A Secure Account-Based Mobile Payment Protocolwith Public Key Cryptography by ides editor

ACEEE Int. J. on Network Security , Vol. 03, No. 01, Jan 2012

A Secure Account-Based Mobile Payment Protocol with Public Key Cryptography Vorugunti Chandra Sekhar1, Mrudula Sarvabhatla2 1

Dhirubhai Ambani Institute of Information and Communication Technology, Gandhinagar, India Email: Vorugunti_Chandra_Sekhar@daiict.ac.in 2 Sri Venkateswara University, Tirupati, India Email: mrudula.s911@gmail.com

institution). An additional party called Payment Gateway which acts an interface between the mobile payment world and existing payment infrastructure. Payment Gateway plays a major role between Issuer and Acquirer for the settlement of the transaction. The complete payment system is operated by payment system provider who maintains a relationship with banks (Issuer, Acquirer). The graphical view of typical online payment system is represented below [13]

Abstract—The way people do the business and transactions are changing drastically with the advent of Information Technology. The customer wants to access information, goods and services any time and in any place on his mobile device. Receiving financial data, trade on stock exchanges, accessing balances, paying bills and transfer funds using SMS are done through mobile phones. Due to involvement of valuable financial and personal information, the mobile phones are vulnerable to numerous security threats. Most common activity in M-Commerce is the payment to the merchant using a mobile phone. In this paper we present a secure account–based payment protocol which is suitable for M-commerce to transfer the payment from wireless networks based on public key cryptography. Based on author knowledge, this is a first kind of protocol which applies public key cryptography to mobile network and satisfies all the security requirements of the properties provided by standard protocols for wired networks such as SET and iKP. IndexTerms—Electronic commerce protocol, Mobile payment, Wireless payment, Credit card payment, Cryptographic Protocol, Account–Based protocol

I. INTRODUCTION Mobile commerce is a powerful technology which is a result of combining two strongly emerging trends: electronic commerce and wireless computing. Internet + Wireless + EBusiness = M-Commerce. M-Commerce represents extended application of e-commerce in which user uses a mobile phone or PDA to do business. Mobile phones are most common devices to do business and commerce today and the trend is increasing due to involvement of huge financial and personal data transferring (PIN, Band Account no). The rapid use of M-Commerce demands the means for secure mobile payments. Lack of efficient protocols makes the security issue of mobile networks more challenging.In this paper, we present an account-based payment protocol for wireless networks based on public key cryptography. The public key cryptography can provide the Authentication, Confidentiality, Integrity and non-repudiation.

Figure 1. Depicts online transaction

B. Public Key and Cryptography in Mobile Networks Mobile networks have limitations [4 7 10] such as Low power storage capacity, Computational capability, Resources, Battery Constraints, makes the public key cryptography infeasible for them.In 2009, a new standard was proposed for public key cryptography by name NTRU cryptosystem [14]. The results shows that NTRU algorithm is much faster than RSA, the key size is one quarter than RSA with similar security level as RSA and key generation time is 200 times faster than RSA as presented in shen et al. NTRU is 1133 times faster than 2048-bit RSA when compared the data throughput (Hermans et al).The NTRU algorithm was approved by the IEEE in February 2009 as public key algorithm with standard 1363.1.The usage of NTRU provides the same level of security provided by RSA and it is having the ability to work in limited computing environments. These properties made NTRU are an efficient public key cryptography algorithm for mobile networks.

A. General Model for Payment Transactions A general account–based payment model [5] involves 4 parties. Buyer(who makes the actual payment through mobile phone), Seller(who receives payment), Issuer (Bank or Buyer financial institution), Acquirer(Bank or Seller financial © 2012 ACEEE DOI: 01.IJNS.03.01. 62

ACEEE Int. J. on Network Security , Vol. 03, No. 01, Jan 2012 C. Scope of Public Key Cryptography in the Proposed Protocol

originated. In financial transactions non repudiation is a most important factor. Symmetric key may suffer from MAC attacks. To the best of Authors knowledge it is the first protocol to be used for Mobile networks based on public key cryptography. The non-repudiation cannot be proved from symmetric key cryptography as the key is shared between two parties.

