AnyID and Privacy

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

AnyID And Privacy
Narudom Roongsiriwong, CISSP

About Me
● Head of IT Security and Solution Architecture,
Kiatnakin Bank PLC (KKP)
● Consulting Team Member for National e...

Disclaimer
● This presentation primarily expresses from Ministry of
Finance requirement.
● Final project may be different ...

Agenda
● National e-Payment Big Picture
● AnyID as a Payment Infrastructure
● AnyID Security Design & Implementation
● Pri...

National e-Payment Big Picture

How We Make Payments
● Banknotes & Coins
● Paper-based Cheques
● Payment Cards
– ATM
– Debit Card
– Credit Card
– e-Money
...

Reasons for Non-Usage of e-Payment

National e-Payment Initiative
5 Strategic Projects
● Payment Infrastructure “AnyID”
● Expansion of Card Acceptance (via ED...

Expansion of Card Acceptance
● Increase numbers of
Electronics Data Capture
(EDC)
● Support multiple types of
cards
– Debi...

Electronics Taxation Document
● Improve laws related to revenue tax to support electronics
documents conform to Electronic...

Government e-Payment
● Pay
– Pay by AnyID
– Pay to everyone
● Receive
– Accept card payment

AnyID as a Payment Infrastructure

How ORFT Works (Simplified)
XYZ Bank
Mobile Banking
Transfer From:
To:
Account #:
OK
Amount:
XYX Bank
Transfer 1,000 Baht
...

AnyID Does the Same, But … With ID
XYX Bank
Transfer 1,000 Baht
from My Account 1
to ID “spiderman”
Via HTTPS
Conversion
A...

Current Limitations of Payment System
Switch/
Clearing
house
Consumer
Business
Bank Account No.
Government
OK
Non-Bank
OK
...

Expand Infrastructure to handle AnyID
Switch/
Clearing
house
AnyID
Non-Bank
Consumer
Business
Government
OK
OK
New

Use AnyID to
Receive Payment
Payer does not
have to register
for AnyID
Payee registers
xxxxxx as
payee's AnyID
AnyID: xxxx...

Which ID Can be Used?
● First Phase (Oct 2016)
– Bank+Account (for compatibility)
– National ID (13-Digit Citizen ID & Tax...

Use as Many AnyID’s as You Need
One AnyID can link
to one account
But each person can
use many AnyID's
Many AnyID's can li...

123-456-789-1
123-456-789-1
How to Use AnyID
Bank account number or eWallet ID
can be used as AnyID to receive
money but c...

How to Use AnyID
0891234567
ID owner may choose to link
mobile number to a bank account,
even though the number may have
a...

Number (“ID”) Portability
● Switch Banks / instruments
(type of accounts, current,
saving or e-money)
● Efficiency : no ne...

Channels to Use AnyID
XYZ Bank
Mobile Banking
Transfer From:
To ID:
OK
Amount:
On Every Bank Channels

Refilling eWallet
XYZ Bank
Mobile Banking
Transfer From:
To ID:
OK
Amount:
From Every
Bank Channels
9812314051273

e-Money / e-Wallet ID
Bank A
Bank C
Bank B
e-Money/e-Wallet or
e-Ticketing System
conceptual idea, not actual technical im...

e-Money / e-Wallet ID
● Any new player fast access
● Speed up competition
● Support Common Ticketing
● Cash withdraw, refi...

Dangling Payment
Pay Before … Register Later
Citizen ID1
If payee links
citizen id to
an account, the
money is transfer
in...

Dangling Payment
Pay Before … Register Later
Citizen ID1
After registration of
Citizen ID2, money is
automatically transfe...

NBTC and TelCo’s will
automatically inform
banks/switch to deregister, in
the event of a change in
ownership — whether or ...

AnyID: Conceptual Interface Diagram

AnyID: Normal Flow
1. Customer 1 asks his bank to transfer money to ID 0812345678 with
amount 1,000 baht from his main acc...

AnyID: Normal Flow
7. Customer 1 confirms
8. Bank 1 sends transfer instruction to ITMX for bank 2 account
1234 amount 1,00...

Mobile P2P Payment
Driver Mobile No.
0854598731
XYZ Bank
Mobile Banking
Transfer From:
To ID:
OK
Amount:

Mobile P2P Payment
Driver Mobile No.
0854598731
XYZ Bank
Mobile Banking
Transfer From:
To ID:
OK
Amount:

Request-to-Pay & Bill Payment
New Payment Infrastructure
XYZ Bank
Mobile Banking
Request to Pay From
Pay
Amount:
Bill Paym...

