Patent Application
20050149739
Each day in the United States alone over 100 million transactions aggregating $5 Billion are authorized and initiated by cardholders at over 400,000 Automated Teller Machines (ATMs) and seven million Point-of-Sale (POS) terminals. Securing the massive daily financial flow against fraud and loss relies upon protecting and verifying cardholder Personal Identification Numbers (PINs) using methods, structures, and cryptographic algorithms originating over twenty-five years ago.
Data security systems, such as financial systems, use security techniques and systems originating in the early 1980s that were based on technologies created in the late 1970s. Computational power, cryptanalytic knowledge, breadth of targets, and creative ingenuity accessible to potential attackers have grown dramatically since origination of the systems, while defensive technologies have scarcely evolved.
The Personal Identification Number (PIN) is a basic construct for establishing identity and authorization or consumer financial transactions. In a typical transaction, a PIN is used in finance industry applications to authorize an electronic funds transaction initiated by an entity such as a customer. A magnetic stripe card or smart card is intended for usage to identify the customer in combination with a PIN that is known to the customer but otherwise is secret.
Current PIN verification techniques are now known to be cryptographically weak, resulting in a PIN security vulnerability that even exceeds weaknesses in underlying keys and algorithms. These weaknesses can be attacked by an adversary, potentially resulting in a loss of data security.
Present-day financial and commercial transaction systems predominantly use cryptographic algorithms with known weaknesses. Security difficulties afflict several techniques. One technique determines a PIN offset as a modulus 10 difference of a natural PIN and a customer-selected PIN. The natural PIN is formed by receiving the first leftmost bits of the output data from a Data Encryption Standard algorithm. Another algorithm uses the same algorithm with parameters which select the natural PIN beginning with any digit in the hexadecimal output.
One difficulty is that the single Data Encryption Standard (DES) key used in techniques is too short (56 bits) to attain adequate security. In addition, the first technique is unforgiving if a PIN is compromised. Another problem is that the input data to the algorithm is not secret.
A difficulty with existing handling relates to the relationship of the natural PIN, the entered PIN, and the PIN offset. If a PIN is compromised, then an adversary can use the PIN offset to compute a new PIN chosen by the customer. Accordingly, selection of the new PIN does not attain security once a PIN is compromised. The only way to recover security is for the bank or other issuing entity to change either the customer account number or the bank's PIN verification key. Changing the customer account number is difficult for the bank, and changing the PIN verification key is even more difficult. Accordingly, an easy attack against that PIN is available.
In accordance with an embodiment of a data security system, a PIN verification apparatus comprises a plurality of cipher blocks linked in a Cipher Block Chain (CBC) and keyed with a secret PIN Verification Key (PVK). A first input block is coupled to a first cipher block in the CBC chain and is configured to receive a plaintext block derived from a secret PIN. A second input block is coupled to a second cipher block in the CBC chain capable of receiving a plaintext block derived from a non-secret entity-identifier and ciphertext from a cipher block in the CBC chain.
Embodiments of the invention relating to both structure and method of operation, may best be understood by referring to the following description and accompanying drawings.
Referring to
In an illustrative embodiment, the PIN verification apparatus 100 can further comprise a logical operator 106A that exclusive-ORs the plaintext block derived from the secret PIN with an initialization vector (IV) to produce an initialized block. A first encryptor cipher block 102A encrypts the initialized block, for example using triple Data Encryption Standard (3-DES) encryption, to produce a first ciphertext block C1108A. A logical operator 106B exclusive-ORs the plaintext block derived from the non-secret entity-identifier with the first ciphertext block C1108A to produce a chained block. A second cipher block encryptor 102B encrypts the chained block, for example using triple Data Encryption Standard (3-DES) encryption, to produce a second ciphertext block C2108B.
Although the illustrative embodiment includes a plurality of cipher blocks 102A, B that encrypt data according to a triple Data Encryption Standard (3-DES), in other embodiments the cipher blocks 102A, B may encrypt data according to other definitions including, for example, an Advanced Encryption Standard (AES) definition. Triple Data Encryption Standard (3-DES) is a higher security encryption technique based on the Data Encryption Standard (DES) described in Federal Information Processing Standards (FIPS) Publication 46-2, of Jan. 15, 1977. Triple DES is simply three DES encryptions in a sequence, commonly with three different keys. American National Standards Institute (ANSI) X9.52 standard defines triple-DES encryption with keys k1, k2, k3 as C=Ek, (Dk
Implementation of the AES definition causes the encryption block size to increase from 16 hexadecimal digits to 32 hexadecimal digits. Using an Electronic CookBook (ECB) mode of AES encryption enables inclusion of all PIN and account number information in plaintext blocks P1 and P2.
