Payment Protocol Research Articles

A Novel Secured Authentication Protocol for Mobile Banking

Objective: In the modern era, smart phones and iPhones are the most dominating gadgets among human beings. The tremendous number of mobile users along with the omnipresent nature of mobile devices has created an immense market for mobile commerce. But, for that m-commerce to be recognized to 100%, users have to belief the security measures of m-commerce generally and m-payment especially. In other words, the growth of wireless networks and massive usage of mobile devices have increased the concerns about performance and security of mobile payment systems. The two critical and challenging features of any payment protocol are security and privacy. Method: This paper proposes a novel secured authentication protocol for mobile banking which would overcome the two critical features of any mobile payment transactions. This proposed protocol combines both asymmetric and symmetric key cryptographic techniques. Findings: Compared to few existing authentication protocols based on either ECC or RSA, the proposed authentication protocol over resource-constrained mobile devices serves better in terms of privacy, security and computation. Novelty: This paper proposes a novel secured authentication protocol which combines both asymmetric and symmetric key cryptographic techniques (HECC and AES).Keywords: Authentication, ECC, HECC, Privacy, RSA, Security

A secure and efficient payment protocol based on ElGamal cryptographic algorithms

In this paper we present a secure and efficient transaction protocol that provides the anonymity and can detect the double spending. The proposed payment system is based on the ElGamal encryption scheme, the ElGamal signature scheme and the ElGamal blind signature protocol. We show that our transaction protocol is secure and efficient. We give the definitions of unlinkability and unforgeability of our security model and we prove that the proposed transaction protocol is unforgeable and satisfies the unlinkability property. We show that the proposed system is more efficient, in terms of the computation and communication cost, than the compared payment systems (Eslami et al. in Electron Commer Res Appl 10:59–66, 2011; Chen et al. in Electron Commer Res Appl 10:279–287, 2011; Liu et al. in Proceedings of second European PKI workshop: research and applications. Lecture notes in computer science, vol 3545, pp 206–214, 2005 and Chen et al. in Electron Commer Res Appl 10:673–682, 2011) for a customer who withdraws and spends an e-coin and for the merchant who verifies an electronic coin. Also, the proposed e-cash system is useful for the electronic transactions when the connection between the bank and the merchant is not available during the payment protocol. This means a less bandwidth of the payment protocol and then increases the speed of the electronic transaction.

A lightweight two-gateway based payment protocol ensuring accountability and unlinkable anonymity with dynamic identity

In the current scenario, mobile web payment provides a standard platform to the Internet users for online digital goods shopping. Though the majority of online transactions use single gateway, there is a need for multi-gateway, due to insufficient balance in a customer’s account in a specific bank. There are a few payment protocols which support a transaction using multiple cards, but they too have some limitations like cards should be of the same bank and the process should be based on independent transactions. This paper proposes an efficient payment protocol that is used for making online transactions via two gateways for purchasing digital goods to overcome the above mentioned limitations. The proposed protocol is simulated using the automated tool Cryptographic Protocol Shape Analyzer (CPSA) and it satisfies accountability, anonymity and atomicity properties. Formal proof of correctness is provided using the strand space model. The protocol is then compared with the state-of-the-art protocols in terms of different security features and computational overhead. Results show that our protocol achieves better performance than other protocols.

SSL과 패스워드 기반의 신용카드 간편결제 프로토콜

SSL과 패스워드 기반의 신용카드 간편결제 프로토콜

Verifying concurrent probabilistic systems using probabilistic-epistemic logic specifications

In this paper, we address the problem of verifying probabilistic and epistemic properties in concurrent probabilistic systems expressed in PCTLK. PCTLK is an extension of the Probabilistic Computation Tree Logic (PCTL) augmented with Knowledge (K). In fact, PCTLK enjoys two epistemic modalities Ki for knowledge and PrźbKi$Pr_{\triangledown b}K_{i}$ for probabilistic knowledge. The approach presented for verifying PCTLK specifications in such concurrent systems is based on a transformation technique. More precisely, we convert PCTLK model checking into the problem of model checking Probabilistic Branching Time Logic (PBTL), which enjoys path quantifiers in the range of adversaries. We then prove that model checking a formula of PCTLK in concurrent probabilistic programs is PSPACE-complete. Furthermore, we represent models associated with PCTLK logic symbolically with Multi-Terminal Binary Decision Diagrams (MTBDDs), which are supported by the probabilistic model checker PRISM. Finally, an application, namely the NetBill online shopping payment protocol, and an example about synchronization illustrated through the dining philosophers problem are implemented with the MTBDD engine of this model checker to verify probabilistic epistemic properties and evaluate the practical complexity of this verification.

