A Novel NFC-Based Secure Protocol for Merchant Transactions

Abstract

The unprecedented growth of mobile applications promoted the usage of these mobile applications for payments. The current research works in mobile payments and commerce are prone to reverse-engineering attacks and lacked transport layer protection, so these research works do not ensure security. Therefore, such attacks on Mobile Payment Applications (MPA) will be successful, which leads to severe financial loss. To address these issues, we propose a secure framework incorporating a defense-in-depth approach for Near Field Communication (NFC) based mobile payment frameworks. Our defense-in-depth approach has three levels, i.e., Defense at hardware, mobile application, and communication level. We have proposed a NFC based Secure Protocol for Mobile Transaction (NSPMT) protocol and successfully verified a mobile payment protocol with BAN (Burrows, Abadi, and Needham) logic and Scyther tool, and our proposed protocol overcome multi-protocol attack, RAM (Random Access Memory) scrapping attack, DOS (Denial Of Service), DDOS (Distributed Denial Of Service), and Phlashing attacks. Our proposed mobile Payment system overcomes the known mobile application vulnerabilities, including Heartbleed and ROBOT (Return Of Bleichenbacher's Oracle Threat). We also show that our proposed protocol's energy consumption, communication cost, and computation cost are far less than the existing works in this realm. Our proposed protocol ensures all the security properties. Finally, we have successfully implemented our protocol using Kotlin language in Android Studio, with two MPA's and POS Payment Application (PPA), Elliptic Curve Digital Signature Algorithm (ECDSA) is used in generating and verifying digital signatures and Advanced Encryption Standard (AES) with GCM (Galois/Counter Mode) mode is used for encryption and decryption of Customer Payment Data at MPA and PPA.

An introduction of transaction session‐induced security scheme using blockchain technology: Understanding the features of Internet of Things–based financial security systems

“…In the next subsection, the comparative analysis for the TS3-BT is discussed with suitable illustrations for prediction, transaction success rate, session failure, transaction failure, and time complexity. RONFC (Turk et al, 2019), DCAP (Lin et al, 2020), and NSPMT (Ahamad, 2021) are used alongside the proposed TS3-BT in the comparisons.…”

VTAIM: Volatile Transaction Authentication Insurance Method for Cyber Security Risk Insurance of Banking Services

“…Ahamad et al [16] introduced a new near-field communication (NFC) based secure protocol for smart mobile transaction systems. NFC consists of three-layer that form a proper application for the transaction process.…”

“…From the above discussion, the authentication methods proposed rely on additional functions as in [28] or demanding protocols as in [16]. This increases the complexity and better adaptability other than indepdnent validations.…”

“…The methods in the above table are expanded as Secure Mutual Authentication Protocol based on Universal 2 nd Factor (SMAP-U2F) [28], Multi-Server Authentication Scheme (MSAS) [21], and Near Field Communication-based Secure Protocol for Mobile Transaction (NSPMT) [16].…”

Privacy-Preserving NFC-Based Authentication Protocol for Mobile Payment System

“…A public key cryptography-based NFC mobile payment mechanism was presented by the authors of [21]. In [23], the authors proposed a Secure Protocol for Mobile Transaction (NSPMT) protocol based on NFC that included a Defense in Depth approach. Their Defensein-depth approach consisted of three levels: defense at the hardware level, defense at the application level, and defense at the communication level.…”