An Introduction to Internet Banking

1
An Introduction toInternet Banking

• Milos Kovacevic, milos_at_grf.bg.ac.yu
• Nikola Klem, klem_at_grf.bg.ac.yu
• Veljko Milutinovic, vm_at_etf.bg.ac.yu
• University of Belgrade, Yugoslavia

2
Presentation Outline

• Introduction to E-Banking

• Internet bank demo customers point of view

• Security issues

• Setting up an Internet bank channel

• Internet bank demo small community bank

• Searching for financial information on the Web

• Conclusions

3
Introduction to E-Banking

• The basis

4
Introduction to E-Banking

• Introduction to E-Business

• What is E-Bank

• Why to do E-Banking

• Some facts about E-Banking

5
Introduction to E-Business

• We are living in the connected world!

6
Introduction to E-Business

• Its Monday. You have to

• Reserve airplane tickets for your vacation

• Buy gifts for your childs birthday

• Pay bills for the current month (electricity,
  telephone )

• Check the bank account information

• Inform relatives about family gathering next
  weekend

• Thanks to the development of E-Business, you
  can do all of the above from your home or
  even from the car!

7
Introduction to E-Business

• The transformation of key business processes
  through the use of of Internet and related
  technologies (IBM Corporation)

• B-to-B (Business to Business)

• B-to-C (Business to Customer)

8
European E-Business momentum
9
European E-Business momentum
10
European E-Business momentum
11
What is E-Bank?

• Traditional banking business assumes

• customer desk at banks building
• working time from 8.00 am to 19.00 pm

• Customers have

• their job during the day
• family activities after job

12
What is E-Bank

• E-Bank is transforming banking business into
  E-Business thru utilizing various E-Channels

• E-Channels are

• Internet

• WAP based mobile network

• Automated telephone

• ATM network

• SMS and FAX messaging

• Multipurpose information kiosks

• Web TV and others

13
What is E-Bank?

• E-Banking business assumes

• E-Channels enable financial transactions from
  anywhere
• working time is non-stop

• Customer requests are

• non-stop working time
• using services from anywhere

14
Why to do E-Banking

• Possibility to extend your market (even out of
  country)

• Possibility to process more financial
  transactions

• Possibility to lower your transaction cost

15
Some facts about E-Banking in Europe
16
Some facts about E-Banking in Europe
17
Some facts about E-Banking in Europe
18
Some facts about E-Banking in Europe
19
Some facts about E-Banking in USA
20
Some facts about E-Banking in USA
21
Internet Banking

• Using Internet as an E-Channel makes financial
  services aavailable to wide population

• WWW service

• In this tutorial we shall focus oon
  Internet Banking

22
Internet Bank Demo

• Customers point of view

23
Internet Bank Democustomers point of view

• What customer needs for online bank access

• Equifax demo primer

24
Customer should have a

• Standard PC with Internet access

• Internet browser that supports SSL and,

• Money

25
Equifax demo primer

• Here goes presentation of Equifax demo primer
  for their Internet bank solution
• The aim is to show how an online bank looks like
  from the customers point of view
• Presentation will be done thru Internet Explorer
  and with cached HTML pages

26
Security Issues

• How security works in Internet communications

27
Security issues

• What are the security problems in Internet
  communication

• Cryptography basics

• How digital signatures and certificates work?

• Secure Sockets Layer protocol

• Internet browsers and security

• Useful links to visit

28
Security problem

• Spoofing How can I reassure customers who come
  to my site that they are doing business with me,
  not with a fake set up to steal their credit card
  numbers?

• Eavesdropping How can I be certain that my
  customers account number information is not
  accessible to online eavesdroppers when they
  enter into a secure transaction on the Web?

• Data alteration How can I be certain that my
  personal information is not altered by online
  eavesdroppers when they enter into a secure
  transaction on the Web?

