What is a bank card transaction platform?

Card transaction platforms are responsible for processing card transactions performed at an automatic teller machine, point of sale device, and more recently over the Internet and mobile devices such as smart phones and tablets.

In the traditional card transaction platform we have the card holder (who may have a magnetic or chip card), a merchant (shop), an acquirer (responsible for supplying the point of sale device to the merchant, and managing the connection between the point of sale device and the bank card brand, and a brand that is responsible for relaying card transactions to the issuing bank.  In support of the the issuing bank there may be an `issuer processor' that manages the transaction processing and possibly a back office `operations centre'.  For more detailed information see Fabian Martins IEEE Key Management Summit 2010 presentation titled: "Practices and difficulties of key management in the card market" which has an excellent introduction to the traditional card processing environment.

Security problems and theft plague today's card processing systems

A large amount of information has been written about credit card fraud, both in the popular press and by security researchers. We recommend reading the wikipedia page on credit card fraud as it offers a concise introduction to many of the problems such as skimming, carding, account takeover and application fraud.

Frequently credit card attacks are "inside jobs" perpetrated by a dishonest employee of a legitimate merchant, or by privileged technicians within the bank-card processing environment.  Often attacks are well organised and use a combination of inside and outside attacks (see Wikipedia page on Albert Gonzalez the computer criminal who is accused of masterminding the combined credit card theft and subsequent reselling of more than 170 million card and ATM numbers from 2005 through 2007).

Major banks now issue credit card security warning notices routinely.   This notice is accessible from the front page of the HSBC (Singapore) website (23 December 2010): 

"CARDS FRAUD ALERT  Cards fraud is a commonly known issue and has been on the rise in recent years. The industry recently reported a number of cards and PIN numbers being compromised in the United Arab Emirates ("UAE") resulting in unauthorised cash withdrawals on customers' debit and credit cards.

Fraudsters are able to acquire PIN numbers and electronic data from the black strip of the bank card, possibly during cash withdrawals at ATMs. Thereafter, they fashion counterfeit cards that are used to withdraw money from the customers' accounts.

To safeguard yourself against cards fraud, it is advisable that you refrain from performing any cash withdrawals in the UAE in the near term where possible.

If you have recently returned from the UAE and have performed cash transactions in the UAE, you should immediately change your PIN number if you have not been contacted by HSBC to replace your card."

Example of some security problems in the Eurocard-Mastercard-Visa platform

Let us consider the EMV protocol.  EMV is the dominant protocol used for smart card payments worldwide, with over 730 million cards in circulation.  As of February 2010, the EMV protocol is broken. Specifically criminals can perform transactions on stolen chip and PIN cards without knowing the PIN.  Furthermore, several vulnerabilities have been found in the support for EMV secure messaging.  These attacks are significant because they show that the EMV protocol has not mitigated the risks of abuse by bank programmers at operations centers, and by exploiting this weakness insider attack there can rapidly undermine the system.  This is a serious concern.  Celent, a research and advisory firm for financial institutions, estimates that approximately 60 percent of bank fraud cases where a data breach or theft of funds has occurred are the work of an insider (2008).

List of some common bank transaction security problems

Common security themes relating to banking revolve around inadequate security controls:

• Confidentiality failures:
  • Card transaction information may not be encrypted at every point along the transaction flow
  • Some back-end key management operations are done manually, by hand, in a way that is poorly managed
  • The information in each card transaction is exposed to several organisations, and several information processing systems (risk surface is relatively large)
• Authentication failures:
  • Faulty electronic security protocols (EMV) fail to provide essential transaction authentication failures
  • The ability to perform transactions using account numbers and verification codes that are not adequately secured (magnetic strips, authorisation codes)
• Physical security failures:
  • Physically compromised Point of Sale devices that violate necessary security properties

• Trust failures: 
  • Malicious insider attacks conducted at the point of sale
  • Malicious insider attacks conducted within the transaction environment
  • Complex server side systems that are difficult to audit, permitting fraud to be present inside the back-end processing environment

The Trustworthy Bank Card Transaction Platform initiative seeks to address security threats across the full life-cycle of card transactions in Point of Sale, ATM and Internet banking, making them more resilient against a wide range of insider attacks (attacks originating inside the hardware, operating systems, trusted staff and administrators) and outsider attacks (reduce attack surface).

