TABLE OF CONTENTS
Title page i
- Background to the Study 1
- Statement of Problem 7
- Scope and limitation of the Study 10
CHAPTER TWO LITEARTURE REVIEW 12
- Preamble 12
- Why Biometric 15
- Fusion in Multimodal Biometric System 22
- Types of Biometric 24
- Bank Frauds 29
- Existing Security Models/Architectures in Banking 32
CHAPTER THREE SYSTEM ANALYSIS AND METHODOLOGY 66
- Preamble 66
- Site Visit 70
- Strength of Site Visit 70
- Weakness of Site Visit 71
- Analysis of the Existing System 71
- Problems of Existing System 75
- Site Visit 70
- Preamble 84
- The Open Group Architecture Framework 86
- Application Algorithm 124
- Programming Languages used 127
- Why these Languages 128
- Application Dataflow Diagram and Flowchart 129
- Modeling the Application using the Unified Modeling Language (UML) 134
- Class Diagram 134
- Sequence and Component Diagram 135
- Activity Diagram 137
CHAPTER FIVE SYSTEM IMPLEMENTATION 145
- Development of Application Database 145
- System Implementation Technique 162
- Minimum Hardware Requirements 163
- Server Software Requirements 163
CHAPTER SIX SOFTWARE PERFORMANCE EVELUATION 174
- Preamble 174
- Material and Method of Evaluation 175
CHAPTER SEVEN CONCLUSION AND RECOMMENDATION 183
References 185
Program Listing 198
LIST OF FIGURES
Figure 2.1 Digital Banking Software Security Model 38
Figure 2.2 Random Data Banking Software Model 39
Figure 2.3 Flowchart of Transaction 40
Figure 2.4 Password Based Model Source 40
Figure 2.5 Bank Adaptive Architecture 41
Figure 2.6 Class Model View of Banking Software 41
Figure 2.7 Tier Banking Solution Model 42
Figure 2.8 Search Bank Security Model 42
Figure 2.9 Online Banking Authentication Model 43
Figure 2.10 Password Based Authentication Model 43
Figure 2.11 Bank Pattern Security Model 44
Figure 2.12 Online Banking Architecture 44
Figure 2.13 Bank Transaction Model 45
Figure 2.14 Bank Software Use-Case diagram. 45
Figure 2.15 QR-Code Bank Model 46
Figure 2.16 Password Simulated Bank Model 46
Figure 2.17 Mobile Payment Security Architecture 47
Figure 2.18 Fund Transfer Model 48
Figure 2.19 IBM Banking Model 49
Figure 2.20 Frame of Reference for Integrated GRC 49
Figure 2.21 Internet Banking Software Security Model 50
Figure 2.22 Identity Banking Software Security Model 51
Figure 2.23 Layered Banking Software Security Model 51
Figure 2.24 Card Data Banking Software Security Model 52
Figure 2.25 Password Fraud Prevention Pillar 52
Figure 2.27 Block Bank Model 53
Figure 2.28 Secure Money Exchanging Model 54
Figure 2.29 Inference Flow Model 55
Figure 2.30 Entrust Grid Card 55
Figure 2.31 Banking Services Conceptual Framework 56
Figure 2.32 Model Driver Online Banking 56
Figure 2.33 Bank Entity Protocol Model 57
Figure 2.34 PIN Validation Model 57
Figure 2.35 System Security Model 58
Figure 2.36 Hybrid Authentication Model 58
Figure 2.37 E-Payment Gateway. 59
Figure 2.38 PayPal Security Model 59
Figure 2.39 Mobile Banking System Architecture 60
Figure 2.40 Bank Transaction Model 60
Figure 2.41 PIN Transaction Model 61
Figure 2.42 Bi-PIN Transaction Model 61
Figure 2.43 PIN/Fingerprint Transaction Model 62
Figure 2.44 Fingerprint Banking Software Security Model 62
Figure 2.45 Three Level Model Interaction 63
Finger 2.46 Database Transaction Details Model 63
Figure 2.47 Three Level Pin Security 64
Figure 2.48 Banking Solution Secured Bank-end 64
Figure 2.49 Banking Security Flowchart 65
Figure 2.50 PIN/Username Transaction Model 65
Figure 3.1 Conceptual Design of Existing System 79
Figure 3.2 Use-case Diagram of Existing System 80
Figure 3.3 Use-case Diagram of Proposed System 81
Figure 4.0 The Open Group Architectural Framework 89
Figure 4.1 System Conceptual Design 92
Figure 4.2 Fingerprint Matching Block Diagram 93
Figure 4.3 Face Matching Block Diagram 95
Figure 4.4 Combined Decision Flowchart 97
Figure 4.5 System Logical Design 99
Figure 4.6 Architectural Design of the System 101
Figure 4.7 Input Processing Output Architectural View of the System 102
Figure 4.8 System Framework 103
Figure 4.9 Biometric Verification Flowchart 105
Figure 4.10 Biometric Authentication Flowchart 105
Figure 4.11 File Management Flowchart 106
Figure 4.12 Data Login Flowchart 106
Figure 4.13 Database Biometric Flowchart 107
Figure 4.14 Transaction Management Flowchart 107
