THE SYSTEM FOR SECURE MOBILE PAYMENT TRANSACTIONS
Abstract
Secure mobile payment methods are typically needed in mobile access channels, it is vital to apply them when using mobile payment applications, which have arisen as a result of the increase of e-commerce. Currently, there are some payment methods that most of them can be used when conducting transactions but, they differ in terms of functionality, usability, costs or security.
What makes mobile payment system more useful and necessary are the features and functionalities which are essentially based on customer needs that may differ in different market places, social categories and regions. In addition to payment system functionality, what mainly matters is securing payment methods with sufficient security protections.
In this thesis, it is been tried to introduce some features currently lacking in mobile payment systems to propose a security architecture and then to present a solution for prospective problems with some current mobile payment systems and applications. The solution mainly implements what has been proposed and required to fulfill system requirements.
The proposed security architecture supports already designed mobile payment system (SAFE) which typically interacts with the merchant and the customer for performing secure payment transactions. Mobile payment security architecture is designed, implemented and analyzed to be highly scalable and modular in addition to providing the desired security requirements set to it in this thesis work. The architecture is enhanced with mobile applications, so called SAFE apps, enabling securely authorizing e-commerce transactions.
This report begins with introducing mobile payment system technologies, concept and architecture as the foundation for this work. The systems relevant to the one proposed in this thesis are briefly discussed in terms of functionality and security issues. System architecture and design of SAFE Mobile Payment System are briefly discussed as the core component of the settling e-commerce functions in a holistic view. The functionality and security issues of the system design and implementation are presented and finally the work is analyzed to determine how the project objectives were met. The future development and work are finally summarized in the conclusions chapter.
- Introduction
Recent developments of communications technologies and business models raised concerns about mobile payment systems in terms of usability and security. Rising smart mobile devices with variety of usage and privacy and easy access to communication protocols have provided the potentials for growing development of mobile commerce. Furthermore, new business models in daily activities have increased the need of comprehensive mobile e-commerce system.
Apart from business models of m-commerce, identical with today’s current business behavior, mobile payment is a core player affecting the whole scenario of m-commerce. There are significant number of mobile users with various incomes and spending power who can affect the adaptability of mobile payments with current business models. In fact, the main desire in mobile payments is providing a convenient way of payment so that a customer can perform payment anytime, anywhere for any available services. Also, there is a variety in kinds of services, value of the transactions, customer habits which are not developed equally in each market. Hence, there was always been a challenge in adopting users’ experience with current and upcoming mobile devices. In other words, mobile devices can offer users many conveniences, such as portability and availability in spite of small screen, lower power supplement, less memory capacity and processing power. On the other hand, there is a lack of a specific mobile payment policy to deal with larger number of customers and low-value transactions. Based on these aspects and limitations, mobile payment methods will be provided with considerable potential for a creative development. Several payment methods are designed or developed in m-commerce area but still new customized payment methods are required to fulfill customers’ needs in special markets.
Naturally, m-commerce is highly regional. Many regions may prefer customized and aboriginal service providers. In other words, a desired m-commerce environment is required to establish strategic relationships with regional financial rules and institutions. Here, payment methods are being introduced in which even the customers with special limitations can operate. The widespread use of mobile devices and consequently electronic commerce assisted us to develop a new integrated system to provide m-commerce services that extends e-business using latest technologies considering special circumstances.
Basically, depending on interaction model, m-commerce applications could be classified into three types: client to server, client to proxy server, and peer-to-peer. Also, m-commerce applications inevitably require essential underlying connectivity features, mobile access adaptation, mobile user profile and mobile security [1] . On the other hand, new technologies usually bring new risk and challenges despite new capabilities and services. In order to design a desired payment method, the inherited risks of new technologies must be overcome in order to leverage their capabilities in handling existing obstacles of payment transactions in corresponding markets. Mobile payment methods have always been critical, since they are dealing with credits or money. So, providing an adequate security would be mandatory and an inevitable aspect of mobile payments. On the other hand, there has been an issue to preserve a trade-off between usability and security of mobile payments, so that providing maximum security can affect or even violate the usability of mobile payments in practice. The art of work will be combining security and usability to provide a smooth, fast and comprehensive mobile e-payment for end-users. This artifact would be able to evolve into a financial system supporting transaction environments which eliminates or minimizes physical cash handling, as a potential in eliminating criminal activities.
