12-04-2012, 11:34 AM
Overview of Micropayment Technology
[attachment=19964]
Abstract
Payment System is a system to supports transfer of funds between two parties. It can be defined as a set of rules, protocols to complete a transaction. There are number of payment systems available for a consumer to pay for the services/goods, but all these payment systems can be divided into two main types, traditional payment system and electronic payment system. But these systems have their own limitations, which are mostly related to very small payments. To overcome these limitations new payment system known as micropayment system is proposed. It is not as that this payment system can‘t be used for large payments but the system is designed in such a way to provide convenience to users and that too at fast speed. Radio Frequency Identification (RFID) technology is used in these systems. Few RFID based systems are already in use the most common example is electronic toll tax system, in some countries it is used in public transport system for ticketing, and etc. RFID system consists of three main components RFID tag/card, RFID reader and middleware. RFID is a powerful emerging technology it offers number of advantages but has some drawbacks too. Exploiting these weaknesses different groups have successfully attempted to hack these systems. There are number of issues that authorities need to considered, before deploying payment system based on this technology. The aim of this work is to provide an overview of RFID as a technology to be used in future payment systems. This project starts with the study of basic payment systems, followed by study of current micropayment system in use at various locations in different applications. In recent time successful attacks have been launched against vulnerabilities of this technology, these attacks have been analyzed and studied in detail to get the ideas for building new systems in future. The outcome of this work is the deep understanding of RFID as a technology to be used in payment systems, discussing its main strengths and vulnerabilities.
3 | Final Report
Acknowledgement
Thanks to Josef Pieprzyk for his guidance and support, and Robert Dale for useful feedback on this work. And also I would like to express my gratitude to all those who gave me the possibility to complete this report.
1 Introduction
Payment systems are systems used to settle financial transactions. Currently there are two payment systems in use traditional (that deals mainly with cash) and electronic payment system (that deals with all digital transactions). Micropayment system is considered different as it uses different mechanism for authentication and authorization of a transaction.
1.1 Payment Systems
Payment systems are one of the fundamental pillars of modern economies and it can be defined as a collection of technologies, laws, protocols, and customs that make it possible for people and companies to pay money to each other (Kniberg, 2002). All payment systems have definite characteristics and qualities and they find their application in various systems on the basis of these qualities and characteristics. Payment systems currently in use can be divided into mainly two types.
Traditional Payment System
Electronic Payment System
Traditional Payment System
The traditional payment systems cover all the payments which are made using cash and paper documents such as bank checks, drafts and money orders. This is the most convenient mode of payment. The main advantage of using cash is that it doesn‘t need any authentication from external party and secondly it provides anonymity as there are very less details of cash payments in general. So why don‘t we just stick to cash? The fundamental problem with cash is that two parties can‘t exchange money without meeting, third party can be involved but it slows down process. Another problem with cash is that a currency has a fixed set of denominations, which makes it difficult to handle extremely large or extremely small transactions. There is nothing wrong with cash other than the fact that there are occasions when people don't have any and have to rush off to find an ATM, or there are occasion when you need the exact change and you have nothing but notes. Or there may be times when you have too much change and your pockets are bulging with the inconvenience of it (Juniper, N. D.). Examples of traditional payment system are all the businesses supporting cash.
Electronic Payment System
A payment system, in which the transactions take place digitally – usually through network connection, can be defined as an electronic payment system (Jari Kytojoki, 2000). An electronic payment system covers all card based payments, internet based transactions, and payments made through mobiles. In the transactions
6 | Final Report
made by card the main task of electronic payment systems is to authenticate the user requesting for transaction using some mechanism (PIN number or Signature) that it is the legitimate user and authorization for the transaction on the basis of checking his account. This authentication and authorization is done by the card issuing or service providing authority. Whereas in mobile payments, authentication is not required as the SIM card issued by the operator is used for this authentication and authorization is either made by sending message on special number or by making a call on special number. On internet authentication is done on the basis of the information feed by user on computer, and authorization is done on the basis of that information. All these systems have been developed by thinking of macro-payments considering high security.
