Secure Contactless Mobile Payment System

Abstract

Near-field communication technology is a great enabler of contactless applications, which has resulted in exponential growth of contactless payment systems. While the NFC technology has an advantage over other wireless technologies like Bluetooth and barcode due to the close communication proximity and speed, it is still susceptible to security threats such as eavesdropping, relay, and replay attacks. Cryptographic protocols resist most attacks mounted on the NFC systems, but relay attacks remain evasive to such attempts. We propose a relay attack countermeasure that ensures mutual authentication of paring devices during contactless payment. The protocol combines proximity token and challenge/response key exchange to verify the communicating devices’ proximity before authentication. In this paper, we detail the architecture of the proposed contactless payment system, discuss its fully functional prototype, and present the experiment results when subjected to relay attacks. The experiment results show additional time while the user device terminates the communication where the relay attack was detected. From the experiment, the protocol is secure, easy to use, and practical.