Mobile Payments in the Cloud

Transcription

1 Mobile Payments in the Cloud Peter Landrock - patents pending

2 Mobile / Digital Cloud Wallets Opportunity & Challenge in the Market EMV / Payments MOBILE CLOUD Immediate Benefits Decrease Fraud Decrease Liability The Trend Continues Anywhere, Anytime, Anyhow Private Networks Age of Dinosaurs vs. Virtual Private Clouds Opportunities Improve Image / Trust Users become more accustomed to security Opportunities Ubiquitous Computing Commerce during every waking hour Opportunities Cost savings On-Demand Convenience Biggest Challenge Card-not-present (can be dealt with ) Biggest Challenge Security (can be dealt with) Biggest Challenge Security (can be dealt with)

3 Today s Users are Well Connected

4 Static Data s Days are Counted, but innovation in CNP limited Today s Innovators vs Tomorrow s Innovators Static Data Dynamic Data Magstripe NFC VbV DDA Contactless DPA

5 Introducing a New Chip Platform: Cloud Wallet Pair the user s wallet with that user s devices ensure that the wallet is fully protected ensure user-friendliness beyond expectations

6 Virtual Chip Card Service Any payment scheme keys that would normally reside inside The Secure Element or The EMV Chip Card Reside inside Hardware Security Modules (HSMs) The HSMs will never export such keys in clear-text

7 Cloud Wallet - next generation Cryptomathic Signer The Award-winning, patented, Virtual Chip Card technology from Cryptomathic is the ideal candidate for hosting the Cloud Wallet: Allows the Virtual Chip Card Server to securely compute cryptographic operations on behalf of a user, if and only if it is presented with an appropriate amount of evidence that: 1. The user is who he/she claims to be 2. The user intends to carry out the transaction at hand Cloud Wallet securely holds the users EMV chip data within a FIPS Level 3+ boundary Just like on the EMV Chip, keys may be used when appropriately authorized, yet can never be revealed thus, the virtual chip card (completely transparent to the user!)

8 Implementation Scenarios Online Security Use: Online Banking and Payments Benefits: Prevent M-i-M attacks Prereq s: Two user devices available Payments Use: POS Contactless Transactions Benefits: No Secure Element, no agreement with Telco or Handset Manufacturer required Prereq s: NFC on Smart Phone End-to-end EMV in Cloud Use: Cloud POS and Wallets Benefits: Requires no POS Prereq s: Both merchant and consumer must subscribe to service

9 Online Security Transaction Signing High Risk 2 or more devices available Transact on one device Validate transaction on the other Transfer $500 to some@body.com OK? Less Risk Only one device Transact one device Validate on same device, possibly using different channel (e.g app and )

10 User Experience 1. User opens App and taps / points at POS to Pay 2. Op9onally User selects payment card other than default User and merchant interact in custom ways 3. User and merchant validate POS complete ) ) ) POS SmartPhone Cloud Wallet Service

11 Web shopping with cloud wallet Today, user copies all informa9on wrieen on his card With cloud wallet, once user is ready to pay 1. He keys in his ID in the system 2. The virtual shop connects to the back- end with his cloud wallet 3. Back- end connects to his smartphone and ask him to confirm e.g. Easyjet 9cket Munich- London at for Joe Smith 4. User confirms 5. Back- end sends an EMV transac9on to shop 6. Shop confirms payment and issues e- 9cket Great user experience, much improved security

12 EMV Cloud POS - Wallet SmartPhone / Tablet Cloud POS Service ) ) ) SmartPhone Cloud Wallet Service

13 Cryptomathic Mobile Security Core Mobile Device Web / App Layer Back-end APP UI / Presentation Layer Security Core Advanced Obfuscation, Communications & Tamper Mechanisms OS Network Security Perimeter Firewalls, IDS HTTPS WAS Security Registration Enrollment Authentication Session Mgmt Secure Service Monitoring HSMs

14 QuesAons/Discussions