WO2009000223A2

WO2009000223A2 - Device and method for tap-proof and manipulation-proof encoding of online accounts

Info

Publication number: WO2009000223A2
Application number: PCT/DE2008/000885
Authority: WO
Inventors: Bernd Borchert; Klaus Reinhardt
Original assignee: Universität Tübingen
Priority date: 2007-06-27
Filing date: 2008-05-27
Publication date: 2008-12-31
Also published as: DE102007052734A1; DE112008002306A5; DE102007052734B4; WO2009000223A3; WO2009000223A9

Abstract

The invention relates to a method and a device for the tap-proof and manipulation-proof transmission of messages between a server and the computer of a client, over a computer network, and for the decoding of encoded messages by clients. The method and the device can be especially used for encoding online accounts, especially for online banking. The device, described as a cryptocard, is preferably a flat appliance comprising photosensory elements on the rear side and a display on the front side. The device also contains a logic element/processor and an electronic memory containing codes. It is placed on the screen of the computer of the client, on which the following is displayed in image format: (1) an encoded message, (2) the number of the code required for the decoding, and (3) the co-ordinates of the actual position of the indicator symbol. This information received by the photosensors is decoded by the logic element/processor by means of the code, and the message is decoded and displayed in a clearly visible manner on the display. The indicator symbol on the screen is simulated on the display. By clicking buttons marked with characters on the cryptocard, a message can be transmitted from the client to the server. As the marking of the buttons by the characters is fixed previously at random by the server and transmitted in a tap-proof manner to the cryptocard, the transmission of the message from the client to the server is also tap-proof. The tap-proofness in both directions allows a protocol for online banking to be implemented, which renders the PIN tap-proof and prevents the falsification of transfers.

Description

Device and method for tapping and tamper-proof encryption for online accounts

description

The present invention relates to a method and a device for tapping and tamper-proof transmission of messages between a server and the computer of a client through a computer network and for decrypting encrypted messages by the client by means of a

Decryption device, hereinafter also referred to as key card. The method and the device can be used in particular for encryption for online accounts, in particular for online banking.

The tapping and tampering security of online accounts - especially those of online bank accounts - is jeopardized by the ever-increasing quantity and harmfulness of malware (ie viruses, Trojans, etc.) on the banking customers' computers, see Figure 1. The current standard for securing online bank accounts is the PIN / TAN or PIN / iTAN method, together with the SSL encryption of the transferred data. SSL encryption ensures security against malware on the Internet. However, the critical point of the PIN / iTAN method is the computer used by the bank customer, see Fig. 1C: the malware that might be acting there can not only listen to the PIN, but also Manipulate transfers. These two potential dangers are described in more detail in the following two paragraphs.

The privacy of the PIN is obvious in the PIN / iTAN process: the malware on the bank customer's computer secretly observes the keyboard input when entering the PIN. Later, the eavesdropped PIN secretly passed through computer network to another computer. From there, then - at least reading - the account can be accessed. Procedures in which the PIN is entered with mouse clicks in a number field on the screen are also not tap-proof: the malware simultaneously listens screen and mouse movement.

More dangerous than the privacy of the PIN is the possibility of manipulating transactions - these are the transfer orders for online banking. The so-called man-in-the-middle attack on a transfer order looks as follows: Bank customers would like to transfer 50 euros to X's account. He fills out the appropriate online transfer form and sends it to the bank server. The malware on the machine intercepts this transfer order before it is sent to the bank, converts it into a transfer order of 5000 euros to Y, and sends this manipulated transfer order to the bank. The demand of the bank for the iTAN for the transfer order of 5000 Euro to Y is also intercepted by the malware in the opposite direction, and it becomes the bank customer on the screen the demand of the bank for an iTAN for a transfer order of 50 euros X pretended.

Unknowingly, the bank customer confirms this pre-paid order with an iTAN, and the malware sends the iTAN entered by the bank customer to the bank to confirm the fraudulent transfer order of $ 5,000 to Y. Also, the encryption of the connection (eg SSL) can only make the attack more difficult, but can not safely protect it, because the malware can turn on even before the start of the connection encryption and the manipulations even before the connection encryption, or in the other direction: after the connection decryption perform.

Methods that protect an online bank account securely from listening to the PIN and man-in-the-middle attack are those that attach both a numeric keypad and a display outside of the client computer, such as a personal computer. HBCI- 3. However, due to the physically existing cable connection between this extra hardware and the client's computer, there is still a residual risk that malware on the client's computer spies on or even manipulates the actions on the extra hardware. Another disadvantage of these devices is that they are difficult to transport. Moreover, they are undesirable on foreign computers because of possible virus transmission.

Another alternative to the PIN / iTAN method is the PIN / mTAN procedure: the bank transfer data is confirmed by the bank via SMS to the mobile phone. The PIN / mTAN method only protects against the man-in-the-middle attack, not before listening to the PIN. Furthermore, it is disadvantageous in this solution that a mobile phone must be present and that the reception of the SMS may take a while. Also, it's only a matter of time before malware infiltrates cell phones, making it insecure. In so-called m-banking, the computer used and the mobile phone are identical, so malware could fake the SMS.