Figure 4.15 Database Recovery Flowchart 108
Figure 4.16 Biometric Access Flowchart 108
Figure 4.17 Record Update Flowchart 109
Figure 4.18 Record Integrity Flowchart 109
Figure 4.19 System Controls Framework 110
Figure 4.20 Dataset Flowchart 113
Figure 4.21 Data Adapter Flowchart 113
Figure 4.22 Object Command Flowchart 114
Figure 4.23 Object Connector Flowchart 114
Figure 4.24 Application Dataflow Diagram 130
Figure 4.25 Application Flowchart 131
Figure 4.26 User Flowchart 132
Figure 4.27 Admin Flowchart 133
Figure 4.28 Application Class Diagram 136
Figure 4.29 Withdraw Services Activity Diagram 138
Figure 4.30 System Activity Diagram 140
Figure 4.31 System Sequence Diagram 141
Figure 4.32 Component-level Design for Withdrawal Service 142
Figure 4.33 Withdrawal Services and Customer Association Diagram 143
Figure 4.34 Relation of Customer and Withdrawal Services Diagram 144
Figure 5.1 Database Server Connection 146
Figure 5.2 Database Creation Screen 147
Figure 5.3 Database Name Screen 147
Figure 5.4 Database Tables Creation Command 149
Figure 5.5 Database Tables 150
Figure 5.6 System Compiler Home Page 152
Figure 5.7 System Master Page 152
Figure 5.8 System Forms Codes 154
Figure 5.9 System Form File 155
Figure 5.10 Database Connection Tool 156
Figure 5.11 System Connection Type 156
Figure 5.12 SQL Server Connection 157
Figure 5.13 System Database 157
Figure 5.14 Database Connection String 158
Figure 5.15 Establishing the Application Connection String 158
Figure 5.16 Connection Testing 159
Figure 5.17 Application Button Creation 160
Figure 5.18 Sample Coding Environment 161
Figure 5.19 Sample of Application Codes 161
Figure 5.20 System Login Page 165
Figure 5.21 System Main Menu 166
Figure 5.22 New User Creation 166
Figure 5.23 Existing Staff Data Interface 167
Figure 5.24 Customer Registration Interface 167
Figure 5.25 Customer Fingerprint and Face Registration 168
Figure 5.26 Customer Database List 168
Figure 5.27 Customer Transaction Detail 169
Figure 5.28 General Ledger Form 169
Figure 5.29 Checking Customer 170
Figure 5.30 Customer Transactions 170
Figure 5.31 Biometric Authentication of Transaction 171
Figure 5.32 Face/Fingerprint Biometric Parameters 171
Figure 5.33 Successful Transaction Screen 172
Figure 5.34 Personal Ledger Interface 172
Figure 5.35 Face/Fingerprint Biometric Features Used 173
Figure 5.36 Exiting Application 173
Figure 6.1 Jmeter Screen Shot 178
Figure 6.2 Finacle/Biometric Application Minimum Response Time Graph 181
Figure 6.3 Finacle/Biometric Application Maximum Response Time Graph 182
LIST OF TABLES
Table 1 Customer Account Registration Table Design Layout 121
Table 2 Withdrawal Table Design Layout 122
Table 3 Payin Table Design Layout 123
Table 4 Application Staff Table Design Layout 123
Table 5 General Ledger database 124
Table 6 Result captured for Existing System 179
Table 7 Result Captured for the Biometric System 180
ABSTRACT
Guaranteed solutions to the current transaction security challenges facing banking industries may not be possible on a large scale, if the solutions are not developed to prevent third party transaction in the used software. Thus, this research lends its voice in support of the move to develop a biometric platform for preventing third party transaction in the banking system. It is meant to use both human face and fingerprint in securing payment platform in the banking software. Hence, the study is motivated by the need to develop a payment platform that is self-secured and be able to prevent third party transaction. In carrying out this research, an in-dept analysis of the existing banking software (Finacle 10.8) used in United Bank for Africa (UBA) was carried out to ascertain its existing security features, also the existing up-to-date banking security models were reviewed in order to establish the gap filled by this research. The data for this research were collected through the use of Key Informant Interview Method (KIIM), site visit and system observation techniques. It was seen that the existing software does not prevent third party transaction and made the software to be secured for customer but not secure for people entrusted with the software (staff). Hence we proposed the used of human face and fingerprint to secure the payment