M Mobile Payment

16 downloads 18879 Views 89KB Size Report
The digital signature is an electronic signature that can be used to ... Digital signatures can be used ..... This is a cheap and quick solution for banks and mobile.
1

Mobile Payment

M

Gyõzõ Gódor Budapest University of Technology and Economics, Hungary Zoltán Faigl Budapest University of Technology and Economics, Hungary Máté Szalay Budapest University of Technology and Economics, Hungary Sándor Imre Dr. Budapest University of Technology and Economics, Hungary

INTRODUCTION

BACKGROUND

The widespread usage of new telecommunication technologies implies the demand on payment via Internet since the ’90s. First, these solutions were applied only by pioneer users, while average men still chose traditional payment methods such as payment by cash, cheque, or bank transfer. In the latest decade, the notable improvement of mobile communications allowed the provision of customized services. A new payment method has appeared which is called mobile-payment. Consequently, increasing number of banks provide access to their services via mobile equipment. Reliable network security is an essential prerequisite for the expansion of the rapidly growing world of electronic payment. Public key infrastructure (PKI) offers the capabilities needed to provide this security. Establishing trust in a wireless public key infrastructure (WPKI) is crucial for the success of applications that will exploit the opportunities created by handheld wireless devices. This trust is based on the reliability of the technology but also on a carefully implemented system of laws, policies, standards, and procedures. The development of trusted electronic transactions is motivated by legislation. The EU adopted a legislative framework to guarantee the security and acceptance of electronic signatures in 1999. The U.S. adopted legislation for the recognition of electronic signatures in national and global trade in June 2000 (Sievers, 2000). This article deals with mobile payment and mobile banking services and focuses particularly on the mobile side of the system. First, we introduce the technological background necessary for developing m-services, and we define the m-payment reference model. After that, the differences between chip-card and software based implementations will be presented. Finally, we conclude the article and summarize the main terms used in the article.

The Mobile Payment Forum (MPF) (2002) defines mobilepayment (m-payment) as the process of two parties exchanging financial value using a mobile device in return for goods or services. The trusted transactions of a mobile payment system are called mobile payment transactions. The main areas of use are the following: • • •

m-banking and m-payment, in case of performing banking and payment affairs; m-administration, when accomplishing administration tasks; and m-government, in case of arranging public administration affairs using the mobile electronic way.

The mobile device and the mobile network have two main roles in m-payment: • •

they enable secure client authentication and identification; and they support the generation of digital signatures on the client side.

The user authentication means that a service provider determines the identity of a user (Kanniainen, 2001). The digital signature is an electronic signature that can be used to authenticate the identity of the sender of a message or the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures can be used for many purposes, such as authorizing a subsequent transaction or creating a signature of the user with properties fulfilling the requirements of electronic signature laws.

Copyright © 2006, Idea Group Inc., distributing in print or electronic forms without written permission of IGI is prohibited.

Mobile E-Payment: Participants and Solutions

The user authorization means that a service provider ensures that the user has viewed and accepted a transaction contract (Kanniainen, 2001). The technological background exists for developing services based on trusted mobile transactions. The bandwidth of the mobile channel is only a small fraction of that of the Internet, but user authentication, digital signature transfer, authorization control require low bandwidth from the mobile network. Even low-end mobile devices support WAP functionalities (Wireless Application Protocol Forum [WAP Forum], 2001c) and text message sending. Their SIM card implements SIM Application Toolkit (SAT) and supports the necessary cryptographic algorithms at chip-card level. These are essentials to implement client-side banking applications (Van der Merwe, 2003). Smart-phones with increased processing speed have already been introduced to the market. They support the development of software-based banking applications without using the functionalities of chip-card and relying only on the security of software-based encryption algorithms (Mobey Forum Mobile Financial Services Ltd. [Mobey], 2003). In 2004 the Trusted Mobile Platform was introduced by IBM and Intel. It is a software and hardware requirement specification for mobile equipment (Trusted Mobile Platform, 2004) in secure environment. Trusted mobile services are based on PKI technology. PKI offers strong authentication and encryption mechanisms and facilitates the secure exchange of sensitive messages in public information networks (Torvinen, 2000). PKI functions permit detection of messages that have been tampered with or altered during transmission. PKI summarizes the processes and techniques performing key-certification in public cryptography architecture. Each entity in the PKI system has at least one key-pair which consists of a private key and a public key. The private key is the secret of a given entity never discovered to others. Public keys are certified by a trusted third party called Certification Authority (CA) (WAP Forum, 2001a). WPKI is a PKI where at least the user-side of the system uses wireless medium. WPKI uses more compact certificates then PKI and its certificate acquisition process is adapted to mobile environment (WAP Forum, 2001b). Several international technical organizations were founded starting from the late ’90s, elaborating standard solutions or directives for trusted mobile transactions. Such organizations are Radicchio, Liberty Alliance, GSMA, ETSI M-COMM Working Group, OMA, MPSA, Mobey Forum, and Mobile Payment Forum, for example. Members of these organizations are mobile operators, financial institutions, research, developing, and standardization organizations (see Table 1). 2

