steps 1 & 2 & 3 & 4 - more security
Each step contributes to the creation of the resulting Disposable PIN:
- Disposable PIN = [Random Digits] [Counter Digits] Time Digits [Operator] [Random Digits]
- Disposable PIN = [Step 4] [Step 2] Step 1 [Step 3] [Step 4]
The length of digits used in each step can be specified:
- - the Length of the Time Digits in Step 1.
- - the Length of the Counter Digits in Step 2.
- - the Value of the Operator used in Step 3.
- - the Length of the Random Numbers used in Step 4.
The Receiver can perform the above 4 steps in reverse order to easily compare whether the Counter and Time digits match, if there is a match then the Disposable PIN received is Valid (otherwise it is Invalid).
1.2 Encryption
Although the Disposable PIN is designed for authentication rather than encryption, it is possible to OPTIONALLY encrypt a small amount of information (called a Secret Number) inside it. An additional step (Step 0) is added in front of the 4 steps so they “wrap around” that Secret Number.
Generating a Disposable PIN for Encryption has an extra step in front for the Sender (can consists of up to five steps):
- Step 0: Get Secret Number
- Step 1: Get Time Digits
- Step 2: Get Counter Digits
- Step 3: Perform Operations e.g. multiply, sum, rotate, replacement, swapping with a number (called the Operator).
- Step 4: Random Digits are added in front and behind of the result from Step 3.
The user can trade-off ease of use with security by varying the number of steps used in generating the Disposable PIN. More steps can be included as required to increase security of the encryption.
- Using THREE steps - steps 0, 1 & 4 or steps 0, 2 & 4 - less security
- Using FOUR steps - steps 0, 1 & 3 & 4 or 0, 2 & 3 & 4 - average security
- Using FIVE steps - steps 0, 1 & 2 & 3 & 4 - more security
Each step contributes to the creation of the resulting Disposable PIN:
- Disposable PIN = [Random Digits] [Counter Digits] Secret Number [Time Digits] [Operator] [Random Digits]
- Disposable PIN = [Step 4] [Step 2] Step 0 [Step 1] [Step 3] [Step 4]
Like the other 4 steps, the length of digits used in step 0 (the Secret Number) can also be specified.
The Receiver can perform the above 5 steps in reverse order to easily compare whether the Counter and Time digits match. After they match (the Disposable PIN is Valid), the receiver can then extract the Secret Number and trust that Secret Number to be genuine.
The Secret Number extracted can be stored, retransmitted or processed by the receiver. For example, Disposable PIN can act as a message receiving front-end in an e-commerce application, using it to protect (encrypt and decrypt) the dollar amounts of a transaction from change or seen by unauthorized parties.
In order for the receiver to identify what the Secret Number is for, the Disposable PIN allows the tagging of extra information at the end of the Disposable PIN. Any information can be added by putting them behind a dash “-” at the end of the Disposable PIN. or example if the Disposable PIN is 6567987 then and the words Dim_Sim needs to be added then “6567987-Dim_Sim” will be send by the Sender to the Receiver. The Disposable PIN system will extract the Secret Number from 6567989 (say the Secret Number is “3”) and store or pass it on (to email, web, sms, phone or fax destinations) along with the tag as “3-Dim_Sim”.
2 Authentication Examples
Disposable PIN Authentication involves checking that the information provider by the Sender to the Receiver is correct.
2.1 Only step 1, 4 used
Current Time = 13:19 (use last 1 digit), 3 random digits at each end
- Step 1 Result : 9 (where 9 is the last 1 digit of the current time)
- Step 4 Result : 7659522 (Disposable PIN - final value - where 765 and 522 are random digits)
2.2 Only step 2, 4 used
A counter value can be used (e.g. for people WITHOUT watches or clocks), Step 2 is used instead of Step 1.
Current Counter = 18 (use last 1 digit), 3 random digits at each end. The Counter value is incremented every time after a successful authentication.
- Step 2 Result : 8 (where 8 is the last 1 digit of the current counter)
- Step 4 Result : 7658522 (Disposable PIN - final value - where 765 and 522 are random digits)
2.3 Only step 1, 3, 4 used
Using a time value and maths operation (like addition and multiplication) is secure yet still easy due to the simple operation involved and the availability of calculators in mobile phones and watches.
