Secure Payments Using Mobile Device Literature Synthesis Adrian Maritz 1/05/ Introduction

Transcription

1 Secure Payments Using Mobile Device Literature Synthesis Adrian Maritz 1/05/2011 Abstract In this paper we discuss different methods used to conduct payments using a mobile device. Focusing on the factors that need to be taken into consideration to implement a successful mobile payments system. Using QR Codes to identify the client to a merchant and a pin to authenticate the client to process payment between two parties. Keywords: m- payment, Bluetooth,RFID,near sound data transfer, QR Code 1. Introduction The aim of this paper is to establish the feasibility of an m- payments system in developing nations like South Africa with focus on people living in rural areas. At the moment in some rural parts of South Africa people are using prepaid airtime as an alternative currency [7]. During the course of this paper a new method will be examined alternative methods. With an estimated 5.3 billion mobile phone [1] users worldwide the demand for further uses of these devices is growing. In 2009 Gartner identified that money transfer would be the number one consumer mobile application for The reasons for this being its lower costs, faster speeds and improved confidence compared to traditional money transfer techniques. [2]. The number six consumer mobile application is mobile payments with large interest from both developing and developed countries. The one problem with mobile payments is the regulatory requirements of the different markets that it has been tested in. For this reason the market is very fragmented with many different methods being used. In this paper the different methods and current providers will be discussed. Mobile phones have made it possible for people without bank accounts to do financial transactions on their mobile phones using a form of credit system or prepaid airtime. There has become more demand for mobile applications that supply pro- poor services [3] with a focus on providing them with access to financial services. In many developing worlds these mobile payments services are the first financial service for the previously unbanked people. More than a billion people worldwide lack access to traditional financial services yet many of them have mobile phones and access to wireless telecommunication networks. [6] They offer a compromise between formal bank accounts and temporary money transfers. Experts predict that by million people will rely on mobile money [6]. Japan is one of the pioneers in this market in December 2010, 9.8 million Japanese mobile users made purchases using their mobile wallets on their mobile phones this is nearly 10% of all mobile subscribers in Japan. Majority of these purchases were in retail or convenience stores.

2 2. Features needed for a successful M- Payments system An m- payments system should be quicker, safer and just as easy as using normal cash. It also needs to meet the following requirements. [13] Security: The system should be as secure as traditional cash if not more secure. This is one of the most important characteristics in all financial transactions. Anonymity: The merchant should not be able to access the clients bank account they should also not be able to get personal details about the client. The bank should also not be able to track what the client is buying. They should only know the amount and the merchant s details. A bank or merchant should not be able to track or monitor the spending habits of a customer and be able to build a profile for that client. Off- line availability: A payment needs to be able to be made even if the 3 rd party server is unavailable. If this were not possible it would not be better than traditional cash. Scalability: There should be no reliance on a central component. The reason for this is that it could cause a bottleneck and can become a point of failure. The whole system needs to be distributed and be able to be run from a variety of locations. This would eliminate the threat of the whole system failing if one server goes down. 3. Methods of communicating between mobile devices 3.1. RFID to connect devices One method of identifying and connecting mobile devices is with the use of Near- Field Communication (NFC), which is based on radio- frequency identification (RFID)[4]. These RFID chips would need to be included in the mobile device. One of the biggest advantages of RFID is that because the two devices communicate with each other to do a transaction there is no need for a 3 rd party back- end payment server to complete the transaction. Therefore it makes it possible to make payments in areas without the entire required infrastructure available [5]. The two devices are able to identify and authenticate each other. The person details and the electronic cash of the users are stored on his/hers mobile device on the RFID chip, these details will be securely stored to prevent a stolen phone been used to make payments. Each transaction would require the user to enter a pin. RFID chips have high power consumption and therefore result in reduced battery life they also add an addition cost to the mobile phone. It s a combination of these factors that have prevented RFID chips been included in all mobile phones. Gentag sells a cheap mobile phone for US$119 that has built in RFID. [20] Because the payment can only be done in person it provides a level of authentication because the users are able to see whom they are paying. RFID only work when they are within close proximity to each other Bluetooth to connect devices Bluetooth offers a cost- neutral form communicating between mobile devices needed in the process of making m- payments. It has sufficient bandwidth and is supported by a large number of mobile phones. [4] It therefore seems the perfect choice to implement wireless cashless payments on mobile device. It was first introduced in 1990 and since then has been through many phases to increase bandwidth and security. One of the downsides of Bluetooth is it has several security risks associated with it. The connection between devices can be