Table 1. Organizations specifying trusted mobile transactions Name Radicchio (T2R)

Foundation Members Mars 2002

Liberty Alliance

Sept 2001

MPSA (SimPay)

Mars 2003

Mobey Forum

Mai 2000

MeT

April 2000

Mobile Payment Forum (MPF) Open Mobile Alliance (OMA)

Nov. 2001

June 2002

GSMA, Liberty Alliance, ETSI VeriSign, Nokia, Sun, RSA, Vodafone, American Express, Novell Vodafone, T-Mobile, Orange, Telefónica Móviles VISA, ABN-Amro Bank, Nokia, Deutsche Bank NEC, Nokia, Panasonic, SonyEricsso2n American Express, JBC Co. Ltd., MasterCard International and Visa International Vodafone, Ericsson, WAP Forum, IT companies

MOBILE-PAYMENT SERVICES An m-payment system involves a wireless device that is used and trusted by the customer. M-payment is not a new payment instrument but an access method to activate existing payment transactions processed by banks. Mobile payment transactions (and systems) can be classified upon location basis or value basis. On location basis, local and remote environments are distinguish (Mobile electronic Transactions [MeT], 2001), on value basis, micro (10Euros) payment (Mobey, 2003). In local environments transactions are usually initiated over a short-range wireless technology

Figure 1. The mobile payment transaction Consumer

Transaction Details

Merchant

Transaction Credentials

Transaction Credentials

Bill

Funds

Transaction Credentials Funds

Issuer

Acquirer

Mobile E-Payment: Participants and Solutions

such as Bluetooth or RFID (Saleem, 2002). A typical application would be retail shopping using an account-based payment made from a mobile device. In remote environment the connection between the content server and mobile device is established via a Public Land Mobile Network, such as the GSM cellular network (Mobey, 2003). The four main parties involved in a mobile payment transaction (see Figure 1) – the user, the network operator, the financial institution, and the merchant – share many of the same concerns that need to be addressed by a mobile payment standards body (Henkel, 2001; MPF, 2002). •







Consumers are mostly concerned with security, ease of use, and privacy. They also require the payment scheme to work across multiple devices, including mobile phones, PDAs, wireless tablets, and handheld computers. Mobile operators’ principal concerns revolve around standardization and interoperability. Operators want payment to be seamless, allowing them to compete on services and applications. Financial institutions, meanwhile, are primarily concerned with ensuring the integrity of the payment system and reducing the risk of fraud. M-payment solutions must have synergy with existing payment instruments and infrastructure, systems, processes, and rules. Merchants or content providers want the payment process to be transparent to the user, as this encourages greater usage and/or propensity to complete a purchase. They also want any payment scheme to facilitate swift and easy completion to ensure they get paid on time.

Figure 2 shows the reference model of mobile payment systems. The main elements of the reference model are the following: •









Mobile Device: Its main functions are the authentication of the subscriber’s identity and granting of the permission for the operation of a secure transaction. It is called Personal Trusted Device (PTD) by MeT (2001). Security Element: The mobile device includes a security element which provides a tamper-proof environment to run the necessary cryptographic functions. It contains the user’s private-public key pairs and root certificates (used to verify other certificates) (Mobey, 2003). Issuer: This is the user’s bank or a provider via which the mobile electronic transactions are running. One of its main functions is to issue certificates for the subscriber when the user registers himself for the m-banking service. The issuer should produce at least two certificates for the user, which are the following: one is used during the authentication process; the other is used during the digital signing process. Content Provider: It corresponds to the merchant. The content provider supplies content to the user’s mobile device. The application running on a content server may request the user to perform user authorization (sign a transaction). Acquirer: The acquirer provides a single point of contact between issuers and content providers. In mobile payment transactions, the acquirer’s role is