Extending SIP to support payments in a generic way

The growth of users connected to the Internet with a high bandwidth connection hasfavored the increase of multimedia services. As many of these services are provided by means of SIP, adding support for payment to SIP might benefit vendors. Payments in SIP have been proposed for accessing services, for microbilling and even as a solution to SPAM in VoIP systems. Current proposals have some limitations such as either not being suitable for low payments or micropayments, or not supporting the use of different payment protocols or the payment is always made for the whole session or they do not take into account that streams of different quality could have different prices. In response to these limitations, we propose a new SIP extension for supporting any kind of payments (both micropayments and macropayments) on SIP. In addition to being payment-independent, our proposal solves interoperability problems. Our proposal is based in an standard extension of SDP and SIP in order to maximize the compatibility. This facilitates the deployment of payment in SIP-based services. Moreover, our SIP extension supports an offer/answer model that allows the choice of the quality of the streams as well as the payment options to use. Furthermore, it is flexible and not only supports payment but also more complex business models such as loyalty models, credentials and subscriptions. In this paper, we provide a generic way to incorporate new payment methods and business models in the vendor's software. Using some application scenarios, we make a comparison between our proposal and previous work to show some of the advantages of using our proposal.

A Novel Logic for Analyzing Electronic Payment Protocols

A novel formal method which can be used to analyze security properties such as accountability, fairness and timeliness in electronic payment protocols is proposed. The novel method extends Qing-Zhou approach based on logic reasoning by adding a simple time expression and analysis method. It increases the ability to describe the event time, and extends the time characteristics of the logical inference rules. An anonymous electronic cash payment protocol is analyzed by the novel logic, and the result shows that the fairness of the protocol is not satisfied due to the timeliness problem in protocol. The novel logic method proposed in this paper has a certain theoretical and practical significance for the design and formal analysis of electronic payment protocols. At the same time, its idea has a certain guiding value for improving the security of other security protocols.

Formally verified TSM centric privacy preserving NFC mobile payment framework and protocol

Near field communication is on the verge of broad adoption worldwide. The combination of NFC and smart mobile devices are making the way of life more easier for millennials. Sensitive consumer information can be predicted using data aggregation and predictive data mining approaches on any profit-oriented open e-commerce business models which may potentially cause a privacy breach. In mobile payment, which is a popular e-commerce sub domain application, consumers' sensitive information potentially sits on retailers' server over which consumer has no control but hackers can exploit. This paper presents a new TSM centric privacy preserving framework and a protocol for NFC-based proximity payments. It prevents consumer data from ever touching a merchant's server where the majority of data breaches occur. The correctness of proposed privacy preserving NFC payment protocol is ensured here via formal modelling and verification using Proverif.

Understanding and Regulating Twenty-First Century Payment Systems: The Ripple Case Study

Ripple is an open-source Internet software that enables users to conduct payments across national boundaries in multiple currencies as seamlessly as sending an email. This decentralized Internet payment protocol could provide a cure to an inefficient cross-border payments system. Although Ripple’s technology can reduce significant risks and costs that exist in the international payments system, regulators should adopt a new regulatory framework that responds to how this technology works. This Note performs two functions to help regulators realize this goal. It first helps regulators and other market participants understand how Ripple operates by explaining what Ripple is and comparing it to current payments systems. Second, it suggests a series of principles that regulators should use to monitor decentralized Internet payment protocols like Ripple. It does this by drawing from and tailoring existing regulatory principles to account for the risks reduced and presented by Ripple.

Building a Secure Mobile Payment Protocol in the Cloud

This paper is mainly to resolve the secure problems of mobile payment business which the remote payment is their main businesses. The identity authenticity of mobile payment user, the confidentiality and non repudiation of information transmitted in the mobile payment process are all the main secure problems. The secure mobile payment protocol is established base all the above secure problems’ solutions.