Bank security expert calls for new trustworthy key exchanges for credit card back-end

In May 2010, at the IEEE Key Management Summit, Prof. Fabian Martins (Crosscut Consulting / FIAP University) made a presentation titled: "Practices and Difficulties of key management on the credit card market" [Streaming] [Download low-res video] [Download high-res video].  In that presentation Fabian called for new trustworthy and dependable key management solutions for use in the back-end of credit card processing systems, specifically for technologies that were suitable for use between mutually-suspicious parties and also provided protection against insider attacks.

ICT Gozo Malta Initiatives

It is clear that new solutions are needed in the credit-card transaction space.

ICT Gozo Malta member Synaptic Laboratories has proposed a key management model which addresses the security problems raised by Prof. Fabian Martins in the point above.  This proposal was presented at the same IEEE Key Management Summit and can be found here and here.  

ICT Gozo Malta member Synaptic Laboratories' Trustworthy Cloud Compute Platform is designed to address issues of trust and insider attacks in financial processing environments. 

end faq

Synaptic Labs' trustworthy bank card transaction platform

The creation of a universally trustworthy and dependable bank card transaction platform suitable for processing day-to-day and high value financial transactions.  This platform should deliver unprecedented confidentiality, integrity, availability, reliability, financial safety and authenticity assurances for all stakeholders against continuous and evolving insider and outsider attacks (i.e. all malicious actors), in a way that is credible and can be audited. Furthermore this platform should facilitate business continuity in the face of natural or man made physical disasters.  The platform will employ the use of smart phones.

Achieving this vision

We have taken a clean-slate approach to bank card transaction processing.

Synaptic Labs' solution synergistically combines high-availability techniques found in aerospace, safety techniques found in critical infrastructure, survivability techniques employed by biological systems and modern information security techniques in a cost-effective design that reduces the attack surface and mitigates the number of single point of trust failures.

We will achieve secure transactions for all stakeholders:

• using commercial off the shelf (COTS) hardware and operating systems often found in card transaction environments, where each component is managed in a particular way; and
• by employing split controls.

Synaptic Labs' unique-value-propositions

Synaptic Labs' trustworthy bank card transaction platform:

• has been designed from the ground up as a cryptographic project
• is designed as an online system that opportunistically exploits all wide-area networking facilities, including mobile phones and the Internet
• is a clean-slate design that reduces the attack surface and focuses on the essential transaction functionality
• employs an intrusion and malware resistant design:
  • offers unprecedented assurances for all stakeholders with regard to confidentiality, integrity and availability against broad classes of both insider and outsider attacks, even when the attack successfully compromises one component
  • employs a system of inter-organisation checks-and-balances to improve accountability
• is designed to reduce the risk exposure of all stakeholders (including the client) within the card transaction platform
• employ the use of the Trustworthy Cloud Computing Platform to host all server side transactions

The trustworthy bank card transaction platform can be built using commercial-off-the-shelf hardware, operating systems and programming languages.  Synaptic Labs' project will be exploring the wireless connectivity issues between banking applications running on mobile phones and point of sale devices.

Comparing Features with EuroMasterVisa (EMV) Card

(Key: Bad, Good)

{/arijdatatable}

Elements in the design

• The Trustworthy Bank Transaction Platform will employ the Trustworthy Cloud Compute Platform on the server side.  The server side can be implemented using commercial off the shelf (COTS) hardware and a small amount of proprietary software, all organized in an innovative configuration that provides greater confidentiality, integrity and availability to all cloud stakeholders.
• The Trustworthy Bank Transaction Platform will employ commercial off the shelf magnetic cards, or preferably smart cards (chip cards) on the client side.
• The Trustworthy Bank Transaction Platform will employ the use of smart mobile phones or possibly portable low-cost smart devices that have a simple LCD screen, PIN pad and short-range wireless connectivity (bluetooth, NFC).
• The Trustworthy Bank Transaction Platform will employ point of sale terminals.
• Synaptic Labs' project will be exploring the wireless connectivity issues between banking applications running on mobile phones and point of sale devices.  We anticipate the connectivity between point of sale devices and mobile phones is already being prepared for by point of sale and mobile phone manufacturers in response to increased interest in m-Banking.

Phase 1: Proof of concept

Implement proof of concept using a smart card, a smart phone, a point of sale device, and the back-end servers running on the Trustworthy Cloud Compute Platform.

end faq