Basically, m-payment process may be implemented in different scenarios, but it includes some fundamental steps: registration, payment submission, authentication and authorization of parties by system service provider, and the final confirmation. In order to provide a secure and comprehensive m-payment, the payment scenario should be designed so that it performs fast and simple for the end-user, but secure and comprehensive for the provider. An efficient payment scenario takes efficient steps in performance. The critical items in each step are the payment messages containing critical information being transferred between participating parties. These messages are objects to which security should be applied. Applying security to messages, to transfer and process payment messages should be done to fulfill a desired fast, secure, integrated and comprehensive transaction. Authentication, secure communication, including confidentiality and integrity of messages, authenticity of sender and recipient, key exchange protocols and non-repudiation should enhance an atomic payment transaction with security.
To establish the desired implementation of convenient m-commerce operations, a need of a mobile application is being felt. With rising new smart phones available in markets, the facilities of smart mobile devices could be exploited to develop an application to perform required m-commerce operations. Current smart phones with different operating systems provide an extensive environment to develop desired applications based on business and users needs.
This project basically followed the potential to overcome specific financial access problems in some developing markets by accommodating unbanked users. Then, design and implementing a mobile application is conducted according to some defined business and professional needs. This report brings a comprehensive overview about its potentials starting form supporting back-end systems, up to design and implementation of account-based payment scenarios used in m-commerce and traditional transactions and evaluating and analyzing of the results against the essential and probable business needs, keeping in mind a perspective for further development and research potentials.
1.1 Research Problems
With development of m-applications, there is an inevitable need of security for all functions of the applications. In this research, the issues regarding payment transactions are considered.
Based on what is designed, implemented and tested, some potential points of development for essential security enhancement could be detected. The most sensitive part of application, the payment function as a mobile payment operation, is the process of exchanging financial values done by two or three parties using mobile devices.
In this project, according to particular business needs and underlying technologies, a specific security policy should be defined to cover privacy and security issues of payment and even functions of mobile application. Apart from security of the complete application in a mobile device, every aspect, from initial point of payment up to final delivery of payment report for involved parties, should be considered.
The following security services are required to establish a secure, comprehensive and smooth payment. There are potentials where the security is an essential property.
- Authentication of all parties and objects involved in a transaction.
- Confidentiality of messages and information transferred in a transaction.
- Integrity of messages and transactions.
- None-repudiation of payment parties and objects.
Applying security services and constraints will assist payment functions in performing secure and integrated transactions. The next issue will be design of a system for secure mobile payment transactions. Extensive cryptography, key handling protocols and several packaging and repackaging the payment messages will reduce the usability level of the payment function.
1.1.1 Research question
Considering the research problems, there are research questions that need to be answered during the research work.
How payment’s end parties can make sure about their connection if it is really continued in the secured way behind the TTP proxy?
How to manage decryption and encryption of the connection content in TTP’s proxy not to make it vulnerable to probable attacks both internally or externally?
How to provide an end-to-end authentication based on our security architecture design?
1.2 Purpose
The ultimate purpose of this thesis is design of a system for secure mobile payment transactions using new methods to provide efficient security for payment messages using existing mobile payment models. In fact, upon considering general characteristics of mobile payment models, a typical m-commerce system involved with a specific payment model is being chosen. Then, based on underlying protocols and methods of the system, a method is proposed to provide security of payment messages during payment procedures. To reach the ultimate purpose of this thesis, there were some other objectives which had to be addressed.
First of all, identifying general and standard characteristics of mobile commerce systems is necessary to understand the applied methods and protocols, so that the payment models could be understood comprehensively in terms of efficiency, usability and security.
Next, whatever the required characteristics of m-commerce systems are, a typical architecture for mobile commerce and financial transactions should be adopted. This architecture should comprise components, protocols and interfaces to provide various services to various mobile applications: registration, security of users at different levels, and protection of its own components. The architecture is required to be modular, integrated, extendible and scalable. This thesis briefly describes design of the architecture and its integration with proposed models and methods besides future research and development plans.
