A novel verification method for payment card systems

被引:8
作者
Alhothaily, Abdulrahman [1 ,2 ]
Alrawais, Arwa [1 ,3 ]
Cheng, Xiuzhen [1 ]
Bie, Rongfang [4 ]
机构
[1] George Washington Univ, Washington, DC 20052 USA
[2] Saudi Arabian Monetary Agcy, Gen Dept Payment Syst, Riyadh, Saudi Arabia
[3] Prince Sattam Bin Abdulaziz Univ, Coll Comp Engn & Sci, Al Kharj, Saudi Arabia
[4] Beijing Normal Univ, Coll Informat Sci & Technol, Beijing 100875, Peoples R China
基金
美国国家科学基金会; 中国国家自然科学基金;
关键词
Cardholder verification; Contactless card; Payment system; EMV;
D O I
10.1007/s00779-015-0881-9
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
Security plays a crucial role in payment systems; however, some implementations of payment card security rely on weak cardholder verification methods, such as card and a signature, or use the card without having any cardholder verification process at all. Other vulnerable implementations of cardholder verification methods suffer from many security attacks, such as relay attacks and cloning attacks. In addition, the impact of these security attacks is high since they cause monetary losses for banks and consumers. In this paper, we introduce a new cardholder verification method using a multi-possession factor authentication with a distance bounding technique. It adds an extra level of security to the verification process and utilizes the idea of distance bounding which prevents many different security attacks. The proposed method gives the user the flexibility to add one or more extra devices and select the appropriate security level. This paper argues that the proposed method mitigates or removes many popular security attacks that are claimed to be effective in current card based payment systems, and that it can help to reduce fraud on payment cards. Furthermore, the proposed method provides an alternative verification technique and enables cardholders with special needs to use the payment cards and make the payment system more accessible.
引用
收藏
页码:1145 / 1156
页数:12
相关论文
共 34 条
[1]  
Alhothaily A, 2014, LECT NOTES COMPUT SC, V8491, P356, DOI 10.1007/978-3-319-07782-6_33
[2]  
[Anonymous], TECHNICAL REPORT
[3]  
Atkins S, VISA EUROPE CLAIMS G
[4]   Chip and Skim: cloning EMV cards with the pre-play attack [J].
Bond, Mike ;
Choudary, Omar ;
Murdoch, Steven J. ;
Skorobogatov, Sergei ;
Anderson, Ross .
2014 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP 2014), 2014, :49-64
[5]  
Bonneau J., 2012, FINANCIAL CRYPTOGRAP, P25
[6]  
Brands S, 1994, LECT NOTES COMPUTER, V765, P344, DOI [10.1007/3-540-48285-7_30, DOI 10.1007/3-540-48285-7_30]
[7]   Evaluation of a template protection approach to integrate fingerprint biometrics in a PIN-based payment infrastructure [J].
Breebaart, Jeroen ;
Buhan, Ileana ;
de Groot, Koen ;
Kelkboom, Emile .
ELECTRONIC COMMERCE RESEARCH AND APPLICATIONS, 2011, 10 (06) :605-614
[8]  
Ceipidor UB, 2012, INT ISC CONF INFO SE, P115, DOI 10.1109/ISCISC.2012.6408203
[9]  
Cisco, 2015, Fog Computing and the Internet of Things: Extend the Cloud to Where the Things Are
[10]  
Drimer S, 2007, USENIX ASSOCIATION PROCEEDINGS OF THE 16TH USENIX SECURITY SYMPOSIUM, P87