KerNeeS: A protocol for mutual authentication between NFC phones and POS terminals for secure payment transactions

• Published in: 2012 9th International ISC Conference on Information Security and Cryptology pp. 115 - 120
• Main Authors: Ceipidor, U. B., Medaglia, C. M., Marino, A., Sposato, S., Moroni, A.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-09-2012
• Subjects: Authentication; contactless; Cryptography; EMV; Mobile communication; mobile payment; mutual authentication; NFC; Protocols; Servers; Smart cards
• ISBN: 9781467323871; 146732387X
• DOI: 10.1109/ISCISC.2012.6408203

The aim of this paper is to propose a solution for a potential vulnerability in mobile proximity payment. The mobile proximity payment is the evolution of the card payment whose reference standard is EMV (Europay, MasterCard and VISA). A mobile proximity payment transaction is performed via radio waves so there is the possibility to intercept the communication with the point-of-sale and also to activate the payer device, in a range of 10 cm. The EMV protocol assumes that within a range of 10 cm card fraud is hard to perform, moreover IC card capable point of sale are considered safe a priori, while the card must authenticate itself. This allows a leak of card information. In this paper we describe a possible solution to this problem, adding a safe level to the EMV protocol in the case of mobile proximity payment transactions. Our solution is a Needham-Schroeder based protocol, that guarantees authentication and confidentiality between the entities involved in the payment.