1 / 28

Technology Challenges in Mobile Payments

Technology Challenges in Mobile Payments. Dr.V.N.Sastry Professor, IDRBT & Executive Secretary, MPFI Road No.1, Castle Hills, Masab Tank, Hyderabad 500057 E-Mail : vnsastry@idrbt.ac.in Ph: 91-40-23534981 Test : 9440803813 (M) & MMID : 9211933 January 30, 2012 at IDRBT for the EDP.

lawrence-oneal
Download Presentation

Technology Challenges in Mobile Payments

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Technology Challenges in Mobile Payments Dr.V.N.Sastry Professor, IDRBT & Executive Secretary, MPFI Road No.1, Castle Hills, Masab Tank, Hyderabad 500057 E-Mail : vnsastry@idrbt.ac.in Ph: 91-40-23534981 Test : 9440803813 (M) & MMID : 9211933 January 30, 2012 at IDRBT for the EDP

  2. Outline • Mobile Payment Technologies • Technology Challenges • Some innovative developments

  3. Classification of Mobile Payments Based on the validation of the tokens exchanged Based on Value Based on Location Based on Charging method Micro Payments Remote Payments Post-paid Online Payments Mini Payments Pre-paid Proximity Payments Offline Payments (ex: e-coins in P2P transfers) Macro Payments

  4. Enabling Mobile Technologies Transport Security enablers Platforms User Interface Voice SIM Long-range Short-range SAT SMS WPKI/WIM Java ME Infrared GSM USSD Bluetooth GPRS Dual slot phones WAP Java Card RFID 3G NFC 4G

  5. Technology Challenges • Device Level • Application Level • Communication Level • User Level • Security Level • Standards Level • Consolidation Level

  6. Device Level Challenges • Variation in Features and Functionalities, look and feel, text size, recharging frequency, OS • User Awareness and Education • Voice, Data, MMS, interactivity, real time response, location aided feature etc. properly used ?

  7. Mobile Application Level Challenges • Is the Mobile Payment Application Developed in Conformance to standards ? Is it interoperable ? • On which folder client application is to be downloaded ? how to install and run a mobile payment application ? • Is the design optimized for execution in limited phone memory? • Has it been Tested and certified by Trusted entity ? • Can the customer wait for the delay to get it for his/her new model ?

  8. Communication Level Challenges • Which channel to use : SMS, USSD, GPRS, DTMF ? • What way mobile banking convenience is enhanced by 2G, 3G, 4G ? • When and how to use Wireless Communication Technologies : Bluetooth, Zigbee, Wi-max, Wi-fi , LTE ?

  9. BTS BTS Mobile Communication Architecture Mobile Stations Base Station Subsystem Network Management Subscriber and terminal equipment databases OMC Exchange System VLR MSC BSC HLR AUC EIR

  10. Settlement (CCIL) Switching (NPCI) Bank - A Bank -B Interbank Mobile Payment Service (IMPS) Payer-X Payee- Y

  11. User Level Challenges • Local language support on Mobiles • Generation of Transaction report • Mobile Application on Phone memory or SIM or memory card ? • Trace of transaction data or critical personal data : access by others • Mobile Wallet : risk of multiple cards in the device and value offload for cash exchange in local currency • Mobile based Financial Inclusion services • Complaint registration and Grievance resolution

  12. Biometric Authentication ( UIDAI ) Settlement (CCIL) Switching (NPCI) Bank A Bank B Mobile based Financial Inclusion and Mobile Wallet BC Micro ATM ATM / Merchant PoS Customer

  13. Security Challenges • Authentication • User, Device, Application, Transaction • Direct, Indirect • Factors : You Know (UK), You Have (UH), You Are (UR) • One Way from source (S) to destination (D) • Mutual between source, destination or intermediate entities as Telco , Mobile Payment Provider, Bank Server, Switching agency. • Encryption & Decryption Using Cryptoghaphy • Symmetric key ( Password, m-Pin ) • Asymmetric key (PKI , WPKI ) • Layers of OSI Model • Access Control Models • Between Source (S) and Destination (D) • MPP to Bank : SSL / TCP • Bank to NPCI : SSL/TCP

  14. Major 3 Sections of a Mobile Phone • Power Section • Power distribution • Charging section • Radio Section • Band Switching • RF Power Amplification • Transmitter • Receiver • Computer Section • CPU (central processing unit) • Memory (RAM,FLASH,COMBO CHIP)

