M2M
fraud prevention and identity proofing.
Replay attack
Replay attack
In the process of verifying that the user is correct, the server system exchanges encrypted data such as electronic signatures between users. In the meantime, a third-party hacker tries to impersonate a legitimate user by copying
the data that is in transit on the network and then transmitting it to the server as it is.
For example, if an industrial robot that performs a service based on recorded data is subjected to a replay attack,
it may not be able to perform normal tasks and may endanger workers nearby.
Impersonation attack
Impersonation attack
In a modern factory system, numerous machines are paired and operated for efficient production.
An impersonation attack is tricked into being a device connected to each other using a persistent encryption key
or a long-term key used when multiple devices are first paired. Since the mutual authentication process is no
longer required, the attacker controls the devices as the master.
OTAC in M2M
Machine to Machine (M2M) Authentication
Why swIDch
that provides all of the following features, tested and substantiated
by the University of Surrey technical report
Sufficient to IDENTIFY user
that does NOT duplicate
in off-the-network environment
OTAC is a dynamic code, which means the code keeps changing. As a result, you don’t need to worry about any leak of your personal information, such as
your card details, because the codes must have already been changed when others try to use them.
The network connection is NOT necessary at all for generating OTAC.
Reducing an authentication stage that requires the network connection directly means there are fewer gateways for
the hackers to access our personal information.
Moreover, this feature enables users
to authenticate even when they are
in networkless environments, such
as on the plane, underground, rural or foreign areas.
swIDch can guarantee that the code never duplicates with anyone
at any given moment.
There is NO chance of someone else having the same code.
The users or their devices can be identified with the code alone.
Once OTAC has been generated, providing OTAC alone is already fully sufficient to identify the user as the code is unique.
It means, you can forget about the bundles of static information including IDs and passwords.