A Novel NFC-Based Secure Protocol for Merchant Transactions
The unprecedented growth of mobile applications promoted the usage of these mobile applications for payments. The current research works in mobile payments and commerce are prone to reverse-engineering attacks and lacked transport layer protection, so these research works do not ensure security. The...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9664524/ |
| _version_ | 1819283120501817344 |
|---|---|
| author | Shaik Shakeel Ahamad |
| author_facet | Shaik Shakeel Ahamad |
| author_sort | Shaik Shakeel Ahamad |
| collection | DOAJ |
| description | The unprecedented growth of mobile applications promoted the usage of these mobile applications for payments. The current research works in mobile payments and commerce are prone to reverse-engineering attacks and lacked transport layer protection, so these research works do not ensure security. Therefore, such attacks on Mobile Payment Applications (MPA) will be successful, which leads to severe financial loss. To address these issues, we propose a secure framework incorporating a defense-in-depth approach for Near Field Communication (NFC) based mobile payment frameworks. Our defense-in-depth approach has three levels, i.e., Defense at hardware, mobile application, and communication level. We have proposed a NFC based Secure Protocol for Mobile Transaction (NSPMT) protocol and successfully verified a mobile payment protocol with BAN (Burrows, Abadi, and Needham) logic and Scyther tool, and our proposed protocol overcome multi-protocol attack, RAM (Random Access Memory) scrapping attack, DOS (Denial Of Service), DDOS (Distributed Denial Of Service), and Phlashing attacks. Our proposed mobile Payment system overcomes the known mobile application vulnerabilities, including Heartbleed and ROBOT (Return Of Bleichenbacher’s Oracle Threat). Our proposed protocol ensures all the security properties and the energy and communication cost and computational cost are far less than the existing works in the literature. Finally, we have successfully implemented our protocol using kotlin language in Android Studio, with two Mobile Payment Applications (MPA) and POS Payment Application (PPA), Elliptic Curve Digital Signature Algorithm (ECDSA) is used and Advanced Encryption Standard (AES) with GCM (Galois/Counter Mode) mode is used for encryption and decryption of Customer Payment Data at MPA and PPA. |
| first_indexed | 2024-12-24T01:26:26Z |
| format | Article |
| id | doaj.art-98b1605c5e70423db452692aae38332e |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-24T01:26:26Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-98b1605c5e70423db452692aae38332e2022-12-21T17:22:29ZengIEEEIEEE Access2169-35362022-01-01101905192010.1109/ACCESS.2021.31390659664524A Novel NFC-Based Secure Protocol for Merchant TransactionsShaik Shakeel Ahamad0https://orcid.org/0000-0002-9619-0907Department of Information Technology, College of Computer and Information Sciences, Majmaah University, Al Majma’ah, Saudi ArabiaThe unprecedented growth of mobile applications promoted the usage of these mobile applications for payments. The current research works in mobile payments and commerce are prone to reverse-engineering attacks and lacked transport layer protection, so these research works do not ensure security. Therefore, such attacks on Mobile Payment Applications (MPA) will be successful, which leads to severe financial loss. To address these issues, we propose a secure framework incorporating a defense-in-depth approach for Near Field Communication (NFC) based mobile payment frameworks. Our defense-in-depth approach has three levels, i.e., Defense at hardware, mobile application, and communication level. We have proposed a NFC based Secure Protocol for Mobile Transaction (NSPMT) protocol and successfully verified a mobile payment protocol with BAN (Burrows, Abadi, and Needham) logic and Scyther tool, and our proposed protocol overcome multi-protocol attack, RAM (Random Access Memory) scrapping attack, DOS (Denial Of Service), DDOS (Distributed Denial Of Service), and Phlashing attacks. Our proposed mobile Payment system overcomes the known mobile application vulnerabilities, including Heartbleed and ROBOT (Return Of Bleichenbacher’s Oracle Threat). Our proposed protocol ensures all the security properties and the energy and communication cost and computational cost are far less than the existing works in the literature. Finally, we have successfully implemented our protocol using kotlin language in Android Studio, with two Mobile Payment Applications (MPA) and POS Payment Application (PPA), Elliptic Curve Digital Signature Algorithm (ECDSA) is used and Advanced Encryption Standard (AES) with GCM (Galois/Counter Mode) mode is used for encryption and decryption of Customer Payment Data at MPA and PPA.https://ieeexplore.ieee.org/document/9664524/MPABAN logicRAM scrapingphlashing attacksHeartbleed and ROBOT vulnerabilitiesScyther tool |
| spellingShingle | Shaik Shakeel Ahamad A Novel NFC-Based Secure Protocol for Merchant Transactions IEEE Access MPA BAN logic RAM scraping phlashing attacks Heartbleed and ROBOT vulnerabilities Scyther tool |
| title | A Novel NFC-Based Secure Protocol for Merchant Transactions |
| title_full | A Novel NFC-Based Secure Protocol for Merchant Transactions |
| title_fullStr | A Novel NFC-Based Secure Protocol for Merchant Transactions |
| title_full_unstemmed | A Novel NFC-Based Secure Protocol for Merchant Transactions |
| title_short | A Novel NFC-Based Secure Protocol for Merchant Transactions |
| title_sort | novel nfc based secure protocol for merchant transactions |
| topic | MPA BAN logic RAM scraping phlashing attacks Heartbleed and ROBOT vulnerabilities Scyther tool |
| url | https://ieeexplore.ieee.org/document/9664524/ |
| work_keys_str_mv | AT shaikshakeelahamad anovelnfcbasedsecureprotocolformerchanttransactions AT shaikshakeelahamad novelnfcbasedsecureprotocolformerchanttransactions |