Transactions made by cards have to pay some transaction cost (fixed and percentage) which depends upon the merchant, therefore some merchant support very low amount to be paid by card and some don‘t. The cards (magnetic stripe/optical memory) are the main source of payments in electronic payment system. Although these cards are widely used, but they posses some limitations, first the technology used in this system is too slow it takes around 1-2 seconds to process one magnetic stripe card1, and the authentication and authorization for transaction involves the issuing authority, which adds up extra delay. The payments made by mobile and internet also support only some specific types of payments, and moreover are dependent on cards. Therefore they can‘t be considered as an alternative to current electronic payment system. Example, all the major businesses support card payments.
Micropayment Systems
Micropayment systems also fall in the category of electronic payment systems, but these are considered different from the normally used cards & systems due to following reasons.
The technique used in this system is RFID, in which card needs to be in proximity of reader to complete the transaction.
It is faster than all the techniques used.
Authentication and authorization is done on the spot, without contacting main server. But, not in all cases, there are few exceptions.
It is mainly pre-paid based system (User need to reload2).
Example of this payment system is electronic toll collection system, E-tags. (Kniberg, 2002) in his work on micropayment systems, revealed the main characteristics that system should posses to be successful in micropayments. Following should be taken in account by authorities while designing micropayment sys-tem. Important characteristics
1 http://www.card-readeridscan_magnetic.htm
2 http://www.octopuscardsconsumer/payment/.../index.jsp
7 | Final Report
Ease of joining: It should be easy to join as user could be scared away if the payment system is too complex.
Ease of use: Systems should be easy to use and load/reload otherwise it won‘t be successful.
Pervasiveness: It is not worth joining a new payment system just to make one single payment; it is only worth it if the same system can be used in many different situations.
Fixed transaction cost: The transaction cost shouldn‘t be there as the payment is so low, in some cases it may be more than the amount to be transferred.
Transaction speed: Most people make small payments relatively often as compared to large payments. Delay in payment system transactions would add up more problems.
Security: System should be able to provide at least basic level security.
1.2 Technologies In Use In Payment Systems
In electronic payment system numbers of technologies are in, these technologies have different characteristics which decide their use in various systems. Despite the very advantages and benefits, RFID create security issues unique to it.
Magnetic Stripe Cards
Magnetic Stripe Cards are in use from a while, in these cards there is a magnetic stripe which stores information. These cards are read by physical contact while swiping past a reading head. These magnetic stripes allows to edit or new data onto them. These can be programmed to be used with some authentication mechanism or even without it (Halliday, 1997).
Optical Memory Cards
Optical memory cards use a technology similar to the one used for music CDs or CDROM‘s. A panel of the ―gold colored‖ laser sensitive material is laminated in the card and is used to store information. The material is comprised of several layers that react when a laser light is directed at them. The laser burns a tiny hole in the material which can be sensed by a low power laser during the read cycle (Halliday, 1997).
RFID Cards
Radio Frequency Identification Cards also known as contactless cards, these cards consists of an antenna and integrated circuit. Antenna is used for transmitting and receiving signals and integrated circuit is for storing and processing information, modulating and demodulating a radio frequency signal. These are generally of two types; active which contain a battery and thus can transmit its signal autonomously, and passive which have no battery and require an external source to
8 | Final Report
initiate signal transmission. (Halliday, 1997); (Curtin J., 2007); (Feldhofer M., 2004).
Smart Cards
These cards have an embedded micro-chip in them; they differ from magnetic stripe cards in mainly two ways: the amount of information that can be stored is much greater, and some of them can be reprogrammed to add, delete or rearrange data. There are two types of smart cards. The first is a just a memory card, these are used to store information. The second type of card is a true ―smart‖ card where a microprocessor is embedded in the card along with memory. This card has the ability to make decision about the information stored on it (Halliday, 1997).
