Design and implementation of smart channel establishment schemes for mobile wallet services

Abstract

A mobile wallet is a mobile-enabled application that provides users with a variety of payment services through their smartphones by integrating various payment methods into one application system. Its service can be provided by using a variety of short-range wire les s connectivity techniques between a designated payment server and a smartphone. However, these wireless communication systems have several vulnerabilities in that the services may be exposed to attackers. Hence, to provide this mobile wallet service commercially, it is necessary to develop secure session management techniques which are provided at short range between the mobile wallet and the terminal. In this paper, we propose a session key establishment protocol without using a pre-shared secret or a trusted third party, and authentication methods that can be applied to the out-of-band (OOB) channel authentication phase of the proposed protocol. The main idea of the proposed scheme is to utilize an OOB authentication channel to provide security in a mobile wallet payment service. We then design and implement both the proposed authentication protocol and three different types of OOB authentication methods and evaluate the performance of the proposed schemes after embedding them into a real payment system and a mobile wallet application. © 2012 American Scientific Publishers All rights reserved.