Connected mode

Protecting smart card pin

An alarming number of applications continue to use smart cards that are inadequately protected with static PINs. Applications such as PKI, or online banking applications are exposed to Trojans or key loggers if they rely simply on static PIN entry on the keyboard for smart card transactions. Digipass 870 provides the secure advantage of entering the PIN directly on the reader and not on the computer keyboard. Therefore, the PIN is never available on the PC platform. Similarly, smart card PIN changes can be securely performed using the Digipass 870 keyboard. Furthermore, a firewall mechanism protects the card from unauthorized access.

See it before you sign it

Digipass 870 has a full dot matrix display allowing extended data field validation on the Digipass screen. The large screen sets a new standard for e-signature offering high transaction security thanks to the “what you see is what you sign” (WYSIWYS) capability. With WYSIWYS, the user will validate the key data on his Digipass 870 display before he signs the transaction.

Reader signature and multi secure channel

The bank which issues Digipass 870 to its customers can verify that a transaction is approved and signed by his customer with a genuine card reader. When that same transaction is signed by an unauthorized reader it is fully detectable. The enduser can trust the data he digitally signed since they were displayed in the secure environment of a trusted reader. During the transaction, banks can even send messages to the user through a secure channel which can be easily implemented in any bank’s security infrastructure.

Easy deployment, installation and use

Digipass 870 uses a standard driver compliant with all popular operating systems such as Windows, Linux and MacOS. Digipass 870 does not require the installation of a separate driver on most of the popular PC platforms. The reader is not personalized and as a result can randomly be distributed to customers without compromising their security and benefitting deployment to large customer bases.

Firmware update optional

As an option, the Digipass 870 supports secure firmware update. Digipass 870 firmware and applications can be updated by the bank which issues the card reader at any time even when Digipass 870 has already been issued to the enduser, making use of proven and standard cryptographic mechanisms.

Unconnected mode

When used in unconnected stand-alone mode, Digipass 870 offers the same functionality as other Digipass unconnected, including strong authentication and e-signatures. Digipass 870 is perfectly suited for environments with high security requirements including digital signatures, secure PIN verification, corporate network access, strong authentication (internet banking), e-commerce transactions, etc.

 

Digipass 870 can be delivered with a wide variety of applications including MasterCard CAP, Visa Dynamic Passcode Authentication (DigipassA) and various domestic and proprietary schemes. The reader leverages the inherent security of chip cards to store secrets with cryptographic calculations for maximum efficiency. For each function, Digipass 870 uses a different cryptographic key to generate one-time passwords and e-signatures.

How to sign transactions in connected mode

Digipass 870 is directly linked to the bank system via a secure connection:

1. Digipass 870 will display the transaction information (amount , account number, etc.)
2. The user confirms each data field separately or the full transaction as displayed on the screen of the device
3. Enter your PIN code and press the ‘OK’ button. The transaction is signed using the ‘what-you-see-is what-you-sign’ functionality

How to log-on to your account in unconnected mode

4. Insert your card into the slot of Digipass 870 and press the login function button
5. Enter the challenge value provided to you on the bank’s webpage
6. Enter your PIN code. The reader displays a response code (one-time-password)
7. Enter the response code in the application. The bank will validate the code and grant user access