A Personal Information Management Scheme

There have been many studies on the management of personal information such as PIN code, password, etc. Most schemes include a server containing explicit personal information, and if one can attack this server successfully, then he/she can reach whole personal information on the server. Since information is centralised, the responsibility for services and information is also centralised. There was an example mentioned by R. M. Needham for the Personal Identification Number (PIN) management scheme for Automatic Teller Machine (ATM) transactions [3]. Implicitly, this example represents design concept for enhanced privacy and the responsibility separation. The concept responsibility separation can be regarded as an important design idea for security protocols. Based on this concept, we rebuild his example for practical application. Our scheme provides enhanced privacy, separated responsibility, and nonrepudiation of a bank. It is designed to obtain a cost effective secure system without additional investment to existing structure.