Understanding The ATM, PIN Security, And Biometric Authentication Systems

Advantages of Using Automated Teller Machines

Write about the Fundamentals of InfoSec in Theory and Practice.

ATM is an electronic device that helps to withdraw money without going to the bank. It is extremely effective and is present in every city, village or country in the world. The customer, who is withdrawing money, should have a valid bank account with balance in it (De Gramatica et al., 2015). The major advantage of this electronic device is that there is no time restriction and the client can withdraw his or her money anytime. Moreover, a huge amount of money could be extracted from the account and thus it is extremely advantageous for the customer.

The ATM or the Automated Teller Machine users are solely provided with personal identification number or PIN and an ATM card. The presence of both of these is required for any transaction. This PIN is a unique number of four digit and it is kept hidden or private. There are three basic requirements for maintenance of privacy and security in the PIN and other bank account details (Peltier, 2016). These are known as CIA or simply confidentiality, integrity and availability. The descriptions of these three requirements with proper examples are given below:

1. i) Confidentiality: The most important requirement for any ATM card is confidentiality. This can be referred to as privacy. This confidentiality is maintained by the customers by not sharing the credentials with the other users so that the data is not hacked at any cost.

The degree of importance of the confidentiality factor is extremely high as the PIN could easily be utilized for any type of illegal activities by the hackers.

The two examples of confidentiality are as follows:

1. i) ATM card and PIN should be present to make the transaction.
2. ii) If the credentials would be lost, hackers would utilize them.
3. ii) Integrity: It helps to maintain the data integrity and so that no data is altered at any cost (Siponen, Mahmood & Pahnila, 2014).

The degree of importance of the integrity factor is extremely high as if the data would be changed, it could be used by the hackers.

The two examples of integrity are as follows:

1. i) Altering data of ATM card and PIN.
2. ii) Unintentional change of data.

Availability: The availability of relevant information and the hardware is required for making the transaction (Von Solms & Van Niekerk, 2013).

The degree of importance of the availability factor is high as without the information and hardware, transaction will not be made.

The examples of availability are as follows:

1. i) Absence of hardware will not allow transaction.
2. ii) Absence of information will not allow transaction.

According to the given scenario, a thief has broken the Automated Teller Machine or an ATM after using a screwdriver and finally has jammed the card reader of that particular ATM machine. Next, this thief has broken the five keys from the keypad of the ATM.

Meanwhile, a customer gets in the ATM for withdrawing cash. He is successful in withdrawing cash, however unsuccessful in taking out the card; since the card reader is jammed. He thus, goes out for calling of help for getting out his ATM card from the machine.

PIN Security: Confidentiality, Integrity, and Availability

The thief now wants to discover the PIN of the customer.

Total number of keys in PIN= 4

Total number of keys broken by the thief = 5.

Therefore, the total number of possibilities of permutation of the four keys is give below:

5P₄ = 5!/(5 – 4)! = 5!/4! = 120.

Hence, the thief can detect up to 120 ways of permutation.

However, there is a restriction of 3 times in every ATM. After the third wrong attempt, the card would be blocked.

Biometric authentication systems are utilized for the proper and systematic identification of any specific individual with the help of his or her biological features. The identity of the user is verified with this type of system and thus is extremely effective and popular in respect to others (Bhagavatula et al., 2015). The methods of the biometric authentication are utilized for the protection of several types of systems. The logical systems that are facilitated through the access points of hardware to all the physical systems that are protected by the physical barriers, like secured research sites and secured facilities, are secured with biometric.

There are various types of biometric authentication systems that are utilized for successfully identifying the individuals. The most popular types are the fingerprint recognition, face recognition, scanning of iris, cornea, and hand palm, and voice recognition. These biometric authentication systems help the individual to protect their valuables or get entry to any secured or protected building (Frank et al., 2013). The most significant benefit of this type of system is that fake data or information is restricted. A database or an information system is present within the biometric system and the biological trait or data is matched with the previously existing data.