29
What do we have to achieve

• Authentication no spoofing

• Privacy no eavesdropping

• Data integrity no data alteration

• Non-repudiation no claiming of user action

30
Solutions are . . .

• Digital certificates for Web servers,
  to provide authentication
  and data integrity

• Cryptography algorithms to provide privacy

• Secure Sockets Layer (SSL)
  the basis for every e-business
  trust infrastructure

31
Cryptography basis

• Cryptography provides privacy

• Symmetric approach

• Asymmetric approach

• Hybrid approach

32
Symmetric approach

• Both sides use the same key for encryption and
  decryption

• Convenient for bulk data encryption
  (computationally faster then other
  methods)

• Examples RSA RC4, DES, IDEA

33
Asymmetric approach

• Sender uses public key for encryption
  receiver uses private key for decryption

• Convenient for short data encryption
  (computationally slower then other
  methods)

• Examples RSA, Diffie-Hellman , ElGamal

34
Hybrid approach

• Using symmetric approach for data encryption

• Using asymmetric approach for passing the
  symmetric key

• Applied in SSL (Secure Sockets Layer)

35
Key management problem

• Key distribution (in symmetric approach)

• Secure binding between public key and his owner
  (in asymmetric approach)

• Q1 How can I be sure that the public key that
  my browser uses to send account number
  information is in fact the right one for that Web
  site, and not a bogus one?

• Q2 How can I reliably communicate my public
  keys to customers so that they can rely on it to
  send me encrypted communications?

36
Digital Signatures

• To provide authentication and data integrity of
  electronic documents

• Creating message digest using one way hashing
  algorithm (MD5, SHA )

• Encrypting digest with private key

37
Digital Signatures
38
Digital Certificates

• An electronic file that uniquely identifies
  communication entities on the Internet

• Associates the name of an entity with its public
  key

• Issued and signed by CA (Certification Authority)

• Everybody trust CA, and
  CA is responsible
  for entity name public key binding

• Example CAs VeriSign, Thawte,

39
Digital Certificates

• How a X.509 Certificate Is Issued
• Key Generation
• Matching of Policy Information
• Sending of Public Keys and Information
• Verification of Information
• Certificate Creation
• Sending/Posting of Certificate
• The certificate is loaded onto an individual's
  computer.

40
Secure Sockets Layer

• Together with DC enables secure communication
  over the TCP/IP network

• SSL session consists of two phases
• 1. handshaking phase
• 2. data exchange phase

41
SSL handshaking phase (simplified)
Server
Client
42
SSL data exchange phase (simplified)
Client
Server
Fragments msg. into blocks (bytes)
Calculates MAC and appends it to msg.
Decrypts data with SSK
Encrypts data with SSK
Calculates new MAC and verifies the old one
Reassembles the msg.
43
Verification of DCs in user browser
44
About SSL strength

• Two variants of SSL 40-bit and 128-bit (refers
  to SSK length)

• According to RSA Labs it would take a trillion
  trillion years t to crack 128-bit
  SSL using todays technology!

• US export restrictions apply to issued digital
  certificates a and browser
  implementations (support for 128-bit SSL)

• From recently VeriSign is allowed to issue
  Global DCs that work both in
  US and export versions of browsers(128-bit SSL)

45
Useful links to visit

• www.verisign.com , how to apply for DC, security
  related stuff

• www.thawte.com , how to apply for DC, security
  related stuff

46
Setting up an Internet Bank Channel

• Bankers point of view

47
Setting up an Internet Bank Channel

• Internet bank architecture

• Planning phase in setup process

• Choosing strategic and technology partners

• Required tasks after initial introduction of new
  channel

48
Internet bank architecture
49
In-house architecture (CustomerLink primer)

• All components in the bank

50
Out-of-house architecture (CustomerLink primer)
51
Banking software architecture

• Before Internet revolution banking software
  systems were dominantly of client-server type

business logic
52
Banking software architecture

• In the Internet era banking software systems are
  n-tier (ngt2)

53
Presentation logic
Java Server Pages/Servlets Active Server
Pages PHP
54
Application logic
Written in C/C, Java(EJB), COBOL
55
Planning phase in setup process

• What are the services to be installed?
• What services we (bank) could implement in-house?
• What services we could implement thru ASPs
  (out-of-house)?
• Who are technology partners?

56
Application service providers

• ASP offers standardized packages of applications,
  necessary infrastructure, and
  certain degree of service

• Main characteristics of ASPs is that they offer
  applications that are already purchasable

• ASP gt one-to-many solution
  Classic IT outsourcing gt one-to-one
  solution
  

57
Application service providers division
58
Application service providers pros and cons
59
Planning phase in setup process (revisited)

• Complexity of a problem
• telecommunications infrastructure
• security
• multi-tier software infrastructure
• maintenance

• We recommend using ASPs
  for setting up new Internet channel
  in the case of mid and
  small size banks!

