Lloyds TSB has installed a product to manage and authenticate customers using small tokens generating a new password every 30 seconds.
The Cryptomathic Authenticator is on trial with 30,000 internet banking customers.
On October 14, Lloyds TSB announced the trial of a new security system for internet banking, based on two-factor authentication. Each customer in the trial receives a keyring-sized security device, which generates a six-digit code to be used alongside their username and password. The news was received with interest by the business press and was reported on the BBC radio, television and online media and in national newspapers.
The technology that enables this is an Authentication Server installed at the bank end, delivered by Cryptomathic. The product from Cryptomathic’s division in the Cambridge Science Park, UK, and developed in its HQ in Aarhus, Denmark, is in its third generation.
The Authenticator is capable of verifying 500 secured transactions per second, and can be scaled to manage even higher volumes, it is claimed. The guaranteed uptime for a single server on a Microsoft platform is 99.7pc, which can be increased with the addition of fail-over machines. By using tamper resistant hardware (HSMs) all keys are protected against any kind of exposure, according to the makers. In addition the server provides advanced independent auditing measures, which simply makes insider attacks completely infeasible, the makers claim. The core hardware component of this authentication engine is provided by nCipher, one of Cryptomathic’s partners.
The Authenticator allows a bank to choose among a variety of customer authentication mechanisms (SMS OTP, CAP, Card and Reader, TAN cards, etc), as well as offering a number of additional features indispensable for Internet and telephone banking, according to the product firm.