Figure 2. The reference model of the m-payment transaction Issuer

Acquirer Proprietary interface

User User interface

Service registration interface

Security element interface

Security Element

Proprietary interface

Service execution interface

PTD

Content Server 3

M

Mobile E-Payment: Participants and Solutions

to provide the business rules and relationship among multiple content providers and issuers. As a consequence, banks do not need to make agreements with every merchant and vice versa. A consumer decides to pay in a shop using mobile payment service. When the transaction is initiated, he sends the URL of his bank to the merchant. The merchant redirects the user to the issuer (bank) and sends him the total amount. The bank and the user authenticate each other; the bank sends the transaction data to the user. If the user decides to authorize the transaction, he signs the content with his digital signature by entering his signing PIN. Then the bank connects to the merchant and requests his authorization to finish the transaction. After this, the bank redirects the user’s browser to the page of the merchant, and the merchant notifies the user about the successful termination of transaction (Vilmos & Karnouskos, 2003; Karnouskos, Hondroudaki, Vilmos & Csik, 2004).

TECHNOLOGICAL SOLUTIONS FOR M-PAYMENT SERVICES The security element – defined in the reference model – can be implemented in many ways, depending on the agreement of banks, m-payment service issuers, and mobile operators. Two main categories exist: chip-card based solutions or software-based solutions. In chip-card based (Kanniainen, 2001) solutions, security-related functions and keys are stored on the chip-card. Applications not requiring a tamper-proof environment (e.g., the menu of the service) can be stored both on a chip-card and/or a mobile device. In software-based (Mobey, 2003) solutions all parts are implemented in software on the mobile device, including cryptographic functions, certificate and key storage. In case of chip-card implementations banks, and mobile operators have to decide either to put banking applications and keys on the same chip-card or on a separate one. Security element implementations can also be classified by distinguishing between SIM-card dependent and SIM-card independent solutions referring to the role of mobile operator. In case of SIM-card dependent solutions, the applets, keys, and a part of the certificates for the banking and payment applications are stored on the chip-card under the control and authority of the mobile operator. In case of SIM-card independent solutions nothing from the banking application, private key and certificate for m-payment is stored on the chip-card for

4

mobile operators.

SIM-Dependent Solutions Advantages SIM-dependent solutions are advantageous for the user because all functionalities are integrated into one chipcard and one device. The merchant can strongly authenticate the user through a trust chain starting from his bank and ending at the user’s bank. Device manufacturers do not need to develop multi-card devices. The security level of this solution is high. The chip-card is portable from one device to another, can dispose standard interface via the device, and applications on the chip-card are protected against viruses.

Disadvantages The main disadvantage of SIM-dependent banking applications from the bank’s point of view is the dominant role of the mobile operator in the system. The bank and the mobile operator have to agree on their choice of chip-card manufacturer, the set of applications, and keys to upload to the card. The mobile operator can influence the choice of technical solution for the banking application. Besides these, it is the bank who has to handle the financial responsibility and risks. Mobile operators can charge the bank with costs of service. Registration for m-payment and m-banking service can be done in the stores of the mobile operator.

SIM-Independent Solutions An SIM-independent solution means that the mobile operator does not have to change its SIM cards. There are two major types of SIM-independent solutions. The implementation of security element can be: •



a second chip-card (dual-chip device [Kanniainen, 2001]), which may be either one common chip-card for all banks or one separate chip-card for each bank; or implemented in software as an application that is downloadable to the mobile device.

Dual-Chip Solution Advantages Banks become independent from the mobile operator because they provide the user a separate chip-card. The tasks of registration, chip-card distribution, and other services of the bank and of the mobile operator diverge.

