Abstract:The unprecedented growth of mobile applications promoted the usage of these mobile applications for payments. The current research works in mobile payments and commerce are prone to reverse-engineering attacks and lacked transport layer protection, so these research works do not ensure security. Therefore, such attacks on Mobile Payment Applications (MPA) will be successful, which leads to severe financial loss. To address these issues, we propose a secure framework incorporating a defense-in-depth approach for Near Field Communication (NFC) based mobile payment frameworks. Our defense-in-depth approach has three levels, i.e., Defense at hardware, mobile application, and communication level. We have proposed a NFC based Secure Protocol for Mobile Transaction (NSPMT) protocol and successfully verified a mobile payment protocol with BAN (Burrows, Abadi, and Needham) logic and Scyther tool, and our proposed protocol overcome multi-protocol attack, RAM (Random Access Memory) scrapping attack, DOS (Denial Of Service), DDOS (Distributed Denial Of Service), and Phlashing attacks. Our proposed mobile Payment system overcomes the known mobile application vulnerabilities, including Heartbleed and ROBOT (Return Of Bleichenbacher’s Oracle Threat). Our proposed protocol ensures all the security properties and the energy and communication cost and computational cost are far less than the existing works in the literature. Finally, we have successfully implemented our protocol using kotlin language in Android Studio, with two Mobile Payment Applications (MPA) and POS Payment Application (PPA), Elliptic Curve Digital Signature Algorithm (ECDSA) is used and Advanced Encryption Standard (AES) with GCM (Galois/Counter Mode) mode is used for encryption and decryption of Customer Payment Data at MPA and PPA.

NFC-enabled Attack on Cyber Physical Systems: A Practical Case Study.

Large-Scale Invisible Attack On Afc Systems With Nfc-Equipped Smartphones

Card Terminal ( with SAM ) Read basic info Success Request Random Number Verify Random Number ( R ) Calculate MACEntrance Data ( with MAC ) Success

Pricing Data Tampering in Automated Fare Collection with NFC-equipped Smartphones

Security Analysis of Near-Field Communication (NFC) Payments

Hardware-fingerprint Based Authentication for NFC Devices in Power Grids

Near Field Communication (NFC) Technology Security Vulnerabilities and Countermeasures

When Theory and Reality Collide: Demystifying the Effectiveness of Ambient Sensing for NFC-based Proximity Detection by Applying Relay Attack Data

Sensory-Data-Enhanced Authentication For Rfid-Based Access Control Systems

Implementation and Analysis of a Practical NFC Relay Attack Example

MIFARE Classic: Practical Attacks and Defenses

NFCGate: Opening the Door for NFC Security Research with a Smartphone-Based Toolkit

Beware of Pickpockets: A Practical Attack against Blocking Cards

Chord - Thwarting Relay Attacks Among Near Field Communications.

Dynamic array PIN:A novel approach to secure NFC electronic payment between ATM and smartphone

Using Ambient Sensors for Proximity and Relay Attack Detection in NFC Transactions: A Reproducibility Study

Design and Implementation of Active Access Control System by Using NFC-based EAP-AKA Protocol

Fringing Electric Field Sensors for Anti-Attack at System-Level Protection

A Novel NFC-Based Secure Protocol for Merchant Transactions

Securing Emerging Short Range Wireless Communications: the State of the Art