The PIN verification apparatus 100 can further comprise formatters that format plaintext for application to the cipher blocks 102A, B. In an illustrative embodiment, a first formatter 110A is configured to construct a first incoming plaintext block from a concatenation of a length digit and x hexadecimal digits of the secret Personal Identification Number (PIN) with 16−(x+1) rightmost hexadecimal digits of the non-secret entity-identifier. A second formatter 110B is configured to construct a second incoming plaintext block from a concatenation of y hexadecimal digits of the non-secret entity-identifier, such as a Primary Account Number (PAN), with a pad character that is repeated 16-y times.
The number of digits x in the PIN is typically in a range from four to twelve. The length value is a hexadecimal character representing the length of the PIN. For example, if the PIN length is 12, then the length is a hexadecimal value ‘C’. The number of digits y in the PAN is normally 14-16. The right PAN is the rightmost 16−(x+1) digits of the PAN. The pad is the predetermined pad digit or digits that are applied if y is less than sixteen.
The first formatter 110A receives a one digit PIN length and the Personal Identification Number (PIN), a secret value that is either generated or entity-selected, for example customer-selected, for enrollment. Typically, the customer enters the PIN and a keypad supplies the PIN length. After enrollment and during a customer transaction, the PIN is entered at a terminal for verification.
The second formatter 110B receives an entity-identifier, such as the Primary Account Number (PAN). The entity-identifier is padded with a fixed hexadecimal character, for example ‘A’, to produce a length of 16 hex characters for triple-DES. Similar padding in the case of Advanced Encryption Standard extends the entity-identifier to 32 hex characters. The entity-identifier is non-secret and, in many systems, is stored on a magnetic stripe card for usage in a transaction.
The PIN verification apparatus 100 can include a format converter 112 coupled to a cipher block 102A, B in the CBC chain that is capable of converting hexadecimal digit ciphertext to a decimal result by scanning the hexadecimal digit ciphertext, selecting a predetermined number of numeric digits, and generating output digits as a PIN Verification Value (PVV). Decimalization can be performed using any reasonable or substantially unbiased decimalization algorithm, which does not use a decimalization table. In some conditions, the PVV can be in the form of a specified number of hexadecimal digits. Whether in decimal or hexadecimal form, the number of output digits is typically at least twelve, the length of the longest PIN.
The PIN Verification Value (PVV) can be recorded on the magnetic stripe card and can be sent via network to a server or host where PIN verification is performed. If the PVV is not recorded in the magnetic stripe card, then the PVV can be stored on a database at the server where PIN verification takes place. The server sends an acknowledgement and permission to proceed with the transaction for an approved verification, or sends denial of permission.
The illustrative PIN verification apparatus 100 operates in a reversible mode that enables an issuer, such as an issuer bank, to securely recover an entity's secret PIN, such as a customer PIN, if desired according to the issuer's PIN management policies.
Referring to
The alternative embodiment PIN verification apparatus 120 operates in an irreversible mode so that, after enrollment, the PIN cannot be recovered by techniques other than an exhaustive PIN search. The irreversible mode may have an option at enrollment to escrow data, enabling recovery of an entity PIN in a secure off-host operation. In the illustrative embodiment, the PIN verification apparatus 120 further comprises a PIN escrow processing block 126 coupled to receive ciphertext C2108B from the cipher block 102B. The PIN escrow processing block 126 provides the option for the second ciphertext block C2108B to be split into one or more secret shares. The shares can be supplied to multiple different databases, for example A1 and A2. Division of secure data into multiple parts increases security. PIN escrow storage 128 stores escrow data from the PIN escrow processing block 126.
In irreversible mode, even if all sixteen digits of the third ciphertext block C3124 are retained as a PIN Verification Value (PVV), the PIN is generally only retrievable by using the ciphertext block C2 escrow.
Selection between reversible and irreversible mode is optional, depending on the security policies of an organization supporting the cards. Some institutions may wish to recover the PIN for various purposes.
Referring to
In a Cipher Block Chain (CBC), results from an encryption block are fed back to the input block of the next encryption block. Each encryption block in the chain receives plaintext input data, which is exclusive-Ored with results from the previous cipher-text block, then encrypted. As a result, encryption of each block depends on results from all previous blocks. Accordingly, a corresponding decryption side processes all encrypted blocks sequentially using a random initialization vector that is exclusive-OR'ed with the first data block before encryption.
The initialization vector can be public or secret. In various embodiments, the initialization vector can be a random number or a serial number, to ensure unique encryption of each message. An encryption error, for example due to transmission failure, garbles the block with the error and causes bit errors in the subsequent block at the same positions as the original erroneous block. Subsequent blocks are not affected by the error so that CBC is self-recovering from bit errors, although not from synchronization errors. Bits added or deleted from the cipher-text stream cause garbling of all subsequent blocks.
The Cipher Block Chaining Message Authentication Code (CBC MAC) specifies that a message x=x1, . . . , xm can be authenticated among parties who share a secret key a by tagging x with a prefix of:
fam(x)=fa(fa(. . . fa(fa(x1)xor x2)xor . . . xor xm-1)xor xm),
where f is an underlying block cipher, such as an encryption definition or standard, and a is a secret key.
