A Protocol for Online Mobile Payment Asgeir Steine 1/10 Plan: - - PowerPoint PPT Presentation

a protocol for online mobile payment
SMART_READER_LITE
LIVE PREVIEW

A Protocol for Online Mobile Payment Asgeir Steine 1/10 Plan: - - PowerPoint PPT Presentation

A Protocol for Online Mobile Payment Asgeir Steine 1/10 Plan: Mobile Online Payment Properties Blind Signatures Near Field Channel U <-> M Anonymous Online Channel B <-> U Protocol 2/10 Mobile Online Payment


slide-1
SLIDE 1

A Protocol for Online Mobile Payment

Asgeir Steine

1/10

slide-2
SLIDE 2

Plan:

◮ Mobile Online Payment ◮ Properties ◮ Blind Signatures ◮ Near Field Channel U <-> M ◮ Anonymous Online Channel B <-> U ◮ Protocol

2/10

slide-3
SLIDE 3

Mobile Online Payment

U withdraw pay M B

3/10

slide-4
SLIDE 4

Mobile Online Payment

U withdraw pay M B claim

3/10

slide-5
SLIDE 5

Mobile Online Payment

U withdraw pay M B

3/10

slide-6
SLIDE 6

Mobile Online Payment

U withdraw pay M B

3/10

slide-7
SLIDE 7

Mobile Online Payment

U withdraw pay M B

3/10

slide-8
SLIDE 8

Mobile Online Payment

U withdraw pay M B

◮ Many potential threats.

3/10

slide-9
SLIDE 9

Mobile Online Payment

U withdraw pay M B

◮ Many potential threats. ◮ Hidden players: Network operator N, Mobile Service Provider

S.

3/10

slide-10
SLIDE 10

Properties

Transaction security:

◮ Bank security (withdraw ≥ claim). ◮ Merchant security (claim ≥ pay). ◮ User security (pay ≥ withdraw).

Privacy:

◮ Bank should learn who you are, but not where

(same with N).

◮ Merchant should learn where you are, but not who

(same with S).

4/10

slide-11
SLIDE 11

Weak Blind Signatures

◮ Blind signatures allow users to request signatures from

someone without disclosing the message to be signed.

◮ A blind signature scheme consist of five algorithms:

Key generation (Gen), Request (Req), Issue (Issue), Unblind (UnBlind), and Verify (Ver).

◮ Completeness:

(sk, vk) ← Gen (ρ, s) ← Req(vk, m) ˜ σ ← Issue(sk, ρ) σ ← UnBlind(s, ˜ σ) ⇒ Ver(vk, σ, m) = true

5/10

slide-12
SLIDE 12

Weak Blind Signatures

◮ Weak Unforgeability:

No efficient adversary (given a honestly generated vk) can sign more messages than he has received issue tokens ˜ σ.

◮ Weak Blindness:

A bit technical, but essentially no efficient adversary (given honestly generated keys (sk, vk) can distinguish ρ ← Req(vk, m) from ρ′ ← Req(vk, m′) for any m, m′.

6/10

slide-13
SLIDE 13

Weak Blind Signatures

◮ Weak Unforgeability:

No efficient adversary (given a honestly generated vk) can sign more messages than he has received issue tokens ˜ σ.

◮ Weak Blindness:

A bit technical, but essentially no efficient adversary (given honestly generated keys (sk, vk) can distinguish ρ ← Req(vk, m) from ρ′ ← Req(vk, m′) for any m, m′. (Even after seeing the corresponding signatures.)

6/10

slide-14
SLIDE 14

Near Field Channel

U M

◮ Attacker can delay/stop messages and eavesdrop, but not

modify (unless U or M are corrupted).

◮ User identity does not leak. ◮ User location leaks if M is corrupt or adversary is eavsdropping.

7/10

slide-15
SLIDE 15

Anonymous Online Channel

B U

◮ A bit technical functionality (previous work). ◮ Adversary has full control of the network in corrupted

locations.

◮ U’s identity leaks only if service provider S is corrupted. ◮ However N can trace U through corrupted locations by denial

  • f service attack.

8/10

slide-16
SLIDE 16

Protocol

U M B

9/10

slide-17
SLIDE 17

Protocol

U M B Tr, M, B Tr

9/10

slide-18
SLIDE 18

Protocol

U M B Tr, M, B Tr Tr

9/10

slide-19
SLIDE 19

Protocol

U M B Tr, M, B Tr Tr c

9/10

slide-20
SLIDE 20

Protocol

U M B Tr, M, B Tr Tr c c, σM(c, Tr)

9/10

slide-21
SLIDE 21

Protocol

U M B Tr, M, B Tr Tr c c, σM(c, Tr) (ρ, s) k

◮ (ρ, s) ← Req(vk, (M, c)).

9/10

slide-22
SLIDE 22

Protocol

U M B Tr, M, B Tr Tr c c, σM(c, Tr) (ρ, s) k {ρ, U, k, σU}pkB

◮ (ρ, s) ← Req(vk, (M, c)). ◮ ˜

σ ← Issue(sk, ρ).

9/10

slide-23
SLIDE 23

Protocol

U M B Tr, M, B Tr Tr c c, σM(c, Tr) (ρ, s) k {ρ, U, k, σU}pkB ˜ σ

◮ (ρ, s) ← Req(vk, (M, c)). ◮ ˜

σ ← Issue(sk, ρ).

9/10

slide-24
SLIDE 24

Protocol

U M B Tr, M, B Tr Tr c c, σM(c, Tr) (ρ, s) k {ρ, U, k, σU}pkB ˜ σ {˜ σ}k

◮ (ρ, s) ← Req(vk, (M, c)). ◮ ˜

σ ← Issue(sk, ρ).

9/10

slide-25
SLIDE 25

Protocol

U M B Tr, M, B Tr Tr c c, σM(c, Tr) (ρ, s) k {ρ, U, k, σU}pkB ˜ σ {˜ σ}k σ

◮ (ρ, s) ← Req(vk, (M, c)). ◮ ˜

σ ← Issue(sk, ρ).

◮ σ ← UnBlind(s, ˜

σ).

9/10

slide-26
SLIDE 26

Protocol

U M B Tr, M, B Tr Tr c c, σM(c, Tr) (ρ, s) k {ρ, U, k, σU}pkB ˜ σ {˜ σ}k σ σ

◮ (ρ, s) ← Req(vk, (M, c)). ◮ ˜

σ ← Issue(sk, ρ).

◮ σ ← UnBlind(s, ˜

σ).

9/10

slide-27
SLIDE 27

Thank You.

10/10