Click here to close now.

Welcome!

Web 2.0 Authors: Liz McMillan, Aria Blog, Dana Gardner, Elizabeth White, Ian Khan

Related Topics: Wireless, SOA & WOA, Web 2.0, iPhone, Security

Wireless: Article

Securing Mobile Payments

As the mobile payment industry continues to develop at lightning speed, best practices have yet to be solidified

As mobile phones become as indispensable as credit cards for purchasing goods and services, mobile payment developments are quickly gaining pace. Many different service providers are competing for their piece of the action. Within the last year, we have witnessed the arrival of mobile payment solutions such as MasterCard's PayPass, Google's Android-based eWallet scheme and Starbucks' emerging Quick Tap PayPass service.

A study from Juniper Research predicts that mobile contactless payment transactions are to reach nearly $50 billion worldwide in 2014 and NFC solutions will be used in 20 countries within the next 18 months.

However, with the widespread adoption of this technology, there is a need to debate which type of scheme works best and is the most robust.

Setting the Standard
As with traditional payments, standardization is vital. Several effective standards are already gaining momentum in delivering a secure mobile payments ecosystem:

  • Organizing Mobile NFC Services - The Trusted Service Manager (TSM) acts as an intermediary between Mobile Network Operators (MNOs) and third-party service providers that wish to offer additional services to subscribers. GlobalPlatform's ‘System Messaging Specification for Management of Mobile-NFC Services' defines the messaging between each of the three parties to guarantee secure ‘provisioning' of services to the device.
  • The SIM Alliance Open Mobile API - Applications utilizing the Secure Element (the cryptographically secured piece of hardware on newer mobile devices) to secure their critical operations, such as payments, banking or transport tickets, can have a component running within the device's operating system that ensures the user can securely interact with the keyboard/touch screen while enjoying a rich graphical user experience. The SIM Alliance Open Mobile API allows application developers to utilize additional security of the Secure Element more easily, be this in a UICC SIM, a dedicated Secure Element built into the device or a secure SD card, by providing a common means of interfacing with it.
  • Trusted Execution Environment (TEE) - The Secure Element cannot easily host apps with a highly developed or cutting edge user interface, but can look after critical data on the mobile handset. Applications that require complex user interactions must run on the device's primary processor. The TEE secures these apps; GlobalPlatform is leading the standardization and interoperability in this area to ensure that software and data are sufficiently protected. For example, payment apps that run their user interface in TEE and their transaction security in the Secure Element would have a particularly high level of security.

Such standards encourage the industry to work together and benchmark best practices, but they remain as fundamental elements of successful mobile payment security. It is also required that technology that makes the security of provisioning mobile payment applications is as safe as issuing cards, and designing the necessary infrastructure requires much needed consumer confidence.

Security Issues Prompt Consumer Fear
Consumer's perceived fear surrounding new mobile payments technology often looms around security. The lack in consumer confidence originates from the threat of information being intercepted during a transaction. Yet risks are prominent at every stage of the mobile payment life cycle, including how payment applications get onto a phone securely in the first place. Constructing the data needed to issue a payment application and generate the secure messages to personalize a handset can be a lengthy and inefficient process, and the various cryptographic functions pose the possibility that sensitive data is at risk of exposure.

This initial set-up process or ‘provisioning' usually takes place over-the-air (OTA). The process increases security risks due to the various parties involved - typically the payment application provider (usually a bank), a Trusted Service Manager, the Mobile Network Operator and the end user. A vital success factor is maintaining security throughout this procedure, ensuring that no data is compromised. Successful provisioning utilizes unique personalization keys to not only encrypt the loading of data onto a device, but also the succeeding transactions performed by the application.

Mobile Payment Security as Secure as Traditional Payment Cards
By implementing the newest cryptography methods, users can ensure that ‘provisioning' occurs securely with the same level of protection provided by traditional payment cards. Providers of physical cards tend to favor Hardware Security Modules (HSMs), which generate and secure the encryption keys crucial to managing issuance risk. This method is also relevant for provisioning services to a mobile phone and can significantly reduce the complexities associated with the process while simultaneously avoiding the weakness of keys stored in software. The primary benefit of an HSM is to secure encryption keys and sensitive data in a way that safeguards such data from exposure. With this method, service providers reduce risk.

While encryption is crucial to the security of mobile payments, it isn't the only answer. For a more comprehensive approach to optimize security, encryption and authentication must be combined to provide protection for data exchanges and authorizations.

Reducing Risk
As the mobile payment industry continues to develop at lightning speed, best practices have yet to be solidified. Operators and related parties are still unsure about who ultimately controls the mobile wallet. But one thing that is for sure is that security remains the primary hurdle most consumers can't get over.

Extinguishing this concern is no easy task; it requires a mixture of robust standards and best practices, accompanied with the right technical path to ensure the experience is safe from the second that a user opts to download a payment app. If businesses want to take advantage of the mobile payments, security needs to be at the forefront of their approach to mitigating risk and encourage comprehensive consumer adoption.

