The Transmission Control Protocol.

Secure authentication scheme for IoT and cloud servers

It has been well documented that lack of trust between commercial entities and purchasers can restrict the potential of e-commerce. This may be because the purchaser is required to provide personal information to the commercial entity, which may then be abused, or because the purchaser may be suspicious that after payment has been processed, the goods purchased will not arrive. The challenge for the researcher is to determine the e-commerce model which maximizes the trust a purchaser has when shopping online.

In this paper, we focus on the personal information which must be revealed by the purchaser when purchasing online and we present the first comprehensive analysis of personal information distributed in an e-commerce setting from the point of view of the purchaser and his perception of trust in an online transaction. We introduce a measure of trust based on the information distributed to the parties in the transaction and isolate the instances which maximize trust for the purchaser relative to the personal information revealed. This leads us to the establishment of a theoretical framework on which to compare e-commerce protocols and to the development of four new models, all of which, as we demonstrate, are better in concrete ways than the traditional e-commerce model based on secure e-payment protocols. While the overall cost of implementation to the parties remains the same as in the traditional protocols, there is a slight overall decrease in cost to the seller but a slight increase in cost to the deliverer. However, the small additional costs to the deliverer are mitigated by the opportunity for new capabilities and business. Implementation of our work is likely to improve consumer trust and therefore lead to an increase in on-line commerce, especially in countries where privacy recognition is not strong.

E-commerce: protecting purchaser privacy to enforce trust

In this paper, we introduce a secure mobile payment model suitable for macro transactions that compromise cost, simplicity, security, and performance of transaction, with minimum number of cryptography key usages, and less encryption/decryption operations compared to other models. This model can use symmetric and asymmetric cryptography without the need of trusted 3rd parties or even PKI complexity. It is based on SMS as a transport channel which provides the capability to send transactions to payer not to payee; as usually done in most current payment transaction models. The payer receives a secured SMS message (invoice) waiting his/her confirmation (yes/no). Each entity in the payment system payer/payee trusts only his/her bank respectively, so the transaction will always go through trusted nodes. The payer/payee can also use any bank payment instrument (credit card, debit card, or even current account) without revealing confidential data during the payment. This model can be applied on any payment application e.g. e-check, money transfer, e-commerce, and even normal EFTPOS transactions with leverage infrastructure supporting the above mentioned payment applications.

SecureSMSPay: Secure SMS Mobile Payment model

Wearable devices communicate among themselves, but they also need to communicate with remote entities through the Internet in order to share information. Given the sensitivity of the information handled, authentication is needed to allow data access only to authorized parties. However, the existing authentication solutions for wearable devices are limited to scenarios where direct communication between the authenticating parties is possible. With this in mind, we propose an authentication protocol that enables secure mutual end-to-end authentication between a wearable device and any other entity such as another wearable device, a personal device (mobile phone), a remote server, or a user’s application. Our design uses a point-topoint authentication protocol (end-to-end authentication) regardless of whether other intermediate devices are trusted or not. Finally, we present a security evaluation of the proposed authentication protocol.

Toward self-authenticable wearable devices

Advances in network smart cards authentication

Most attacks against security protocols are due to their vulnerable designs. These type of protocols are usually the base which many other protocols and applications are built upon, so proving the correctness of such protocols has become a very important issue in recent years. At the same time, the complexity of security protocols has increased considerably, making it harder to perform an exhaustive analysis of the different situations they are able to deal with. BAN logic was created to assist in the validation of authentication protocols. Although there are other validation logics, we have chosen BAN because we believe its formal process is very simple and robust and therefore facilitates its application to validate old protocols such as Otway-Rees and more complex new ones such as IKE (standard Internet Key Exchange protocol). This paper is based on BAN logic. We will give a brief description of validating procedures and we will demonstrate the validity of BAN foundations, refuting some weaknesses detected by other authors.

Validating the Use of BAN LOGIC

Most of the security proposals in m-commerce scenarios have been based on a classical payment model, which basically establishes relationships across domains among customers and merchants by means of business and banking domains. Nevertheless, these security solutions are not sufficiently robust when new components intend to participate in the m-commerce process. From our research, we can identify three emerging factors that could subordinate the design of current and future m-commerce scenarios: enhanced payment cards with networking functionalities, a plethora of infrastructures with constrained connectivity and intermediary entities with multiparty payment functionalities. Consequently, this paper identifies the need for review of the model being used so far in order to guarantee security robustness, and proposes an extended payment model that, among other advantages, allows the study of more effective security solutions.

A new domain-based payment model for emerging mobile commerce scenarios

Towards self-authenticable smart cards

Most of the security proposals in commerce scenarios have been based on a classical e-payment system definition. This definition basically represents a client who sends a payment order to obtain some goods/services from the merchant, which the intentions of the real money transaction carry on between his financial institutions. Nevertheless, these definitions are not sufficiently robust when new aspects appear in the electronic payment transaction. We can identify some of those new aspects (such as: smart card with network capabilities, business mediator with advantage services, handheld devices with constrained connectivity, and multiparty scenarios) that could subordinate the design of current and future commerce scenarios. In this paper we extended the traditional e-payment system definition, in order to include these new aspects. Additionally, we describe two new payment models, where such aspects are involved, and where the secure solution needs to consider new security requirements.

Joaquin Torres

Papers

Advances in network smart cards authentication

Validating the Use of BAN LOGIC

A new domain-based payment model for emerging mobile commerce scenarios

Towards self-authenticable smart cards

New E-Payment Scenarios in an Extended Version of the Traditional Model