3 eavesdropped and changed. It does also not include a unique method of authenticating communication partners in the Bluetooth transmission protocol. For this reason their needs to be a form of encryption and the two devices need to make use of a share symmetric key. When version 2.1 was introduced it included Enhances Data Rate (EDR) [8], which provided a more sure form of authentication and secure pairing of devices. The latest Bluetooth version is version 4, which includes built- in symmetric encryption using 128bit AES [9]. Unlike the RFID method this method still makes use of a 3 rd party financial institution and therefore needs to have a data connection in order to make payments. The client s details are obtained from his/hers mobile device and encrypted before being sent to the merchant. The merchant then adds the value of the purchase and encrypts it with its symmetric key that is share with the financial institution. All the process is then done the financial institutions servers and the merchant never knows any person details about the client. They only get a response saying if the payment was successful or not Voice to connect devices Near Sound Data Transfer (NSDT ) uses audio to transfer an electronic signature, one time password and cryptographic key to secure an electronic payment. [11] It works similar to RFID is the sense that it relies on both parties being in close proximity to each other. One of the main advantages of NSDT is that there is no need for any software downloads or hardware modifications unlike RFID. two devices to complete the payment process. Because it only used audio it can be done using any cellphone and on any mobile network. NSDT provides a high level of security and protects the users privacy it is therefore perfectly suited for retail. MobiCash is currently using this system in South Africa. [11,12] 3.4. Overview of current methods The above- mentioned methods would work in developed nations. They are not suited for developing nations. Most mobile phones in developing nations are old and cheap and therefore offer very little extra features. RFID technology is very expensive to implement and is only found in expensive smartphones that the average mobile phone user does not have access too. It would therefore not be a feasible option for developing nations. Bluetooth is not a very secure platform to use even though the latest version 4 supports encryption it has not yet been widely used. With most phones still using version 2.1. The most popular phone in developing nations is the Nokia 1100 it has sold 250million units since its launch in 2003 [14]. The reason for this is its low cost at prices below US$100 and easy interface. The voice method requires a phone call to make the payment this costs money and is seen as an unnecessary cost to make a payment. Therefore it is not an optimal option for rural people in developing nation. It requires the merchant to dial a number and enter the value of the transaction the client then dials a similar number and the two devices are placed next to each other. An audio signal is then sent between the

4 Table 1 Comparison of different technologies used for m- payment

5 4. Current Mobile Cash Providers At the 2008 Mobile Money Summit it was revealed that there were 120 Mobile Payment Services operating worldwide this was double the number in [15] One of the most successful m- payment systems is M- PESA run in Kenya by Safaricom, which is Kenya s largest mobile network provider. [16] 4.1. M- PESA (Kenya) M- PESA is based on SIM Application Toolkit and uses mainly SMS communication as the service bearer. [15] M- PESA allows the user to use his/hers mobile phone to move money quickly, securely and over great distances, directly to another users mobile phone. There is no need for the user to have a bank account they only need to be registered with Safaricom. Within one year of rolling out the service in Kenya nearly 2 million users had registered. M- PESA works by a user depositing money into their M- PESA account at any Sarfaricom Airtime dealer. The user then sends an SMS to M- PESA dedicated number with the receipts details and the amount. That s all that is needed to complete the transfer. M- PESA has made it possible for many small shops all over Kenya to order supplies and make payments using their cellphone. [15] 5. Problems faced with implementing a M- Payments system There are many factors that are restricting the implementation of m- payments systems in developing nations. One of the problems is each nation has its own financial regulations and these need to be adhered to. These regulations are in place to restrict money laundering and combating financial terrorism. [10] One of the main regulatory issues that m- payments face is that its not legal tender. Virtual Wallets does not have the same status as cash, which is authorized and guaranteed by the government. [19] They only thing that m- payment provider s can offer is the issuer s promise to acknowledge the value. In the future legislation will need to be passed that makes m- payments legal tender. 6. Chosen method to communicate between mobile devices to process m- payments The above mentions methods and services are all very good and work in their current environments. Yet they might not be properly suited for a township spaza shop owner. The 3 methods mentioned above do not meet all the requirements for a system used by spaza shop owners. The perfect system would run hand- in- hand with the spaza shops Point of Sale (POS) system. All previous methods require both users to have a mobile phone. The proposed method does not require the client to have a mobile phone. This would be done with the use of 2D barcodes also known as QR Codes. A QR Code is a two- dimensional symbol that can store 100 times more data than a linear barcode. QR Codes was first invented in 1994 by Denso it was initially designed to be used in production control of automotive parts. [17] It is much superior to linear bar codes because it adds a second dimension and therefore has a much higher data density. QR Codes