More Stories By Ian Hermon

Ian Hermon is Product Marketing Manager at Thales e-Security. He has more than 15 years’ experience in the payment industry, being responsible for the Thales portfolio of payment and transaction security products. He represents Thales on both the MasterCard Global Vendor Forum and Visa Europe Vendor Forum, is a member of the Smart Card Alliance Payments Council and the Smartex Smart Payments Forum Steering Committee. Ian also represents Thales as a participating organization on the PCI Security Standards Committee and is an EMV subscriber.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
IoT is still a vague buzzword for many people. In his session at @ThingsExpo, Mike Kavis, Vice President & Principal Cloud Architect at Cloud Technology Partners, discussed the business value of IoT that goes far beyond the general public's perception that IoT is all about wearables and home consumer services. He also discussed how IoT is perceived by investors and how venture capitalist access this space. Other topics discussed were barriers to success, what is new, what is old, and what the future may hold. Mike Kavis is Vice President & Principal Cloud Architect at Cloud Technology Pa...
Hadoop as a Service (as offered by handful of niche vendors now) is a cloud computing solution that makes medium and large-scale data processing accessible, easy, fast and inexpensive. In his session at Big Data Expo, Kumar Ramamurthy, Vice President and Chief Technologist, EIM & Big Data, at Virtusa, will discuss how this is achieved by eliminating the operational challenges of running Hadoop, so one can focus on business growth. The fragmented Hadoop distribution world and various PaaS solutions that provide a Hadoop flavor either make choices for customers very flexible in the name of opti...
The true value of the Internet of Things (IoT) lies not just in the data, but through the services that protect the data, perform the analysis and present findings in a usable way. With many IoT elements rooted in traditional IT components, Big Data and IoT isn’t just a play for enterprise. In fact, the IoT presents SMBs with the prospect of launching entirely new activities and exploring innovative areas. CompTIA research identifies several areas where IoT is expected to have the greatest impact.
Advanced Persistent Threats (APTs) are increasing at an unprecedented rate. The threat landscape of today is drastically different than just a few years ago. Attacks are much more organized and sophisticated. They are harder to detect and even harder to anticipate. In the foreseeable future it's going to get a whole lot harder. Everything you know today will change. Keeping up with this changing landscape is already a daunting task. Your organization needs to use the latest tools, methods and expertise to guard against those threats. But will that be enough? In the foreseeable future attacks w...
The Internet of Things (IoT) is rapidly in the process of breaking from its heretofore relatively obscure enterprise applications (such as plant floor control and supply chain management) and going mainstream into the consumer space. More and more creative folks are interconnecting everyday products such as household items, mobile devices, appliances and cars, and unleashing new and imaginative scenarios. We are seeing a lot of excitement around applications in home automation, personal fitness, and in-car entertainment and this excitement will bleed into other areas. On the commercial side, m...
Disruptive macro trends in technology are impacting and dramatically changing the "art of the possible" relative to supply chain management practices through the innovative use of IoT, cloud, machine learning and Big Data to enable connected ecosystems of engagement. Enterprise informatics can now move beyond point solutions that merely monitor the past and implement integrated enterprise fabrics that enable end-to-end supply chain visibility to improve customer service delivery and optimize supplier management. Learn about enterprise architecture strategies for designing connected systems tha...
Dale Kim is the Director of Industry Solutions at MapR. His background includes a variety of technical and management roles at information technology companies. While his experience includes work with relational databases, much of his career pertains to non-relational data in the areas of search, content management, and NoSQL, and includes senior roles in technical marketing, sales engineering, and support engineering. Dale holds an MBA from Santa Clara University, and a BA in Computer Science from the University of California, Berkeley.
Wearable devices have come of age. The primary applications of wearables so far have been "the Quantified Self" or the tracking of one's fitness and health status. We propose the evolution of wearables into social and emotional communication devices. Our BE(tm) sensor uses light to visualize the skin conductance response. Our sensors are very inexpensive and can be massively distributed to audiences or groups of any size, in order to gauge reactions to performances, video, or any kind of presentation. In her session at @ThingsExpo, Jocelyn Scheirer, CEO & Founder of Bionolux, will discuss ho...
The cloud is now a fact of life but generating recurring revenues that are driven by solutions and services on a consumption model have been hard to implement, until now. In their session at 16th Cloud Expo, Ermanno Bonifazi, CEO & Founder of Solgenia, and Ian Khan, Global Strategic Positioning & Brand Manager at Solgenia, will discuss how a top European telco has leveraged the innovative recurring revenue generating capability of the consumption cloud to enable a unique cloud monetization model to drive results.
Docker is an excellent platform for organizations interested in running microservices. It offers portability and consistency between development and production environments, quick provisioning times, and a simple way to isolate services. In his session at DevOps Summit at 16th Cloud Expo, Shannon Williams, co-founder of Rancher Labs, will walk through these and other benefits of using Docker to run microservices, and provide an overview of RancherOS, a minimalist distribution of Linux designed expressly to run Docker. He will also discuss Rancher, an orchestration and service discovery platf...
