Safer Internet Banking

Germany's Sparda Bank offers Internet banking with added security.

Rainer Mauth

Digital signatures, encryption, and closed networks effectively combat most security risks in electronic banking. However, if banks want their customers to perform transactions via an open network such as the Internet, hard encryption and smart-card-based authentication are not enough.

That's the thinking behind Sparda Bank's (Hamburg, Germany) new home-banking service, which is based on a new security chip and identification procedure. "One threat that is especially acute but isn't addressed by software encryption is the potential for spying in customers' PCs," says a Sparda Bank spokesperson.

Sparda Bank provides each customer with a unique, seria lized version of ESD's (Leipzig, Germany) MeChip. The chip plugs into a PC's parallel port, PC Card slot, or an ISA extension board. It includes a RISC encryption engine with both RAM and ROM that hold the customer's private keys, identification, and password. In contrast to smart-card-based home-banking applications, the MeChip also connects directly to the keyboard and immediately encodes all the information you type in.

"Most security applications on the Internet don't address snooping -- virus-like programs that invade a PC over the Internet, wait until the next session, intercept the customers' PIN and transaction numbers, and tamper with transactions before they get authenticated and encrypted," says Rempert von Meysenbug of ESD. "Because the MeChip encrypts all information on-board before any software can access it, there is no chance that viruses can check out the main memory and spoof the encryption process."

ESD plans to issue a smart-card reader based on the MeChip (called MeChip Pro) early next year. Customers will then be able to reload their electronic purses just as securely in their living rooms as from any ATM.