Two Factor Authentication Using Mobile Phones

Abstract In our project security and authentication plays a major role. It can be mainly used in online banking or ATM machines. The mobile phone acts as a security token for authentication. The user login’s the ATM machine by scratching the card and entering the password. For providing more security separate token number is used for performing the banking operation like money withdrawal, checking the balance etc. This token number is generated using the SHA algorithm and XOR operation. The user mobile number, IMEI number, pin number and IMSI number were included to generate the token number. The token number is a six digit random number that were obtained from the included number. The token number is sent to the user mobile. This token number is given for accessing or performing the banking operations. The token number is generated for every interval of time. For more than three times if the user gives any invalid pin number the ATM card is blocked. In our project security and authentication plays a major role. It can be mainly used in online banking or ATM machines. The mobile phone acts as a security token for authentication. The user login’s the ATM machine by scratching the card and entering the password. For providing more security separate token number is used for performing the banking operation like money withdrawal, checking the balance etc. This token number is generated using the SHA algorithm and XOR operation. The user mobile number, IMEI number, pin number and IMSI number were included to generate the token number. The token number is a six digit random number that were obtained from the included number. The token number is sent to the user mobile. This token number is given for accessing or performing the banking operations. The token number is generated for every interval of time. For more than three times if the user gives any invalid pin number the ATM card is blocked.

Existing System In the existing system, only the scratch card and the pin number were considered for accessing the ATM machine. But in case of lost or theft of scratch card the account can be easily accessed by the unauthorized user. This is not secure and not reliable for account maintenance. In the existing system, only the scratch card and the pin number were considered for accessing the ATM machine. But in case of lost or theft of scratch card the account can be easily accessed by the unauthorized user. This is not secure and not reliable for account maintenance.

Proposed System In the proposed system, mobile phone is used for security and authentication. Here a token number is generated using the user mobile number, IMEI number, pin number and IMSI number. The SHA algorithm and XOR operation were used for the generation of token number. The generated token number is sent to the user mobile and only by entering the token number the user can access the ATM machine.

Modules  Login Module  Token Generation Module  SMS Module  ATM Process Module

System Architecture

DATA FLOW DIAGRAM Internal Data Flow

DATA FLOW DIAGRAM External Data Flow External Data Flow

Methodologies Step-1: New user account is created. Step-1: New user account is created. Step-2: Existing user is logged in by scratching the card and entering the pin number Step-2: Existing user is logged in by scratching the card and entering the pin number Step-3: The token number is generated. Step-3: The token number is generated. Step-4: The IMEI number, IMSI number, user name and pin number were considered for token number generation. Step-4: The IMEI number, IMSI number, user name and pin number were considered for token number generation. Step-5: The SHA256 algorithm is used for generating the Hash message. Step-5: The SHA256 algorithm is used for generating the Hash message. Step-6: This Hash message is taken and XOR operation is made. Step-6: This Hash message is taken and XOR operation is made. Step-7: Then the XOR-ed message was encoded using Base64 algorithm. Step-7: Then the XOR-ed message was encoded using Base64 algorithm. Step-8: From the encoded message a random six digit output is taken as token number. Step-8: From the encoded message a random six digit output is taken as token number. Step-9: The generated token number is sent to the account holder mobile number. Step-9: The generated token number is sent to the account holder mobile number. Step-10: With the help of the token number the user performs various operations like withdrawal, checking account balance etc. Step-10: With the help of the token number the user performs various operations like withdrawal, checking account balance etc.

Software & Hardware Requirements Software Requirements Software Requirements Java1.5 or More Java1.5 or More JSMS JSMS MS-SqlServer MS-SqlServer Hardware Requirements Hardware Requirements Hard disk:40 GB Hard disk:40 GB RAM :128mb RAM :128mb Processor:Pentium Processor:Pentium Mobile Phone With Data Cable Mobile Phone With Data Cable

References [1] A. Jøsang and G. Sanderud, “Security in Mobile Communications: Challenges and Opportunities,” in Proc. of the Australasian [1] A. Jøsang and G. Sanderud, “Security in Mobile Communications: Challenges and Opportunities,” in Proc. of the Australasian information security workshop conference on ACSW frontiers, 43-48, information security workshop conference on ACSW frontiers, 43-48, [2] Aladdin Secure SafeWord Available at securecomputing.com/index.cfm?skey=1713 [2] Aladdin Secure SafeWord Available at securecomputing.com/index.cfm?skey=1713http://www [3] A. Medrano, “Online Banking Security – Layers of Protection,” Available at Banking-Security--- [3] A. Medrano, “Online Banking Security – Layers of Protection,” Available at Banking-Security--- Layers-of-Protection&id= Layers-of-Protection&id= [4] B. Schneier, “Two-Factor Authentication: Too Little, Too Late,” in Inside Risks 178, Communications of the ACM, 48(4), April [4] B. Schneier, “Two-Factor Authentication: Too Little, Too Late,” in Inside Risks 178, Communications of the ACM, 48(4), April [5] D. Ilett, “US Bank Gives Two-Factor Authentication to Millions of Customers,” Available at [5] D. Ilett, “US Bank Gives Two-Factor Authentication to Millions of Customers,” Available at financialservices/0, , ,00.htm financialservices/0, , ,00.htm [6] D. de Borde, “Two-Factor Authentication,” Siemens Enterprise Communications UK- Security Solutions, Available at [6] D. de Borde, “Two-Factor Authentication,” Siemens Enterprise Communications UK- Security Solutions, Available at [7] A. Herzberg, “Payments and Banking with Mobile Personal Devices,” Communications of the ACM, 46(5), , May [7] A. Herzberg, “Payments and Banking with Mobile Personal Devices,” Communications of the ACM, 46(5), , May [8] J. Brainard, A. Juels, R. L. Rivest, M. Szydlo and M. Yung, “Fourth- Factor Authentication: Somebody You Know,” ACM CCS, [8] J. Brainard, A. Juels, R. L. Rivest, M. Szydlo and M. Yung, “Fourth- Factor Authentication: Somebody You Know,” ACM CCS, [9] NBD Online Token. Available at NBD_CDA/CDA_Web_pages/Internet_Banking/nbdonline_topbanner [9] NBD Online Token. Available at NBD_CDA/CDA_Web_pages/Internet_Banking/nbdonline_topbannerhttp:// [10] N. Mallat, M. Rossi, and V. Tuunainen, “Mobile Banking Services,” Communications of the ACM, 47(8), , May [10] N. Mallat, M. Rossi, and V. Tuunainen, “Mobile Banking Services,” Communications of the ACM, 47(8), , May 2004.