6 can be freely used because Denso released the patent into public domain. QR Codes can store a maximum of 7,089 numerical characters they also have high- speed reading. They can be read using a mobile devices camera. Figure 1 The history of barcodes Source: [17] The client can carry a card with his/hers person QR Code printed on the card this would be like a person bankcard. The QR Code will store person information about the client the information will be encrypted using a private key that only the payments server will have. The merchant then scans the QR Code using his/hers Mobile Device in this case a tablet. The tablet then sends an encrypted message to the payment server with the client s encrypted QR Code details and the amount to deduct. The Client will then be prompted to enter their unique pin code on the merchant s tablet. [18] The payment will then be made. 7. Conclusion Payments on mobile phones have been done for quite some time. Yet I believe that the optimal method best suited for a spaza shop in a township has not yet been found. Therefore there is space for development in this area. Each of the methods discussed in this paper have downfalls. In order for there to be a successful m- payments system a few challenges need to be overcome. There needs to be widely accepted standards and a solid regulatory framework needs to be in place. The also needs to investment from businesses, merchants and consumers for an m- payments system to become a widely used standard form of payment. 8. Reference 1. Anon, Global mobile statistics 2011: all quality mobile marketing research, mobile Web stats, subscribers, ad revenue, usage, trends. Global Mobile Staticts. Available at: [Accessed April 25, 2011]. 2. Pettey, C. & Stevens, H., Gartner Identifies the Top 10 Consumer Mobile Applications for Gartner, p.1. Available at: [Accessed April 25, 2011]. 3. Gamos, N.S. et al., The impact of mobile phones in africa. Knowledge Creation Diffusion Utilization, (November). 4. Tuchscheerer, S., Fruth, J. & Dittmann, J., Secure cashless transactions on mobile. Communication. 5. Balan, R.K. et al., mferio: the design and evaluation of a peer-to-peer mobile payment system. In Proceedings of the 7th international conference on Mobile systems, applications, and services. ACM, p Available at: 46 [Accessed April 25, 2011]. 6. Merritt, C., Mobile Money Transfer Services : The Next Phase in the Evolution in Person-to-Person Payments. Structure. 7. Chatain, Hernandez-Coss, Borowik, and Zerzan 2008?????? World Bank 8. Bluetooth SIG, Inc., Bluetooth Specification Version EDR, Vol. 1, Bluetooth SIG, Inc., Bluetooth Specification, Version 4.0, Vol. 0, Recuero, L., Oecd, V. & Centre, D., Mobile payments for remittances in Africa : Benchmarking with Latin America 1. Economic Outlook, 95(95), pp Anon, MobiCash Technology. Available at: 7/Technology [Accessed May 2, 2011]. 12. Engineering, I., Implemented by Elliptic curve Cryptography., pp Askoxylakis, I.G. et al., Integration of a secure mobile payment system in a GSM/UMTS SIM smart card. In Proceedings of the Fourth IASTED International Conference on Communication, Network and Information

7 Security. ACTA Press, p Available at: 51 [Accessed April 25, 2011]. 14. Virki, T., Nokiaʼs cheap phone tops electronics chart. Reuters. Available at: [Accessed April 27, 2011]. 15. Nguyen, L. et al., The Missing Link: Human Interactive Security Protocols in Mobile Payment. In Proceedings of the 5th International Workshop on Security&\# x201a; IWSEC. Available at: ng=search&q=intitle:the+missing+link+:+ Human+Interactive+Security+Protocols+in+ mobile+payment#0 [Accessed April 25, 2011]. 16. Hughes, N. & Lonie, S., M-PESA: Mobile Money for the Unbanked Turning Cellphones into 24-Hour Tellers in Kenya. Innovations: Technology, Governance, Globalization, 2(1-2), pp Available at: /itgg Soon, T.J., QR Code., pp Starnberger, G., Froihofer, L. & Goeschka, K.M., QR-TAN: Secure Mobile Transaction Authentication International Conference on Availability, Reliability and Security, pp Available at: pper.htm?arnumber= [Accessed October 18, 2010]. 19. Carr, M., Mobile Payment Systems and Services : An Introduction 3. Mobile Payment Solutions. Provider, pp Clark, S., Near Field Communications World. Near Field Communications World. Available at: om/2011/02/10/35893/gentag-announceslow-cost-nfcrfid-phone/ [Accessed May 2, 2011].