Current Limitations: Related Document/Transaction Flows
Outside Payment System
Switch/
Clearing
house
Consumer
Business
Ba...

Expand Infrastructure to handle Related
Document/Transaction Flows
Switch/
Clearing
house
Tax, Bill Presentment,
Bill Paym...

E-Commerce Enabler
Bank A Bank C
Bank B
Bank D
e-Commerce
Website /
Merchant
PG PG
PG
Simplify Payment Gateway with Reques...

E-Commerce Enabler
Bank A Bank C
Bank B
AnyIDAnyID
SwitchSwitch
Bank D
e-Commerce
Website /
Merchant
Simplify Payment Gate...

Ease of Doing Business
● Withholding Tax with payment
● Bill payment across banks. No more faxing slip
● B2B Bill payment ...

AnyID Security Design &
Implementation

Security vs. Usability
Security
Usability
{This is my opinion not team nor participants}

Current Exposure to Internet
Switch/
Clearing
house
Consumer
Business
Government
Non-Bank
Bank Account No.OK
OK
Old

Same Structure : No New Exposure to Internet
Switch/
Clearing
house
Consumer
Business
Government
Non-Bank
AnyIDOK
OK
New

IT Security Architecture
ITMX Implementation
● Only Member Bank can sent/receive data with ITMX.
● Member bank connect to ...

Network Security & Cryptography
ITMX Implementation
● Single Registration: REST/HTTP TLS 1.2 with Message
Signing (PKCS#7 ...

Error Prevention
● Transfer to unregistered ID
– MOF require banks to implement dangling account
– {Dangling account is go...

About Fraud
● AnyID does not intend to reduce the existing electronics
fund transfer frauds but some flows will reduce fra...

Registration Security & Privacy
ITMX Implementation
● ID Validation
– National ID: Banks will validate the registration/de...

Privacy Comparison between
“With” and “Without” AnyID

What is Privacy?
“Well, it depends on who you ask. Broadly speaking, privacy
is the right to be let alone, or freedom from...

Control Over Information
"Privacy is not simply an absence of information about us in
the minds of others; rather it is th...

Personally Identifiable Information (PII)
Any information about an
individual maintained by an
agency, including
(1) any i...

Factors for Determining PII Confidentiality Impact
Levels
● Identifiability
● Quantity of PII
● Data Field Sensitivity
● C...

AnyID Participants
● Banks
● Switching (ITMX)
● Government
● Employers (for Payroll)
● Payers with Withholding Tax
● Other...

AnyID & Identifiability
● Considered as PII
– Citizen ID
– Bank Account
– Mobile Phone Number
– Payment Card Number
– Emai...

Participants & Quantity of PII
Participants
Bank
Account
Citizen
ID
Phone
Number
Banks # Accounts # Customers # Customers
...

AnyID & Data Field Sensitivity
“For example, an individual‘s SSN, medical history, or
financial account information is gen...

Participants & Context of Use
● How the disclosure of data elements can potentially harm
individuals and the organization
...

Participants & Obligations to Protect Confidentiality
Participants Context of Use Impact
Banks Bank of Thailand Regulation...

Participants & Access to and Location of PII
● Consideration the nature of authorized access to PII
● More often or by mor...

PII Exposure Shift After AnyID
Participants
Bank
Account
Citizen
ID
Phone
Number
Banks ● ● ●
Switching (ITMX) ● ▲ ▲
Govern...

Privacy Impact from Bank Account
Participants Quantity Context Obligation Access Shift
Banks High Low High Low ●
Switching...

Privacy Impact from Citizen ID
Participants Quantity Context Obligation Access Shift
Banks High Low High Low ●
Switching (...

Privacy Impact from Phone Number
Participants Quantity Context Obligation Access Shift
Banks High Low High Low ●
Switching...

AnyID and Privacy

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Secure PHP Coding by Narudom Roongsiri... 6048 views
Secure Code Review 101 by Narudom Roongsiri... 7122 views
Coding defines reality by Varokas Panusuwan 4646 views
Securing the Internet from Cyber Cr... by Narudom Roongsiri... 1153 views
Unlock Security Insight from Machin... by Narudom Roongsiri... 6302 views
OWASP Top 10 A4 – Insecure Direct O... by Narudom Roongsiri... 3883 views

View on Slideshare

1 of 67 Ad

View on Slideshare

1 of 67 Ad