Mobile E-Payment: Participants and Solutions

Later, newer applications can be downloaded over the air (OTA) to the chip-card provided by the bank without affecting the applications of the mobile operator. The mobile operator and the m-payment provider may choose chip-card manufacturer independently. The mobile operator does not have to extend its registration and chipcard distribution system. The device manufacturer gains a dominant role because new, dual-chip card devices are needed, and mobile operators and banks would support this activity. The user can feel himself more secure because his security data are not only on one card, but can also see the separation between mobile operator and banking services. The user does not have to change his SIM-card. The merchant can strongly authenticate the user through the trust chain of banks. High security applications can be implemented using this solution. Disadvantages In general, we cannot expect the introduction of these devices from device manufacturers. There are several reasons for this. The size of the device would grow, their hardware structure would change, and the production of new devices would be expensive. Another problem is that banks would have to handle chip-card management. In the case of one common chip-card for all banks, banks would need to agree on the application set installed on the chipcard, or they would have to choose the same m-payment service provider. Banks usually do not want to deal with the distribution of new chip-cards into the phones. This solution is costly for banks. For the big-sized dual-chip devices, a future solution may be the use of secure RFID chips (Mobey, 2003). These chips do not need real slots; they are contactless. It is enough to put them near the device, on its back, for example. In this case, the bank would give an RFID chip to the user at the registration. Secure communication between the RFID chip and the mobile device is indispensable.

banking services could work easily. In practice, they have to cooperate with mobile operators because operators have the only control over the communication channel. The applications are easy to upgrade but require high caution. The downloading of new applications to a coded device may require some agreement with the mobile operator. Disadvantages One of the disadvantages of software-based solutions, from a technical point of view, is the huge and rapidly increasing number of new software environments and operating systems. The client application must be prepared to run in several environments and should pass many audits during development. Besides this, if software-level encryption is used, viruses and malicious code pose a much higher risk than in the case of chip-card based solutions. Chip-cards filter out non-standard messages by default.

FUTURE TRENDS A key issue concerning mobile payment is interoperability. As interoperability can be achieved by the use of (preferably international) standards, the intensive standardisation work is very important for mobile payment systems to get widely used. Another important issue is a PKI as global as possible and trusted by all the players of the system. As Lannerström (2000) states, wireless devices offer tremendous flexibility when combined with a PKI. With the use of a PKI for wireless systems, a mobile device turns into an inexpensive but powerful device by which the user can be securely authenticated and digital signatures can be produced. As these features are absolutely necessary for mobile payment systems, PKI will also play an important role in the evolution of these systems.

Software-Based Solutions CONCLUSION In the case of a software based security element (Kanniainen, 2001; Mobey, 2003), all the banking application are uploaded on the device without the need of any SIM-based function. Advantages This is a cheap and quick solution for banks and mobile operators. Device manufacturers tend to produce smartphones capable of running these applications. Mobile operators will have traffic increase on their networks due to m-services. Theoretically, banks could upload their own applications separately from mobile operators, and

In this article, the main concepts of m-payment were presented. The article gives a general overview of mpayment solutions, without going into too much technical detail but addresses technical issues. First, the mobile payment model was presented; the four participants were introduced. Then, we focused on the difference between chip-card based and software-based client side banking applications. We analyzed them from the point of view of participants in the m-payment business.

5

M

Mobile E-Payment: Participants and Solutions

REFERENCES

http://www.projectliberty.org/Radicchio/downloads/ leg_001.pdf

Henkel, J. (2001). Mobile payment. The German and European Perspective. Department of Computer Science and Engineering, Indian Institute of Technology, Bombay, India. Retrieved August 19, 2005, from Indian Institute of Technology Web site http://www.cse.iitb.ac.in/~anil/ MTP/MobilePayment.pdf

Torvinen, V. (2000). Wireless PKI: fundamentals. Radicchio White Paper (Publication No. WP-SMD-001). Retrieved August 19, 2005, from Liberty Alliance Web site http://www.projectliberty.org/Radicchio/downloads/ smd_001.pdf

