Çevrimiçi bankacılık için yeni kimlik doğrulama yöntemi
New authentication method for online banking
Yazar: NURANA VERDIYEVA
Danışman: DOÇ. DR. ENVER ÖZDEMİR
İstanbul Teknik Üniversitesi / Lisansüstü Eğitim Enstitüsü / Bilgisayar Bilimleri Ana Bilim Dalı / Bilgisayar Bilimleri Bilim Dalı
Derece: Yüksek Lisans, 2022
Konu: Bankacılık = Banking ; Bilgisayar Mühendisliği Bilimleri-Bilgisayar ve Kontrol = Computer Engineering and Computer Science and Control ; Bilim ve Teknoloji = Science and Technology
Dizin: Elektronik bankacılık = Electronic banking ; Kimlik doğrulama = Identification verify

Özet:
Teknolojinin hızla ilerlemesi sonucunda birçok alanda yapılan işlemlerin çevrimiçi olması hem kolaylık hem de zaman tasarrufu sağlıyor. Günümüzde çevrimiçi bankacılık uygulamalarının kullanımı buna en iyi örneklerden biridir. Çevrimiçi bankacılık, bir bankanın veya bir finans kurumunun müşterisine internet üzerinden çevrimiçi olarak finansal veya finansal olmayan işlemlerini yapmasını sağlayan elektronik bir sistemdir. Müşterinin banka hesap ve kayıtlarına 7 gün 24 saat boyunca dilediği yerden erişim sağlaması, hesap bakiyelerinin kontrolü ve işlemlerinin hızlanması çevrimiçi bankacılık uygulamalarının önemli avantajları arasında yer almaktadır. Geleneksel bankaların aksine çevrimiçi bankalar, müşterilerinin hesaplarına öncelikle mobil erişim sağlar. Tüketici, çevrimiçi bankacılık uygulamaları vasıtasıyla uluslararası ödemeler, para transferleri, fatura ödemeleri, ödemeleri otomatik hale getirmesi gibi temel bankacılık işlemlerini çevrimiçi bankacılık uygulamaları ile gerçekleştirebilir. 
Bunun dışındaki farklı ve daha komplike durumlar için müşterinin banka şubesine gitmesi gerekiyor. Bu durumlardan biri kullanıcının bir bankada yeni bir hesap açma işlemidir. Bir tüketici, her hangi bir bankada hesap açtırmak için gerekli belgelerle birlikte hesap açmak istediği bankanın en yakın şubesine uğramalıdır. Veya tüketicinin, banka hesabı açtırmak istediği bankanın internet sitesi üzerinden çevrimiçi başvuru yaptıktan sonra işlem tamamlanması için yine de bu banka şubesine uğraması gerekiyor. Sadece çevrimiçi hizmet sağlayan bankalar ise, kullanıcı ile görüntülü konuşma yaparak veya bu kullanıcı ile belirli bir lokasyonda görüşerek hesap açma işlemini gerçekleştiriyor. Bu ihtimallerinin her birinde hem kullanıcı hem de banka için zaman kaybı olması önereceğimiz metotun ilk önemli avantajlarından biridir. 
Önereceğimiz bu metot sayesinde kullanıcının her yeni bankada hesap açma prosedürü için fiziksel olarak banka şubesine uğramasına veya görüntülü konuşmasına gerek kalmadan işlemini tamamlamış olacaktır. Sunacağımız metot dolayısıyla tüketici bilgilerinin çalınması veya kaybedilmesi durumunda bu tüketicinin bilgilerini kullanarak her hangi bir bankada hesap açılmasının da önüne geçmiş olacağız. Hakkında bahsedeceğimiz bu yeni metot, bir kullanıcı, bir kullanıcının önceden fiziksel olarak hesap açma işlemini tamamlamış olduğu banka ve bir kullanıcının hesap açma işlemini yapmak istediği bir banka arasındadır.  Bu yöntem, kendi arasında kullanıcı bilgilerinin paylaşımını yapabilen bir grup banka arasında olacaktır. Bu metotun algoritmasında şifreleme için AES şifreleme yöntemi kullanılmıştır. Ayrıca yöntemin, en çok kullanılan Replay saldırılarına karşı güvenli olduğu ve metotun algoritmasındaki bazı değerlerin değişkenliği kontrol edilerek hızlı ve verimli olduğu sonucuna varılmıştır.