As organizations shift toward IT-as-a-service models, the need for managing and protecting data residing across physical, virtual, and now cloud environments grows with it. CommVault can ensure protection &E-Discovery of your data – whether in a private cloud, a Service Provider delivered public cloud, or a hybrid cloud environment – across the heterogeneous enterprise. In his session at 16th Cloud Expo, Randy De Meno, Chief Technologist - Windows Products and Microsoft Partnerships, will discuss how to cut costs, scale easily, and unleash insight with CommVault Simpana software, the only si...
Analytics is the foundation of smart data and now, with the ability to run Hadoop directly on smart storage systems like Cloudian HyperStore, enterprises will gain huge business advantages in terms of scalability, efficiency and cost savings as they move closer to realizing the potential of the Internet of Things. In his session at 16th Cloud Expo, Paul Turner, technology evangelist and CMO at Cloudian, Inc., will discuss the revolutionary notion that the storage world is transitioning from mere Big Data to smart data. He will argue that today’s hybrid cloud storage solutions, with commodity...
Cloud data governance was previously an avoided function when cloud deployments were relatively small. With the rapid adoption in public cloud – both rogue and sanctioned, it’s not uncommon to find regulated data dumped into public cloud and unprotected. This is why enterprises and cloud providers alike need to embrace a cloud data governance function and map policies, processes and technology controls accordingly. In her session at 15th Cloud Expo, Evelyn de Souza, Data Privacy and Compliance Strategy Leader at Cisco Systems, will focus on how to set up a cloud data governance program and s...
Roberto Medrano, Executive Vice President at SOA Software, had reached 30,000 page views on his home page - http://RobertoMedrano.SYS-CON.com/ - on the SYS-CON family of online magazines, which includes Cloud Computing Journal, Internet of Things Journal, Big Data Journal, and SOA World Magazine. He is a recognized executive in the information technology fields of SOA, internet security, governance, and compliance. He has extensive experience with both start-ups and large companies, having been involved at the beginning of four IT industries: EDA, Open Systems, Computer Security and now SOA.
The industrial software market has treated data with the mentality of “collect everything now, worry about how to use it later.” We now find ourselves buried in data, with the pervasive connectivity of the (Industrial) Internet of Things only piling on more numbers. There’s too much data and not enough information. In his session at @ThingsExpo, Bob Gates, Global Marketing Director, GE’s Intelligent Platforms business, to discuss how realizing the power of IoT, software developers are now focused on understanding how industrial data can create intelligence for industrial operations. Imagine ...
Every innovation or invention was originally a daydream. You like to imagine a “what-if” scenario. And with all the attention being paid to the so-called Internet of Things (IoT) you don’t have to stretch the imagination too much to see how this may impact commercial and homeowners insurance. We’re beyond the point of accepting this as a leap of faith. The groundwork is laid. Now it’s just a matter of time. We can thank the inventors of smart thermostats for developing a practical business application that everyone can relate to. Gone are the salad days of smart home apps, the early chalkb...
We certainly live in interesting technological times. And no more interesting than the current competing IoT standards for connectivity. Various standards bodies, approaches, and ecosystems are vying for mindshare and positioning for a competitive edge. It is clear that when the dust settles, we will have new protocols, evolved protocols, that will change the way we interact with devices and infrastructure. We will also have evolved web protocols, like HTTP/2, that will be changing the very core of our infrastructures. At the same time, we have old approaches made new again like micro-services...
Operational Hadoop and the Lambda Architecture for Streaming Data Apache Hadoop is emerging as a distributed platform for handling large and fast incoming streams of data. Predictive maintenance, supply chain optimization, and Internet-of-Things analysis are examples where Hadoop provides the scalable storage, processing, and analytics platform to gain meaningful insights from granular data that is typically only valuable from a large-scale, aggregate view. One architecture useful for capturing and analyzing streaming data is the Lambda Architecture, representing a model of how to analyze rea...
Today’s enterprise is being driven by disruptive competitive and human capital requirements to provide enterprise application access through not only desktops, but also mobile devices. To retrofit existing programs across all these devices using traditional programming methods is very costly and time consuming – often prohibitively so. In his session at @ThingsExpo, Jesse Shiah, CEO, President, and Co-Founder of AgilePoint Inc., discussed how you can create applications that run on all mobile devices as well as laptops and desktops using a visual drag-and-drop application – and eForms-buildi...
SYS-CON Events announced today that Vitria Technology, Inc. will exhibit at SYS-CON’s @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Vitria will showcase the company’s new IoT Analytics Platform through live demonstrations at booth #330. Vitria’s IoT Analytics Platform, fully integrated and powered by an operational intelligence engine, enables customers to rapidly build and operationalize advanced analytics to deliver timely business outcomes for use cases across the industrial, enterprise, and consumer segments.