{"id":352,"date":"2015-03-13T13:44:23","date_gmt":"2015-03-13T10:44:23","guid":{"rendered":"https:\/\/www.protectimus.com\/blog\/?p=352"},"modified":"2019-06-11T15:39:22","modified_gmt":"2019-06-11T12:39:22","slug":"detailed-information-on-data-signing","status":"publish","type":"post","link":"https:\/\/www.protectimus.com\/blog\/detailed-information-on-data-signing\/","title":{"rendered":"Detailed Information on Data Signing"},"content":{"rendered":"<p>In response to new challenges, Protectimus has developed a powerful means of protection against auto-filling, injecting, and other types of malicious software that manipulates and modifies data during transactions.<\/p>\n<p>There are different ways in which such software can work; for example, the recipient is changed during a transfer as an unsuspecting user enters a one-time password sent via an SMS message. The problem is that this user actually performs and verifies a fraudulent transaction without even realizing that fraudulent activities are taking place.<\/p>\n<p>A serious threat for banks and payment services lies in the fact that customers unwilling to admit their own mistakes place the blame on the payment systems themselves, which undermines companies\u2019 business reputation.<\/p>\n<p>The Protectimus R&amp;D Department has come up with a solution to this problem. In accordance with RFC 6287, the challenge for the challenge-response algorithm is generated randomly. We have taken further steps and developed a special challenge generation algorithm based on the details of a transaction performed by a user. It allows entering the data correlating to the data being verified and a one-time password; consequently, if this user\u2019s data is modified in any way, the one-time password entered cannot verify the data because it is generated based on a different set of data, which prevents the possibility of any fraudulent activities.<\/p>\n<p>The new data signing function called CWYS (Confirm What You See) is available in the <a href=\"https:\/\/www.protectimus.com\/protectimus-ultra\" target=\"_blank\" rel=\"noopener noreferrer\">Ultra<\/a>, <a href=\"https:\/\/www.protectimus.com\/protectimus-smart\" target=\"_blank\" rel=\"noopener noreferrer\">Smart<\/a>, <a href=\"https:\/\/www.protectimus.com\/protectimus-sms\" target=\"_blank\" rel=\"noopener noreferrer\">SMS<\/a>, and <a href=\"https:\/\/www.protectimus.com\/protectimus-mail\" target=\"_blank\" rel=\"noopener noreferrer\">Mail<\/a> tokens.<\/p>\n<p>Diagram 1 shows the process of performing a transaction requiring verification.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4852 size-full\" src=\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2015\/03\/2fa-data-signing-CWYS-in-details.png\" alt=\"Transaction with the CWYS function\" width=\"744\" height=\"1009\" srcset=\"https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2015\/03\/2fa-data-signing-CWYS-in-details.png 744w, https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2015\/03\/2fa-data-signing-CWYS-in-details-221x300.png 221w, https:\/\/www.protectimus.com\/blog\/wp-content\/uploads\/2015\/03\/2fa-data-signing-CWYS-in-details-610x827.png 610w\" sizes=\"auto, (max-width: 744px) 100vw, 744px\" \/><\/p>\n<p>To send data to Protectimus and receive a challenge, a user must call the POST method at<\/p>\n<p>https:\/\/api.protectimus.com\/api\/v1\/token-service\/tokens\/sign-transaction<\/p>\n<p>using these mandatory parameters:<\/p>\n<ul>\n<li>tokenId \u2013 user\u2019s token identifier;<\/li>\n<li>transactionData \u2013 transaction details to be used in \u041e\u0422\u0420 generation;<\/li>\n<li>hash \u2013 \u041d\u041c\u0410\u0421-SHA256 hash of the transactionData string to verify the integrity of the data received; the user\u2019s API key is used as the key.<\/li>\n<\/ul>\n<p>In the response, you will receive XML or JSON with the following elements:<\/p>\n<ul>\n<li>challenge &#8211; challenge for the \u041e\u0422\u0420 generation algorithm;<\/li>\n<li>transactionData \u2013 encrypted transaction details;<\/li>\n<li>tokenType \u2013 token type;<\/li>\n<li>tokenName \u2013 token name;<\/li>\n<li>id \u2013 token identifier.<\/li>\n<\/ul>\n<p>For a user with a Smart token, a QR code needs to be generated and displayed; for users with other types of tokens or for users unable to scan the QR code, there has to be a displayed, which they must enter in the token to generate an \u041e\u0422\u0420.<\/p>\n<p>For example, if in the reply you received a challenge equal to 191,565, and the value of transactionData = 9 \/ vhmVzLIm \/ M + 8w9QXiJDA ==, then the row for QR code generation will look as follows:<\/p>\n<p>transaction: \/\/ challenge = 191565 &amp; transactionData = 9 \/ vhmVzLIm \/ M + 8w9QXiJDA ==<\/p>\n<p>To complete the process and verify the transaction, the user must provide the OTP received to the system being protected. After receiving the \u041e\u0422\u0420, the system again sends a POST request to this address:<\/p>\n<p>https:\/\/api.protectimus.com\/api\/v1\/token-service\/tokens\/verify-signed-transaction<\/p>\n<p>with the following parameters:<\/p>\n<ul>\n<li>tokenId \u2013 user\u2019s token identifier;<\/li>\n<li>transactionData \u2013 details of the transaction being verified (it is important to send the details that will be sent to perform the transaction, not those received when performing the previous steps);<\/li>\n<li>hash \u2013 hash of the transactionData string generated in the same way as when calling the previous method;<\/li>\n<li>otp \u2013 one-time password provided by the user.<\/li>\n<\/ul>\n<p>In response, the system being protected will receive information on the validity of the one-time password provided.<\/p>\n<p>The CWYS function will be available in the new version of the Protectimus software. If you want to protect yourself and your data now, please contact the customer support service to get this new and advanced tool today.<\/p>\n<span class=\"et_bloom_bottom_trigger\"><\/span>","protected":false},"excerpt":{"rendered":"<p>In response to new challenges, Protectimus has developed a powerful means of protection against auto-filling, injecting, and other types of malicious software that manipulates and modifies data during transactions. The new data confirmation function called CWYS (Confirm What You See) is available in the Ultra, Smart, SMS, and Mail tokens.<\/p>\n","protected":false},"author":2,"featured_media":4857,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[3,9],"tags":[16,142,118,134,99],"class_list":["post-352","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-engineering","category-protectimus-products","tag-2fa","tag-cwys","tag-data-protection","tag-data-signing","tag-two-factor-authentication"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts\/352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/comments?post=352"}],"version-history":[{"count":11,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts\/352\/revisions"}],"predecessor-version":[{"id":4859,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/posts\/352\/revisions\/4859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/media\/4857"}],"wp:attachment":[{"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/media?parent=352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/categories?post=352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.protectimus.com\/blog\/wp-json\/wp\/v2\/tags?post=352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}