platform in this software as against the use of account number. In designing the platform, the Unified Modeling language such as Use-Case, Class diagrams etc were used as the modeling tool. Similarly, the platform was developed using Object Oriented Analysis and Design Methodology (OOADM) with Rapid Unified Process (RUP) model to manage the software processes. In examining the designed architecture, the Open Group Architectural Framework and the Design Science approach were used to evaluate the architecture/design and the control mechanism framework. During the implementation of the platform, Microsoft Visual Studio 2008 was used as the Integrated Development Environment (IDE) and Microsoft SQL Server 2008 was used as the backend. Similarly, Visual C#.NET programming language was used to program the application control mechanism and ASP.NET was used to develop the application interfaces. The implementation of the software and the testing shows that the platform could secure the banking system using both human face and fingerprint biometric. This thereby makes the software to be able to prevent third
party transaction. Similarly, this platform was subjected to load performance testing using Jmeter performance testing package in order to ascertain the system performance, that is, tail tolerance and scalability. The result captured from the use of the Jmeter was graphically presented using excel. The result shows that the tail tolerance of the platform build using our architecture is significantly better than its equivalent. Specifically, we established that our biometric platform is better than the current platform used in securing banking transaction and can prevent third party transaction.
CHAPTER ONE INTRODUCTION
- BACKGROUND OF THE STUDY
Over the years, there has been a lot of advancement in information processing. Since computers form the major tools used in processing data and manipulating information in many sector (e.g. banking sector), there is need to have adequate security for these computers. Meanwhile Michael and Herbat (2005), define computer security as the need to secure physical location, hardware and computer software from outside threats. There exist multiple layers of computer security namely- physical security, personal security, operational security, communication security, network security and information security. All these layers of computer security have received series of researchers’ attentions since the information age
and a lot of improvements have been recorded on them. It is true that computer software are used to process data and store customers account details in the banking sectors. These computers need vigorous software security because any little compromise by the system, can lead to loss of large amount of money which can create problem for the banks and their customers. Banks need more intrusive security procedure in their software than many other applications (Sommerville, 2011). It is important to note that the banking sectors have been using account number, account name and customers signature for account verification and authentication. These methods of verification and authentication of bank customers has make banking operation to be very easy for the literate and highly difficult for the illiterate and have so many challenges like; poor customer data security, allowing third party transaction, and enabling transaction falsification. This is true because, people can easily copy someone account number, forge his/her signature to commit fraud on that persons account. Also many people who are not familiar with the concept of Personal Identification Number (PIN) and account number are unlikely to memorize and recognize it (Jiang and Yan, 2007), this is mainly applicable to the illiterate customers. These have made many aged people mainly the illiterate ones not to be making use of banks in carrying out their transaction. Thus, there is need for an easy to use banking system, that will be well secured, reliable, simple to access and use by everyone. In the same vein, alots have been
recorded about how many people (bankers) entrusted with the banking solutions, used it to commit fraud, and the software will be unable to prevent it (Paul, 2016, Adebayo, 2016 and Anaba, 2016).