Current Time = 13:19 (use last 1 digits), Operation = + and Operator = 2, 3 random digits at each end
- Step 1 Result : 9 (where 9 is the last 1 digits of the current time)
- Step 3 Result : 9 + 2 = 11 (where 2 is the Operator)
- Step 4 Result : 76511522 (Disposable PIN - final value - where 765 and 522 are random digits)
Current Time = 13:19 (use last 2 digits), Operation = + and Operator = 30, 3 random digits at each end
- Step 1 Result : 19 (where 19 is the last 2 digits of the current time)
- Step 3 Result : 19 + 30 = 49 (where 30 is the Operator)
- Step 4 Result : 76549522 (Disposable PIN - final value - where 765 and 522 are random digits)
Current Time = 13:19 (use last 2 digits), Operation = X and Operator = 2, 3 random digits at each end
- Step 1 Result : 19 (where 19 is the last 2 digits of the current time)
- Step 3 Result : 19 x 2 = 38 (where 2 is the Operator)
- Step 4 Result : 76538522 (Disposable PIN - final value - where 765 and 522 are random digits)
Current Time = 13:19 (use last 1 digits), Operation = X and Operator = 12, 3 random digits at each end
- Step 1 Result : 9 (where 9 is the last 1 digits of the current time)
- Step 3 Result : 9 x 12 = 108 (where 12 is the Operator)
- Step 4 Result : 765108522 (Disposable PIN - final value - where 765 and 522 are random digits)
2.4 Only step 2, 3, 4 used
A counter value can be used (e.g. for people WITHOUT watches or clocks), Step 2 is used instead of Step 1.
Current Counter = 18 (use last 1 digits), Operation = X and Operator = 2, 3 random digits at each end
- Step 2 Result : 8 (where 8 is the last 1 digits of the current counter)
- Step 3 Result : 8 x 2 = 16 (where 2 is the Operator)
- Step 4 Result : 76516522 (Disposable PIN - final value - where 765 and 522 are random digits)
2.5 All step 1, 2, 3, 4 used
Using all steps provide a more secure way of using the Disposable PIN.
Current Time = 13:19 (use last 2 digits), Current Counter = 18 (use last 2 digits), Operation = + and Operator = 2, 3 random digits at each end
- Step 1 Result : 19 (where 19 is the last 2 digits of the current time)
- Step 2 Result : 1819 (where 18 is the last 2 digits a counter stored on the platform)
- Step 3 Result : 1819 + 2 = 1821 (where 2 is the Operator)
- Step 4 Result : 7651821522 (Disposable PIN - final value - where 765 and 522 are random digits)
Current Time = 13:19 (use last 2 digits), Current Counter = 18 (use last 2 digits), Operation = X and Operator = 2, 3 random digits at each end
- Step 1 Result : 19 (where 19 is the last 2 digits of the current time)
- Step 2 Result : 1819 (where 18 is the last 2 digits a counter stored on the platform)
- Step 3 Result : 1819 x 2 = 3638 (where 2 is the Operator)
- Step 4 Result : 7653638522 (Disposable PIN - final value - where 765 and 522 are random digits)
3 Encryption Examples
Disposable PIN Encryption involves the passing of a Secret Number from Sender to the Receiver.
3.1 Only step 0, 1, 4 used
Current Time = 13:19 (use last 1 digit), 3 random digits at each end
- Step 0 Result : 3 (where 3 is the Secret Number)
- Step 1 Result : 39 (where 9 is the last 1 digit of the current time)
- Step 4 Result : 76539522 (Disposable PIN - final value - where 765 and 522 are random digits)
3.2 Only step 0, 2, 4 used
A counter value can be used (e.g. for people WITHOUT watches or clocks), Step 2 is used instead of Step 1.
Current Counter = 18 (use last 1 digit), 3 random digits at each end. The Counter value is incremented every time after a successful decryption.
- Step 0 Result : 3 (where 3 is the Secret Number)
- Step 2 Result : 83 (where 8 is the last 1 digit of the current counter)
- Step 4 Result : 76583522 (Disposable PIN - final value - where 765 and 522 are random digits)
3.3 Only step 0, 1, 3, 4 used
Using a time value and maths operation (like addition and multiplication) is secure yet still easy due to the simple operation involved and the availability of calculators in mobile phones and watches.
Current Time = 13:19 (use last 2 digits), Operation = X and Operator = 2, 3 random digits at each end
- Step 0 Result : 3 (where 3 is the Secret Number)
- Step 1 Result : 319 (where 19 is the last 2 digits of the current time)
- Step 3 Result : 319 x 2 = 638 (where 2 is the Operator)
- Step 4 Result : 765638522 (Disposable PIN - final value - where 765 and 522 are random digits)
3.4 Only step 0, 2, 3, 4 used
A counter value can be used (e.g. for people WITHOUT watches or clocks), Step 2 is used instead of Step 1.