Kanniainen, L. (2001). The preferred payment architecture. Technical Documentation. (Requirements for manufacturers and standardisation bodies, Version 1.0). Retrieved August 19, 2005, from Mobey Forum Web site h t t p : / / m ob eyfor u m . or g / p u bl i c / m a t er i a l / PPATechnical.pdf Karnouskos, S., Hondroudaki, A., Vilmos, A., & Csik, B. (2004). Security, trust and privacy in the SEcure MObile Payment Service. 3rd International Conference on Mobile Business 2004 (m>Business), New York City, U.S.A., July 12-13. Lannerström, S. (2000). Wireless PKI: Opportunities. Radicchio White Paper (Publication No. WP-SMD-002). Retrieved August 19, 2005, from Liberty Alliance Web site: http://www.projectliberty.org/Radicchio/downloads/ smd_002.pdf Mobey Forum Mobile Financial Services Ltd. (2003). Mobey forum white paper on mobile financial services 1.1. Retrieved August 19, 2005, from Mobey Forum Web site http://mobeyforum.org/public/material/Mobey% 20Forum%20White%20Paper%20on%20Mobile%20 Financial%20Services%20v1_14.pdf Mobile electronic Transactions. (2001). MeT Core Specification. (Version 1.0, 21 February 2001). Retrieved July 15, 2005 , from MeT Web site h tt p:/ / www.m obiletra nsaction .org/pdf/MeT-Cor e-Spec20010221.pdf Mobile Payment Forum Inc. (2002). Enabling secure, interoperable, and user-friendly mobile payments. Mobile Payment Forum White Paper. Retrieved August 19, 2005, from MPF Web site http://mobilepaymentforum.org/ pdfs/mpf_whitepaper.pdf Saleem, R. (2002). Preferred payment architecture: local payment. (Local Payment Discussion Document 1.0). Retrieved August 19, 2005, from Mobey Forum Web site h t t p : / / m ob eyfor u m . or g / p u bl i c / m a t er i a l / Local%20Payments%20Discussion%20Document%201.0.pdf Sievers, M. (2000). Legislation and PKI evolution. Radicchio White Paper (Publication No. WP-LEG-001). Retrieved August 19, 2005, from Liberty Alliance Web site

Trusted Mobile Platform. (2004). Trusted Mobile Platform (Hardware Architecture Description - Revision 1.0). Retrieved August 19, 2005, from Trusted Mobile Platform Web sit e h tt p://www.t r usted-m obil e.or g/ TMP_HWAD_rev1_00.pdf Van der Merwe, P.B. (2003). Mobile commerce over GSM: a banking perspective on security. MSc Theses, Faculty of Engineering, University of Pretoria, Pretoria, South Africa. Vilmos, A. & Karnouskos, S. (2003). SEMOPS: Design of a new payment service. International Workshop on Mobile Commerce Technologies & Applications (MCTA 2003). Proceedings of the 14th International Conference DEXA 2003, Prague, Czech Republic, September 15. Wireless Application Protocol Forum LTD. (2001a). Wireless application protocol. Public key infrastructure definition. (WAP-217-WPKI, Version 24-Apr-2001). Retrieved August 19, 2005, from Open Mobile Alliance Web site http://www.openmobilealliance.org/tech/affiliates/ LicenseAgreement.asp?DocName=/wap/wap-217-wpki20010424-a.pdf Wireless Application Protocol Forum LTD. (2001b). Wireless application protocol, WAP certificate and CRL profiles specification. (WAP-211-WAPCert, Version 22May-2001). Retrieved August 19, 2005, from Open Mobile Alliance Web site http://www.openmobilealliance.org/ tech/affiliates/LicenseAgreement.asp?DocName=/wap/ wap-211-wapcert-20010522-a.pdf Wireless Application Protocol Forum LTD. (2001c). Wireless application protocol architecture specification. (WAP-210-WAPArch-20010712, Version 12-July-2001). Retrieved August 19, 2005, from Open Mobile Alliance Web site: http://www.openmobilealliance.org/tech/affiliates/LicenseAgreement.asp?DocName=/wap/wap-210waparch-20010712-a.pdf

KEY TERMS Authentication: Proof of identity. Digital Signature: An electronic signature based

6

Mobile E-Payment: Participants and Solutions

upon cryptographic methods of origin authentication. Usually it is appended to a message to assure the recipient of the authenticity and integrity of the message. Mobile Payment: The process of two parties exchanging financial value using a mobile device in return for goods or services. Mobile Transaction: Trusted transactions of a Mobile Payment system. PKI: The abbreviation of Public Key Infrastructure, a

set of policies, processes, server platforms, software, and workstations used to administer certificates and publicprivate key pairs, including the ability to issue, maintain, and revoke public key certificates. Registration: A procedure where the account of the given services and the subscriber’s identity are coupled. RFID: Abbreviation of Radio Frequency Identification, a transponder technology for the contactless recognition of objects. SAT (SIM Application Toolkit): A standard operational environment for applications stored on the SIM (and the third generation USIM). SIM (Subscriber Identity Module): The subscriber dependent part of the mobile equipment. Smart-Phone: Voice centric mobile phone with information capability.

7

M