Welcome!

Cloud Security Authors: Yeshim Deniz, Elizabeth White, Peter Silva, Pat Romanski, Scott Millis

Related Topics: Mobile IoT, Microservices Expo, Agile Computing, Wearables, Cloud Security

Mobile IoT: Article

Securing Mobile Payments

As the mobile payment industry continues to develop at lightning speed, best practices have yet to be solidified

As mobile phones become as indispensable as credit cards for purchasing goods and services, mobile payment developments are quickly gaining pace. Many different service providers are competing for their piece of the action. Within the last year, we have witnessed the arrival of mobile payment solutions such as MasterCard's PayPass, Google's Android-based eWallet scheme and Starbucks' emerging Quick Tap PayPass service.

A study from Juniper Research predicts that mobile contactless payment transactions are to reach nearly $50 billion worldwide in 2014 and NFC solutions will be used in 20 countries within the next 18 months.

However, with the widespread adoption of this technology, there is a need to debate which type of scheme works best and is the most robust.

Setting the Standard
As with traditional payments, standardization is vital. Several effective standards are already gaining momentum in delivering a secure mobile payments ecosystem:

  • Organizing Mobile NFC Services - The Trusted Service Manager (TSM) acts as an intermediary between Mobile Network Operators (MNOs) and third-party service providers that wish to offer additional services to subscribers. GlobalPlatform's ‘System Messaging Specification for Management of Mobile-NFC Services' defines the messaging between each of the three parties to guarantee secure ‘provisioning' of services to the device.
  • The SIM Alliance Open Mobile API - Applications utilizing the Secure Element (the cryptographically secured piece of hardware on newer mobile devices) to secure their critical operations, such as payments, banking or transport tickets, can have a component running within the device's operating system that ensures the user can securely interact with the keyboard/touch screen while enjoying a rich graphical user experience. The SIM Alliance Open Mobile API allows application developers to utilize additional security of the Secure Element more easily, be this in a UICC SIM, a dedicated Secure Element built into the device or a secure SD card, by providing a common means of interfacing with it.
  • Trusted Execution Environment (TEE) - The Secure Element cannot easily host apps with a highly developed or cutting edge user interface, but can look after critical data on the mobile handset. Applications that require complex user interactions must run on the device's primary processor. The TEE secures these apps; GlobalPlatform is leading the standardization and interoperability in this area to ensure that software and data are sufficiently protected. For example, payment apps that run their user interface in TEE and their transaction security in the Secure Element would have a particularly high level of security.

Such standards encourage the industry to work together and benchmark best practices, but they remain as fundamental elements of successful mobile payment security. It is also required that technology that makes the security of provisioning mobile payment applications is as safe as issuing cards, and designing the necessary infrastructure requires much needed consumer confidence.

Security Issues Prompt Consumer Fear
Consumer's perceived fear surrounding new mobile payments technology often looms around security. The lack in consumer confidence originates from the threat of information being intercepted during a transaction. Yet risks are prominent at every stage of the mobile payment life cycle, including how payment applications get onto a phone securely in the first place. Constructing the data needed to issue a payment application and generate the secure messages to personalize a handset can be a lengthy and inefficient process, and the various cryptographic functions pose the possibility that sensitive data is at risk of exposure.

This initial set-up process or ‘provisioning' usually takes place over-the-air (OTA). The process increases security risks due to the various parties involved - typically the payment application provider (usually a bank), a Trusted Service Manager, the Mobile Network Operator and the end user. A vital success factor is maintaining security throughout this procedure, ensuring that no data is compromised. Successful provisioning utilizes unique personalization keys to not only encrypt the loading of data onto a device, but also the succeeding transactions performed by the application.

Mobile Payment Security as Secure as Traditional Payment Cards
By implementing the newest cryptography methods, users can ensure that ‘provisioning' occurs securely with the same level of protection provided by traditional payment cards. Providers of physical cards tend to favor Hardware Security Modules (HSMs), which generate and secure the encryption keys crucial to managing issuance risk. This method is also relevant for provisioning services to a mobile phone and can significantly reduce the complexities associated with the process while simultaneously avoiding the weakness of keys stored in software. The primary benefit of an HSM is to secure encryption keys and sensitive data in a way that safeguards such data from exposure. With this method, service providers reduce risk.

While encryption is crucial to the security of mobile payments, it isn't the only answer. For a more comprehensive approach to optimize security, encryption and authentication must be combined to provide protection for data exchanges and authorizations.

Reducing Risk
As the mobile payment industry continues to develop at lightning speed, best practices have yet to be solidified. Operators and related parties are still unsure about who ultimately controls the mobile wallet. But one thing that is for sure is that security remains the primary hurdle most consumers can't get over.

Extinguishing this concern is no easy task; it requires a mixture of robust standards and best practices, accompanied with the right technical path to ensure the experience is safe from the second that a user opts to download a payment app. If businesses want to take advantage of the mobile payments, security needs to be at the forefront of their approach to mitigating risk and encourage comprehensive consumer adoption.

