mDevCamp 2016 - Zingly, or how to design multi-banking app
•
1 gefällt mir•1,019 views
What problems do you need to deal with when designing an app for multiple banks? How do you solve a security of such apps? And how about a user interface design and application structure? What technologies are under the hood? And what does Zingly bring to you?
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (9)
Ähnlich wie mDevCamp 2016 - Zingly, or how to design multi-banking app
Ähnlich wie mDevCamp 2016 - Zingly, or how to design multi-banking app (20)
Mehr von Petr Dvorak
Mehr von Petr Dvorak (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
mDevCamp 2016 - Zingly, or how to design multi-banking app
- 1. Zingly, or how to design a multi-banking app Petr Dvorak joshis@tweets Lime
- 3. A big change is comming …
- 5. Access to account information and payment service initiation
- 6. Banking API Server Multi-Banking Hub Services Bank A BanksUsersIntegrators Banking API Server Bank B Banking API Server Bank C
- 7. Zingly
- 8. Simple, faster and more secure mobile banking for your bank
- 9. Extra fast login with PIN or Touch ID
- 12. Pay your friends and family
- 13. Mobile e-commerce payments (with SDK)
- 14. Design
- 15. There is only one chance to do your app right…
- 18. Showing only the nice things ("dictator rule")
- 19. Architecture
- 20. Open-source
- 21. Architecture • PowerAuth 2.0 Server • Zingly API Server • Zingly Multi-banking Hub • Zingly Mobile App
- 22. • Native iOS app (Android later) • Written in Swift 2.0 • Native PowerAuth 2.0 core (C/C++) • Cocoapods for library management
- 23. Zingly server components play nice with existing banking systems
- 24. PowerAuth 2.0 Server Zingly API Server Zingly Multi-Banking Hub Bank A Internet banking BanksUsersZingly Core Services Custom API Bank B Custom Security and Core Services SOAP SOAP REST REST + WebSockets
- 25. PowerAuth 2.0
- 26. Security
- 27. What is so hard on mobile banking apps?
- 28. Multi-banking • Storing data from multiple banks • Authentication to multiple banks • Data transport security
- 29. 3rd parties • People don’t trust them • Cannot provide huge guarantees • Can play no, positive or negative role
- 30. … back to PowerAuth
- 34. Mobile libraries soon But I will show you today !
- 35. Authentication Secure Storage E2E Encryption
- 36. Authentication • Secure app activation • Activation life-cycle • Multi-factor data signature
- 40. Step 1: Set up your app
- 41. • Application key • Application secret • Master Public Key
- 42. #define APP_KEY "QvTX+lSRTNNJ9zAT8bC8iw==" #define APP_SECRET "1zNNJNgP0RBGCJWuoHwKqw==" #define APP_MASTER_KEY "BKltWgFa0U0qlef0c9ll3y3E4lGWrFPTBvrB+gv9tQ3wIwI aEeBnonH9HuSo/6eJKhCJcse6wHXQl8bQ="
- 43. class SecurityContext { let session = PA2Session() static let sharedInstance = SecurityContext() func initSecurityContext() { let setup = PA2SessionSetup() setup.applicationKey = APP_KEY setup.applicationSecret = APP_SECRET setup.masterServerPublicKey = APP_MASTER_KEY self.session.initializeSessionWithSetup(setup) } }
- 44. Step 2: Read the "activation code"
- 45. XC651-AB231-13891-DE123 Short activation ID Activation OTP
- 46. Step 3: Securely exchange public keys
- 47. Request - POST: /pa/activation/create { "requestObject": { "activationName": "My iPhone", "applicationKey": "UNfS0VZX3JhbmRvbQ==", "activationIdShort": "XDA57-24TBC", "activationNonce": "hbmRvbQRUNESF9QVUJMSUNfS0VZX3J==", "applicationSignature": "SF9QRUNEVUJMSUNfS0VZX3JhbmRvbQ==", "encryptedDevicePublicKey": "RUNESF9QVUJMSUNfS0VZX3JhbmRvbQ==", "extras": "Any custom data in any format (XML, JSON, ...)" } }
- 48. let session = SecurityContext.sharedInstance.session let step1Param = PA2ActivationStep1Param() step1Param.activationIdShort = activationIdShort step1Param.activationOtp = activationOtp let step1Result = session.startActivation(step1Param)! // if (session.lastErrorCode == PA2ErrorCode.Ok) { let activationNonce = step1Result.activationNonce let applicationSignature = step1Result.applicationSignature let encryptedDevicePublicKey = step1Result.cDevicePublicKey
- 49. Response - HTTP 200 - OK { "status": "OK", "responseObject": { "activationId": "c564e700-7e86-4a87-b6c8-a5a0cc89683f", "activationNonce": "vbQRUNESF9hbmRQVUJMSUNfS0VZX3J==", "ephemeralPublicKey": "MSUNfS0VZX3JhbmRvbQNESF9QVUJMSUNfS0VZX3JhbmRvbQNESF9QVUJ==", "encryptedServerPublicKey": "NESF9QVUJMSUNfS0VZX3JhbmRvbQNESF9QVUJMSUNfS0VZX3JhbmRvbQ==", "serverDataSignature": "QNESF9QVUJMSUNfS0VZX3JhbmRvbQ==" } }
