sequence diagram for point of sale terminal

In the SafetyPIN project our goal is to prevent observation attacks during PIN entry while retaining the same workflow that user’s are already familiar with and with minimal additional hardware cost. However, these methods have not been introduced into practical applications because the users would have to be retrained to use a completely different approach to PIN entry and the significant additional costs involved in the hardware setup. Another approach proposes the use of an elaborate hardware to make PIN entry resilient to the observation attacks. One such proposed alternate PIN entry method requires the user to input some information, which is derived from a combination of the actual PIN and some additional information displayed by the system, instead of the PIN itself. These security problems have been recognized for a long time and researchers have proposed a number of different schemes to minimize the risk of PIN entry observation.

As most applications that use PINs for authentication operate in a public setting a common attack is to try to observe and record a user’s PIN entry (shoulder-surfing). The security of the system relies on the fact that an attacker is unlikely to guess the correct PIN number and that the systems (e.g., Automated Teller Machines) limit the user to few attempts (e.g., 3) for entering the correct PIN. In financial applications PINs are typically four-digit numbers, resulting in 10000 possible numbers. bank card) and the user’s secret PIN is commonly used to authenticate transactions. This is especially true for banking applications where the combination of a token (e.g. The use of PINs (personal identification numbers) as passwords for authentication is ubiquitous nowadays.

Sequence diagram for point of sale terminal