1. Technology Challenges in Mobile Payments
Dr.V.N.Sastry
Professor, IDRBT &
Executive Secretary, MPFI
Road No.1, Castle Hills, Masab Tank, Hyderabad
Ph:
Test : (M) & MMID :
January 30, at IDRBT for the EDP

2. Outline Mobile Payment Technologies Technology Challenges
Some innovative developments
March 29, 2012

3. Classification of Mobile Payments
Based on the validation of the tokens exchanged
Based on Value
Based on Location
Based on Charging method
Micro
Payments
Remote
Payments
Post-paid
Online
Payments
Mini
Payments
Pre-paid
Proximity
Payments
Offline
Payments (ex: e-coins in P2P transfers)
Macro
Payments
March 29, 2012

4. Enabling Mobile Technologies
Transport
Security enablers
Platforms
User Interface
Voice
SIM
Long-range
Short-range
SAT
SMS
WPKI/WIM
Java ME
Infrared
GSM
USSD
Bluetooth
GPRS
Dual slot phones
WAP
Java Card
RFID 3G
NFC 4G
March 29, 2012

5. Technology Challenges
Device Level
Application Level
Communication Level
User Level
Security Level
Standards Level
Consolidation Level
March 29, 2012

6. Device Level Challenges
Variation in Features and Functionalities, look and feel, text size, recharging frequency, OS
User Awareness and Education
Voice, Data, MMS, interactivity, real time response, location aided feature etc. properly used ?
March 29, 2012

7. Mobile Application Level Challenges
Is the Mobile Payment Application Developed in Conformance to standards ? Is it interoperable ?
On which folder client application is to be downloaded ? how to install and run a mobile payment application ?
Is the design optimized for execution in limited phone memory?
Has it been Tested and certified by Trusted entity ?
Can the customer wait for the delay to get it for his/her new model ?
March 29, 2012

8. Communication Level Challenges
Which channel to use : SMS, USSD, GPRS, DTMF ?
What way mobile banking convenience is enhanced by 2G, 3G, 4G ?
When and how to use Wireless Communication Technologies : Bluetooth, Zigbee, Wi-max, Wi-fi , LTE ?
March 29, 2012

9. Mobile Communication Architecture
Mobile Stations
Base Station Subsystem
Network Management
Subscriber and terminal equipment databases
BTS
OMC
Exchange System
VLR
MSC
BSC
HLR
AUC
BTS
EIR
March 29, 2012

10. Interbank Mobile Payment Service (IMPS)
Settlement
(CCIL)
Switching
(NPCI)
Bank - A
Bank -B
Interbank Mobile Payment Service (IMPS)
Payer-X
Payee- Y
March 29, 2012

11. User Level Challenges Local language support on Mobiles
Generation of Transaction report
Mobile Application on Phone memory or SIM or memory card ?
Trace of transaction data or critical personal data : access by others
Mobile Wallet : risk of multiple cards in the device and value offload for cash exchange in local currency
Mobile based Financial Inclusion services
Complaint registration and Grievance resolution
March 29, 2012

12. Mobile based Financial Inclusion and
Biometric
Authentication
( UIDAI )
Settlement
(CCIL)
Switching
(NPCI)
Bank A
Bank B
Mobile based Financial Inclusion and
Mobile Wallet
BC Micro ATM
ATM /
Merchant PoS
Customer
March 29, 2012

13. Security Challenges Authentication
User, Device, Application, Transaction
Direct, Indirect
Factors : You Know (UK), You Have (UH), You Are (UR)
One Way from source (S) to destination (D)
Mutual between source, destination or intermediate entities as Telco , Mobile Payment Provider, Bank Server, Switching agency.
Encryption & Decryption Using Cryptoghaphy
Symmetric key ( Password, m-Pin )
Asymmetric key (PKI , WPKI )
Layers of OSI Model
Access Control Models
Between Source (S) and Destination (D)
MPP to Bank : SSL / TCP
Bank to NPCI : SSL/TCP
March 29, 2012

14. Major 3 Sections of a Mobile Phone
Power Section
Power distribution
Charging section
Radio Section
Band Switching
RF Power Amplification
Transmitter
Receiver
Computer Section
CPU (central processing unit)
Memory (RAM,FLASH,COMBO CHIP)
March 29, 2012

15. Some reported attacks on Mobile Phones
Phishing
Botnet
Fake Player
Trojan horse
Bluejacking (Symbian )
BlueBug
BlueSnarfing
BluePrinting
Cabir (First in )
Comwar
Skulls
Windows CE virus
March 29, 2012