Tez, beş bölümden oluşmaktadır. İlk bölümde giriş, ikinci bölümde mevcut kimlik doğrulama yöntemlerinden bahsedilmiştir. Üçüncü bölümde çevrimiçi bankacılık ve kimlik doğrulama yöntemleriyle ilgili literatür araştırılması yapılmıştır. Dördüncü bölümde önereceğimiz metot detaylı olarak anlatılmış ve Python programlama dilinde algoritması kodlanmıştır. Son bölümde ise bu metot ile ilgili analizlerin sonucu hakkında yazılmıştır

Abstract:
Today, the use of the Internet has a positive effect on every aspect of life. Dealing with transactions online is everyone's choice in terms of both times saving and convenience. For this reason, in addition to their websites, organizations offer their own applicationson phones and tablets suitable for both iOS and Android use. Especially in the banking sector, the use of online applications has increased considerably. In order to log into the online application of each bank, it is necessary to be a customer of that bank. A password is sent to the phone number or e-mail address where the user performs this transaction after registering with the bank. The bank customer can log in to the online banking application downloaded to his/her device for the first time with this password and the customer number given after opening the account. After this process, the user can change the application's password and set his/her own password. Online banking is an electronic system of a bank or a financial institution that allows its customer to conduct financial or non-financial transactions online. Online banking provides the opportunity to perform and manage all banking transactions over the internet and outside of normal banking hours, using a computer, tablet or mobile phone. Thus, customers do not have to go to the bank branch to enjoy every little service.
Using online banking applications, customers can check their bank account balances access bank statements, automate their payments, and make some financial or non-financial payments from anywhere, 24/7. The fact that the user can check his/her bank account at any time means that his/her account is even more secure.
Authentication is a term that refers to the process used to prove that a document or piece of information is authentic. In general, in the authentication process, a user proves his/her identity by providing shared credentials between the user and the system. Authentication technology grants access to the system by checking that the user's credentials match those in a data authentication server or database. Information security is ensured by performing the authentication process in a secure process. It is important for banks to have a proper authentication system set up, the user proves that he/she is who he/she says he/she is when he/she authenticates accessing his/her bank account. Multi-Factor Authentication, which prevents most cyberattacks with stolen credentials, is one of the most used methods by banks.
Authentication is always done at the start of accessing an application or system without allowing any code to run. In different systems, different information may be requested to verify the identity of users. A credential is usually a type of confidential information known only to a user and a system. In general, the authentication process is divided into 2 different phases. The first of these is the identification phase, and the other is the actual authentication phase.
There are common authentication methods used to secure modern systems in order not to be affected by cybercriminal attacks. These are Single-Factor Authentication or Traditional Authentication, Two-Factor Authentication or Double-Factor Authentication, and Multi-Factor Authentication.
Banks make their online service applications available for some purposes from wherever the consumer wishes, without time constraints, as long as the consumer is connected to the internet network. The first of these is that the bank customer can check his balance. Another purpose is to transfer money between accounts in the same institution or between accounts in different banks. Another is that users can pay their bills, automate payments, and set up or cancel pending orders through the online service. Another purpose is that it can control linked mortgages, loans, and investments that may be tied to the user's account.
In order for the consumer to open an account in any bank, he or she generally needs to visit a branch of that bank with the required documents. In some banks, even if the user applies to open an account on the website in advance, he/she still needs to visit the bank branch to complete the procedure. Banks that provide only online services, onthe other hand, complete the process of opening a bank account by either making a video call with the user or meeting at a certain location, since they do not have bank branches. The last step of opening a bank account is the delivery of the bank card to the customer. The customer can use the bank's ATM service or internet banking to activate the card and set the card password.
One of the most important reasons for using online banking applications is that it saves time for both the bank and the consumer. One of the other important reasons is to use internet banking applications to prevent a problem such as opening a bank account with that user's information in case of theft or loss of user information. Considering these reasons, a new method is proposed in this thesis.
Thanks to the method we will suggest, the user will not need to be physically present at any branch of that bank to open an account at the bank if a user has already an account in any bank or in a trusted institute. The user will have completed the procedure of opening an account in new bank without making a video call with the bank's customer representative or meeting at a certain location. This method requires communication between banks that can exchange data securely with each other. This new method will be between a user, a bank where a user has previously physically visited the bank's branch and completed the account opening process, and a bank where a user wants to open an account. There is communication between the bank where the user is physically located at the bank branch and the bank which he/she wants to open an account with.
According to this method, the user physically goes to the branch of a bank and completes the procedure for opening an account in that bank. This user is now a customer of the bank. The user wants to open an account in the other bank. We offer this new method so that the user is not physically present in this bank and does not repeat the same transactions. According to the method we will suggest, the bank tha tthe user wants to open a new account shares some information with the user and with the bank where the user has already an account. The received information and the user's private information obtained from the earlier bank is processed and it is send to the bank where the user wants to open an account. The new bank also needs to perform some computational task and compare the results with the received information from the user if received and computated information match an account is granted to the user and if the values are different, the user cannot open an account in this bank. AES encryption method is used for encryption in the method. This procedure will be between the bank where the user wants to open an account and the bank where the user has already an account.
Analyzes were made on the algorithm of the method we will propose in the thesis, and charts were created according to the result. According to this result, the presented method is fast and efficient. In addition, it has been determined that the method is safe against the most applied replay attack.
The thesis consists of five sections. In the first part, the introduction is presented. In the second part, the current authentication methods are laid out. In the third chapter, the literature on online banking and current authentication methods has been described. In the fourth chapter, the method is explained in detail and the analysis of the method was made on the algorithm and the tables were created. In the last section, the results of the analysis are presented