With this in mind, the banking sector have be making more efforts in introducing biometrics as a means of customers account verification and authentication. In order to improve security measures in many data-driven applications, authentication like biometric plays important roles (Rashmi, 2015). It was pointed out that “Biometrics provide very powerful tools for the problems requiring positive identification and provide enabling technology that have potential to make our society safer, reduce fraud and lead to user convenience” (Jain et.al., 2000 and Gunajit and Pranav, 2010). Compared to other security measures, application of biometric technology may provide a better method to curb online fraud, since it uses certain physical and behavioral traits that are distinctive to an individual to identify and verify the person through authentication (Shouvik et.al., 2012 and Okediran, 2014). According to Selina and Jane (2012), “Institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services”. Conventry et.al.(2003) and Amtul (2011) affirmed that fingerprint technology in particular, can provide a much more accurate and reliable user
authentication method. It can help to reduce fraudulent practices in payment transaction in the banking sector.
Meanwhile, the Central Bank of Nigeria (CBN) has recently makes it mandatory for all bank customers to register their biometric information, this is to ease the identification of customer using their physiological characteristics. Biometric is the utilization of physiological characteristics to differentiate an individual. It utilize biological characteristics or behavioral features to recognize an individual. It is a new way to verify authenticity (Rupinder and Narinder, 2014). The reason biometric is gaining more attention in the banking sectors is because, its use has no need for PIN and signature.
Biometric fingerprint are unique to every human, they are generations of numerous ridges and valleys on the surface of human figure. A fingerprint is the flows of ridges patterns in tip of the human finger. Among all biometric traits, fingerprint has one of the highest levels of reliability (Conventry et.al., 2003, Keerthi et.al., 2014). In the rapid growth of information security, fingerprints are highly used to secure information system and are highly reliable. These make many researchers to be agitating for the full use of this technology in securing information in different sectors. Fingerprint has so many application like banking security, Automated Teller Machine (ATM) security, card transaction, physical access control, voting, identification of criminals as recorded by (Vidya and Aswathy, 2014). Similarly,
Adeoye (2014) shows how a fingerprint can be used to control examination screening. The possibilities of using fingerprint to perform verification and authentication is determined by the pattern of ridges and furrows as well as the minute points. Catalin et.al., (2015) maintained that the idea of using biometric for bank user authentication is a new idea that need more attention. With the success of fingerprint biometric system in many fields such as conducting election, keeping attendeance register in company, used in education and many others, many researchers support the opinion of using this kind of technology in our banking services in Nigeria. Since fingerprint biometric system can accept artificial fingerprint it is therefore true that it cannot be 100 percent reliable in securing banking withdrawal transaction as claimed by Selina and Jane (2012), Akinyemi et.al. (2010), Rana and Mumtaz (2012) and Dhurgham and Mohammad (2012). Hence there is need for a multimodal biometric system for banking services. According to Ross and Jain (2006), a multibiometric system can have multiple sources of information: multi-sensor, multialgorithm, multi-instance, multi-sample and multimodal (many biometrics combined, like iris, fingerprint, facial recognition, etc.). Multiple biometric systems can be combined in order to increase the security of specific applications. In our case, using fingerprints and facial recognition will lead to an extremely enhanced authentication method. This system use more than one human physiological (face and fingerprint) feature to provide
strong security during direct payment in the banking system. Thus, this research is to provide an improved methodology and framework in using biometric features for securing payment module in the banking system.
The move to the direction of multimodal is as a result of the fact that some of the limitations imposed by unimodal biometric systems can be addressed through multimodal source of information for establishing identity (Ross and Jain, 2003). Multimodal source are expectedly more reliable due to their multiple, (fairly) independent pieces of evidence (Kuncheva et.al., 2000). They also provide stringent performance requirements imposed by various applications and also address the problem of non-universality. They also deter spoofing since it would be difficult for an impostor to spoof multiple biometric traits of a genuine user simultaneously. Furthermore, they facilitate a challenge response mechanism by requesting the user to present a random subset of biometric traits thereby ensuring that a ‘live’ user is indeed present at the point of data acquisition (Ross and Jain, 2004). A generic biometric system has four important modules; namely sensor, feature extraction, matching and decision modules (Ross and Jain, 2004 and Ahuja and Chabbra, 2013).