The patent application DE102007018802.3 proposes applying the principle of visual cryptography to the security problem in online accounts by placing a transparent foil or punched paper on the screen. The patents EP1472584B1 and US2005 / 0219149A1 describe, however, without direct reference to the online account or online banking problem, also an application of so-called visual cryptography, in which a transparent electronic display is mounted on the screen. All of these solutions based on visual cryptography have the disadvantage that the contrast loss is at least 50%, and that the adjustment of the transparent medium placed on the screen is complex for the user.

The document US20060020559A1 describes an online account encryption method in which punched paper cards are placed on the screen to show secret information to the user. This principle is known in the literature as "Richelieu board." The method has the disadvantage, inter alia, that the privacy against large numbers of the map must be opaque and therefore the movement of the pointer icon on the screen can not be followed The procedure is that in a tamper-proof operation against the man-in-the-middle attack, the punched paper card would be very large.

Patent WO2004 / 040903 describes a flat device which is to be placed on the screen of a computer in order to display a coded image displayed there on a display on the front side decoded. With this device, however, only decodes are possible that swap the pixels of the image ("permutation"). An inaudible transfer of messages from the client to the server is not possible with this device, making it suitable for the use of tamper-proof and tamper-proof online Accounts can not be used.

The patent US2006 / 0026428A1 proposes to have several keys on the device. In this method, the user is interactively involved in finding the correct decoding key. Also in this method, the flow of information takes place in one direction: from the server to the user and not vice versa, so that it is unsuitable for use with online accounts.

The object of the present invention is to provide an encryption method for online accounts, with which a tamper-proof and tamper-proof transmission of messages between a server and a client's computer is possible, the message exchange can be done in both directions, and is easy and intuitive for the client to use. The provision of a user-friendly device, with which the encryption method is feasible, is also part of the object of the present invention.

An online account here and below means access to an access-restricted IT system, hereinafter referred to as the server, for which a user (hereinafter referred to as a client) from a computer in a computer network uses a login (eg user name ) and password must authenticate. Examples of online accounts are online bank accounts, corporate or organization accounts, email accounts, online shops or online auctions. In the example of online bank accounts, the account number of the user is usually used as the login and a predefined number series (PIN) is used as the password.

In the following, first the device according to the invention - hereinafter referred to as key card - described and then the inventive method.

The key card is constructed in such a way that, after being placed on the screen, it reads an on-screen encrypted message by means of photo sensors and decrypts the message on a display and makes it clearly legible to the user.

The key card is preferably a flat, opaque, electronic device, see Fig.2. On the front there is a display (Fig. 2A) and on the back are photosensors (Fig. 2B). Furthermore, the key card has an electronic circuit logic / processor, and an electronic memory that has electronically stored, among other things, the keys necessary for decryption. The key card is placed on a screen that displays an encrypted image in such a way that its rear photo sensors are located on the corresponding positions of the encrypted message in the image format, see Fig.3. The information read in is linked by the circuit logic / processor with the information stored on the key card (= key), and can be decrypted in this way. The decrypted message is displayed unencrypted and clearly legible on the display.

The photosensors can be equipped with lenses. In the simplest case, each photo sensor or logic distinguishes only between black and white. However, if necessary, even more gray values or colors can be distinguished, and this information will be passed on to the logic on the key card. If each photo sensor can distinguish different values m, and there are n such photosensors, m ⁿ may be various information coded. Example: the key card shown in Fig. 2 appears to have 8x15 = 120 photosensors. Assuming that each photo sensor distinguishes only black and white, so 2 ¹²⁰ different inputs can be coded.

The key card has more than one key stored. Therefore, the picture appearing on the screen also contains the information about which key to decrypt is to be used. For example, if the information is encoded with black and white areas (as in Fig. 3A), then with n additional such areas, up to 2 ⁿ different keys can be addressed. For example, if the first three columns of photo sensors of the key card shown in Fig. 2B are for addressing the key and can only distinguish black and white, 2 ²⁴ keys can be addressed, that is more than 16 million keys. The information about the key to be used can therefore be transmitted in the same form, namely via the photo sensors, to the key card, as the encrypted message itself. In the simplest case, all information necessary for decryption is read in parallel through the various photo sensors. However, the transmission can also be partially serial: A message is split into several parts, and the individual parts are transmitted in parallel one after the other. The circuit logic / processor reassembles the various parts of the overall message and displays them to the user on the display as a whole, possibly in segments, one after the other as appropriate over time. The frequency at which the serial transmission can take place is limited by the clock frequency of the screen. For the synchronization and management of serial transmission, additional photo sensors may be necessary.

Quite conversely, a message read by the key card can also be divided by the server into a plurality of display representations which are successively displayed to the client, see e.g. the procedure shown in Fig. 5 will be explained later.

