Formal Verification of a Secure Mobile Banking Protocol

Ngo, Harry Huy Hoang; Dandash, O.; Le, Phu Dung; Srinivasan, Balasubramaniam; Wilson, Campbell

doi:10.1007/978-3-642-17878-8_42

Cited by 10 publications

(6 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This approach requires a session key generation and distribution between participating entities, on the basis of the mobile operator only. Ngo et al 22 developed a framework for formal verification of secure mobile banking protocol that encompasses on advanced authentication mechanism to provide strong authentication schemes. But, the integration of smart card and biometric feature requires more operations between the client and the bank.…”

Section: Related Workmentioning

confidence: 99%

“…We compare our proposed work with the existing solutions, in previous studies [12][13][14][15][16][17][18][20][21][22] and Johnny et al, 46 for attacks resilience. We mentioned some of the attacks in the previous subsection, regarding the most well-known attacks such as replay, node capture, man-in-the-middle, impersonation, SQL-injection, which cover parts of the attacks resilient summary in Table 5 shown security features supported by our scheme and other schemes.…”

Section: Performance Analysismentioning

confidence: 99%

See 1 more Smart Citation

A secure end‐to‐end SMS‐based mobile banking protocol

Bojjagani

Sastry

2017

Int J Communication

View full text Add to dashboard Cite

Short message service (SMS) provides a wide channel of communication for banking in mobile commerce and mobile payment. The transmission of SMS is not secure in the network using global system for mobile communications or general packet radio service. Security threats in SMS restricted the use of SMS in mobile banking within certain limits. This paper proposed a model to address the security of SMS using elliptic curve cryptography. The proposed model provides end-to-end SMS communication between the customer and the bank through the mobile application. The main objective of the proposed model is to design and develop a security framework for SMS banking. Further, the protocol is verified for its correctness and security properties because most of the protocols are not having the facility to be verified by using the formal methods. Our proposed framework is experimentally validated by formal methods using model checking tool called automated validation of internet security protocols and Scyther tools. Security analysis shows that the proposed mechanism works better compared to existing SMS payment protocols for real-world applications.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Performance Analysismentioning

confidence: 99%

A secure end‐to‐end SMS‐based mobile banking protocol

Bojjagani

Sastry

2017

Int J Communication

View full text Add to dashboard Cite

show abstract

“…In addition to these existing mobile payment protocols adopt WPKI for ensuring non repudiation property. Protocols proposed in the realm of M obile Payments [1][2][3][4][5][6][7][8] were formally verified using manual verification methods like BAN logic and SVO Logic but not with Automated Tools like Scyther [11] and AVISPA [12]. were successfully verified using AVISPA and Scyther Tools.…”

Section: Related Workmentioning

confidence: 99%

“…In the existing mobile payments solutions [1][2][3][4][5][6][7] client"s credentials are generated and stored in the in the memory of mobile phone and could be infected by viruses or can be maliciously replaced, does not ensure secure and reliable communication security, does not ensure end to end security in the application layer. In addition to these existing mobile payment protocols adopt WPKI for ensuring non repudiation property.…”

Section: Related Workmentioning

confidence: 99%

“…Implementation of WPKI on mobile phones raises serious concerns such as secret keys stored in the memory of M obile Phone could be infected by viruses or can be maliciously replaced. Existing M obile Payments solutions [1][2][3][4][5][6][7] adopt WPKI which is implemented in the memory of M obile Phone. Implementing WPKI in M obile Phones is not an easy task because of the fundamental limitation of performance such as less memory and less powerful CPU.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A secure and optimized mobile payment framework with formal verification

Ahamad

Sastry

Udgata

2012

Proceedings of the First International Conference on Security of Internet of Things

View full text Add to dashboard Cite

In this paper we propose a Secure and Optimized M obile Payment Framework based on Universal Integrated Circuit Card (UICC) (a) which summarizes a mobile payment in relation to several different participants, (b) a procedure of personalizing UICC by the client c) a procedure of provisioning and personalization (M utual Authentication, Key Agreement Protocol & a procedure for ensuring non repudiation without adopting WPKI) of M obile Payments Application (which is on UICC) by the Bank d) a mobile payment protocol is proposed between the personalized M obile Payment Application on UICC and the Bank Server which ensures all the security properties. All the proposed protocols have been successfully verified using AVISPA and Scyther Tools.

show abstract