Current Counter = 18 (use last 1 digits), Operation = X and Operator = 2, 3 random digits at each end
- Step 0 Result : 3 (where 3 is the Secret Number)
- Step 2 Result : 83 (where 8 is the last 1 digits of the current counter)
- Step 3 Result : 83 x 2 = 166 (where 2 is the Operator)
- Step 4 Result : 765166522 (Disposable PIN - final value - where 765 and 522 are random digits)
3.5 All step 0, 1, 2, 3, 4 used
Using all steps provide a more secure way of using the Disposable PIN.
Current Time = 13:19 (use last 2 digits), Current Counter = 18 (use last 2 digits), Operation = X and Operator = 2, 3 random digits at each end
- Step 0 Result : 3 (where 3 is the Secret Number)
- Step 1 Result : 319 (where 19 is the last 2 digits of the current time)
- Step 2 Result : 18319 (where 18 is the last 2 digits a counter stored on the platform)
- Step 3 Result : 18319 x 2 = 36638 (where 2 is the Operator)
- Step 4 Result : 76536638522 (Disposable PIN - final value - where 765 and 522 are random digits)
3.6 Secret Number Destination
The Encryption feature of Disposable PIN is similar to the Authentication feature of Disposable PIN (which return “Valid” or “Invalid”), but in addition it also return a Secret Number to a destination. The destination can be any thing on-line like email, SMS, web, instant message, fax etc. The preferred way is to use secured web page (https).
Say Disposable PIN 76536638522 is received and it is Valid and the extracted Secret Number from it is 3, then the following web transaction will be initiated: https://customer.webserver.com?result=3
3.7 Disposable PIN Tagging
It is possible to identify individual Disposable PIN by tagging extra information at the end. The tagged information is separated from the Disposable PIN with a dash “-”. The “-” and anything after it is passed along with the Secret Number to the Secret Number Destination.
Say Disposable PIN 76536638522-Dim_Sim is received and it is Valid and the extracted Secret Number from it is 3, then the following web transaction will be initiated: https://customer.webserver.com?result=3-Dim_Sim
4 Operation Details
4.1 Time Digits
It is up to the user to define the length of the Time Digits to use (normally between 0 to 8 digits). For parties with very accurate clocks , the Time Digits can optionally include Seconds in the matching:
- - Using Minutes only - up to 12 digits: 200702182103 (stands for 18-Feb-2007 at 9:03:12pm)
- - Using Seconds as well - up to 14 digits: 20070218210312 (stands for 18-Feb-2007 at 9:03:12pm)
The user's timezone is automatically taken into account in the matching. In order to compensate for the difference in clock time between the sender and the receiver, the delay in the transmission and processing of the Disposable PIN, the receiver can perform fuzzy matching of the Time Digits. For example, it will accept the time as MATCHED if the difference between the 2 current times of the sender and receiver is less than 2 minutes. The number of minutes allowed to be different (know as the Time Offset) can be adjusted by the user at anytime. The larger the Time Offset value the easier it is to match the current time value, but it also means that it is less as secure (since more potential values will match as well).
4.2 Counter Digits
The Counter value increases every time after a successful authentication, although it can be set to static (increment by zero every time means constant with no change) if required. Both parties (the sending party and the receiving party) must use the SAME counter value for Disposable PIN for each transaction to work properly. The increment can be set by the user in some implementation but is normally 1.
The counter value is of a predefined length and is specified by the user. In some implementations, the counter cannot be zero and cannot start with zero. It always counts in a circular sequence. For counter length of ONE, it will count from 1 and loops back to 1 after 9 is reached. If the length of the Counter Digits is TWO then the sequence starting counter value is 10. The same rule applies to longer lengths, where the number of zeros behind 1 (in the sequence starting value) always equals to the length minus one. So,
- Length 1 counts from 1 to 9, Length 2 counts from 10 to 99, Length 3 counts from 100 to 999 , etc etc..
Rather than remembering the latest counter value, it can be written on a piece of paper, a card, stored in mobile phone etc.