In order to enable the entry of a message from the client and its transmission from the computer of the client to the server, the pointer icon is simulated on the screen by a pointer icon on the display of the key card: whenever the user the pointer icon on the screen of his computer on the encrypted image, ie Under the key card and especially under the part of the key card controls, in which the front of the key card is the display, leads, appears on the display a corresponding pointer icon on the user's same or similar position, and can be moved accordingly. When the screen pointer icon leaves the keycard display area, the pointer icon on the keycard display also disappears.

This simulation is achieved by the position of the pointer symbol that it would have relative to the key card on the screen as part of the information that the Key card reads, is transferred to the key card. For example, if the display of the key card is not more than 256 by 256 pixels, 8 + 8 = 16 more black and white photosensors and 16 corresponding black and white areas are enough on the screen to transmit the information about the position of the pointer icon. The display of the pointer icon on the screen itself should be turned off at the moment when the pointer icon under the key card is controlled, so as not to jeopardize the transmission of the information to the key card (which, indeed, takes place under the key card). In addition to the position of the pointer symbol, the information should also be transmitted, eg via additional 1 or 2 photosensors, as to whether the pointing device is operated ("clicked") at the moment or not.

An input combination for the photo sensors of the key card thus contains as essential information

(1) the coded message, and moreover as important information

(2) the number of the decoding key

(3) the information about the position and state of the pointer icon on the user's screen.

The input may also contain further information, e.g. those that allow error correction, see below.

In the simplest case, the essential information (1), (2), and (3) correspond to certain groups of photosensors. For example, it would be useful to specify the key card shown in Fig. 2B (see Fig. 7): the first three columns with their 24 photo sensors set the number of the key to use, the next two columns define the current position of the pointer symbol, and the the remaining 10 columns represent the coded message. However, there is no need for this assignment of photosensors to the three important pieces of information (1), (2) and (3): it only depends on that the information (1), (2) and (3) can always be uniquely determined from the total input.

In order to achieve stability for the user in the display, although the changes in the position of the pointer symbol should be forwarded as soon as possible by the logic to the display, but the information about the key to be used and the encoded message should be buffered and not too fast change, ie this information should have some minimum time, e.g. a 1/10 second long, stable against the photo sensors before the display in the display updated. This also serves to prevent a systematic espionage of the keys by someone who has unjustifiably come into possession of the card. Additional protection against espionage, especially in connection with this delayed presentation, is to use part of the encoded message as test sites and not display the display if the test sites do not meet the test criteria. Example: it has been proposed above, for example, to use the last 10 columns of the key card in Fig. 2B for the transmission of the coded message. If one asks the last column with its 8 input digits the criterion that the coded key must show in its last 8 digits the same bit pattern as the 8 input values at these photosensors, and otherwise nothing is shown on the display , someone who tries to spy on this key has to dig through an average of 256/2 = 128 lots of encoded messages to see something on the screen, so that they can infer the key at all.

If the key card has used a key, it should be deleted so that messages can not subsequently be decrypted by someone who has come into possession of the card and has intercepted part of the communication.

The key card is preferably provided with a self-sufficient power supply, in particular with a battery or with solar cells. The key card should have no external ports to their circuit logic / processor or their stored keys, because any such port would be an entry gate for spying on the stored keys. For the same reason, the key card is best welded and shielded from radiation. The key card should have as few switches as possible. In a preferred embodiment, it does not have any switches, not even an on / off switch: it starts working when it gets enough energy and / or when its photosensors detect a particular pattern. The key card is preferably flat and compact. But it can also be divided into two or more sub-devices, which are connected by cables.

The adhesion of the key card to the screen can be achieved by adhesive strips. An alternative to this are attached to the key card suction cups. Another alternative is a front and rear transparent or recessed bag (or housing), which is provided with adhesive strips or suction cups and in which the key card can be inserted. In a further embodiment, the key card or provided for fixing pocket or housing have hook or clip, with the help of the key card is hooked to the screen from above. Optionally, the adhesion can also be achieved by placing the card on a position of the lower part of the frame of the screen. A movable or fixed support for the card on the screen frame is another possibility. For practical purposes, it may also be sufficient to provide no liability on the screen, but the user for each key card action (and this should only be the safety-related) with one hand holding the key card to the screen and with the other the pointing device to be served.

The photo sensors on the key card can also be designed in such a way that it is not necessary to hold the key card directly on the screen, but sufficient to align the back of the key card on the screen Photo sensors make the encrypted image on the screen perceive. This means that even with a certain distance between key card and screen, the key card function can be achieved. In particular, the sensors of the key card could be the sensors of a photo camera. First, the pixels of the encrypted image are calculated from the captured overall image by an image processing software, and then the decryption is applied to the calculated partial image. Fig. 8 shows the situation: there is a certain distance between key card and screen.

