Personal digital signer for Internet banking

Abstract

Cryptographic protocols such as SSL make possible to provide secure communication over insecure networks. But these protocols are useless if a man-in-the-middle attack is done on the user's computer, and domestic operating systems (like MS Windows) generally offer little protection against this kind of attack. Online banking and e-commerce can be especially affected as they rely on data sent over Internet, normally from PCs with nearly no protection against hostile attacks. Through this paper we will propose a new digital signer device that not only provides a tamper proof storage for the cryptographic keys but also provides its own display and keyboard. This system improves the security provided by smart cards avoiding its dependency on the computer to interface with the user. Even more, in order to pass the data to be signed to the digital signer, we use the computer monitor which is always present on any computer. For that purpose data is represented by color changes. This makes it possible to implement the digital signer as a pocket device similar in size to a smart card.