Finally, all objectives above will be reached by proposing methods for secure payments in order to enhance all payment and commerce services with security.
1.3 Delimitations
This thesis deals only with mobile payment security and evaluates only current mobile commerce models and systems.
A general analysis of mobile commerce systems is being mentioned and it is evaluated in terms of security. In fact, having a holistic approach to mobile payment models, a detailed analysis of mobile payment message security has been considered.
There are some general concepts about mobile commerce which are explained briefly and then a short, but efficient and comprehensive description of underlying mobile financial system will be provided.
The underlying mobile financial system is described, so explanation of other components of the system will be discarded and left as an optional source of reference for audiences of this thesis.
The information security concepts are described as they have been applied to the implementation and evaluation of thesis artifacts.
1.4 Methodology
1.4.1 Methodology for Establishing System Requirements
This section describes system requirements being considered in order to evaluate if the purpose of the thesis is successfully met.
Initially, technical, business, and user requirements should be considered for a payment system presenting an interoperable, modular, integrated, extendible and mobile payment architecture that provides the potentials for deploying security extensions.
Secondly, according to the specified system requirements, a financial system appropriate for mobile applications has been chosen. Considering fundamental system requirements of mobile payment systems, the architecture of the system has been evaluated as well as the interactions between internal components and external components of the system.
The third step will be identifying potentials of the payment model of the system for security enhancement along with preserving system behavior including protocols, services, transactions and message structure.
Next, an interface has been designed which is used to interact with the adopted financial system. Development of mobile applications is required to provide required mobile commerce services for corresponding users.
Identifying potentials points of interactions between mobile applications and back-bone system in applying security constrains was the starting point to employ security arrangements.
According to all information related to evaluating system security potentials, security requirement specifications have been determined, so that the system can proceed persistently along with predicted security circumstances.
Based on possible security requirement specifications, some of them should be adopted which are feasible in terms of design, implementation and deployment in an efficient way.
Finally, a methodology for security design and implementation will be planned.
1.4.2 Methodology for Design and Implementation
This section describes a methodology for design and implementation of the system described in this thesis report.
A qualitative case study methodology has been conducted in order to provide tools to study existing phenomena within the research context, for revealing and understanding multiple facets of the phenomenon.
According to [2] a case study design is considered in this report, since this study focuses on answering “how all steps of mobile payments should be considered in applying security” and “why it is required to design and employ a security method of payment transactions”;; Also the behavior of involved components in the study could not be manipulated. Moreover, it is required to include contextual conditions relevant to the phenomenon under study. Here, the contextual conditions could be financial system infrastructure and mobile interfaces.
Next, in order to determine the case of analysis, it is required to analyze the process of mobile payment in adopted environment. So, there might be a question how the payment process would be carried out between external mobile interfaces and internal components of a financial system. Then, it is essential to evaluate the payment process in terms of security issues. So, it needs to be found out how to design a secure payment system which will
preserve the usual behavior of the backbone financial system. Accordingly, security of payment messages will be considered independent of communication protocol security.
Also, the case study of this thesis could be considered as “Descriptive”, since it describes the real behavior of the mobile payment transactions while applying security constraints.
1.4.3 Methodology for Data Acquisition
This section describes the complimentary methodology for data acquisition in order to make conclusion of the current work.
Using different data sources enhances data credibility for this research project. Potential data sources in this thesis include extensive study and analysis of related works and technology, direct observations, and participant-observation. By data acquisition in integration with qualitative approach, within a case study research, data integration and collection can facilitate reaching a holistic understanding of the phenomenon under study. In this project, multiple related works and experiences of the financial system are then converged in the analysis process. Each work and practice experience contributing to understanding of requirements of the design and implementation method.
1.4.4 Methodology for Evaluating the Results
Having designed and implemented the proposed payment security system, the performance of the system considering the messages security and payment transactions integrity was evaluated in a pattern-matching analysis. In other words, according to the most relevant and successful empirical works, there are certain standard and recognized factors which could be considered as a merit to evaluate this project, so that it could be declared as the most efficient, desirable and promising solution proposed for the common research problem.
THE SYSTEM FOR SECURE MOBILE PAYMENT TRANSACTIONS