• The biggest banks should reconsider
  which services to delegate to ASPs

60
Required services for Internet banking

• Services offered by ASPs
• Online personal banking
  (account information,
  transfers, deposits)
• Online cash management for companies
• Bill payment
• Check payment
• Card payment solutions
• Insurance services
• Web presentation design
• Web presentation hosting
• Web presentation administration
• Security
• Testing of electronic business software
• Remote administration of banks servers

61
Choosing strategic and technology partners

• Choosing the right ASP is the most important task
  in setup procedure
• An ASP must
• be an expert for Internet access
• have experience in electronic business
• have a secure and fault-tolerant local area
  network
• have a good software solution
• have well-educated IT staff accessible 24 hours,
  365 days

62
Choosing ASPs the cost of downtime
63
Choosing ASPs personal banking, cash
management

• Equifax www.equifax.com www.efx-ebanking.com ,
  CustomerLink

64
Choosing ASPs personal banking, cash
management

• Digital Insight, www.digitalinsight.com, AXIS

65
Choosing ASPs personal banking, cash
management

• Vifi, www.vifi.com, InternetBanker

66
Choosing ASPs bill payment

• CheckFree, www.checkfree.com

67
Choosing ASPs card payment processing

• RS2 Software Group , www.rs2group.com, BankWorks

68
Choosing ASPs web hosting

• Digex , www.digex.com

69
Choosing ASPs web design for banking

• DiamondBullet , www.diamondbullet.com,
  ,,,,,,,,,,,,,,,,,,,,,,,,www.bankingwebsit
  es.com

70
Required tasks after initial introduction of new
channel

• Education of banks staff

• Permanent marketing

• Obtaining information about competition and
  potential customers (investors)

71
Education of staff

• Studies show that education of bank staff in
  using Internet channel is often incomplete
• Staff should provide answers to FAQ about using
  Internet channel to their customers
• Conclusions deduced from incompetence of staff
  are
• we do it (Internet banking) because all do it
• we do it but we dont think it is important to us
• Education process can be done thru
• courses after job
• by stimulating staff to use Internet Banking from
  home (participating in PC purchase,
  obtaining discounts from local ISP)

72
Permanent marketing

• We have a good solution for Internet banking
  but number of online users
  is very low after initial setup whats
  wrong?

• The answer is we need permanent marketing
  campaign!

• Customers who were not ready for new service
  at the moment of the initial
  introduction
  will be ready after few months

• Marketing cycles to involve customers that
  became ready in the meanwhile

• Key of success enthusiasm, especially among
  management

73
How to do marketing

• Spreading enthusiasm among staff
• Utilizing common media for advertising
  (professional agencies)
• Organizing education about Internet technologies
  and new banking services among
  customers
• Agreements with local ISPs and resellers of PC
  equipment

74
Education of customers

• Studies show that 7 of bank users are
  technically advanced while 25 is open
  to new banking services
  but they lack technical experience

75
Education of customers

• In order to attract more online customers, bank
  should

• organize courses for using PCs and Internet

• provide PC installations inside bank halls and
  rooms, accessible to customers

• make agreements with local ISP to give discounts
  for online bank customers

• organize periodical meetings where online
  customers can exchange information about
  Internet banking services and E-Business in
  general

76
Monitoring activity on Internet channel

• In order to react fast we should gather
  information about channel use
• Different statistics should be made
• number of visitors
  
• number of transactions
• which services are most/least used
• average time spend at Web site by common user
• Feedback support
  (customer forms, e-mail for additional
  questions/services)

77
Obtaining information about competition and
potential customers (investors)

• To be successful in every business (banking
  services) you constantly need
  information about
• competition
  (what they
  offer, what are the complaints of their
  customers)
• potential customers
• Among other ways to find information
  it is useful to
  monitor the Web and Web activity using search
  engines

78
Internet Bank Demo

• Small community bank

79
Internet Bank Demo

• Small community bank primer
• The Bank of Northern Michigan (BNM)

80
BNM Profile

• Community bank from Petoskey, Michigan, USA
• Independent, full service financial institution
• More then 140 years of experience
• Strong customer-bank relationship
• Commitment to new banking technologies
• A FDIC member
• Contact addresses
• Web www.bankofnorthernmichigan.com
• Email talktous_at_bankofnorthernmichigan.com

81
BNM web presence

• BNM web site is created and maintained by ASP
• ASP is Diamond Bullet Design

82
BNM online banking services
83
Login to online bank
84
Who is the real online bank provider?

• BNM uses Equifax as an ASP for online bank
  services
• www.efxibank.com/clkpcb/072414006/default1.asp

