A security mechanism to increase confidence in m-transactions

Abstract

International audienceCurrently, NFC phones are coming in the handheld market, providing facilities to perform m-transactions. Obviously, this type of operation requires special security precautions. Indeed, a malicious code could intercept and hijack the system, even if there is a smart card. For example, the amount of the payment displayed in the terminal can be hijacked by an attacker to fool the user, or user's credential can be stolen thanks to a keylogger (and thus malicious codes can perform unwanted m-transactions automatically). This paper describes a security mechanism based on a graphical Turing test to prevent m-transactions submission by malwares. Firstly it introduces current m-transactions solutions. Then it explains the security mechanism that we propose to tackle the problem of untrusted handheld devices. It also underlines a proof of concept we implemented, to test its feasibility on a SIM card. Finally, it gives information on performances corresponding to the implementation that we made

Invisible CAPPCHA: A usable mechanism to distinguish between malware and humans on the mobile IoT

“…Yeh et al [18] introduced a mobile user authentication system in cloud environments that uses CAPTCHA to protect cloud servers against malicious registrations and logins. Pequegnot et al [19] suggested to use CAPTCHA to improve the security of PIN codes on mobile devices against automated attacks. Recently, Althamary el al.…”

Color Channel CAPTCHA: A Secure Scheme for Cloud Environment

“…Pequegnot et al [11] insisted to use CAPTCHA to enhance the security of PIN codes against automated attacks in mobile devices. To improve the protection of passwords against various attacks Althamary et al [12] proposed a CAPTCHA based authentication in the cloud environment.…”

Completely Automated Public Physical test to tell Computers and Humans Apart: A usability study on mobile devices

“…Thus, it requires the selection of some elements in the grid, instead of traditional textual CAPTCHAs that requires inputting a string of characters using the mobile keyboard, which results to be challenging. Despite showing some advantages, this scheme has Pequegnot et al [11] proposed an authentication mechanism based on graphical Turing test to increase the confidence in mobile transactions. Their mechanism consists of typing a secure code of three-digit displayed in a CAPTCHA, in addition to the four-PIN digits.…”

“…As stated above, we also assume that the sensitive application is running in a TEE or a SE, and is protected with a common PIN code. Despite the strong isolation provided by TEE and SE to protect sensitive applications, the malicious code running in Android OS can steal the user's PIN code (see e.g., [32,33,34,35]) and replay this PIN in the next authentication session to execute unwanted transactions without the user's consent [11]. , most of the current applications running on mobile devices still use PIN codes to authenticate the user that aims to access sensitive services/data or to perform security-critical transactions.…”