[attachment=19964]
Abstract
Payment System is a system to supports transfer of funds between two parties. It can be defined as a set of rules, protocols to complete a transaction. There are number of payment systems available for a consumer to pay for the services/goods, but all these payment systems can be divided into two main types, traditional payment system and electronic payment system. But these systems have their own limitations, which are mostly related to very small payments. To overcome these limitations new payment system known as micropayment system is proposed. It is not as that this payment system can‘t be used for large payments but the system is designed in such a way to provide convenience to users and that too at fast speed. Radio Frequency Identification (RFID) technology is used in these systems. Few RFID based systems are already in use the most common example is electronic toll tax system, in some countries it is used in public transport system for ticketing, and etc. RFID system consists of three main components RFID tag/card, RFID reader and middleware. RFID is a powerful emerging technology it offers number of advantages but has some drawbacks too. Exploiting these weaknesses different groups have successfully attempted to hack these systems. There are number of issues that authorities need to considered, before deploying payment system based on this technology. The aim of this work is to provide an overview of RFID as a technology to be used in future payment systems. This project starts with the study of basic payment systems, followed by study of current micropayment system in use at various locations in different applications. In recent time successful attacks have been launched against vulnerabilities of this technology, these attacks have been analyzed and studied in detail to get the ideas for building new systems in future. The outcome of this work is the deep understanding of RFID as a technology to be used in payment systems, discussing its main strengths and vulnerabilities.
3 | Final Report
Acknowledgement
Thanks to Josef Pieprzyk for his guidance and support, and Robert Dale for useful feedback on this work. And also I would like to express my gratitude to all those who gave me the possibility to complete this report.
1 Introduction
Payment systems are systems used to settle financial transactions. Currently there are two payment systems in use traditional (that deals mainly with cash) and electronic payment system (that deals with all digital transactions). Micropayment system is considered different as it uses different mechanism for authentication and authorization of a transaction.
1.1 Payment Systems
Payment systems are one of the fundamental pillars of modern economies and it can be defined as a collection of technologies, laws, protocols, and customs that make it possible for people and companies to pay money to each other (Kniberg, 2002). All payment systems have definite characteristics and qualities and they find their application in various systems on the basis of these qualities and characteristics. Payment systems currently in use can be divided into mainly two types.
Traditional Payment System
Electronic Payment System
Traditional Payment System
The traditional payment systems cover all the payments which are made using cash and paper documents such as bank checks, drafts and money orders. This is the most convenient mode of payment. The main advantage of using cash is that it doesn‘t need any authentication from external party and secondly it provides anonymity as there are very less details of cash payments in general. So why don‘t we just stick to cash? The fundamental problem with cash is that two parties can‘t exchange money without meeting, third party can be involved but it slows down process. Another problem with cash is that a currency has a fixed set of denominations, which makes it difficult to handle extremely large or extremely small transactions. There is nothing wrong with cash other than the fact that there are occasions when people don't have any and have to rush off to find an ATM, or there are occasion when you need the exact change and you have nothing but notes. Or there may be times when you have too much change and your pockets are bulging with the inconvenience of it (Juniper, N. D.). Examples of traditional payment system are all the businesses supporting cash.
Electronic Payment System
A payment system, in which the transactions take place digitally – usually through network connection, can be defined as an electronic payment system (Jari Kytojoki, 2000). An electronic payment system covers all card based payments, internet based transactions, and payments made through mobiles. In the transactions
6 | Final Report
made by card the main task of electronic payment systems is to authenticate the user requesting for transaction using some mechanism (PIN number or Signature) that it is the legitimate user and authorization for the transaction on the basis of checking his account. This authentication and authorization is done by the card issuing or service providing authority. Whereas in mobile payments, authentication is not required as the SIM card issued by the operator is used for this authentication and authorization is either made by sending message on special number or by making a call on special number. On internet authentication is done on the basis of the information feed by user on computer, and authorization is done on the basis of that information. All these systems have been developed by thinking of macro-payments considering high security.