85
Security is essential

• Customer session is established thru 128-bit SSL
  connection
• SSL between client browser and online bank ASP
  (Equifax)

86
Security is essential

• Customer session is timed out after 10 minutes of
  inactivity

• Browser cache is disabled when working thru
  security connection

87
Services
88
Services
89
Pay Bill option thru CheckFree

• Customers pay their bills thru CheckFree
• Online bank software redirects us automatically
  to www.checkfree.com

90
Front end system architecture
91
Out-of-house architecture (BNM)
92
Distribution of services

• Web design Diamond
  Bullet Design
• Web hosting Local ISP
• Web administration Diamond Bullet
  Design
• Core online bank services Equifax
• Paying bills and e-bills CheckFree

93
Searching for financial information on the Web

• A necessary step to be successful in banking
  business

94
Searching the Web

• Importance of web search (WS) in banking business

• Searching services on the Web

• General search engines how do they work?

• Searching financial data by using focused crawlers

• Useful links to visit

95
Financial data on the Internet

• Huge amount of financial data publicly available
  on the Internet

• Among 660 largest companies from 22 countries (30
  from each) 62 had some form of financial data
  on their Web sites (IASC Report for
  1999)

• The role of outsiders

• DigiTRADE

• EDGAR

• Wall Street City.Com

• Yahoo! Finance

96
Nature of the financial data on the Web

• Among others, we can find information about

• Quarterly and annual financial reports
• Financial history
• SEC filings
• Stock quotes
• Press releases
• Information request forms
• Other shareholder information

97
Importance of WS in banking business

• Internet Banking market is very dynamic

98
Importance of WS in banking business

• To be successful in business we need information
  about

• Potential customers

• Potential competitors

• A vast amount of information can be acquired
  using search engines and monitoring
  interesting web sites

99
Searching services on the Web

• subject directories

• search engines that use crawlers for collecting
  data

• meta-crawlers

100
Subject directories

• Links to web sites are collected
  according to topics they treat

• Links are collected by humans who evaluate them

• Useful when searching about some topic in general

• Not effective when trying to find something
  specific

• Examples Yahoo!, World Wide Web Virtual
  Library

101
Search engines

• They try to collect as many as possible pages
  from the Web and store them locally for
  later keyword search

• Pages are collected by using crawlers (sw
  components)

• Good for search on specific query

• Result pages are sorted by relevancy

• Results can be out of date (currency problem)

• Examples Google, Fast, AltaVista, Inktomi

102
Search engines how do they work?
103
Meta-crawlers

• They utilize other search engines concurrently
  by sending users query to them

• Good for queries about exotic topics

• Queries are simple because of different formats
  among search engines

• Examples MetaCrawler, Dogpile,

104
Search engines comparisons

• Estimated size of the Web as of 2000 7.4
  billion documents
• (source OCLC)

105
Searching financial data by using focused crawling

• Focused crawlers visit only topic-specific pages

• Focused crawlers versus classic crawlers (solve
  currency problem)

106
Useful links to visit

• www.searchenginewatch.com , search engine
  comparisons

• www7.scu.edu.au/programme/fullpapers/1921/com1921.
  htm the anatomy of the Google search engine

• http//www.streeteye.com/cgi-bin/allseeingeye.cgi
  , financial data meta-crawler

• www.moneysearch.com , finance specific directory
  search

• www.dailystocks.com , excellent financial portal
  for investors

• www.companysleuth.com , excellent financial
  portal for investors

107
Conclusions
108
Final words

• Every bank should implement its Internet channel
  (reduced cost of transaction, global
  connectivity )

109
Final words

• Small and mid-size banks could benefit using
  ASPs for different kind of services

• Choosing the right ASP is
  the most important step!

110
Final picture
111
An Introduction toInternet Banking

• Milos Kovacevic, milos_at_grf.bg.ac.yu
• Nikola Klem, klem_at_grf.bg.ac.yu
• Veljko Milutinovic, vm_at_etf.bg.ac.yu
• University of Belgrade, Yugoslavia

112
Evaluating important pages (links)

• Important metrics for evaluating pages(links) in
  searching process are

• Back link count
• IB(P) number of links that point to P

• Location metric
• IL(P) F(u), u is link to P

113
Evaluating important pages (links)

• Important metrics for evaluating pages(links) in
  searching process are

• Forward link count
• IF(P) number of links that go from P