The issuer is the main source of financial transactions from where the actual fund is transferred to Acquirer by the payment Gateway. In the proposed protocol, the issuer and the Buyer possess the individual public key pairs and thus can generate digital signatures.In public key cryptography, the public key must be certified. We assume a Certification Authority, CA, authenticate the public key of Issuer and Buyer.CA certifies the public key of Issuer using its private key CAPvtKey. The public key of CA is conveyed in an authenticated manner to all the entities involved. This can be done through any efficient algorithm.

III. ORGANIZATION OF THE PAPER The remainder of the paper is organized as follows. Section 4 discusses security requirements in Mobile networks. Section 5 discusses the generic payment model. Section 6 discusses the proposed protocol.Section 7 analyses the security requirements met by the proposed protocol. Section 8 discusses the comparison between our protocol and standard wired mobile payment protocols. Section 9 provides conclusion of this research paper.

D. Related Work In this section several existing standard payment protocols are analyzed briefly. Secure Electronic Transaction (SET) Protocol: SET is set of security protocols enables users to employ the existing private credit card payment infrastructure on an open network, such as Internet in a secure fashion. Cardholder, Seller, Issuer, Acquirer, Payment Gateway, Certification Authority forms the major participants in the protocol. SET is public key cryptography based protocol. The SET protocol supports three types of transaction steps which are Purchase request, Payment authorization, Payment capture [11, 13]. iKP Protocol: The iKP(i-Key Protocols) where i=1,2,3 is a set of payment protocols. Three parties are involved in IKP: Buyer, Seller, and Acquirer gateway. iKP is based on public key cryptography .i value indicates the number of parties possess the public key pairs and can generate digital signatures. As i increases from 1 to 3, the security requirements met by iKP increases [2]. The major drawback of SET and iKP protocols is that they can be successfully implemented for wired networks but not for mobile networks in terms of computation and security. SET and iKP are based on public key cryptography which involves high computational operations such as public key encryptions and decryptions. A Certification Authority (CA) is needed to authenticate the public keys possessed by the engaging parties. The public key of the Certification Authority must be transmitted in a secure manner to all the parties which increases the number of messages exchanged. The SET and iKP uses RSA algorithm for encryption which makes the system slower. In our algorithm we use NTRU algorithm which faster than RSA. II. MY CONTRIBUTIONS

IV. SECURITY REQUIREMENTS IN M-COMMERCE In this section we analyze the security requirements [1] for a Mobile Payment in view of the above mention system entities. Buyer(B), Seller(S), Issuer(I), Acquirer(A), Payment Gateway (PG). Party authentication: The receiver must know the sender of the message is the intend and valid sender. Transaction privacy: All the transactions must be secure. Proof of transaction authorization by user: When an Issuer debits certain amount from certain credit card, the issuer must possess unforgeable proof that the owner of the credit card has authorized the payment. The Issuer also need to take care of replay attacks, the amount, currency, order description Impossibility of unauthorized payments: It must be impossible to for adversaries to get the Credit Card Number and PIN from the payment transaction and use it later. A. Our Assumptions 1) A Buyer is an internet accessible mobile device. 2) The Issuer and Buyer are having the public keys pair generated using NTRU algorithm. 3) Buyer and Seller shares a symmetric key X. 4) Seller and PG shares a symmetric key Z. 5) Seller and Acquirer shares a secret key Y. 6) To distribute the secret key between them self in the entities use Authenticated Key Exchange protocol (AKE) for Wireless networks found in [3, 6]. 7) The reversal of a hash function is infeasible, means it is easy to calculate x=h(y), but it is computationally infeasible to compute x, given y. 8) The Banks issues credit card (account) and receives payment records from its customers. Every issuer (Bank) will have BIN (Bank Identification Number) assigned by payment system provider. Every credit card issued by bank to the customer embodies BIN.BIN also identifies the Payment system provider. 9) We assume that the Buyer is having an account with a bank and securely got the PIN. Similar to Buyer a Seller is also associated with its bank (Acquirer) to accept deposits