Referring to
In an embodiment of a reversible form of PIN verification, a Personal Identification Number (PIN) is presumed to be represented by a PIN length character, x hexadecimal digits, and an entity-identifier or account number, such as a Primary Account Number (PAN), is presumed to include y hexadecimal digits. In the American National Standards Institute (ANSI) financial environment, the PIN is assumed to include no more than twelve hexadecimal digits and the account number has a length of sixteen digits or fewer.
Two plaintext blocks P1 and P2 are formed in which P1 is defined as the concatenation of one digit specifying the PIN length, followed by the x digits of PIN along with the 16−(x+1) rightmost digits of the account number. The resulting plaintext block is 16 hexadecimal digits in length and is thus equal to the block length of the triple Data Encryption Standard (3-DES) algorithm. The second plaintext block P2 is constructed by concatenating the y digits of the account number with a pad character which is repeated 16-y times. The pad character is fixed in the algorithm and is not available as input data to the algorithm. The result is two plaintext blocks P1 and P2, each having a length of sixteen hexadecimal digits.
The PIN verification technique using 3-DES can use Cipher Block Chain (CBC) mode since CBC mode facilitates usage of the full 16-digit length which may be desirable to ensure uniqueness of account numbers.
In some systems or circumstances, for example if a more rapid response or only a single 3-DES cycle is desired, information in the account number may be reduced by hashing down to fewer hexadecimal digits, such as four digits. As an alternative to hashing to reduce the number of digits, the account number may be truncated, for example by selecting only the least significant four account number digits. Accordingly, the PIN and the reduced information relating to the account number can be contained in the single plaintext block P1.
In the triple-Data Encryption Standard (3-DES) input data is effectively encrypted three times. Many techniques can be used for the encryption. In one example, ANSI X9.52 standard defines triple-DES encryption with keys, k1, k2, k3 according to an equation of the form:
C=Ek3(Dk2(Ek1(M))),
where Ek and Dk denote DES encryption and DES decryption, respectively, with the key k. The encryption mode is sometimes termed DES-EDE. Another encryption variation is termed DES-EEE that comprises three consecutive encryptions. Three keying options are defined in ANSI X9.52 for DES-EDE. In one option, the three keys k1, k2, k3 are independent. In another option, keys k1 and k2 are independent while k1=k3. In the third option, all three keys are equal, enabling triple-DES backward compatibility with DES.
Although the illustrative embodiment describes a technique using triple-DES encryption, in other embodiments other encryption definitions may be used such as Advanced Encryption Standard (AES) definition, and the like.
The technique 300 can further comprise actions including, for systems and conditions that use a decimal result, converting hexadecimal digit ciphertext generated by a final ciphertext block in the Cipher Block Chain (CBC) to a decimal result by scanning the hexadecimal digit ciphertext, selecting a predetermined number of numeric digits, and generating output digits as a PIN Verification Value (PVV); and using the PVV for PIN verification.
In some circumstances or systems, the PIN Verification Value (PVV) may be supplied in a hexadecimal form. Accordingly, the method 300 may include supplying hexadecimal digit ciphertext generated by a final ciphertext block in the Cipher Block Chain (CBC) as a PIN Verification Value (PVV).
Referring to
In the irreversible form, the second ciphertext block C2 can be stored in escrow to facilitate recovery of the secret PIN.
Referring to
A first operation, shown in
Referring to
Referring to
Also referring to
Referring to
The illustrative embodiments have several characteristics indicative of improved security. The cryptographic algorithm used in the techniques, such as triple-Data Encryption Standard (3-DES) and Advanced Encryption Standard (AES) definition lengthen the key to enable improved security. The illustrative systems and techniques enable usage of all digits of the account number in the verification process, for example using Cipher Block Chaining (CBC) in combination with triple-DES. Combination of the PIN with the account number for usage as direct input entries into the cryptographic algorithm improves security by hiding the secret PIN as early as possible. PIN Verification Value (PVV) data is variable in length and can be decimalized for storage on track 1 and/or track 2 of the magnetic stripe card.
The structure of the illustrative PIN verification techniques is secure in conditions of PIN or account number changes.
The illustrative systems and methods can be implemented using fast techniques such as fast 3-DES operations or very fast key set-up for usage of AES.
While the present disclosure describes various embodiments, these embodiments are to be understood as illustrative and do not limit the claim scope. Many variations, modifications, additions and improvements of the described embodiments are possible. For example, those having ordinary skill in the art will readily implement the steps necessary to provide the structures and methods disclosed herein, and will understand that the process parameters, materials, and dimensions are given by way of example only. The parameters, materials, and dimensions can be varied to achieve the desired structure as well as modifications, which are within the scope of the claims. Variations and modifications of the embodiments disclosed herein may also be made while remaining within the scope of the following claims. For example, although the illustrative techniques and systems are applied using magnetic stripe cards, smart cards may alternatively be used, although the illustrative technique does not employ the full capabilities of a smart card.
