A Secure Mobile Payment Service

1
A Secure Mobile Payment Service
Stamatis Karnouskos Fraunhofer FOKUS Karnouskos_at_fo
kus.fraunhofer.de
András Vilmos SafePay Systems Vilmos_at_safepaysys.co
m
2
General Mobile Payment Info

• 118 million Europeans, 145 million Asians and 22
  million Americans intend to use their mobile
  phone for paying small purchases (TowerGroup)
• volume of mobile business will reach 225 Billion
  by 2005 (United Nations Conference on Trade and
  Development )
• Mobile Internet-based mobile payment market will
  grow from around 5 billion Euros in 2002 to
  nearly 55 billion Euros in 2006 (Wireless World
  Forum ).
• 44 of 5,600 mobile phone users on 4 continents
  surveyed in the February 2002 (global Mobinet
  study) would like to use their mobile phones for
  small cash transactions
• 2.5 G beyond killer application?
• Why are we not paying TODAY with our mobile
  phones ???

3
mPay Actors
4
SEMOPS Consortium

• The largest mobile payment project of the
  Commission this year
• 24 months (more than 550 MMs)
• 4 countries (15 participants)
• 6 million Euro budget
• 2 phases - research and development
  demonstration

5
Tasks
Design?Development?Testing?Trial

• Development of a Pan European payment service
• technology design
• technical development
• elaboration of standards
• definition of security framework
• preparation of EU conformant legal regulation
• definition of business model
• Introduction of the service
• pilot operation
• Hungary, Greece in 2004
• preparation of other demonstration sites

6
Environment
7
General SEMOPS architecture

• Merchant provides transaction data to Customer.
• Customer prepares payment request sends it to its
  trusted partner (Account manager).
• Customers account manager processes payment
  request and forwards it through Data Center to
  Merchants bank.
• Merchants bank advises merchant real time about
  the payment.
• Settlement is through regular interbank
  procedures.

8
Evaluation of the model

• The solution is based on the cooperation of banks
  and MNOs.
• It is a general model for internet and mobile
  payments, for all size transactions (micro, mini,
  macro), for different payment conditions, with
  global introduction.
• The whole service is decentralized, customers and
  merchants do not have to know each other in
  advance, do not pre-register with any single
  third party service providers. Clients of all
  member banks and MNO-s can transact with each
  other.
• The service is account based does not require any
  cards or any other payment instruments.
• Both customer and merchant are only communicating
  with their trusted partners. (Banks, MNOs)
• No sensitive information is provided by customer
  to merchant. Customers may even retain their
  anonymity. (lawful interception is possible, with
  the cooperation of the two payment processors.)

9
Evaluation of the model (cont.)

• Customers individually approve each transaction
  with a PIN (PKI optional, according to the banks
  policy)
• After the transaction information leaves
  customers trusted partner it cannot be traced
  back to customer by anyone else. (There is no
  reason to hack communication lines or the Data
  Center, as there is not any valuable information
  available, not even for profiling.)
• Merchants are receiving real-time payment
  assurance from their own banks.
• Real time authorization. Banks may even elect to
  credit the merchant accounts also real time.
• With the exception of the new SW applications
  traditional banking infrastructure and processes
  are utilized.
• The service allows payment for anything, anytime,
  anywhere, with the same process. (from the same
  personalized menu, a couple of clicks and a PIN).
  Based on standard technology and homogenous rules
  and regulation even cross-border transactions
  will be possible.

10
Key specifics of the service

• Trust
• both the customers and merchants are interacting
  with their trusted partners, the banks and mobile
  operators

• Security
• process
• customers remain anonymous do not provide
  personal information to merchant
• merchant receives guarantee from its own bank
• hardware and software protection
• PKI each transaction is authorized by the
  customer
• data storage the system does not store sensitive
  information (on non trusted parties)
• Regulations Standardisation
• EU conformity, Integration with state of the art
  technologies

• Speed
• full automation
• real time processing

• Openness
• account based
• no centralized authentication
• no entry barrier for new members (banks, MNO-s)

• User friendliness
• easy operation menu selection, personalization
• simple preparation
• With the same process payments can be performed
  anywhere, in any end-device.

11
Favourable effects

• Banks
• allows inexpensive entry to E- and M-business
• generates new transaction revenues
• allows inter-bank, bank-mobile operator
  cooperation
• improves access to other home banking products
• leverages traditional banking processes and
  infrastructure

• Mobile operators
• increases transaction revenues
• opens new line of business, with related new
  revenue sources
• allows cooperation with banks and other mobile
  operators
• increases customer loyalty
• paves the way to new mobile services and
  applications
• branding

• Merchants
• increases collection security.
• increases the number of realized transactions
• opens E- and M-commerce to new clients
• cost savings

• Customers
• provides secure payment method in E- and
  M-commerce
• simplifies and accelerates payment transactions
• allows payments to a large number of persons,
  retailers, or businesses