A secure NFC mobile payment protocol based on biometrics with formal verification

In this paper, we propose a secure NFC mobile payment protocol based on biometrics SNMPBs using wireless public key infrastructure WPKI and universal integrated circuit card UICC. Electronic signatures generated in this protocol are considered qualified signatures as they are generated in UICC which is tamper resistant device. A procedure for the personalisation of mobile payment application on the UICC by the issuer/bank is proposed. Our SNMPB resolves disputes efficiently among stakeholders by collecting evidence using transaction counters, transaction log, forensics mode and cryptographic audit log techniques. SNMPB ensures end-to-end security i.e., from mobile payments application in UICC to the bank server thereby achieving confidentiality, authentication, integrity and non-repudiation properties, prevents double spending and over spending. Our proposed SNMPB protocol withstands replay, man in the middle MITM, impersonation and multi-protocol attacks as SNMPB is formally verified successfully using BAN logic and Scyther tool.

Reduction of compound lotteries with objective probabilities: Theory and evidence

The reduction of compound lotteries axiom (ROCL) has assumed a central role in the evaluation of behavior toward risk and uncertainty. We present experimental evidence on its validity in the domain of objective probabilities. Our battery of lottery pairs includes simple one-stage lotteries, two-stages compound lotteries, and their actuarially equivalent one-stage lotteries. We find violations of ROCL and that behavior is better characterized by a source-dependent version of the Rank-Dependent Utility model rather than Expected Utility Theory. Since we use the popular “1-in-K” random lottery incentive mechanism payment procedure in our main test, our experiment explicitly recognizes the impact that this payment procedure may have on preferences. Thus we also collect data using the “1-in-1” payment procedure. We do not infer any violations of ROCL when subjects are only given one decision to make. These results are supported by both structural estimation of latent preferences as well as non-parametric analysis of choice patterns. The random lottery incentive mechanism, used as payment protocol, itself induces an additional layer of “compounding” by design that might create confounds in tests of ROCL. Therefore, we provide a word of caution for experimenters interested in studying ROCL for other purposes, such as the relationship between ambiguity attitudes and attitudes toward compound lotteries, to carefully think about the design to study ROCL, payment protocols and their interaction with the preferences being elicited.

A Secure and Lightweight Mobile Payment Protocol Based on Smartcard

A Secure and Lightweight Mobile Payment Protocol Based on Smartcard

An Anonymous NFC-Based Payment Protocol

In this paper, we propose an anonymous NFC-based payment protocol (ANP) using NFC phones in a mobile payment framework. Our protocol is compatible with EMV standards, and can be integrated into an NFC-enabled mobile device serving as a virtual credit card. Each role in the framework can only gather partial user information. Our protocol achieves anonymity, in which only the bank knows a user’s real identity. TSM and the merchants are unable to break the anonymity. In a transaction, none can build up full relationship between a user’s identity and his account, his card information or transaction records.

EMV-based Mobile Payment Protocol for Offline Transaction - With the Ability of Mutual Authentication

The standards for Europay, MasterCard and Visa (EMV) have been widely adopted by current major financial services corporations but there are certain security threats: (1) authentication is one-way only, i.e. from a reader to a card. (2) EMV-compatible contactless smartcards do not encrypt sensitive data in the mobile transactions, which allows attackers to steal the users' personal information. (3) During offline transactions, the merchants cannot verify whether a credit card has been revoked. In 2013, Yang proposed a protocol to enhance the security of EMV standards. Yang's method can perform mutual authentication between a point-of-sale (POS) and a credit card, but the users can exceed the credits after multiple offline transactions. To improve Yang's method, we propose a new offline transaction mechanism that is compatible with the EMV standards. In our scheme, a user is required to apply for a limited and divisible credits from a bank, and stores the credits into his NFC phone's security elements (SE). During an offline transaction, the user has to send his certificate and the specific amount of credits to the merchant. The merchant verifies user's certificate, collects the credits, and redeems the payments from the bank. Our protocol is suitable for the offline environment that accommodates multiple merchants; it prevents exceeding the limitation in multiple offline transactions; and it enhances the security of EMV standards.