- 50. let step2Param = PA2ActivationStep2Param() let response = entity.responseObject step2Param.activationId = response.activationId step2Param.ephemeralNonce = response.activationNonce step2Param.encryptedServerPublicKey = response.encryptedServerPublicKey step2Param.ephemeralPublicKey = response.ephemeralPublicKey step2Param.serverDataSignature = response.serverDataSignature let step2Result = session.validateActivationResponse(step2Param) if (session.lastErrorCode == PA2ErrorCode.Ok) { // ... continue to next step }
- 51. Step 4: Ask user for a PIN code
- 52. • Short PIN code (4 digits) can be used • Check for simple combinations • Ask user to use Touch ID
- 53. Step 5: Generate keys and get session state
- 54. // we need keys for three authentication factors ... let possessionKey = session.generateSignatureUnlockKey() let biometryKey = session.generateSignatureUnlockKey() let unlockKeys = PA2SignatureUnlockKeys() unlockKeys.biometryUnlockKey = biometryKey unlockKeys.possessionUnlockKey = possessionKey unlockKeys.userPassword = PA2Password(string: "1234") session.completeActivation(unlockKeys) let sessionState = session.serializedState()
- 55. Step 6: Store session and keys to keychain
- 56. // KeychainAccess for Swift // created by Kishikawa Katsumi // see https://github.com/kishikawakatsumi/KeychainAccess let keychain = Keychain(service: "com.example.myServiceId") keychain[data: "PA_SESSION_STATE"] = sessionState keychain[data: "PA_KEY_POSSESSION"] = possessionKey do { try keychain .accessibility( .WhenPasscodeSetThisDeviceOnly, authenticationPolicy: .TouchIDAny ) .set(biometryKey, key: "PA_KEY_BIOMETRY") } catch _ { // Error handling... } }
- 57. Step 6: Complete activation on web
- 58. 12345 67890
- 59. Step 8: Sign data, make payments, heureka! !
- 60. // Initialize session after app launch let sessionState = keychain[data: "PA_SESSION_STATE"] if (sessionState != nil) { self.session.deserializeState(sessionState!) } PA2SignatureUnlockKeys keys; keys.possessionUnlockKey = keychain[data: "PA_KEY_POSSESSION"] // ... ask for PIN code keys.userPassword = cc7::MakeRange("1234") // ... or use TouchID instead of PIN like so // keys.biometryUnlockKey = keychain[data: "PA_KEY_BIOMETRY"];
- 61. // send data on server with the correct HTTP header let paHeaderName = session.httpAuthHeaderName let paHeaderValue = session.httpAuthHeaderValueForBody( data, httpMethod: "POST", uri: "/account/payment/commit", keys: keys, factor: PA2SignatureFactor_Possession_Knowledge )
- 63. That wasn't that hard, right?
- 65. Many banks, one PIN code
- 66. activation id PIN(x) knowledge Bank A Bank B activation id knowledge
- 67. activation id PIN(x) activation id PIN(x) knowledge knowledge Bank A Bank B
- 68. Authentication Secure Storage E2E Encryption
- 69. Secure Storage • Data encrypted with remote key • Authentication needed • Enables secure mobile multi-banking
- 70. PowerAuth 2.0 Server Zingly API Server Zingly Multi-Banking Hub Bank A Internet banking BanksUsersZingly Core Services SOAP SOAP REST REST + WebSockets PowerAuth 2.0 Server Zingly API Server Bank B Internet banking Core Services SOAP SOAP REST
- 71. PowerAuth 2.0 Server Zingly API Server Zingly Multi-Banking Hub Bank A Internet banking BanksUsersZingly Core Services SOAP SOAP REST REST + WebSockets PowerAuth 2.0 Server Zingly API Server Bank B Internet banking Core Services SOAP SOAP REST PowerAuth 2.0 Server
- 72. PowerAuth 2.0 Server Zingly API Server Zingly Multi-Banking Hub Bank A Internet banking BanksUsersZingly Core Services SOAP SOAP REST REST + WebSockets PowerAuth 2.0 Server Zingly API Server Bank B Internet banking Core Services SOAP SOAP REST PowerAuth 2.0 Server PowerAuth 2.0 Client activation id PIN(x) activation id PIN(x) knowledge knowledge
- 73. PowerAuth 2.0 Server Zingly API Server Zingly Multi-Banking Hub Bank A Internet banking BanksUsersZingly Core Services SOAP SOAP REST REST + WebSockets PowerAuth 2.0 Server Zingly API Server Bank B Internet banking Core Services SOAP SOAP REST PowerAuth 2.0 Server PowerAuth 2.0 Client knowledge activation id PIN(x) activation id PIN(x) activation id PIN(x) knowledge knowledge
- 74. PowerAuth 2.0 Server Zingly API Server Zingly Multi-Banking Hub Bank A Internet banking BanksUsersZingly Core Services SOAP SOAP REST REST + WebSockets PowerAuth 2.0 Server Zingly API Server Bank B Internet banking Core Services SOAP SOAP REST PowerAuth 2.0 Server PowerAuth 2.0 Client SECURE VAULT knowledge activation id PIN(x) activation id PIN(x) activation id PIN(x) knowledge knowledge
- 75. Authentication Secure Storage E2E Encryption
- 76. That was nice… What's in it for me?
- 77. • Build secure apps with PowerAuth 2.0 • Mobile e-commerce with Zingly payments • Use banking API to access banking services • Steal code, contribute, comment, live! !
- 78. Thank you! Petr Dvořák e-mail: petr@lime-company.eu twitter: @zinglyapp http://zingly.cz/ Lime