We present a protocol based on public key cryptography based on the work done in NTRU for mobile networks which provides all the security requirements [1] in mobile payment transactions. Till now public key cryptography is used only for wired networks (Desktop). Similarly Symmetric key is used for wireless networks. The advantage of Asymmetric key over Symmetric key is non repudiation.The non repudiation property ensures that a party cannot deny the transaction she ÂŠ 2012 ACEEE DOI: 01.IJNS.03.01.62

ACEEE Int. J. on Network Security , Vol. 03, No. 01, Jan 2012 CCN: Credit Card Number issued by the Issuer to the buyer. PIN: The PIN issues by Issuer to the buyer and the Buyer uses CCN and PIN for her mobile transactions. EXPIRATION: Expiration date associated with Buyers CCN. Common: Is a composite entity which contains the common details about the transaction between Buyer and Seller, which includes: Price, IDS, TID, DATE, NONCE, IDB, and DESC.

buyer can use a modern computer. 10) The transferring and authorizing the users and clearing them is done by payment gateway with the help of issuer (Buyer bank) and Acquirer (Seller bank). V. GENERIC PAYMENT MODEL The generic model of a payment system as discussed in [2] is shown below.

Common: Price, IDS, TID, DATE, NONCE, IDB, DESC

Figure 3. The graphical view of our proposed protocol Figure 2. The generic model of payment system

The steps 1 and 2 of the proposed protocol are registration steps, in which the Buyer and Seller exchange their identities. Hence the graphical view started from step 3 from which the payment transactions start. 1) B->S: IDB, TIDREQ, SIDREQ 2) S->B: EX{IDS, TID, DATE, NONCE, h(Common)} 3) B->S: EX{EIPubKey{Price, CCN, PIN, EXPIRATION, BPubKey, h(Common)}} 4) S->PG: EZ{EIPubKey{Price, CCN, PIN, EXPIRATION, h(Common), BPubKey} IDS, IDI, TID, DATE, NONCE, h(Common), MAC[(IDS,TID, IDI,DATE,NONCE),Z]} 5) The below steps will be done in existing private bank network. 5.1) PG->I: {EIPubKey{Price, CCN, PIN, EXPIRATION, h(Common), BPubKey}, IDS, TID, IDB, DATE, NONCE, h(Common)} 5.2) I->PG:{Yes/no, EBPubKey{Yes/No, h(Common)}} 5.3) PG->A: Price, IDS. 5.4) A->PG: {Yes/no, EY{price, Yes/No}} 6)PG->S:EZ{EBPubKey{Yes/No,h(Common)}, EY{h(Common),Yes/ No}} 7) S-> B: EX{ EBPubKey{Yes/No, h(Common)}}

The issuer is a bank which issues credit card to the buyer and acquirer is a bank which acquires payment from the seller. The payment system provider(PSP) is an entity which manages a business relationship with banks. PSP helps seller to receive electronic payments of various methods like credit card, debit card etc. Paypal is an example for a PSP. It acts as an intermediary between Issuer and Acquirer. PSP connects to multiple banks, payment networks to clear the transactions between buyer and seller. Buyer needs to pay the amount (payment) to the Seller. Seller contacts the Acquirer to acquire the amount. The Acquirer contacts the Issuer for clearing. The clearing between the Issuer and Acquirer will be done through the existing banking networks. The generic payment model represents the macro level transactions involved. The operations involved at micro level among entities are described in the proposed protocol. VI. PROPOSED PROTOCOL A. Notations B: Buyer S: Seller I: Issuer (A bank in which the Buyer is having an Account) A: Acquirer (A bank in which the Seller is having an Account). PG: Payment Gateway (Acts as an Interface between Issuer and Acquirer. IDB: Buyer identity, which identifies Buyer to the Payment protocol entities. IDS: Seller identity, which identifies Seller to the payment protocol entities. TID: Transaction ID. It includes date and time of transaction. Price: Total price, which the buyer needs to pay to the seller DATE: Seller’s date /time stamp helps in the replay attack. NONCE: Seller’s random number helps in the replay attack. DESC: Description of Goods, Books, Number of Quantity, The buyer address, Credit Card name, Issuing bank name etc. © 2012 ACEEE DOI: 01.IJNS.03.01. 62

