Welcome!

Wearables Authors: Elizabeth White, Liz McMillan, Yeshim Deniz, Rostyslav Demush, Pat Romanski

Related Topics: Mobile IoT, Microservices Expo, Agile Computing, Wearables, Cloud Security

Mobile IoT: Article

Securing Mobile Payments

As the mobile payment industry continues to develop at lightning speed, best practices have yet to be solidified

As mobile phones become as indispensable as credit cards for purchasing goods and services, mobile payment developments are quickly gaining pace. Many different service providers are competing for their piece of the action. Within the last year, we have witnessed the arrival of mobile payment solutions such as MasterCard's PayPass, Google's Android-based eWallet scheme and Starbucks' emerging Quick Tap PayPass service.

A study from Juniper Research predicts that mobile contactless payment transactions are to reach nearly $50 billion worldwide in 2014 and NFC solutions will be used in 20 countries within the next 18 months.

However, with the widespread adoption of this technology, there is a need to debate which type of scheme works best and is the most robust.

Setting the Standard
As with traditional payments, standardization is vital. Several effective standards are already gaining momentum in delivering a secure mobile payments ecosystem:

  • Organizing Mobile NFC Services - The Trusted Service Manager (TSM) acts as an intermediary between Mobile Network Operators (MNOs) and third-party service providers that wish to offer additional services to subscribers. GlobalPlatform's ‘System Messaging Specification for Management of Mobile-NFC Services' defines the messaging between each of the three parties to guarantee secure ‘provisioning' of services to the device.
  • The SIM Alliance Open Mobile API - Applications utilizing the Secure Element (the cryptographically secured piece of hardware on newer mobile devices) to secure their critical operations, such as payments, banking or transport tickets, can have a component running within the device's operating system that ensures the user can securely interact with the keyboard/touch screen while enjoying a rich graphical user experience. The SIM Alliance Open Mobile API allows application developers to utilize additional security of the Secure Element more easily, be this in a UICC SIM, a dedicated Secure Element built into the device or a secure SD card, by providing a common means of interfacing with it.
  • Trusted Execution Environment (TEE) - The Secure Element cannot easily host apps with a highly developed or cutting edge user interface, but can look after critical data on the mobile handset. Applications that require complex user interactions must run on the device's primary processor. The TEE secures these apps; GlobalPlatform is leading the standardization and interoperability in this area to ensure that software and data are sufficiently protected. For example, payment apps that run their user interface in TEE and their transaction security in the Secure Element would have a particularly high level of security.

Such standards encourage the industry to work together and benchmark best practices, but they remain as fundamental elements of successful mobile payment security. It is also required that technology that makes the security of provisioning mobile payment applications is as safe as issuing cards, and designing the necessary infrastructure requires much needed consumer confidence.

Security Issues Prompt Consumer Fear
Consumer's perceived fear surrounding new mobile payments technology often looms around security. The lack in consumer confidence originates from the threat of information being intercepted during a transaction. Yet risks are prominent at every stage of the mobile payment life cycle, including how payment applications get onto a phone securely in the first place. Constructing the data needed to issue a payment application and generate the secure messages to personalize a handset can be a lengthy and inefficient process, and the various cryptographic functions pose the possibility that sensitive data is at risk of exposure.

This initial set-up process or ‘provisioning' usually takes place over-the-air (OTA). The process increases security risks due to the various parties involved - typically the payment application provider (usually a bank), a Trusted Service Manager, the Mobile Network Operator and the end user. A vital success factor is maintaining security throughout this procedure, ensuring that no data is compromised. Successful provisioning utilizes unique personalization keys to not only encrypt the loading of data onto a device, but also the succeeding transactions performed by the application.

Mobile Payment Security as Secure as Traditional Payment Cards
By implementing the newest cryptography methods, users can ensure that ‘provisioning' occurs securely with the same level of protection provided by traditional payment cards. Providers of physical cards tend to favor Hardware Security Modules (HSMs), which generate and secure the encryption keys crucial to managing issuance risk. This method is also relevant for provisioning services to a mobile phone and can significantly reduce the complexities associated with the process while simultaneously avoiding the weakness of keys stored in software. The primary benefit of an HSM is to secure encryption keys and sensitive data in a way that safeguards such data from exposure. With this method, service providers reduce risk.

While encryption is crucial to the security of mobile payments, it isn't the only answer. For a more comprehensive approach to optimize security, encryption and authentication must be combined to provide protection for data exchanges and authorizations.

Reducing Risk
As the mobile payment industry continues to develop at lightning speed, best practices have yet to be solidified. Operators and related parties are still unsure about who ultimately controls the mobile wallet. But one thing that is for sure is that security remains the primary hurdle most consumers can't get over.

Extinguishing this concern is no easy task; it requires a mixture of robust standards and best practices, accompanied with the right technical path to ensure the experience is safe from the second that a user opts to download a payment app. If businesses want to take advantage of the mobile payments, security needs to be at the forefront of their approach to mitigating risk and encourage comprehensive consumer adoption.

