COVR
Highlights
- Based on three-factor, two-channel encryption
- A secure way of authentication and authorizing transactions even when using an unsecured network
- The solution can be applied for bank transactions, retail, cloud-based databases, online gaming, keyless entry, medical records and e-commerce platforms
- Can be adapted to virtually any web configuration
Challenge
In March 2016, one of the leading Swedish companies in the field of cybersecurity reached out to SoftTeco with a request to develop an iOS application. The goal was to create a secure platform for banking and retail. The key challenges were:
- To make the platform adaptable to various web configurations.
- To provide an authentication mechanism that would remain safe even in unsecured networks
Solution
Using a broad technological stack, SoftTeco developed a multifactor authentication system that can be “connected” with any third-party solution.
Authentication was realized by using the multi-step encrypted communication via the mobile device. The app is user-friendly and requires no additional hardware. It can be fully integrated in bank transactions, cashless store purchases, cloud-based databases, online gaming, and IoT, ensuring 100% protection from identity theft, phishing, skimming and credit card hijacking.
Tech Stack
Mobile
Swift
Kotlin
Backend
.Net
C#
Azure Cosmo DB
Azure
Plugins
WordPress Plugin (php)
Outlook Web Access “plugin”
API micro services | Azure Service Fabric
SignalR socket solution
x25519 encryption for API
Identity Server 4
Have a project in mind?
Let us know what kind of software solution you need, and our specialists will provide an estimate cost and deadline.
How it works
Backend details
The admin panel was developed for easy management of the users. The panel is based on the ASP.NET Core MVC platform, which is a cross-platform server solution. The API microservices are hosted on the Azure Service Fabric – a distributed systems platform, which provides scalability and reliability.
The data is stored in Azure Cosmos DB, a non-relational, globally distributed database. This provides horizontal scaling with the ability to select geographic regions and ensures stable and efficient performance. Identity Server 4 is used to provide authentication and authorization capabilities. Identity Server is implemented as a cluster’s micro-service of the Service Fabric and can be easily deployed in any location over the globe. The SignalR library is used to communicate with mobile clients and is based on sockets.
To ensure a high level of security while sending messages, symmetric AES GCM encryption with the shared secret key was implemented. To obtain the key, the standard x25519 is used. It uses the Diffie-Hellman key-exchange protocol which provides high cryptographic stability with sufficient key exchange speed.
The used Android version provides a rational balance between security and the number of supported devices. During the development, modern approaches and tools were used. The application can also be integrated with a built-in fingerprint scanner which comes with some Android devices.
iOS Features
Complex (about 300 lines) yet stable logic for Touch ID and Keychain-authentication.
Mobile app details
Use of the latest technologies: The COVR application uses the latest technologies for 2-way communication – SignalR for .Net Core. The implementation of the maintenance logic for 2 SignalR connections with authorization through a separate API was a challenging yet successful process.
Results
The solution is now a finished marketable product. SoftTeco was responsible for the full development cycle: from requirements clarification and business analysis to implementation, quality assurance and technical support.