In spite of providing these benefits, few people do not want to use biometric authentication systems. There are eventually three major reasons for this type of phenomenon. The most significant reasons for not using biometric system are as follows:

1. i) Resetting Password: The process of password resetting is complex and thus is not used by all individuals.

            There are various regulations like HIPAA and PCI-DDS that are used for resolving this problem.

1. ii) Lack of Data Accuracy: The next important problem is the lack of data accuracy as biometric systems does not provide 100% accuracy in data.

            Various metrics like FAR or FRR help in this type of situation. They are the False Acceptance Rate and the False Rejection Rate.

Requirement of Hardware: Biometric authentication systems require extra hardware for their systems and thus this is an extra expense for the organization or individual using biometric.

Cheap hardware is the best answer for this problem. 

Biometric Authentication Systems and Their Types

Biometric authentication system is absolutely simple and easy in installing. Hence this particular system is solely utilized many users. The offices or the educational institutes use this system for the attendance purpose as this attendance is often forged by the employees or students. The users of the system do not need to know anything regarding technology as it is very simple to use (Lu et al., 2015). Biometric authentication system even helps in securing the phones, laptops, tablets or any computing devices. Since, the biological traits are unique, it is nearly impossible to forge the data. Moreover, these types of traits or attributes could not be given or transferred to anyone. 

Two distinct types of biometric identification systems are present. One of them is based on the behaviour and the other is based on physiological features. The physiological features include fingerprint and face recognition, iris scan, cornea scan and many more. The behavioural features include voice, gait and behaviour of the individual.

There are various advantages of this biometric authentication system. The most significant advantage of this system is that it helps in the identification of the person uniquely and eventually. However, various disadvantages are also present within the biometric authentication system. Several situations occur, where the false negative rates of biometric are more serious than the false positive rates.

Two examples of this type of situations are given below:

1. i) Limited Access to Own Possessions: Often biometric authentication systems fail to recognize the authorized and authenticated users for their problem in the information systems or databases (Andress, 2014). These users thus could not access their own possessions and their access is restricted. This specific type of restriction is completely baseless; however the user faces this type of situation. Thus, the false negative rates are more dangerous and serious than the false positive rates.
2. ii) Fail to Identify Patients: The patients often fail to give biometric when they suffer from any type of disease like eye infections, heart attacks, burnt fingers and many more. They do not have the capability to give the biometric passwords in this situation and thus the system fails to identify them. Thus, in spite of being the authenticated user, they cannot access their own possessions (Xu, Zhou & Lyu, 2014). This is another important example of false negative rates being more dangerous than the false positive rates. 

The method of encrypting any plain text into the cipher text by shifting the characters or the group of characters to any regular system for constituting a permutation of that plaintext is known as transposition cipher in cryptography. The complete ordering of the units of that plaintext is changes or reordered (Singh, 2013). A bijective function is eventually utilized for encrypting the position of the characters of the plaintext and thus an inverse function is utilized for decrypting those characters’ positions. A specific algorithm is utilized for the purpose of encryption and decryption in transposition cipher.

One of the most simplified and an effective form of the transposition cipher is known as the rail fence cipher. It has got its name from the process of its encryption. In this type of cipher, the plain text to be converted is eventually written downwards, on the series of successive rails within a fence that is imaginary. Then it moves up and again comes down. This goes in a series and finally the plain text is converted to the cipher text and the cipher text is converted to a plain text.

Columnar transposition helps to use to the algorithm as many times as required for encryption. Thus, with the columnar transposition, the encryption could be done easily and promptly.

After using algorithms for Caesar cipher and substitution for George’s company, the cipher text could be decrypted.