More Stories By Ian Hermon

Ian Hermon is Product Marketing Manager at Thales e-Security. He has more than 15 years’ experience in the payment industry, being responsible for the Thales portfolio of payment and transaction security products. He represents Thales on both the MasterCard Global Vendor Forum and Visa Europe Vendor Forum, is a member of the Smart Card Alliance Payments Council and the Smartex Smart Payments Forum Steering Committee. Ian also represents Thales as a participating organization on the PCI Security Standards Committee and is an EMV subscriber.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
Michael Maximilien, better known as max or Dr. Max, is a computer scientist with IBM. At IBM Research Triangle Park, he was a principal engineer for the worldwide industry point-of-sale standard: JavaPOS. At IBM Research, some highlights include pioneering research on semantic Web services, mashups, and cloud computing, and platform-as-a-service. He joined the IBM Cloud Labs in 2014 and works closely with Pivotal Inc., to help make the Cloud Found the best PaaS.
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, led attendees through the exciting evolution of the cloud. He looked at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering m...
DXWorldEXPO LLC announced today that All in Mobile, a mobile app development company from Poland, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. All In Mobile is a mobile app development company from Poland. Since 2014, they maintain passion for developing mobile applications for enterprises and startups worldwide.
DXWorldEXPO LLC announced today that ICC-USA, a computer systems integrator and server manufacturing company focused on developing products and product appliances, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City. ICC is a computer systems integrator and server manufacturing company focused on developing products and product appliances to meet a wide range of ...
Headquartered in Plainsboro, NJ, Synametrics Technologies has provided IT professionals and computer systems developers since 1997. Based on the success of their initial product offerings (WinSQL and DeltaCopy), the company continues to create and hone innovative products that help its customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business or per...
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use of real time applications accelerate, legacy networks are no longer able to architecturally support cloud adoption and deliver the performance and security required by highly distributed enterprises. These outdated solutions have become more costly and complicated to implement, install, manage, and maintain.SD-WAN offers unlimited capabilities for accessing the benefits of the cloud and Internet. ...
Founded in 2000, Chetu Inc. is a global provider of customized software development solutions and IT staff augmentation services for software technology providers. By providing clients with unparalleled niche technology expertise and industry experience, Chetu has become the premiere long-term, back-end software development partner for start-ups, SMBs, and Fortune 500 companies. Chetu is headquartered in Plantation, Florida, with thirteen offices throughout the U.S. and abroad.
Dion Hinchcliffe is an internationally recognized digital expert, bestselling book author, frequent keynote speaker, analyst, futurist, and transformation expert based in Washington, DC. He is currently Chief Strategy Officer at the industry-leading digital strategy and online community solutions firm, 7Summits.
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogge...
I think DevOps is now a rambunctious teenager - it's starting to get a mind of its own, wanting to get its own things but it still needs some adult supervision," explained Thomas Hooker, VP of marketing at CollabNet, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"MobiDev is a software development company and we do complex, custom software development for everybody from entrepreneurs to large enterprises," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Major trends and emerging technologies – from virtual reality and IoT, to Big Data and algorithms – are helping organizations innovate in the digital era. However, to create real business value, IT must think beyond the ‘what’ of digital transformation to the ‘how’ to harness emerging trends, innovation and disruption. Architecture is the key that underpins and ties all these efforts together. In the digital age, it’s important to invest in architecture, extend the enterprise footprint to the cl...
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, discussed the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
Two weeks ago (November 3-5), I attended the Cloud Expo Silicon Valley as a speaker, where I presented on the security and privacy due diligence requirements for cloud solutions. Cloud security is a topical issue for every CIO, CISO, and technology buyer. Decision-makers are always looking for insights on how to mitigate the security risks of implementing and using cloud solutions. Based on the presentation topics covered at the conference, as well as the general discussions heard between sessio...
IoT is rapidly becoming mainstream as more and more investments are made into the platforms and technology. As this movement continues to expand and gain momentum it creates a massive wall of noise that can be difficult to sift through. Unfortunately, this inevitably makes IoT less approachable for people to get started with and can hamper efforts to integrate this key technology into your own portfolio. There are so many connected products already in place today with many hundreds more on the h...
No hype cycles or predictions of zillions of things here. IoT is big. You get it. You know your business and have great ideas for a business transformation strategy. What comes next? Time to make it happen. In his session at @ThingsExpo, Jay Mason, Associate Partner at M&S Consulting, presented a step-by-step plan to develop your technology implementation strategy. He discussed the evaluation of communication standards and IoT messaging protocols, data analytics considerations, edge-to-cloud tec...
DXWorldEXPO LLC announced today that the upcoming DXWorldEXPO | CloudEXPO New York event will feature 10 companies from Poland to participate at the "Poland Digital Transformation Pavilion" on November 12-13, 2018.
Digital Transformation is much more than a buzzword. The radical shift to digital mechanisms for almost every process is evident across all industries and verticals. This is often especially true in financial services, where the legacy environment is many times unable to keep up with the rapidly shifting demands of the consumer. The constant pressure to provide complete, omnichannel delivery of customer-facing solutions to meet both regulatory and customer demands is putting enormous pressure on...
CloudEXPO | DXWorldEXPO are the world's most influential, independent events where Cloud Computing was coined and where technology buyers and vendors meet to experience and discuss the big picture of Digital Transformation and all of the strategies, tactics, and tools they need to realize their goals. Sponsors of DXWorldEXPO | CloudEXPO benefit from unmatched branding, profile building and lead generation opportunities.
The best way to leverage your CloudEXPO | DXWorldEXPO presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering CloudEXPO | DXWorldEXPO will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at CloudEXPO. Product announcements during our show provide your company with the most reach through our targeted audienc...