16. Mobile Station Mobile Equipment (ME) is identified by
International Mobile Equipment Identity (IMEI) Number
Subscriber Identity Module (SIM) Card has keys, identifiers and algorithms
Identifiers
Ki – Subscriber Authentication Key
IMSI – International Mobile Subscriber Identity
TMSI – Temporary Mobile Subscriber Identity
MSISDN – Mobile Station International Service Digital Network
PIN – Personal Identity Number protecting a SIM
LAI – location area identity
STK ( SIM Application Toolkit) allows applications in the SIM to interact with any ME
ETSI GSM standard defines the interface between the SIM and the interoperable ME .
March 29, 2012

17. SIM Card
Mobile Payment Application can be installed on either ME or SIM .
The application burnt on the SIM card gives by far the most secure application environment. The mobile application can be stored on its own security domain and hence prevented from others having access to it.
 Forensic tools and procedures exist that can be used to bypass built-in security mechanisms and recover the contents of a device.
Both software and hardware-based methods are available for data recovery, including those that exploit existing vulnerabilities.
A number of GSM mobile phones allow acquisition with a forensic tool, if a PIN-enabled (U)SIM is missing or removed from the device. It is also possible to create substitute (U)SIMs for certain models of phones that fools them into treating the (U)SIM as the original, and allowing access.
March 29, 2012

18. Security at Mobile Channel Level
Voice Channel : DTMF for IVRS
Text Channel : SMS, USSD
MMS Channel : GPRS
GSM Security Mechanisms
Equipment Identity Register (EIR)
Black list – stolen or non-type mobiles
White list - valid mobiles
Gray list – local tracking mobiles
Central Equipment Identity Register (CEIR)
Approved mobile type (type approval authorities)
Consolidated black list (posted by operators)
March 29, 2012

19. Security at Mobile Application level
Client Application developed by the Mobile Payment Provider (MPP)
Server Application of the MPP at the Bank level
Security Testing
Key Generation and storage process
Check Sum implemented
Reaching to the destined address only ?
March 29, 2012

20. Multiple Standard Challenges
ISO Standards
IEEE Standards
PCI DSS Standards
Regulatory Standards
Global platform Standards
EMV Standards
NIST Standards
SFMS, SWIFT Standards
NFC Standards
March 29, 2012

21. Mobile ad hoc network technologies
Technology Standard
Theoretical Bit Rate
Frequency
Range
Power Consumption
IEEE b
1,2,5.5, 11 Mbits/s
2.4 GHz
100m-500m
30mW
IEEE g
Upto 54 Mbits/s
25-50m
79mW
IEEE a
5 GHz
40m
250mW
Bluetooth
IEEE
1 Mbits/s
10 m-100m
1mW
UWB (IEEE )
Mbit/s
10 GHz
10m
200 mW
Hiper LAN2
150m
IrDA
4Mbits
850 nm
10 m
200mW
IEEE n
600 Mbits/s
100m - 250m
1500W
March 29, 2012

22. Consolidation Level Challenges
Server capabilities to handle high volume mobile payment transactions
Periodic and round the clock clearing services for mobile payments
Net and Real time funds settlement between Banks
Cash management issues at ATMs on account of high velocity mobile payments.
Offering Mobile Banking Application as a Cloud Service
March 29, 2012

23. Some Innovative solutions of Mobile Payments in India:
Bringing all stakeholders of Mobile Payments into one platform by the Mobile Payment Forum of India (MPFI) in 2006
Use of Mobile Phone Number and MMID only for Mobile Payments
Use of AADHAR number and BIN for Mobile Payments
Use of USSD based Mobile Payments
Development of MANETS for Financial Inclusion by IDRBT
And many other solutions reported in the workshop
March 29, 2012

24. MANET Ecosystem for Mobile Payments
MANET nodes.
Gateway.
Backbone Network.
Bank Server.
Fixed Relay.
March 29, 2012

25. Mobile ad-hoc Network (MANET)
It is a Mobile wireless network.
MANET nodes are rapidly deployable, self configuring and capable of doing autonomous operation in the network.
Nodes co-operate to provide Connectivity and Services.
Operates without base station and centralized administration.
Nodes exhibit mobility and the topology is dynamic.
Nodes must be able to relay traffic sense.
A MANET can be a standalone network or it can be connected to external networks(Internet).
March 29, 2012

26. MANET based Mobile Payments
Cellular Network /Satellite Technology
Internet /
Private LAN
Gateway
Backbone I
MANET node
Fixed Relays
Village
Bank Server
Mobile ad hoc Network
March 29, 2012

27. Testbed Cellular Network/ ISDN/PSTN/ LLN/ Satellite Network
Mobile Node A
Mobile Node C
Mobile Node B
Gateway
Fixed Relay
Mobile Node D
Bank-A Server
Bank-B Server
MANET in a Village
March 29, 2012

28. Thank you...
March 29, 2012