B. Description of the Steps Involved in the Protocol 1) B->S: IDB, TIDREQ, SIDREQ Buyer sends her Id to initiate the flow with the seller and requests Seller Id and the Id of the Transaction it completed on the seller server. 2) S->B: EX{IDS, TID, DATE, NONCE, h(Common)} Seller gets IDB from the message sent by Buyer. Seller knows the DATE of transaction and DESC of the transaction. Seller Generates a random number NONCE, The combination of NONCE and DATE is used to resolve ambiguities in cases 7

ACEEE Int. J. on Network Security , Vol. 03, No. 01, Jan 2012 Issuer. The encryption by buyer public key assures that the amount debited and status cannot be forged by any entities.

of payments with common date. Seller computes the h(NONCE) and transfers his ID, Transaction Id, Date, NONCE and hash of NONCE to the buyer. 3) B->S: EX{EIPubKey{Price, CCN, PIN, EXPIRATION, BPubKey, h(Common)}} Buyer forms a message by providing his Credit Card Number, PIN, and expiration date of CCN. It is encrypted with the public key of the Issuer. Hence no one can get the valuable information of CCN, PIN of the Buyer from the payment message. The entire message is encrypted with the sharing key between Buyer and Seller. 4) S->PG: EZ{EIPubKey{Price, CCN, PIN, EXPIRATION, h(Common), BPubKey} IDS, IDI, TID, DATE, NONCE, h(Common), MAC[(IDS, TID, IDI, DATE, NONCE),Z]} On receiving payment message from the Buyer, the Seller transfers the above message to Payment Gateway which is called as value claim request encrypted with the shared secret key Z. The value claim requests contains Value–Subtraction request i.e., E IPubKey{Price, CCN, PIN, EXPIRATION, h(Common), BPubKey} which is sent to Issuer to subtract the prescribed price from the Buyer’s account. ID and ID are used to identify the Seller and Issuer. 5.1) PG->I: {EIPubKey{Price, CCN, PIN, EXPIRATION, h(Common),BPubKey},ID S, TID,ID B ,DATE,NONCE, h(Common)} PG sends the value–subtraction request to I. 5.2) I->PG: {Yes/no, EBPubKey{Yes/No, h(Common)}} Based on the existence of the sufficient funds in the Buyers account, the Issuers responds appropriately by replying Yes/No to the PG. It frames a message containing Yes/No, h(Common) encrypting with the public key of Buyer to inform the Buyer , the exact amount debited from the buyer account, which should not be forgeable by either PG or Seller. 5.3) PG->A: Price, IDS. PG sends ID of Seller (IDS) and Price to notify an Acquirer that S is person whom the requested amount to be transferred. 5.4) A->PG: {Yes/no, EY{Price, Yes/No}} The Acquirer informs the status of Value-Claim request to the Seller by encrypting the appropriate response with the shared key this step prevents the PG forging the reply from Acquirer. 6)PG->S:EZ{EBPubKey{Yes/No,h(Common)}, EY{h(Common), Yes/No}} On receiving the response from the Issuer and Acquirer, PG transmits the message to Seller encrypting with the shared key Z. On getting the reply from the PG, the seller decrypts the message with shared key Z, It transfer the message intended to Buyer and decrypts the message sent by Acquirer using the shared key Y. If the response is Yes, then it compares the price in message with the price it already have. If it is equal to price it have then the transaction is fine or else it rejects it. 7) S-> B: EX{ EBPubKey{Yes/No, h(Common)}} Seller sends the message received from the PG to the Buyer which is encrypted by the public key of Buyer by S

