The Home BankingComputerInterface (HBCI) is a secure transmission protocol for financial transactions in open networks such as the Internet. HBCI is located on the application layer, is based on EDIFACT and offers multibank clients and bank servers the possibility to communicate on any protocol, including TCP/IP. The protocol was selected by the German banking associations as the standard protocol for online banking and is intended to replace financial transactions using the PIN/TAN procedure.
The HBCI system is a communication system between bank and customer computer. It consists of the bank's HBCI chip card, the card reader and the customer computer with the banking software. The customer computer is connected to the bank server via online access. The orders are prepared locally and confirmed by the customer with his HBCI chip card and PIN code on the card reader. This is followed by the digital signature with the signing key. The prepared order is then transmitted in encrypted form from the customer client to the bank server, where it is processed.
HBCI as a flexible user interfaceThe HBCI interface is flexible in terms of the bank-user interface, it is multi-bank capable and can also be used for other transaction services such as online brokerage. It also features high security with triple protection: This includes encryption with the DES-DES procedure (DDV) or the RSA procedure and transmission with the SSL protocol, digital signature and public and private data keys for communication between customer and bank. Authorisation takes place when the connection is established, during which the user logs on to his bank server using a password. After specifying the limits, the user can carry out his transactions, which are completed with the digital signature. The digital signature uses an RSA signature smart card that works with a key pair. Another HBCI interface uses the Message Authentication Code (MAC) with two keys that only the bank customer and the credit institution know. One key is the key for the digital signature, the second is used for encryption.
In version 2.2 (HBCI+) , HBCI allows legitimation by personal identification number (PIN) and transaction number (TAN) in addition to legitimation by chip card and diskette. In version 3.0, the name Financial Transaction Service (FinTS) is used for the HBCI technology. In this version, either HBCI or the PIN/TAN procedure is used. HBCI is used in Europe, while Open Financial Exchange (OFX) is used in the USA.