• Title/Summary/Keyword: Mobile Payment Protocol

Search Result 35, Processing Time 0.025 seconds

Authentication and Key Agreement using Delegating Authority for a Secure Mobile Payment Protocol (안전한 모바일 결제 프로토콜을 위한 위임기관을 사용한 인증과 키 동의)

  • Sung, Soon-Hwa
    • Journal of KIISE:Information Networking
    • /
    • v.37 no.2
    • /
    • pp.135-141
    • /
    • 2010
  • Mobile payment system has many problems in real mobile payment networks because of the characteristics of mobile device and the security of mobile payment process. Specially, the previous suggested mobile payment protocol can not verify a trust of issuing bank. Therefore, this paper has analyzed the efficiency of a mobile payment with a delegating authority for an issuing bank to trust issuing bank. As a result, the mobile payment protocol with a delegating authority for a payment verification of an issuing bank has improved the time complexities for key computation and communication resilience.

A Credit Card based Payment Protocol Assuring End-to-End Security in Wireless Internet (무선인터넷에서의 종단간 보안을 제공하는 신용카드 기반의 지불 프로토콜)

  • 임수철;강상승;이병래;김태윤
    • Journal of KIISE:Information Networking
    • /
    • v.29 no.6
    • /
    • pp.645-653
    • /
    • 2002
  • The WPP payment protocol uses the WAP protocol to enable credit card payment on the wireless internet. Since the security of the WAP protocol is based on the WTLS security protocol, there exists an end-to-end security weakness for the WPP payment protocol. This paper is suggesting a payment protocol, which is making use of the Public-Key Cryptosystem and the Mobile Gateway, so assuring end-to-end security independently of specific protocols. As the on-line certification authority is participating on the authentication process of the payment protocol, the suggested payment protocol enables wireless devices to get services from service providers on other domains.

Privacy-Preserving NFC-Based Authentication Protocol for Mobile Payment System

  • Ali M. Allam
    • KSII Transactions on Internet and Information Systems (TIIS)
    • /
    • v.17 no.5
    • /
    • pp.1471-1483
    • /
    • 2023
  • One of the fastest-growing mobile services accessible today is mobile payments. For the safety of this service, the Near Field Communication (NFC) technology is used. However, NFC standard protocol has prioritized transmission rate over authentication feature due to the proximity of communicated devices. Unfortunately, an adversary can exploit this vulnerability with an antenna that can eavesdrop or alter the exchanged messages between NFC-enabled devices. Many researchers have proposed authentication methods for NFC connections to mitigate this challenge. However, the security and privacy of payment transactions remain insufficient. We offer a privacy-preserving, anonymity-based, safe, and efficient authentication protocol to protect users from tracking and replay attacks to guarantee secure transactions. To improve transaction security and, more importantly, to make our protocol lightweight while ensuring privacy, the proposed protocol employs a secure offline session key generation mechanism. Formal security verification is performed to assess the proposed protocol's security strength. When comparing the performance of current protocols, the suggested protocol outperforms the others.

A Design of Safe AKA Module for Adapted Mobile Payment System on Openness SMART Phone Environment (개방형 스마트 폰 환경에 적합한 모바일 결제 시스템을 위한 안전한 AKA(Authentication Key Agreement) 모듈 설계)

  • Jeong, Eun-Hee;Lee, Byung-Kwan
    • Journal of Korea Multimedia Society
    • /
    • v.13 no.11
    • /
    • pp.1687-1697
    • /
    • 2010
  • The USIM-based AKA authentication process is essential to a mobile payment system on smart phone environment. In this paper a payment protocol and an AKA module are designed for mobile payment system which is suitable for openness smart phone environment. The payment protocol designs the cross authentication among components of the mobile payment system to improve the reliability of the components. The AKA module of mobile payment system based on 3GPP-AKA protocol prevents the exposure of IMSI by creating the SSK(Shared Secure Key) through advance registration and solves the SQN(SeQuence Number) synchronization problem by using timestamp. Also, by using the SSK instead of authentication vector between SN and authentication center, the existing bandwidth $(688{\times}N){\times}R$ bit between them is reduced to $320{\times}R$ bit or $368{\times}R$ bit. It creates CK and IK which are message encryption key by using OT-SSK(One-Time SSK) between MS and SN. In addition, creating the new OT-SSK whenever MS is connected to SN, it prevents the data replay attack.