Plain text: NTJWKHXK AMK WWUJJYZTX MWKXZKUHE

Substitution key: 234

A	B	C	D	E	F	G	H	I	J	K	L	M	N	O	P	Q	R	S	T	U	V	W	X	Y	Z
1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26

Encrypted Text	N	T	J	W	K	H	X	K
Numeric value	14	20	10	23	11	8	24	11
Substitution Key	2	3	4	2	3	4	2	3
Decoded from the substitution cipher	12	17	6	21	8	4	22	8
Shifting as Caeser cipher	3	3	3	3	3	3	3	3
Decoded from Caeser cipher	9	14	3	18	5	1	19	5
Decoded Text	I	N	C	R	E	A	S	E
Encrypted Text	A	M	K
Corresponding numeric value	1	13	11
Substitution Key	4	2	3
Decoded from substitution cipher	23	11	8
Shifting as Caeser cipher	3	3	3
Decoded from caeser cipher	20	8	5
Decoded Text	T	H	E

Encrypted Text	W	W	U	J	J	Y	Z	T	X
Corresponding numeric value	23	23	21	10	10	25	26	20	24
Substitution Key	4	2	3	4	2	3	4	2	3
Decoded from substitution cipher	19	21	18	6	8	22	22	18	21
Caeser cipher shift	3	3	3	3	3	3	3	3	3
Decoded from caeser cipher	16	18	15	3	5	19	19	15	18
Decoded Text	P	R	O	C	E	S	S	O	R
Encrypted Text	M	W	K	X	Z	K	U	H	E
Corresponding numeric value	13	23	11	24	26	11	21	8	5
Substitution Key	4	2	3	4	2	3	4	2	3
Decoded from substitution cipher	9	21	8	20	24	8	17	6	2
Shifting Caeser cipher	3	3	3	3	3	3	3	3	3
Decoded from caeser cipher	6	18	5	17	21	5	14	3	25
Decoded Text	F	R	E	Q	U	E	N	C	Y

Hence, the decrypted text for the provided text of NTJWKHXK AMK WWUJJYZTX MWKXZKUHE is INCREASE THE PROCESSOR FREQUENCY.  

References

Andress, J. (2014). The basics of information security: understanding the fundamentals of InfoSec in theory and practice. Syngress.

Bhagavatula, C., Ur, B., Iacovino, K., Kywe, S. M., Cranor, L. F., & Savvides, M. (2015). Biometric authentication on iphone and android: Usability, perceptions, and influences on adoption. Proc. USEC, 1-2.

De Gramatica, M., Labunets, K., Massacci, F., Paci, F., & Tedeschi, A. (2015, March). The role of catalogues of threats and security controls in security risk assessment: an empirical study with ATM professionals. In International Working Conference on Requirements Engineering: Foundation for Software Quality (pp. 98-114). Springer, Cham.

Frank, M., Biedert, R., Ma, E., Martinovic, I., & Song, D. (2013). Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication. IEEE transactions on information forensics and security, 8(1), 136-148.

Lu, Y., Li, L., Peng, H., & Yang, Y. (2015). An enhanced biometric-based authentication scheme for telecare medicine information systems using elliptic curve cryptosystem. Journal of medical systems, 39(3), 32.

Peltier, T. R. (2016). Information Security Policies, Procedures, and Standards: guidelines for effective information security management. CRC Press.

Singh, G. (2013). A study of encryption algorithms (RSA, DES, 3DES and AES) for information security. International Journal of Computer Applications, 67(19).

Siponen, M., Mahmood, M. A., & Pahnila, S. (2014). Employees’ adherence to information security policies: An exploratory field study. Information & management, 51(2), 217-224.

Von Solms, R., & Van Niekerk, J. (2013). From information security to cyber security. computers & security, 38, 97-102.

Xu, H., Zhou, Y., & Lyu, M. R. (2014, July). Towards continuous and passive authentication via touch biometrics: An experimental study on smartphones. In Symposium On Usable Privacy and Security, SOUPS (Vol. 14, pp. 187-198).