4.3 Operator Digits
Operation in step 3 can be any operation that can be reversed cleanly and easily. The following are some different operation examples for Step 3 using value 123 with a single digit Operator of 2:
- 1. Add - add 2 123 + 2 = 125
- 2. Multiply - multiply 2 123 x 2 = 246
- 3. Rotate - rotate right by 2 positions 123 > 2 = 231
- 4. Replace - replace with random digit at position 2 123 r 2 = 183 (random digit is 8)
- 5. Swap - swap digit in position 1 with position 2 123 s 2 = 132
The default operation is Addition for ease of use, although Multiplication is the preferred operation for higher security. The trick to using Multiplication is to break a long number into smaller parts and then string them up together later. For example, if we have 18319 x 2 = 36638, the trick is to do 18 x 2 = 36, 3 x 2 = 6, 19 x 2 = 38. For people with access to calculators an Operator with more digits will increase the security of the Disposable PIN substantially.
For the Rotate operation, Operator with a positive (+ve) number means rotate right and negative (-ve) number means rotate left. For the Replace operation, each digit in the Operator indicates a position to be replace with a random digit. For the Swap operation, 2 digits are normally required in the Operator to indicate the 2 positions to swap with each other, if only a single digit is specified then that position is assumed to swap with position 1.
In some implementations, multiple operations can be used together (one after another) within Step 3. This is especially useful for simple operations like Replace and Swap. In the following example, both Replace and Swap operations are performed in Step 3:
Current Time = 13:19 (use last 4 digits), Operation = r and s and Operator = 23 and 14, 3 random digits at each end Step 1 Result : 1319 (where 1319 is the last 4 digits of the current time) Step 3 Result : 1319 r 23 = 1289 (where 2 and 3 are positions of the digits to be replaced by random numbers 8 and 2) Step 3 Result : 1289 s 14 = 9281 (where 1 and 4 are positions of the digits to be swapped) Step 4 Result : 7659281522 (Disposable PIN - final value - where 765 and 522 are random digits)
4.4 Random Digits
Random digits for both front and back can be made up very easily and thus should be as long as possible in order to confuse people spying on the Disposable PIN.
4.5 Secret Number
In some implementations, the Secret Number used in Step 0 (for Encryption) cannot be zero (0) and cannot start with zero (0).
5 Secondary Modules
The main module is responsible for the core authentication and encryption but the following secondary modules are essential to the proper operation of the Disposable PIN in demanding real world situations.
5.1 Minimum Security Level
The Disposable PIN system can enforce minimum security level by enforcing things like
- 1. the minimum number of steps allowed
- 2. the minimum length of the digits allowed to be used in which steps
- 3. the minimum number of operations (in Step 3)
- 4. the minimum number of non-random digits
5.2 Rapid Problem Detection
The Disposable PIN system can detect improper attempts by warning on things like
- 1. too many retries (number of error transactions)
- 2. too much usage (number of correct transactions)
Beside sending warnings to people involved (using voice messages, email, SMS, instant messages etc.), it is also possible to use the rapid detection to provide on-line help (send out a help message to remind the Sender of the proper steps to take in creating a Disposable PIN or have a support engineer call the Sender).
5.3 Comprehensive Operation Control
The Disposable PIN system can prevent improper access by locking on things like
- 1. time lock (cannot use outside certain specified times)
- 2. lP lock (cannot use outside certain specified IP addresses)
- 3. phone lock (cannot use outside certain specified phone numbers)
- 4. value lock (cannot use for transactions above or below certain specified values e.g. in handling payment)
5.4 Flexible PIN Selection
A number of different Disposable PIN can be defined for different occasions, transmission mediums and security levels.
- 1. Static Selection (predefined PIN for specific application, sender, receiver, sending device, receiving device)
- 2. Dynamic Selection (sender specify which PIN to use in real time)
Dynamic Selection is normally In-Band, for example adding an extra digit in front of the Disposable PIN to indicate which Disposable PIN to use. For example, adding the digit 3 in front of a Disposable PIN indicates that the 3rd Disposable PIN of the Receiver is being used. This allows the Sender to change to a stronger Disposable PIN when a less secure transmission channel is used. It also allow the Sender to vary the Disposable PIN to be used at any time, making it even harder to crack.
Dynamic Selection can be Out-Of-Band (in which case the Disposable PIN being used is specified in some other associated transmission to the Receiver).
5.5 Easy PIN Change
The Disposable PIN system can increase security by allowing changing of the 5 steps easily at any time from any where
- 1. from phone
- 2. from SMS
- 3. from Disposable Message
- 4. from web
- 5. from email
