1. Apple Pay Research on NFC and the security threat

2. Hello!
Dennis Ho
Asher Kam

3. In the recent year, as the number of user in using Apple Pay to make transaction is increasing and more widely acceptance by Hong Kong

4. Introduction Architecture of Apple Pay
Background of Near Field Communication (NFC)
Background of Apple Pay
Security threat of the NFC mobile payment
Potential security Issue on using (RFID)
Others main security problem
Apple Pay solution on these threats
How Apple Inc tackle the potential risk

5. 1a. Architecture Of Apple Pay
Background of Near field communication (NFC)

6. Background Of NFC Based on radio-frequency identification(RFID)
Wireless connection within 10cm distance
More communication modes are added in. The most updated protocol now currently used is ISO/IEC 21481:2012

7. Steps On Using NFC Placing the user’s phone at the payment terminal
Hold the phone from the distance not exceeding 10 cm and wait for the transaction to complete
Transaction will be complete after certain approval time by the device 


8. 1b. Architecture Of Apple Pay
Background of Apple Pay

9. Background Of Apple Pay
A type of mobile wallets
Perform on IOS perform.
The main purpose of the above are to replace the traditional credit card with mobile phone so that user can use mobile phone NFC function to pay without showing a real credit card. 


10. Five Main Components To Conduct The Apple Pay System
Secure element
NFC controller
Wallet
Secure enclave
Apple pay servers

11. Card Enrolment Part

12. Card Enrolment Part

13. Payment Authorization Part

14. Payment Authorization Part

15. Potential risk of using NFC
2a. Security Threats
Potential risk of using NFC

16. Security Issue On Using (RFID)
Eavesdropping
Signal can be collected with antenna or some equipment.
Data Corruption
A misleading signal is sent to the mobile device and the receiver.
Data Modification
Destory the original signal and send a new modified signal to the mobile device and the receiver.

17. Others Main Security Problem
Lost or stolen mobile device
NFC system cannot detect any device is a lost or stolen device.
Interference of servers and cloud service
During the transmission of cardholder data from the mobile device to the server terminal, compromise of data might be conducted.
DDos attack

18. 3. How Apple Does On Facing The Above Threats
A complex solution will be listed and explained

19. Solution On The Threats
The isolation design of secure element
Find my iPhone setting
Insensitive information
Record in Apple Server

20. Thanks!
Any questions?
Q&A