The sensor module captures the trait (raw biometric data), while the feature extraction module processes the data to extract a feature set that is a compact representation of the trait. The main function of the matching module is to generate
the matching scores based on comparison of the extracted feature set with the templates in the database by a classifier. Based on a matching score, the decision module rejects or confirms a claimed identity. Important considerations for the design of multi-modal biometric system include architecture, choice of biometric modality, total number of modalities, level of accumulation of evidences, level and methods for fusion, safety and user friendliness and cost versus the matching performances. Others are level of security and reliability, mode of operations, assigning weights to biometrics and multimodal database (Khatoon and Ghose, 2013 and Chandran and Rajesh, 2009). Challenges confronting multimodal biometric systems include failure of sensors to show consistency in various operating environments, poor design due to lack of proper understanding of biometric technologies and public confidence. Other challenges are complex and unverifiable matching algorithms, misleading results due to poor scalability and lack of standard guidelines for auditing biometric system and records (Mane and Judhav, 2013).
STATEMENT OF THE PROBLEM
Recently, the Central Bank of Nigeria (CBN) introduced the used of customer biometrics (Biometric Verification Number) in the banking sector that helped Nigerian banks in implementing secure and reliable banking system mainly at the payment or withdrawal module and the fund transfer or quick teller module.
Hence, many banks have started documenting customer’s fingerprints that can help them provide secured and reliable banking services. Meanwhile, since recent discovering shows that fingerprint can be hacked and when hacked cannot be regain, it is important to use alongside with it other biometric features like facial biometric before its implementation. Hence, the need for a multimodal biometric platform in securing payment module in the banking system cannot be underestimated. Thus, the major problem at hand is how can we develop a multimodal biometric platform that will provide an improved security measures using both fingerprint and facial biometric in authenticating direct payment transaction( cash withdraw platform) in the banking software that will be easy to use while taking cognizance of system security, customer data security and reliability.
AIM AND OBJECTIVES OF THE STUDY
The main aim of this research is to design and implement a multimodal biometric platform for an improved security measures using both fingerprint and facial biometric while making payment (withdrawal) with the banking system.
Hence, the specific objectives of the study are stated as follows:
- Develop a multimodal biometric architecture using both fingerprint and facial biometric features for implementing a secure payment platform (module) in the banking software.
- Develop a framework that helps to understand and ease the development process of a secure biometric payment platform (module) in the banking software.
- Design the functionalities of the multi modal biometric architecture.
JUSTIFICATION OF THE STUDY
With the recent move by the Central Bank of Nigeria (CBN) to register customer biometric data in the banking sector, this sector has made it compulsory for all customers to have their biometric data register in their database. This is to help improve the security of these systems. Meanwhile, usernames, password, signature and PIN have been used to secure payment module in banking system in Nigeria. However, usernames, password, signature and PIN authentication is vulnerable to hacking (Vandommele, 2010 and Jung, 2014). Hence, there is need for a secured and reliable payment platform using the fingerprint biometric. Sri et.al.(2011) and Emuoyibofarhe et.al.(2011) proposed the use of fingerprint biometric for a secured and reliable payment services. This was strongly supported by Akinyemi et.al. (2010), Akazue and Efozia (2010) and Favour (2013). However, with the recent successful hacking of the Germany Defense Minister fingerprint (Zoe, 2014), it is therefore true that fingerprint biometric cannot be 100 percent reliable in securing payment module in the banking system. The possibility of the fingerprint scanner to allowing artificial fingerprint to gain access to any fingerprint biometric system
has been a major setback in using this technique for securing monetary systems. Hence, there is need for a multimodal biometric payment platform in order to implement a secured and a reliable payment module in the banking software. Joseph et.al. (2015) carried out a study on how best to secure fingerprint biometric systems. They stated clearly that future researches should look at how more than one human physiological feature can be used to secure biometric system. The issues (poor system security, difficult to use system, not preventing fraud, higher system operational resources) that are central to biometric system as documented by Joseph et.al. (2015) led to the research that is being addressed in this thesis. This platform provide multi-stage of security for securing payment module in the banking system, the system prototype is highly secured and reliable when compared with the existing method used by this module (i.e account number, signature etc).
SCOPE OF THE STUDY
The banking software is very broad as such this research has only covered the direct payment module (i.e. cash withdrawal platform) of the banking software by implementing a multimodal biometric security technique suitable for this module (using both fingerprint and facial biometric) in order to enhance its security features. It also covers customer’s biometric information (mainly facial and fingerprint images) and how they can be used for securing the payment or
withdrawal platform in the banking software. The study also shows that using these features, we can still carry out other transaction like transfer fund, deposit, general ledger etc.