All encrypted information on the screen can still be secured by an error-correcting code against annoying spots on the screen or on the photo sensors, defective screen pixels or defective photo sensors, and the possibly disturbing pointer icon on the screen. For example, if the pixels are arranged as a two-dimensional grid (as in Fig. 2B and corresponding to Fig. 3A), one additional column and one additional row can correct single errors. For higher correction rates you need more test fields. It is also an implicit error correction, if a larger number and concentration of the photosensors is used to compensate for a deviation in the positioning of the card on the screen can.

The key card can be connected according to the invention with other functionalities. For example, the euro-check card could be grouped together with the key-card so that a bank customer can use the method described here but, as before, only have one card; This assumes that the key card is as flat, flexible and robust as a check card is built.

The key card can also be installed according to the invention in a camera phone or a digital camera. In this case, subfunctions of the key card described above (memory, display, photosensors, Circuit logic, in particular the hardware) are at least partially taken over by the existing components of the camera phone or the digital camera. In this way, with relatively little technical effort, an extended functionality for the devices known from the prior art could be achieved, whereby a greater customer benefit could be achieved.

The method according to the invention for the tamper-proof and tamper-proof exchange of messages between client and server is described below.

The server generates a set of numbered keys. He stores these keys with himself including the number, and also stores them on the key card, also including numbering information. The key card is welded and delivered to the client in a physical and as safe as possible way (e.g., by registered mail).

When the client has received the key card, the server and client can send messages that no-one can intercept, unless the one has also obtained the key. For the two possible directions server -> client and client -> server this is shown below.

The sending of an inaudible message from the server to the client is obvious: The server encrypts the message to be sent with an unused key.

In principle, any encryption method can be used for encryption and decryption with the key card. However, if the so-called "one-time-päd" encryption method is used, it can be guaranteed that the information transmission between server and client is absolutely inaudible for anyone who does not possess the key. päd "Encryption was invented by the Americans G. Vernam and J. Mauborgne in 1920. It is the only known encryption method that can not be proven to break, see C. Shannon: Communication Theory of Secrecy Systems, Bell System Technical Journal, Vol 28, 1949, pp. 656-715 The disadvantage of the one-pad-time method is that the key can only be used for a single message, for another message one needs another key (hence the name "one- time-pad "): if keys are used several times, the communication can be monitored in a simple way.

This encrypted message together with the information about the number of the key used sends the server in image format on the screen of the client. The client puts his key card on the appropriate place on the screen. According to the design principle of the key card, the client can then read the decrypted message in plain text on the display. The server keeps track of which keys have already been used so that it will not send another message with the key being used.

The sending of an inaudible message from the client to the server is as follows. It should be a text with n characters from an alphabet consisting of m characters with n input steps absolutely secure against tapping from a client through a computer network to a server. Here and in the following, under alphabet, as usual in computer science, a finite set of characters is understood. In this sense, for example, the set of digits 0, ..., 9 is an alphabet of 10 characters.

First, the case n = 1, described, that is, one of the m characters of the alphabet is to be transmitted from the client to the server inaudible. At least m non-overlapping buttons will appear on the screen of the client. In the simplest case, the number, position, shape and size of the buttons are already set in advance. In Fig. 3B, for example, 10 buttons are already set, the in their position and shape of the Number field correspond to a keyboard. The server randomly sets a marker of the buttons with the characters of the alphabet, where each character of the alphabet must appear on at least one button. In the simplest case, there are as many buttons as characters of the alphabet, and in that case the marking of the buttons is thus a permutation of a standard marking of the buttons. In Fig. 3B, for example, a number field is shown with a permutation of the 10 digits. The server remembers the random marking of the buttons and encodes the information about the tag by a key that has not yet been used. He notes this key as used up. He sends the client in

Image format the encoded information and the number of the key with which it has encoded. The client receives this information encoded in image format on its screen and places its key card on the appropriate location of the screen. On the display of the key card, the information coded by the server appears unencrypted: namely the buttons together with their markings consisting of the letters of the alphabet, see e.g. Fig. 3B. The client uses the pointing device to place the pointer icon under the key card. The display will show the simulated pointer icon in addition to the highlighted buttons. The client passes the simulated pointer icon to a button containing the character he wants to convey to the server. He operates the pointing device by e.g. click on a button. The position of the pointer icon when clicked - relative to the portion of the screen on which the encryption card is located - is determined by the software of the client's computer and this information is transmitted unencrypted to the server. The server receives this information and can reconstruct the button that the client clicked on. Because the server also knows the buttons' markings, it knows which character the client clicked on. So he received the one-character message from the client correctly.

The crucial thing is that this message from the client to the server can not be heard: The position of the pointer icon when clicking has no Meaning, as long as one does not know with which sign the appropriate button has been marked. The information about the marking of the buttons, however, has been randomly determined by the server and has been transmitted to the client inaudibly. Only those who have the key to decode have the information about marking the buttons. A virus on the Internet or on the client's computer can not obtain information about the message sent by intercepting the messages and monitoring the actions of the client, unless he is aware of the key.