Design and implementation of Mobile Electronic Payment Gateway System based on M-Commerce Security Platform (M-Commerce 보안 플랫폼상의 무선 전자지불시스템 설계 및 구현)

  • 김성한;이강찬;민재홍
    • The Journal of Society for e-Business Studies
    • /
    • v.7 no.1
    • /
    • pp.35-50
    • /
    • 2002
  • Recently, payment method is one of the most hot issues for transaction of contents in mobile and internet markets. Many kinds of mobile contents services are rapidly growing with the combination of internet application services. Payment method algorithms are demanded for the stable transaction between producer and consumer. Security protocol algorithms are widely adapted for mobile Platform terminals. In this Paper, we described security mechanism for the current wireless internet services and compared with the performance result. There are security protocols that based on java machine platform or WAP protocols. The system is based on J2ME technology for the java mobile platform. Based on this technology, a security system is proposed for the service of mobile commerce electronic payment. The system is designed for the stability of transaction so that it enables to apply into many kinds of internet payment system.

  • PDF

Secure Mobile Credit Card Payment Protocol based on Certificateless Signcryption (무인증서 서명 암호화 기법을 이용한 안전한 모바일 신용카드 결제 프로토콜)

  • Choi, Hui-Jin;Kim, Hyung-Jung
    • Journal of Digital Contents Society
    • /
    • v.14 no.1
    • /
    • pp.81-88
    • /
    • 2013
  • The increase of the smartphone users has popularized the mobile payment and the mobile credit card users are rapidly getting increased. The mobile credit cards that currently used provide its users with the service through downloading mobile credit card information into USIM. The mobile credit card saved in USIM has the minimized information for the security and is based on PKI. However certificate-based payment system has a complicated procedure and costs a lot of money to manage the certificates and CRL(Certificate Revocation List). Furthermore, It can be a obstacle to develop local e-commerce in Korea because it is hard for foreigners to use them. We propose the secure and efficient mobile credit card payment protocol based on certificateless signcryption which solve the problem of certificate use.

A Credit Card based Authentication and Key Exchange Protocol for Mobile Internet (무선 인터넷을 위한 신용카드 기반의 인증 및 키 교환 프로토콜)

  • 이현주;이충세
    • Journal of the Korea Institute of Information and Communication Engineering
    • /
    • v.7 no.8
    • /
    • pp.1732-1742
    • /
    • 2003
  • WPP protocol based a Credit card payment in mobile Internet uses WTLS which is security protocol of WAP. WTLS can't provide End­to­End security in network. In this paper, we propose a protocol both independent in mobile Internet platform and allow a security between user and VASP using Mobile Gateway in AIP. In particular, our proposed protocol is suitable in mobile Internet, since session key for authentication and initial payment process is generated using Weil Diffie­Hellman key exchange method that use additive group algorithm on elliptic curve.

Comparative Analysis of ViSCa Platform-based Mobile Payment Service with other Cases (스마트카드 가상화(ViSCa) 플랫폼 기반 모바일 결제 서비스 제안 및 타 사례와의 비교분석)

