A cloud-based secure authentication protocol for contactless-NFC payment

Abstract

Nowadays, NFC technology is used in contactless payment applications by offering the NFC payment functionality in credit/debit cards, smartphones and payment terminals. Thus, an NFC payment transaction is executed in a simple and practical way. EMV is the security protocol for both contact and contactless payment systems. However, during an EMV payment transaction, this standard does not ensure two main security constraints between a customer payment device and a payment terminal:(1) mutual authentication, (2) confidentiality of sensitive banking data exchanged. These weaknesses represent a major risk in the case of NFC payment because the transaction is performed using NFC radio waves in an open environment. The risk is reduced in the case of contact payment because the transaction is executed in a closed environment by inserting the card into the terminal. In this paper, we propose a new security protocol for NFC payment transactions based on a Cloud infrastructure. We verify the correctness of this proposal using Scyther tool that provides formal proofs for security protocols.

A Review of Secure Authentication based e-Payment Protocol

“…Furthermore, few of them have focused smart card-based secure protocol [44], [61], [62]. However, this study needs to improve the proposed solution towards developing a prototype as well as illustrate its efficiency in real time application.…”

“…Madhoun et al [44]brought out a novel security protocol for payments and transactions through NFC which resolved the security vulnerabilities which were identified in the EMV protocol. This is based on cloud infrastructure to ascertain the authenticity of payment terminals and offer confirmation to smartphones.…”

Security Enhancements in EMV Protocol for NFC Mobile Payment

“…In fact, authors did not take into consideration the advantage of an NFC smartphone having both Wi-Fi and 4G interfaces that may be useful for direct communication with the server: the NFC smartphone connects firstly using NFC radio waves to the payment terminal, the latter then communicates with the server. In our previous studies [8] and [14], we have designed security protocols for NFC payment systems based on asymmetric key cryptography and allowing to overcome EMV security weaknesses in EMV card authentication phase. They ensure: mutual authentication, non-repudiation, confidentiality and integrity of banking data.…”

“…The proposal [14] is intended to secure NFC mobile payment transactions between NFC smartphones and payment terminals. It is executed in the offline mode where the payment terminal is not connected to the issuing bank and is responsible for the execution of the security procedure authenticating an NFC smartphone.…”

“…The research work [8], [13] and [14], are different from the classical EMV card authentication phase (online or offline): because they implement new security architectures by using new security elements for each actor as: multiple electronics certificates and signatures in [8] and [14], symmetric keys in [13], etc. However, these large differences are too expensive although they theoretically participate in solving EMV vulnerabilities.…”