The case n = 1 is thus solved. But this also provides a solution for the general case of a character string to be transmitted with n characters from an alphabet with m characters: one repeats n times the process described above for the transmission of one character. Thus, the n characters have been transmitted tap-proof to the server.

In the case of knowing that the string consists of n distinct characters (a practical example: a PIN where each digit occurs at most once), the procedure can be improved. In that case, all inputs by the client can be made sequentially, for example, by clicking on the buttons on the pointing device on the buttons with the first marker, without the server having to send new markings, see Fig. 3 and Fig. 4. The privacy is still there guaranteed. On the other hand, keys and their transmission are saved, and the method is more user-friendly, because the non-changing markings of the buttons make it easier for the user to search for the characters. Another possible support for the user in this case is a bank ATM known correction key and a progress bar, which indicates, for example with "asterisks", how many characters have already been entered, see Fig. 3 and Fig. 4. Also, in case n characters are to be transmitted that can be repeated, the method can be improved. The characters of each alphabet can be arranged in an order, most alphabets even have a natural arrangement, eg the numbers have the order 0,1, ..., 9, or the capital letters have the order A, ..., Z. If there are as many buttons as there are characters, it is sufficient for the inaudibility that the characters are cyclically reversed, ie all characters move forward by the same number of buttons, cyclically, ie the last ones return to the top like in a circle. The cyclic permutations of 0.1, 2, 3, 4, 5, 6, 7, 8, 9 are, for example, 1, 2,3,4,5,6,7,8,9,0, and 2,3, 4,5,6,7,8,9,0,1, and 3,4,5,6,7,8,9,0,1, 2, ..., and 9,0,1, 2, 3,4,5,6,7,8, and 0,1,2,3,4,5,6,7,8,9 themselves. A cyclic permutation is obviously already determined by the interchanging of a sign, ie a cyclic permutation can be described much shorter than a general one. This allows the following improved method for the tap-proof transmission of n characters from

Clients to the server: The server sets n random cyclic reversals of the buttons' markings, the buttons are already set in shape, size and location. He encrypts this information with a key and sends the encrypted information together with the number of the key to the client in image format. The client lays his

Key card on. The key card now has all the information about all n cyclic permutations, but only represents the cyclic permutations in their order one at a time, waiting for the input of the user, and only displays the next cyclic permutation after an input, see Fig. 5 The information about the inputs is not sent to the server until n entries have been made, or the user triggers the transmission prematurely, eg by a confirmation key, see Fig. 5. A correction key can be shown in the display so that the Key Card can manage the correction itself. The improved method described in this paragraph for transferring n characters from the client to the server is also secure against eavesdropping. The three improvements are that (1) the transmission of n cyclic A total of significantly less transmission capacity than that of n general exchanges requires that (2) the server is not involved between the individual inputs of the user and therefore no waiting times are incurred by the computer network transmission of the information, and (3) that the user can find the characters faster in the case of cyclic exchanges than in the case of a general permutation, see Fig. 5.

A method has been presented which uses the key card to protect an online account, such as an online bank account or company account, from being eavesdropped on by the PIN and secure against man-in-the-middle attack on a transaction.

Further advantages, features and possible applications of the invention are described below with reference to the embodiments with reference to the drawings. In the drawings show:

Fig. 1: the situation with the on-line banking: the bank (A) has different computers in Internet (B) connection to the computer (C) of the client (D). Viruses lurk on the Internet (B) and on the client's computer (C).

Fig.2: A "key card" with a front display (A) and rear photo sensors (B)

Fig. 3: Interception-proof exchange of information without repetition of symbols, example: PIN entry.

Fig. 4: The pointer symbol simulation: in (A) the pointer symbol is not yet under the key card, but in (B), and is then shown on the display of the key card. Fig. 5: Interception-proof exchange of information with repetition of symbols, example: Account number entry. The order of digits can be cyclic: this allows the user to find the digits faster.

Fig. 6: Counterfeit-proof confirmation of a transfer: in (A) is confirmed as with the mTAN procedure with TAN to be repeated, in (B) is confirmed by pressing the pointing device ("mouse clicks").

Fig. 7: Example of a breakdown of the photosensors to the important information to be read: number of the key (A), relative position and condition of the mouse (B), and the encrypted message (C).

Fig. 8: Interception-proof exchange of information without repetition of symbols, example: PIN entry. The key card is held on the screen like a camera with a certain distance.

Fig. 9: Interception-proof exchange of information without repetition of symbols, example: PIN entry. To read the encrypted message, the key card is held on the screen like a camera with a certain distance. To activate the buttons then the key card is held on the screen.

Working Example

The above procedure for sending secret messages between server and client is applied to the special case of online banking (Fig. 3, 4, 5, 6). The method prevents PIN interception and man-in-the-middle attack.

The bank server randomly generates a set of keys for the bank customer, numbers them, and stores them both in himself his database as well as on a key card. The memory card is welded and delivered to the customer by post. In addition, a PIN is sent to the customer as with the PIN / iTAN procedure, assuming that no digit occurs twice in the PIN (the number of options is still enough to render the PIN guessing meaningless).

