Abstract:The unprecedented growth of mobile applications promoted the usage of these mobile applications for payments. The current research works in mobile payments and commerce are prone to reverse-engineering attacks and lacked transport layer protection, so these research works do not ensure security. Therefore, such attacks on Mobile Payment Applications (MPA) will be successful, which leads to severe financial loss. To address these issues, we propose a secure framework incorporating a defense-in-depth approach for Near Field Communication (NFC) based mobile payment frameworks. Our defense-in-depth approach has three levels, i.e., Defense at hardware, mobile application, and communication level. We have proposed a NFC based Secure Protocol for Mobile Transaction (NSPMT) protocol and successfully verified a mobile payment protocol with BAN (Burrows, Abadi, and Needham) logic and Scyther tool, and our proposed protocol overcome multi-protocol attack, RAM (Random Access Memory) scrapping attack, DOS (Denial Of Service), DDOS (Distributed Denial Of Service), and Phlashing attacks. Our proposed mobile Payment system overcomes the known mobile application vulnerabilities, including Heartbleed and ROBOT (Return Of Bleichenbacher’s Oracle Threat). Our proposed protocol ensures all the security properties and the energy and communication cost and computational cost are far less than the existing works in the literature. Finally, we have successfully implemented our protocol using kotlin language in Android Studio, with two Mobile Payment Applications (MPA) and POS Payment Application (PPA), Elliptic Curve Digital Signature Algorithm (ECDSA) is used and Advanced Encryption Standard (AES) with GCM (Galois/Counter Mode) mode is used for encryption and decryption of Customer Payment Data at MPA and PPA.

Dynamic Symmetric Key Mobile Commerce Scheme Based on Self-Verified Mechanism

Bargain Security Model Based on Mobile Agent

Research on identity authentication management in mobile commerce based on ECC and dynamic fingerprint key

Dual-Anonymous Off-Line Electronic Cash for Mobile Payment

An Identity-Based Elliptic Curve Cryptography for Mobile Payment Security

Secure remote mobile payment architecture and application

A fair electronic payment system for digital content using elliptic curve cryptography

A Mobile Payment Protocol on the Basis of Symmetric Key

An Id-Based Three-Party Authenticated Key Exchange Protocol Using Elliptic Curve Cryptography for Mobile-Commerce Environments

An innovative electronic group-buying system for mobile commerce

A Secure and Efficient Remote User Authentication Scheme for Multi-server Environments Using ECC.

An Efficient and Provably Secure Anonymous User Authentication and Key Agreement for Mobile Cloud Computing.

Multi-bank and Off-Line E-Cash Scheme Based on Smart Card

Multiple Schemes for Mobile Payment Authentication Using QR Code and Visual Cryptography

A Security Multi-Bank E-Cash Protocol Based On Smart Card

An Elliptic Curve Dynamic Identity Authentication Scheme Based on Smart Cards

A Novel NFC-Based Secure Protocol for Merchant Transactions

Efficient Anti-Fraud Micro-Payment Scheme

Provable Secure and Efficient Digital Rights Management Authentication Scheme Using Smart Card Based on Elliptic Curve Cryptography

Mobile Payment Framework Based on 3G Network

An ECC-Based Authentication Protocol for Dynamic Charging System of Electric Vehicles