  15. Some reported attacks on Mobile Phones • Cabir (First in 2004 ) • Comwar • Skulls • Windows CE virus Phishing Botnet Fake Player Trojan horse Bluejacking (Symbian ) BlueBug BlueSnarfing BluePrinting

  16. Mobile Station • Mobile Equipment (ME) is identified by • International Mobile Equipment Identity (IMEI) Number • Subscriber Identity Module (SIM) Card has keys, identifiers and algorithms • Identifiers • Ki – Subscriber Authentication Key • IMSI – International Mobile Subscriber Identity • TMSI – Temporary Mobile Subscriber Identity • MSISDN – Mobile Station International Service Digital Network • PIN – Personal Identity Number protecting a SIM • LAI – location area identity • STK ( SIM Application Toolkit) allows applications in the SIM to interact with any ME • ETSI GSM 11.14 standard defines the interface between the SIM and the interoperable ME .

  17. SIM Card • Mobile Payment Application can be installed on either ME or SIM . • The application burnt on the SIM card gives by far the most secure application environment. The mobile application can be stored on its own security domain and hence prevented from others having access to it. •  Forensic tools and procedures exist that can be used to bypass built-in security mechanisms and recover the contents of a device. • Both software and hardware-based methods are available for data recovery, including those that exploit existing vulnerabilities. • A number of GSM mobile phones allow acquisition with a forensic tool, if a PIN-enabled (U)SIM is missing or removed from the device. It is also possible to create substitute (U)SIMs for certain models of phones that fools them into treating the (U)SIM as the original, and allowing access.

  18. Security at Mobile Channel Level • Voice Channel : DTMF for IVRS • Text Channel : SMS, USSD • MMS Channel : GPRS • GSM Security Mechanisms • Equipment Identity Register (EIR) • Black list – stolen or non-type mobiles • White list - valid mobiles • Gray list – local tracking mobiles • Central Equipment Identity Register (CEIR) • Approved mobile type (type approval authorities) • Consolidated black list (posted by operators)

  19. Security at Mobile Application level Client Application developed by the Mobile Payment Provider (MPP) Server Application of the MPP at the Bank level Security Testing Key Generation and storage process Check Sum implemented Reaching to the destined address only ?

  20. Multiple Standard Challenges • ISO Standards • IEEE Standards • PCI DSS Standards • Regulatory Standards • Global platform Standards • EMV Standards • NIST Standards • SFMS, SWIFT Standards • NFC Standards

  21. Mobile ad hoc network technologies

  22. Consolidation Level Challenges • Server capabilities to handle high volume mobile payment transactions • Periodic and round the clock clearing services for mobile payments • Net and Real time funds settlement between Banks • Cash management issues at ATMs on account of high velocity mobile payments. • Offering Mobile Banking Application as a Cloud Service

  23. Some Innovative solutions of Mobile Payments in India: • Bringing all stakeholders of Mobile Payments into one platform by the Mobile Payment Forum of India (MPFI) in 2006 • Use of Mobile Phone Number and MMID only for Mobile Payments • Use of AADHAR number and BIN for Mobile Payments • Use of USSD based Mobile Payments • Development of MANETS for Financial Inclusion by IDRBT • And many other solutions reported in the workshop

  24. MANET Ecosystem for Mobile Payments • MANET nodes. • Gateway. • Backbone Network. • Bank Server. • Fixed Relay.

  25. Mobile ad-hoc Network (MANET) • It is a Mobile wireless network. • MANET nodes are rapidly deployable, self configuring and capable of doing autonomous operation in the network. • Nodes co-operate to provide Connectivity and Services. • Operates without base station and centralized administration. • Nodes exhibit mobility and the topology is dynamic. • Nodes must be able to relay traffic sense. • A MANET can be a standalone network or it can be connected to external networks(Internet).

  26. MANET based Mobile Payments Cellular Network /Satellite Technology Internet / Private LAN Gateway Backbone I MANET node Fixed Relays Village Bank Server Mobile ad hoc Network

  27. Testbed Cellular Network/ ISDN/PSTN/ LLN/ Satellite Network Mobile Node A 192.168.1.2 Mobile Node C 192.168.1.3 192.168.1.1 Mobile Node B 192.168.1.3 Gateway Fixed Relay Mobile Node D 192.168.1.4 Bank-A Server 172.16.0.8 Bank-B Server 162.16.6.124 MANET in a Village

  28. Thank you...

More Related