If the bank customer has received the key card and his PIN, he can start with online banking. To log in, he goes to the web page of the bank and there gives his account number. at. The account no. will be sent to the bank server. The bank server now checks the authenticity of the bank customer as follows:

The bank server generates a random interchange of the 10 digits. The bank server remembers this random permutation. An unused key is taken for the bank customer and after the one-time-pad

Method is generated from the key and the information about the interchanging an encrypted information. Together with the number of the key, this information is sent in image format to the bank customer in his browser window. The situation arises as in Fig. 3A.

The bank customer sees the encrypted information in picture format and places his key card on it. At the moment, the keycard designally displays the coded information to him, i. the number field with the exchanged numbers, see Fig. 4B. He clicks on the display with the simulated pointer symbol one after the other corresponding to his PIN

Buttons on. Then he presses the confirm button and the positions of the pointer icon when clicked are sent to the server.

The bank server receives the sequence of user input. Because the bank server itself has created the marking of the buttons of the number field with the exchanged numbers and remembered the exchange, he can reconstruct from the inputs the number entered by the bank customer. He compares this reconstructed number sequence with the PIN for the bank customer, which of course is also stored. If that was the correct PIN, the bank customer gets access to the account.

Listening malware on the computer used by bank customers, or on the Internet has no chance to listen to the PIN: the positions of the pointer icon when clicking have no meaning, as long as the interchanging of the numbers on the number field is not known. However, this only knows who has the key used, and these are according to the assumption only the bank server and the key card or its owner.

The bank customer gets so with the knowledge of the PIN and the physical possession of the key card access to his bank account. Only one of them is not enough. The method thus protects the PIN twice: firstly, it can not be heard, and if somebody else should come into its possession, it needs the key card: without it, it does not come into the account.

The following shows how the method thwarts a man-in-the-middle attack. The bank customer has successfully logged in and would like to make a transfer of 50 euros to X. For the decisive transfer information, account number, bank code and amount, the bank customer will be shown a new picture with buttons on the key card display by the server for each digit to be entered, see Fig. 5. The bank customer enters his data by input, eg by clicking on the pointing device - Button ("mouse clicks") on the buttons with the corresponding numbers (figs 5, 8 and 9) The consequences of the inputs are transmitted to the bank server, where the digit sequences entered by the bank customer are reconstructed Referral information (name of the recipient, transfer text), which consist of letters, types in the banker open in a form. Once the bank server has received and reconstructed all the information, it sends the bank account information, bank account code and amount again in coded form to the bank customer for confirmation. In addition, he has previously randomly generated a TAN, which he also encoded with this message sends. The bank customer sees the transfer information and the TAN in his keycard display. Now he has to enter the sent TAN open in a form and send it to the bank. The bank checks if the received TAN is the same as it had previously generated, and only in that case will the transfer be executed. Thus, if the bank server receives the correct TAN, the information about the actual transfer has reached the bank customer, not any pre-mirrored information. A man-in-the-middle attack is thus repulsed with this method.

A more user-friendly option for the bank transfer confirmation is the confirmation by clicking on randomly generated buttons on the display, see Fig. 6B.

It is also possible to enter all transfer data openly, so that the key card is only used when confirming the transfer data - as above, eg via TAN repetition or via mouse clicks. In that case, one has to make sure that the message sent by the server to the client has additional check boxes which make it impossible for an eavesdropper to locate in the message the transfer data known to the eavesdropper: in that case the eavesdropper could to recalculate this part of the key and even fake the message. For example, a solution with checkboxes looks like the message is being populated by the server with a fixed extra character at many random locations, and this padded message is encrypted and sent. The key card strokes the refill sign before displaying the message on the display. In a similar way, as the bank customer can confirm a transfer forgery-proof by means of a key card, the bank customer can also confirm debits from his account forgery-proof, eg when debiting his own account when buying online: if the bank server gets the debit order from the seller , sends the bank server (eg via email, or via link from the web page on which the purchase was made) after the tap-proof query PIN a coded confirmation message to the account holder. Thus, in principle, the debit is made to a transfer, the bank customer first confirmed with his PIN and then as in a transfer. When combining the key card with the debit card, the following safer variant for paying at a checkout (in the real world, eg supermarket, petrol station) is available: after reading the magnetic stripe, the cash register connects to the bank. The bank now acts like a debit, see previous paragraph, ie it sends the customer the debit information encrypted on a screen at the cashier. The customer puts his EC / key card on it. Now the debit can be confirmed by the customer as described in the paragraph above. Because of the security against eavesdropping and counterfeiting, fraudsters - on the customer or seller side - are not allowed to manipulate. So this process is safe and makes paying at checkout for the customer and the customer

Seller safer: Customer can be assured that the specified amount will be debited from the account of the specified seller for the specified product (and no other amount by anyone else). And the seller already has the amount in his account after the transaction.