More Stories By Ian Hermon

Ian Hermon is Product Marketing Manager at Thales e-Security. He has more than 15 years’ experience in the payment industry, being responsible for the Thales portfolio of payment and transaction security products. He represents Thales on both the MasterCard Global Vendor Forum and Visa Europe Vendor Forum, is a member of the Smart Card Alliance Payments Council and the Smartex Smart Payments Forum Steering Committee. Ian also represents Thales as a participating organization on the PCI Security Standards Committee and is an EMV subscriber.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
Extracting business value from Internet of Things (IoT) data doesn’t happen overnight. There are several requirements that must be satisfied, including IoT device enablement, data analysis, real-time detection of complex events and automated orchestration of actions. Unfortunately, too many companies fall short in achieving their business goals by implementing incomplete solutions or not focusing on tangible use cases. In his general session at @ThingsExpo, Dave McCarthy, Director of Products...
The many IoT deployments around the world are busy integrating smart devices and sensors into their enterprise IT infrastructures. Yet all of this technology – and there are an amazing number of choices – is of no use without the software to gather, communicate, and analyze the new data flows. Without software, there is no IT. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, Dave McCarthy, Director of Products at Bsquare Corporation; Alan Williamson, Principal...
Internet of @ThingsExpo has announced today that Chris Matthieu has been named tech chair of Internet of @ThingsExpo 2017 New York The 7th Internet of @ThingsExpo will take place on June 6-8, 2017, at the Javits Center in New York City, New York. Chris Matthieu is the co-founder and CTO of Octoblu, a revolutionary real-time IoT platform recently acquired by Citrix. Octoblu connects things, systems, people and clouds to a global mesh network allowing users to automate and control design flo...
Unsecured IoT devices were used to launch crippling DDOS attacks in October 2016, targeting services such as Twitter, Spotify, and GitHub. Subsequent testimony to Congress about potential attacks on office buildings, schools, and hospitals raised the possibility for the IoT to harm and even kill people. What should be done? Does the government need to intervene? This panel at @ThingExpo New York brings together leading IoT and security experts to discuss this very serious topic.
Businesses and business units of all sizes can benefit from cloud computing, but many don't want the cost, performance and security concerns of public cloud nor the complexity of building their own private clouds. Today, some cloud vendors are using artificial intelligence (AI) to simplify cloud deployment and management. In his session at 20th Cloud Expo, Ajay Gulati, Co-founder and CEO of ZeroStack, will discuss how AI can simplify cloud operations. He will cover the following topics: why clou...
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lead...
Internet-of-Things discussions can end up either going down the consumer gadget rabbit hole or focused on the sort of data logging that industrial manufacturers have been doing forever. However, in fact, companies today are already using IoT data both to optimize their operational technology and to improve the experience of customer interactions in novel ways. In his session at @ThingsExpo, Gordon Haff, Red Hat Technology Evangelist, will share examples from a wide range of industries – includin...
The WebRTC Summit New York, to be held June 6-8, 2017, at the Javits Center in New York City, NY, announces that its Call for Papers is now open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 20th International Cloud Expo and @ThingsExpo. WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web co...
"We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.
Amazon has gradually rolled out parts of its IoT offerings in the last year, but these are just the tip of the iceberg. In addition to optimizing their back-end AWS offerings, Amazon is laying the ground work to be a major force in IoT – especially in the connected home and office. Amazon is extending its reach by building on its dominant Cloud IoT platform, its Dash Button strategy, recently announced Replenishment Services, the Echo/Alexa voice recognition control platform, the 6-7 strategic...
We're entering the post-smartphone era, where wearable gadgets from watches and fitness bands to glasses and health aids will power the next technological revolution. With mass adoption of wearable devices comes a new data ecosystem that must be protected. Wearables open new pathways that facilitate the tracking, sharing and storing of consumers’ personal health, location and daily activity data. Consumers have some idea of the data these devices capture, but most don’t realize how revealing and...
IoT solutions exploit operational data generated by Internet-connected smart “things” for the purpose of gaining operational insight and producing “better outcomes” (for example, create new business models, eliminate unscheduled maintenance, etc.). The explosive proliferation of IoT solutions will result in an exponential growth in the volume of IoT data, precipitating significant Information Governance issues: who owns the IoT data, what are the rights/duties of IoT solutions adopters towards t...
Whether your IoT service is connecting cars, homes, appliances, wearable, cameras or other devices, one question hangs in the balance – how do you actually make money from this service? The ability to turn your IoT service into profit requires the ability to create a monetization strategy that is flexible, scalable and working for you in real-time. It must be a transparent, smoothly implemented strategy that all stakeholders – from customers to the board – will be able to understand and comprehe...
Complete Internet of Things (IoT) embedded device security is not just about the device but involves the entire product’s identity, data and control integrity, and services traversing the cloud. A device can no longer be looked at as an island; it is a part of a system. In fact, given the cross-domain interactions enabled by IoT it could be a part of many systems. Also, depending on where the device is deployed, for example, in the office building versus a factory floor or oil field, security ha...
An IoT product’s log files speak volumes about what’s happening with your products in the field, pinpointing current and potential issues, and enabling you to predict failures and save millions of dollars in inventory. But until recently, no one knew how to listen. In his session at @ThingsExpo, Dan Gettens, Chief Research Officer at OnProcess, discussed recent research by Massachusetts Institute of Technology and OnProcess Technology, where MIT created a new, breakthrough analytics model for s...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Video experiences should be unique and exciting! But that doesn’t mean you need to patch all the pieces yourself. Users demand rich and engaging experiences and new ways to connect with you. But creating robust video applications at scale can be complicated, time-consuming and expensive. In his session at @ThingsExpo, Zohar Babin, Vice President of Platform, Ecosystem and Community at Kaltura, discussed how VPaaS enables you to move fast, creating scalable video experiences that reach your aud...
"Once customers get a year into their IoT deployments, they start to realize that they may have been shortsighted in the ways they built out their deployment and the key thing I see a lot of people looking at is - how can I take equipment data, pull it back in an IoT solution and show it in a dashboard," stated Dave McCarthy, Director of Products at Bsquare Corporation, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.