Transactions made by cards have to pay some transaction cost (fixed and percentage) which depends upon the merchant, therefore some merchant support very low amount to be paid by card and some don‘t. The cards (magnetic stripe/optical memory) are the main source of payments in electronic payment system. Although these cards are widely used, but they posses some limitations, first the technology used in this system is too slow it takes around 1-2 seconds to process one magnetic stripe card1, and the authentication and authorization for transaction involves the issuing authority, which adds up extra delay. The payments made by mobile and internet also support only some specific types of payments, and moreover are dependent on cards. Therefore they can‘t be considered as an alternative to current electronic payment system. Example, all the major businesses support card payments.
Micropayment Systems
Micropayment systems also fall in the category of electronic payment systems, but these are considered different from the normally used cards & systems due to following reasons.
The technique used in this system is RFID, in which card needs to be in proximity of reader to complete the transaction.
It is faster than all the techniques used.
Authentication and authorization is done on the spot, without contacting main server. But, not in all cases, there are few exceptions.
It is mainly pre-paid based system (User need to reload2).
Example of this payment system is electronic toll collection system, E-tags. (Kniberg, 2002) in his work on micropayment systems, revealed the main characteristics that system should posses to be successful in micropayments. Following should be taken in account by authorities while designing micropayment sys-tem. Important characteristics
1 http://www.card-readeridscan_magnetic.htm
2 http://www.octopuscardsconsumer/payment/.../index.jsp
7 | Final Report
Ease of joining: It should be easy to join as user could be scared away if the payment system is too complex.
Ease of use: Systems should be easy to use and load/reload otherwise it won‘t be successful.
Pervasiveness: It is not worth joining a new payment system just to make one single payment; it is only worth it if the same system can be used in many different situations.
Fixed transaction cost: The transaction cost shouldn‘t be there as the payment is so low, in some cases it may be more than the amount to be transferred.
Transaction speed: Most people make small payments relatively often as compared to large payments. Delay in payment system transactions would add up more problems.
Security: System should be able to provide at least basic level security.
1.2 Technologies In Use In Payment Systems
In electronic payment system numbers of technologies are in, these technologies have different characteristics which decide their use in various systems. Despite the very advantages and benefits, RFID create security issues unique to it.
Magnetic Stripe Cards
Magnetic Stripe Cards are in use from a while, in these cards there is a magnetic stripe which stores information. These cards are read by physical contact while swiping past a reading head. These magnetic stripes allows to edit or new data onto them. These can be programmed to be used with some authentication mechanism or even without it (Halliday, 1997).
Optical Memory Cards
Optical memory cards use a technology similar to the one used for music CDs or CDROM‘s. A panel of the ―gold colored‖ laser sensitive material is laminated in the card and is used to store information. The material is comprised of several layers that react when a laser light is directed at them. The laser burns a tiny hole in the material which can be sensed by a low power laser during the read cycle (Halliday, 1997).
RFID Cards
Radio Frequency Identification Cards also known as contactless cards, these cards consists of an antenna and integrated circuit. Antenna is used for transmitting and receiving signals and integrated circuit is for storing and processing information, modulating and demodulating a radio frequency signal. These are generally of two types; active which contain a battery and thus can transmit its signal autonomously, and passive which have no battery and require an external source to
8 | Final Report
initiate signal transmission. (Halliday, 1997); (Curtin J., 2007); (Feldhofer M., 2004).
Smart Cards
These cards have an embedded micro-chip in them; they differ from magnetic stripe cards in mainly two ways: the amount of information that can be stored is much greater, and some of them can be reprogrammed to add, delete or rearrange data. There are two types of smart cards. The first is a just a memory card, these are used to store information. The second type of card is a true ―smart‖ card where a microprocessor is embedded in the card along with memory. This card has the ability to make decision about the information stored on it (Halliday, 1997).