|
- Dr.V.N.Sastry
- Professor, IDRBT &
- Executive Secretary, MPFI
- Road No.1, Castle Hills, Masab Tank, Hyderabad 500057
- E-Mail : vnsastry@idrbt.ac.in
- Ph: 91-40-23534981
- Test : 9440803813 (M) & MMID : 9211933
- January 30, 2012 at IDRBT for the EDP
Outline - Mobile Payment Technologies
- Technology Challenges
- Some innovative developments
- Based on the validation of the tokens exchanged
- Offline
- Payments (ex: e-coins in P2P transfers)
- Enabling Mobile Technologies
Technology Challenges - Device Level
- Application Level
- Communication Level
- User Level
- Security Level
- Standards Level
- Consolidation Level
Device Level Challenges - Variation in Features and Functionalities, look and feel, text size, recharging frequency, OS
- User Awareness and Education
- Voice, Data, MMS, interactivity, real time response, location aided feature etc. properly used ?
Mobile Application Level Challenges - Is the Mobile Payment Application Developed in Conformance to standards ? Is it interoperable ?
- On which folder client application is to be downloaded ? how to install and run a mobile payment application ?
- Is the design optimized for execution in limited phone memory?
- Has it been Tested and certified by Trusted entity ?
- Can the customer wait for the delay to get it for his/her new model ?
Communication Level Challenges - Which channel to use : SMS, USSD, GPRS, DTMF ?
- What way mobile banking convenience is enhanced by 2G, 3G, 4G ?
- When and how to use Wireless Communication Technologies : Bluetooth, Zigbee, Wi-max, Wi-fi , LTE ?
Mobile Communication Architecture - Subscriber and terminal equipment databases
- Interbank Mobile Payment Service (IMPS)
User Level Challenges - Local language support on Mobiles
- Generation of Transaction report
- Mobile Application on Phone memory or SIM or memory card ?
- Trace of transaction data or critical personal data : access by others
- Mobile Wallet : risk of multiple cards in the device and value offload for cash exchange in local currency
- Mobile based Financial Inclusion services
- Complaint registration and Grievance resolution
- Biometric
- Authentication
- ( UIDAI )
- Mobile based Financial Inclusion and
- Mobile Wallet
Security Challenges - Authentication
- User, Device, Application, Transaction
- Direct, Indirect
- Factors : You Know (UK), You Have (UH), You Are (UR)
- One Way from source (S) to destination (D)
- Mutual between source, destination or intermediate entities as Telco , Mobile Payment Provider, Bank Server, Switching agency.
- Encryption & Decryption Using Cryptoghaphy
- Symmetric key ( Password, m-Pin )
- Asymmetric key (PKI , WPKI )
- Layers of OSI Model
- Access Control Models
- Between Source (S) and Destination (D)
- MPP to Bank : SSL / TCP
- Bank to NPCI : SSL/TCP
Major 3 Sections of a Mobile Phone - Power Section
- Radio Section
- Band Switching
- RF Power Amplification
- Transmitter
- Receiver
- Computer Section
- CPU (central processing unit)
- Memory (RAM,FLASH,COMBO CHIP)
Some reported attacks on Mobile Phones - Phishing
- Botnet
- Fake Player
- Trojan horse
- Bluejacking (Symbian )
- BlueBug
- BlueSnarfing
- BluePrinting
- Cabir (First in 2004 )
- Comwar
- Skulls
- Windows CE virus
Mobile Station - Mobile Equipment (ME) is identified by
- International Mobile Equipment Identity (IMEI) Number
- Subscriber Identity Module (SIM) Card has keys, identifiers and algorithms
- Identifiers
- Ki – Subscriber Authentication Key
- IMSI – International Mobile Subscriber Identity
- TMSI – Temporary Mobile Subscriber Identity
- MSISDN – Mobile Station International Service Digital Network
- PIN – Personal Identity Number protecting a SIM
- LAI – location area identity
- STK ( SIM Application Toolkit) allows applications in the SIM to interact with any ME
- ETSI GSM 11.14 standard defines the interface between the SIM and the interoperable ME .
SIM Card - Mobile Payment Application can be installed on either ME or SIM .
- The application burnt on the SIM card gives by far the most secure application environment. The mobile application can be stored on its own security domain and hence prevented from others having access to it.
- Forensic tools and procedures exist that can be used to bypass built-in security mechanisms and recover the contents of a device.
- Both software and hardware-based methods are available for data recovery, including those that exploit existing vulnerabilities.
- A number of GSM mobile phones allow acquisition with a forensic tool, if a PIN-enabled (U)SIM is missing or removed from the device. It is also possible to create substitute (U)SIMs for certain models of phones that fools them into treating the (U)SIM as the original, and allowing access.
-
Do'stlaringiz bilan baham: |
