Technical feasibility of context-aware passive payment authorization for physical points of sale

Abstract

In this work, the technical feasibility of passive secure payments for brick-and-mortar points of sale is analyzed. The core element of the proposed approach is a new application for context-based risk and trust assessment. It allows for dynamic selection of payment authorization methods that constitutes accurate trade-off between security and convenience. Particularly, the payments can be performed and authorized in the background using biometric means (face recognition), without user's explicit action. Generally, in the proposed approach, multiple devices are used for authorization: mobile, wearables, or stationary, client's or seller's, and multiple authorization methods are used: biometric, knowledge-based, and possession-based. The reported research includes requirement identification, novel architecture and protocol proposition, proof-of-concept prototype system deployment, and evaluation-based lessons learned. The research confirms that with the proposed approach, it is possible to take advantage of client-seller trust dynamism to simplify the payment process while maintaining the security level.

RLAuth: A Risk-Based Authentication System Using Reinforcement Learning

“…The authors of [7] proposed a risk engine based on fuzzy logic applicable to energy management tasks in smart homes. In [15], a system is proposed to dynamically choose the appropriate authenticator for the authorization process of payment at the point of service (POS) based on a predefined set of rules. While these systems show that risk-based authentication systems are usable in real-life applications, they are not transferable to other domains because the proposed risk engines are too intertwined with their respective application domain.…”

A study of risk-based authentication system in cyber security using machine learning

“…The single-factor authentication is not dependable and is relatively simple to get around. Although there have been recent in-depth investigations of password substitutes, no work has yet given a comprehensive assessment of the combined usage of several authentication or testimony procedures inside adaptive systems [8]. In the set of traits chosen for recognizing a person's fingerprint based on the context, there are variables that are used for comparison in adjusting behavior.…”