FEIPS: A Secure Fair-Exchange Payment System for Internet Transactions

To be considered secure, a payment system needs to address a number of security issues. Besides fundamental security requirements, like confidentiality, data integrity, authentication and non-repudiation, another important requirement for a secure payment system is fair exchange. Many existing payment protocols require that customers must pay for products before their delivery (in the case of delivery of digital goods) or the delivery of the receipt (in the case of delivery of physical goods). This unfair situation should be eliminated afterward; that is, it is necessary to rebalance fairness for customers. To address these issues, we propose the Fair Exchange Internet Payment Protocol (FEIPS). The FEIPS protocol is designed for the payment of physical goods and falls into the category that uses a trusted third party for ensuring fair exchange. Although FEIPS has a strong emphasis on fair exchange, it still guarantees strong security properties, including confidentiality, data integrity, authentication and non-repudiation. The FEIPS protocol is designed to be simple and practical, unlike other similar protocols designed for the payment of physical goods. To demonstrate that FEIPS satisfies the desired properties, we perform a formal verification using the HLPSL language and the AVISPA tool.

A Secure Electronic Payment Protocol for Wireless Mesh Networks

Electronic payment systems for wireless mesh networks need to take into account the limited computational and communicational ability of mesh clients. Micropayment scheme is well suited for this scenario since it is specifically designed for efficient operations in payment transactions. In this article, we propose a one way hash chain structure based on which efficient and secure payment protocols that support both prepaid and credit-based paying schemes are introduced.

An anonymous mobile payment protocol based on SWPP

Regarding the development of mobile technology, it seems essential to have a payment protocol which provides the required security features along with an acceptable efficiency in mobile environment. This article introduces an anonymous payment protocol based on secure wireless payment protocol (SWPP). Contrary to SWPP, this protocol manages to provide anonymity and privacy of the customer. This protocol uses a blindly signed pseudo digital certificate and anonymous bank account in order to protect the customer's identity. The proposed protocol was simulated, and then its security and efficiency features were compared to those of other protocols. The comparison proves that this protocol covers all security features required by a secure payment system. Moreover, it is more efficient than other protocols.

Experimental payment protocols and the Bipolar Behaviorist

If someone claims that individuals behave as if they violate the independence axiom (IA) when making decisions over simple lotteries, it is invariably on the basis of experiments and theories that must assume the IA through the use of the random lottery incentive mechanism (RLIM). We refer to someone who holds this view as a Bipolar Behaviorist, exhibiting pessimism about the axiom when it comes to characterizing how individuals directly evaluate two lotteries in a binary choice task, but optimism about the axiom when it comes to characterizing how individuals evaluate multiple lotteries that make up the incentive structure for a multiple-task experiment. We reject the hypothesis about subject behavior underlying this stance: we find that preferences estimated with a model that assumes violations of the IA are significantly affected when one elicits choices with procedures that require the independence assumption, as compared to choices elicited with procedures that do not require the assumption. The upshot is that one cannot consistently estimate popular models that relax the IA using data from experiments that assume the validity of the RLIM.

Provably secure E-cash system with practical and efficient complete tracing

E-cash system can guarantee the anonymity of the user, but it also can be misused illegally. So the idea of fair E-cash was introduced, i.e., the anonymity of the user can be revoked when a crime is involved in fair E-cash system. However, it is still an unsolved problem to design a practical and efficient fair E-cash scheme, since there are some problems of the impracticality or the incompleteness in the tracing design of existing schemes. First we discuss the principal reasons of it. The reason of impractical tracing is that many schemes have respective unsolved problems in designing the practical tracing. We solve one kind of the problems, then present the practical tracings in various situations, including the bank's double-spending tracing without the trusted third party (TTP), the TTP's unconditional tracing and the bank's loss-coin tracing without TTP, which we call complete tracing. For some schemes, the reason of incomplete tracing is that the unsolved efficiency problems result in the incomplete design of tracing, whereas for other schemes, the reason of incomplete tracing is that the unconditional tracing and the anonymous spending are contradicting properties of E-cash. Considering that, the TTP can be divided into multiple parties, and the TTP is also removable in our system. Moreover, for solving the efficiency problem of practical tracing, we use a nested structure of signature of knowledge in payment protocol, which is proved to be a secure application. Then we provide the detailed security proofs of all security properties of our E-cash scheme and analyze our system efficiency and system functions comparing with the recent schemes.