For example, the split of the photosensors for the above protocol might look like this, see Fig. 2B and Fig. 7. The keycard has a grid of 8x15 photosensors that can distinguish black and white. The first three columns with their 24 photo sensors represent the number of the key, see Fig. 7A. Thus, the card can potentially store 2 ²⁴ different keys, that is more than 16 million: the That's enough to make all the actions that an online banking customer makes in his entire life with this key card. The next two columns with their 16 photo sensors are used to transmit the position of the pointer icon for the simulated pointer icon in the display, see Figure 7B. The remaining 10 columns are for the transmitted coded message, see Fig. 7C. The stored keys are of course also of this size. This means that a maximum of 2 ²⁴ keys with 80 bits each can be stored on this key card. Together they are 160 megabytes of information that could be stored on keys on the key card and also addressed by the 24 bits. This amount of information is for today's conditions no technical or cost problem, the so-called memory sticks, for example, have a multiple storage capacity. In other words, the keys to a lifetime of online banking easily fit on such a key card. Note: the 80-bit encoded message in the last 10 columns is only enough to display 24

Decimal point (2 ¹⁰ is about 10 ³ , so 2 ^{80 is} about 10 ²⁴ ). For this reason, you would have to omit the BLZ in the TAN confirmation, for example, or transmit two coded messages sequentially.

The bank obtains the key cards from a manufacturer. Out

For security reasons, the key cards should only get their final keys inside the bank building. For this reason, the key cards are delivered to the bank open by the manufacturer and with an accessible direct or indirect electrical connection to their memory components. The bank generates the keys and stores them (a) on their own and (b) on the accessible electrical connection - if necessary with a special device - on the key card. Only then will the key card be welded and / or sealed. Afterwards it can be delivered to the bank customer.

Claims

claims

1) Method for tapping and tamper-proof transmission of

Messages between a server and a client's computer through a computer network and decrypting encrypted ones

Messages by the client by means of a decryption device having a surface with photosensors, a display and a circuit logic, characterized by the following steps:

a) generating a set of keys and storing these keys on the server and on the decryption device of the client,

b) generating a message by the server, presenting an image with buttons randomly labeled with characters,

c) the encryption of the message by the server, the transmission of the encrypted message from the server to the computer of the client and the display of the encrypted message on the screen of the client,

d) holding the decryption device in front of the screen by the client,

e) detecting the brightness and / or color values that occur during

Displays the encrypted message on the client's screen, through which

Photo sensors of the decryption device, and the Transmission of the detected values to the circuit logic,

f) the decryption of the encrypted message by the circuit logic by means of a matching on the

Decryption device stored key through the circuit logic of the decryption device, wherein the decrypted message is visible on the display of the decryption device for the client,

g) the generation of a message by the client by sequentially activating the labeled buttons;

h) the transmission of the message generated by the client to the

Server by transmitting the information about which buttons the client has activated in which order,

i) the reconstruction of the message generated by the client by the server.

2) Method according to claim 1, characterized in that the

The message is encrypted by the server using the one-time-pad encryption method.

3) Method according to one of the preceding claims, characterized in that the decryption device is sealed after storing the key and / or welded.

4) Method according to one of the preceding claims, characterized in that a part of the messages sent by the server to the Calculator of the client, instead of the buttons or in addition to the buttons contains other information.

5) Method according to one of the preceding claims, characterized in that the activation of the labeled buttons by the operation of the connected to the computer of the client pointing device is done by means of a pointer icon.

6) Method according to one of the preceding claims, characterized in that the detection of the relative position of

Pointer symbol to the encrypted message on the screen of the client by means of photo sensors of the decryption device takes place.

7) Method according to one of the preceding claims, characterized in that the information about the relative position of

Pointer symbol on the screen of the client is transmitted to the display of the decryption device by means of the circuit logic of the decryption device in the form of a pointer icon on the display of the decryption device, so that the relative movements of the pointer icon on the display of the

Decrypting device substantially correspond to the relative movements of the pointer icon on the screen of the client.

8) Method according to one of the preceding claims, characterized in that the circuit logic is an error-correcting

Function, which is able to check the values transmitted by the photo sensors for possible errors and correct if necessary.

9) Method according to one of the preceding claims, characterized in that the pointer icon on the screen of the Client is made invisible or reduced to few pixels if it is in the area of the encrypted message.

10) Method according to one of the preceding claims, characterized in that the pointer device is a computer mouse, a

Touchpad, a trackpoint, a trackball, a graphics tablet, a joystick or a gamepad is.

11) Method according to one of the preceding claims, characterized in that the message transmitted by the server a

Identification of the key required for decrypting the encrypted by the server and transmitted to the computer of the client message contains key.

12) Method according to one of the preceding claims, characterized in that a part of the photo-sensors of the decryption device is provided for detecting the identification of the key.

13) Method according to one of the preceding claims, characterized in that a part of the photosensors of the decryption device for detecting the information about the relative position of the pointer icon is provided on the screen of the client.