  • Lee, June-Yeop;Lee, Kyoung-Jun
    • Journal of Intelligence and Information Systems
    • /
    • v.20 no.2
    • /
    • pp.163-178
    • /
    • 2014
  • Following research proposes "Virtualization of Smart Cards (ViSCa)" which is a security system that aims to provide a multi-device platform for the deployment of services that require a strong security protocol, both for the access & authentication and execution of its applications and focuses on analyzing Virtualization of Smart Cards (ViSCa) platform-based mobile payment service by comparing with other similar cases. At the present day, the appearance of new ICT, the diffusion of new user devices (such as smartphones, tablet PC, and so on) and the growth of internet penetration rate are creating many world-shaking services yet in the most of these applications' private information has to be shared, which means that security breaches and illegal access to that information are real threats that have to be solved. Also mobile payment service is, one of the innovative services, has same issues which are real threats for users because mobile payment service sometimes requires user identification, an authentication procedure and confidential data sharing. Thus, an extra layer of security is needed in their communication and execution protocols. The Virtualization of Smart Cards (ViSCa), concept is a holistic approach and centralized management for a security system that pursues to provide a ubiquitous multi-device platform for the arrangement of mobile payment services that demand a powerful security protocol, both for the access & authentication and execution of its applications. In this sense, Virtualization of Smart Cards (ViSCa) offers full interoperability and full access from any user device without any loss of security. The concept prevents possible attacks by third parties, guaranteeing the confidentiality of personal data, bank accounts or private financial information. The Virtualization of Smart Cards (ViSCa) concept is split in two different phases: the execution of the user authentication protocol on the user device and the cloud architecture that executes the secure application. Thus, the secure service access is guaranteed at anytime, anywhere and through any device supporting previously required security mechanisms. The security level is improved by using virtualization technology in the cloud. This virtualization technology is used terminal virtualization to virtualize smart card hardware and thrive to manage virtualized smart cards as a whole, through mobile cloud technology in Virtualization of Smart Cards (ViSCa) platform-based mobile payment service. This entire process is referred to as Smart Card as a Service (SCaaS). Virtualization of Smart Cards (ViSCa) platform-based mobile payment service virtualizes smart card, which is used as payment mean, and loads it in to the mobile cloud. Authentication takes place through application and helps log on to mobile cloud and chooses one of virtualized smart card as a payment method. To decide the scope of the research, which is comparing Virtualization of Smart Cards (ViSCa) platform-based mobile payment service with other similar cases, we categorized the prior researches' mobile payment service groups into distinct feature and service type. Both groups store credit card's data in the mobile device and settle the payment process at the offline market. By the location where the electronic financial transaction information (data) is stored, the groups can be categorized into two main service types. First is "App Method" which loads the data in the server connected to the application. Second "Mobile Card Method" stores its data in the Integrated Circuit (IC) chip, which holds financial transaction data, which is inbuilt in the mobile device secure element (SE). Through prior researches on accept factors of mobile payment service and its market environment, we came up with six key factors of comparative analysis which are economic, generality, security, convenience(ease of use), applicability and efficiency. Within the chosen group, we compared and analyzed the selected cases and Virtualization of Smart Cards (ViSCa) platform-based mobile payment service.

A Ticket based Authentication and Payment Scheme for Third Generation Mobile Communications (3세대 이동 통신을 위한 티켓 기반 인증 및 지불 기법)

  • Lee, Byung-Rae;Chang, Kyung-Ah;Kim, Tai-Yun
    • Journal of KIISE:Information Networking
    • /
    • v.29 no.4
    • /
    • pp.368-374
    • /
    • 2002
  • In the third generation mobile telecommunication systems such as UMTS, one of the important problems for value-added services is to check the recoverability of costs used by a mobile user. Previous authentication and payment schemes for value-added services by a mobile user across multiple service domains, rely on the concept of the on-line TTP, which serves as the users certification authority. In the third generation systems with many service providers, a wide range of services, and a diverse user population, authentication mechanisms with the on-line TTP provide a far from ideal solution. In this paper we present an efficient public-key protocol for mutual authentication and key exchange designed for value-added services in the third generation mobile telecommunications systems. The proposed ticket based authentication and payment protocol provides an efficient way for VASP to check the recoverability of costs without communication with the on-line TTP Furthermore, the proposed ticket based protocol can provide anonymous service usage for a mobile user.

Mobile Payment Based on Transaction Certificate Using Cloud Self-Proxy Server

  • Sung, Soonhwa;Kong, Eunbae;Youn, Cheong
    • ETRI Journal
    • /
    • v.39 no.1
    • /
    • pp.135-144
    • /
    • 2017
  • Recently, mobile phones have been recognized as the most convenient type of mobile payment device. However, they have some security problems; therefore, mobile devices cannot be used for unauthorized transactions using anonymous data by unauthenticated users in a cloud environment. This paper suggests a mobile payment system that uses a certificate mode in which a user receives a paperless receipt of a product purchase in a cloud environment. To address mobile payment system security, we propose the transaction certificate mode (TCM), which supports mutual authentication and key management for transaction parties. TCM provides a software token, the transaction certificate token (TCT), which interacts with a cloud self-proxy server (CSPS). The CSPS shares key management with the TCT and provides simple data authentication without complex encryption. The proposed self-creating protocol supports TCM, which can interactively communicate with the transaction parties without accessing a user's personal information. Therefore, the system can support verification for anonymous data and transaction parties and provides user-based mobile payments with a paperless receipt.