VII. SECURITY REQUIREMENTS MET BY THE PROPOSED PROTOCOL AS DISCUSSED IN SECTION 2 Party authentication: All the messages in the proposed protocol are encrypted with the shared keys between entities. As the key is shared between two entities only, the receiver can assure that the message comes from the Authenticated party only. Transaction privacy: All the transactions are encrypted with the sharing keys and the message contains CCN and PIN double encrypted, hence the privacy is guaranteed. Transaction integrity: All the transactions are concatenated with the hash of the entities involved, which ensures integrity of the message to the receiver. Proof of transaction authorization by user: The message sent to Issuer contains public key of Buyer (BPubKey). The message is encrypted with Public key of Issuer which can be decrypted only with Issuer private key. Hence the message is unaltered by any means. On decryption, the Issuer retrieves the public key of Buyer which confirms the Issuer that the transaction is authorized. Impossibility of unauthorized payments: To send a legitimate payment message to Issuer, the adversary must know the CCN, PIN, EXPIRATION, without knowing this he cannot create a fake request. The CCN, PIN, EXPIRATION are sent in a secure format using the Public key of Issuer, to decrypt the fraudulent must need the private key, which is not possible.

VIII. PERFORMANCE ANALYSIS OF THE PROPOSED PROTOCOL In this section we compare our protocol with SET [11] and iKP [2] protocols which are standardized protocols for ecommerce transactions in wired networks. The below table demonstrates the number of cryptographic operations involved at each party. TABLE I. COMPARISON O F C RYPTOGRAPHIC O PERATIONS O F SET, IKP AND O UR PROTOCOL.

ACEEE Int. J. on Network Security , Vol. 03, No. 01, Jan 2012 We can see that in our protocol only one public key Encryption and one decryption are done by Buyer. The key generation process is required to update the keys regularly. However, this would not cause the time consumption as this can be done offline.

[3] C. Boyd, P. Montague, and K. Nguyen, Elliptic Curve Based Password Authenticated Key Exchange Protocols,LNCS Vol. 2119, 2001, pp. 487-501. [4] S. Cimato, Design of an Authentication Protocol for GSM Javacards, LNCS Vol. 2288, 2002, pp. 355-368. [5] E. V. Herreweghen, Non-Repudiation in SET: Open Issues, LNCS Vol. 1962, 2001, pp. 140-156. [6] G. Horn and B. Preneel, Authentication and Payment in Future Mobile Systems, Proceedings of 5th ESORICS’98, Belgium, 1998, pp. 277-293. [7] S. Kungpisdan, B. Srinivasan, and P. D. Le, A Practical Framework for Mobile SET Payment, Proceedings of International E-Society Conference 2003, pp. 321-328. [8] S. Kungpisdan, B. Srinivasan, and P. D. Le, Accountability Logic for Mobile Payment Protocols, To appear in ITCC’2004, Las Vegas, 2004. [9] S.Kungpisdan, and Y. Permpoontanalarp, Practical Reasoning about Accountability in Electronic Commerce Protocols, LNCS Vol. 2288, 2002, pp. 268-284. [10] L.M. Marvel, Authentication for Low Power Systems, Proceedings of IEEE MILCOM 2001. [11] MasterCard and Visa, SET Protocol Specifications, 1997.http:/ /www.setco.org/set_specifications.html [12] B. S. Yee, Using Secure Coprocessor, PhD thesis, Carnegie Mellon University, 1994. [13] William Stallings “Cryptography and Network Security Principles and Practices” Fourth edition PHI. [14] J.Hoffstein, J.Pipher and J.Silverman. NTRU: A ring based public key cryptosystem,Algorithmic Number Theory (ANTS III), Portland, OR, June 1998, Lecture Notes inComputer Science 1423, 267-288

CONCLUSION We have proposed first of its kind of account based protocol based on public key cryptography which is applicable to wireless networks. We have shown that the proposed protocol has advantages over SET [11] and iKP [2] protocols, in that it has lower computation at each party since only two public key operations are required. In our protocol, Buyers can ensure that their account information will not be compromised by any parties involved. As a result with our proposed protocol the mobile users can have efficient and secure payments and it may gain more acceptability than existing protocols. REFERENCES [1] V. Ahuja, Secure Commerce on the Internet, Academic Press, 1996. [2] M. Bellare, J. A. Garay, R. Hauser, A. Herzberg, H.Krawczyk, M. Steiner, G. Tsudik, E. V. Herreweghen,and M.Waidner, Design, Implementation, and Deployment of the iKP Secure Electronic Payment System, IEEE Journal of Selected Areas in Communications, 2000.