14) Method according to one of the preceding claims, characterized in that the photosensors detect black-white and / or grayscale and / or color values and forward the detected value to the circuit logic of the decryption device.

15) Method according to one of the preceding claims, characterized in that the photosensors by image sensors, In particular CCD or CMOS image sensors, photocells, photodiodes or phototransistors are realized.

16) Method according to one of the preceding claims, characterized in that at least a part of the photosensors with

Lentils is provided.

17) Method according to one of the preceding claims, characterized in that the decryption device is provided with self-sufficient power supply, preferably with battery or photo elements, in particular with solar cells.

18) Method according to one of the preceding claims, characterized in that the transmission of the encrypted message from the server to the computer of the client and the detection of the

Brightness and / or color values resulting from the display of the encrypted message displayed on the screen of the client, through which the decrypting device photosensors are parallel or at least partially serial.

19) Method according to one of the preceding claims, characterized in that the characters on the buttons digits, letters and / or special characters.

20) Method according to one of the preceding claims, characterized in that the buttons labeled with characters represent a number field, wherein the number between 0 and 9 are respectively assigned to the individual buttons.

21) Method according to one of the preceding claims, characterized in that the message to be transmitted by the client to the server is a password, a PIN, a TAN or the like. 22) Method according to one of the preceding claims, characterized in that the decryption device is fixed to the screen for holding the decryption device in front of the screen by the client.

23) Method according to one of the preceding claims, characterized in that for fixing the decryption device to the screen, the decryption device is placed on the lower edge of the screen frame.

24) Method according to one of the preceding claims, characterized in that for fixing the decryption device to the screen, the decryption device is provided with adhesive strips, suction cups, hooks or clamps.

25) Method according to one of the preceding claims, characterized in that the decryption device is plugged for fixing to the screen in a pocket or a housing, which are provided with adhesive strips, suction cups, hooks or clamps.

26) Device for decrypting tagged

Messages displayed on a screen, characterized in that it contains the following elements:

a) memory, suitable for storing keys with

Are provided and are suitable for decrypting encrypted messages,

b) Photosensors, the brightness and / or color values used in the

Display the encrypted message on the Screen, detect and transmit to the circuit logic,

c) display,

d) circuit logic which identifies from a portion of the values transmitted by the photosensors the identification of the appropriate key, identifies the encrypted message from another part of the values transmitted by the photosensors, decrypts that encrypted message with the identified key and displays it on the display.

27) Apparatus according to claim 26, characterized in that the circuit logic part of the transmitted from the photosensors

Values identified as a position indication for the display and according to this position indication a pointer icon on the display.

28) Device according to one of claims 26 to 27, characterized in that the circuit logic has an error correcting function, which is able to check the values transmitted by the photosensors for possible errors and correct if necessary.

29) Device according to one of claims 26 to 28, characterized in that the photosensors detect black-and-white and / or grayscale and / or color values.

30) Device according to one of claims 26 to 29, characterized in that the photosensors by image sensors, In particular CCD or CMOS image sensors, photocells, photodiodes or phototransistors are realized.

31) Device according to one of claims 26 to 30, characterized in that at least a part of the photosensors with

Lentils is provided.

32) Device according to one of claims 26 to 31, characterized in that the photosensors the brightness and / or color values when displaying the encrypted message on the

Screen arise, parallel or at least partially detect serially and transmitted to the circuit logic.

33) Device according to one of claims 26 to 32, characterized in that the circuit logic of the of the

Photo sensors serially detected and transmitted to the circuit logic values can reconstruct the encrypted message.

34) Device according to one of claims 26 to 33, characterized in that it is provided with self-sufficient energy supply, preferably with battery or photo elements, in particular with solar cells.

35) Device according to one of claims 26 to 34, characterized in that it is sealed, welded and / or shielded against radiation.

36) Device according to one of claims 26 to 35, characterized in that it has no external terminals and / or switches. 37) Device according to one of claims 26 to 36, characterized in that it is functional as soon as it gets enough energy, and / or if the photosensors detect a specific pattern of brightness and / or color values.

38) Device according to one of claims 26 to 37, characterized in that it is provided with adhesive strips, suction cups, hooks or clamps.

39) Device according to one of claims 26 to 38, that it with a

Bag or a housing having adhesive strips, suction cups, hooks or brackets.

40) Device according to one of claims 26 to 39, characterized in that it additionally has the function of a debit and / or a credit card.

41) Device according to one of claims 26 to 40, characterized in that it is installed in a digital camera or a camera phone.

42) Computer program product for performing the method according to one of claims 1 to 25, when the computer program is executed on a processor.

43) Computer program product for carrying out the method according to one of claims 1 to 25, when the computer program is executed on the processor in the computer of the client.

44) Computer program product for performing the method according to one of claims 1 to 25, when the computer program is executed on the processor in the decryption device. 45) Use of the method, the computer program product, the server or the device according to one of the preceding claims in online accounts, in particular for online banking and business accounts