Tax Control and Security of M-Commerce in 3G Environments. ZheJiang WanLi University

Transcription

1

2 Tax Control and Security of M-Commerce in 3G Environments PAN Tie-Jun, ZHENG Lei-na, BAI Lingbing ZheJiang WanLi University Abstract This paper seeks to integrate different impressive access technologies to build a kind of innovative M Commerce tax control and security model. It analyzes the key problem of M-Commerce in the age of the 3rd generation wireless communication infrastructure (3G), present a set of mobile tax control and security solution in which the second generation ID card in China is used instead of all kinds of the existing IC or ID card for identification and mutual authentication through Radio Frequency Identification (RFID) access technology with mobile terminal, T-FLASH (TF) card is used for tax control and security junctions of mobile business through SD Input/ Output (SDIO) access technology. K-java is used for cross platform and Web Service is used for system integration base on Open Service Architecture (OSA) according to 3GPP. Then mobile tax control and security mechanisms are given including key enabling technologies, system integration solution, and implement method. In the end, software and hardware design is introduced and a practical application is given. The result of the present work implied that the integration of SIM card and tax control card is gradually becoming a new research field which is a competitive technology and will be used in the mobile business solution. 1. Introduction With the increasing combination of information technology and mobile technologies, mobile commerce has become the hot topic of broad areas of the mobile Internet. The user has the strong demand for mobile commerce at any time, place, which can be realized by the combination of mobile communications services providers and the financial services providers. 3G (The Third-Generation Communication System) will lead to vigorous development of mobile commerce presents a "blowout" phenomenon in China. The wireless resources are rich in Overseas for 3G network set up earlier. As early as 2004, the Japanese mobile phone users can take advantage of free on-line store to select and pay for goods. NTTDoCoMo Company has more than 3 million mobile wallet users who can arbitrarily purchase using mobile phone payment in stores and vending machines in Japan in In South Korea, a growing number of mobile phone users use mobile POS payment, apply for financial business, buying a bus and subway tickets via phone. In the United States, Britain, Germany, Finland, Sweden and other countries have already successfully launched the "mobile commerce system," mobile commerce using mobile phones. [1] However, in the course of the implementation of mobile commerce, security becomes a key bottleneck. Because the phone's encryption capabilities are limited which cannot meet the financial security requirements well, the majority of mobile commerce is currently limited to small or directed the payment which cannot achieve the high-security Internet e-commerce security level. At the same time, due to rampant cell phone virus attacks and new technologies emerge, the security solution simply relying on software security and mobile phone itself has also withstood a severe test, which is the mobile commerce have to face the reality of the serious and growing problem e at home and abroad. In addition, 95% of annual revenue comes from taxes, with the mobile commerce transaction volume is showing explosive growth, how to achieve taxpayer automation, tax collection and management information, strengthen the monitoring of tax sources to ensure stability and security of tax revenue to become an urgent need to solve the problem [3].. 2. Mobile business solution This paper proposes a new mobile business solution, it will not change the phone's any hardware configuration, just use several interface technology to optimize the allocation of existing resources and achieve innovative model of a mobile commerce applications. It contains several key enabling technologies as follows: 2.1. Mobile business information security framework based on 3G To develop mobile commerce vigorously, mobile information should first solve the security issues. In this paper, According to the 3GPP specification and the OSA (Open Service Architecture) service layer model, the security features of identity and identification of the user (lmsi / TMSI / EUIC), AKA (Authority and Key Agreement: Authentication and Key Agreement), DI /10/$ IEEE 83

3 (Data Integrity: Data integrity protection), DC (Data Confidentiality: data confidentiality protection) and certification information in the conversion between the different certified network, will be packaged into a hardware-based encryption driver at the application layer, 3 GPP-defined core algorithm and the concrete implementation are provided in the form of API including: AKA in fl, fl, f3, f4, f5, fl * and f5 *, EUIC the f6 and fl, data encryption algorithm f8, and data integrity algorithm f9. [4] In order to being compatible with 3G mobile commerce, and facilitating the existing software-based encryption to transform to the hardware encryption, it is necessary to packaged the hardware encryption into a standard function interface or message interface for redevelopment. Due to the rampant cell phone virus, mobile commerce hardware encryption security solutions is becoming a hot research, this paper will propose a hardware-based encryption solution with SDIO interface. Now smart phones are generally equipped with SDIO card interface. SDIO allows manufacturers to develop product expansion by adding hardware in the SDIO compatible slot. Many additional products based on the SDIO are development, including mobile commerce electronic key. SDIO compatible slots are available for many PDA and mobile phones, and plans to encryption devices for mobile commerce. Tax Machine commonly use EPROM as tax- memory module to record tax control data for the completion of tax control function so that the encryption system easy to crack, resulting in tax losses. We proposes mobile phone implementing Tax Machine function with 32-bit high-performance central processing unit and SD tax control card by a machine a card, will be seamless method of upgrading mobile phone into a Tax Machine without changing any hardware configuration for mobile commerce Cross-platform application integration based on K-javalWeb Service Mobile payment application development technologies such as SMS, STK, GSM / GPRS, GSM / USSD, WAP, K-JA V A, CDMAIBREW, have their own advantages and disadvantages, how to segment their business for the different user groups to provide cost-effective, userfriendly interactive directly related to the success or failure of mobile commerce. K-JA VA middleware technology based on Web Service could be good compatible with various types of terminals, and could be a very good agreement with the 3GPP TS compliant. It will be enormous pressure on the server side owing to a large amount of mobile business user access and multi-concurrency. How to handle a large number of services access and improve the quality and stability of the mobile commerce may become the bottleneck problem. We adopted SOA Framework technology which mobile commerce functionality is packaged as EJB3.0 components deployed to JBOSS application server, mobile phone client access mobile commerce functionality through Web Service components at the application layer. ESB technology makes it possible to integrate different mobile commerce services developed by different languages in the legacy applications, as shown in Figure 1. Figure 1. Application integration using ESB In order to being compatible with 3G mobile commerce, and facilitating the existing software-based encryption to transform to the hardware encryption, it is necessary to packaged the hardware encryption into a standard function interface or message interface for redevelopment. Due to the rampant cell phone virus, mobile commerce hardware encryption security solutions is becoming a hot research, this paper will propose a hardware-based encryption solution with SDIO interface. Now smart phones are generally equipped with SDIO card interface. SDIO allows manufacturers to develop product expansion by adding hardware in the SDIO compatible slot. Many additional products based on the SDIO are development, including mobile commerce electronic key. SDIO compatible slots are available for many PDA and mobile phones, and plans to encryption devices for mobile commerce. Tax Machine commonly use EPROM as tax- memory module to record tax control data for the completion of tax control function so that the encryption system easy to crack, resulting in tax losses. We proposes mobile phone implementing Tax Machine function with 32-bit high-performance central processing unit and SD tax control card by a machine a card, will be seamless method of upgrading mobile phone into a Tax Machine without changing any hardware configuration for mobile commerce. 84

4 3. M-Commerce System Design 3.1. Principle of Fiscal Cash Register Currently the differenence between ordinary Electronic Cash Register and Fiscal Cash Register in the market is that the later is generally composed of IC card reader module, tax-memory, and invoice-memory. Fiscal Cash Register includes the user IC card and tax control IC card for the tax data generation, transmission and management. The user IC card is used for tax data transmission between Fiscal Cash Register and the corresponding tax control POS management systems: In the specified date, the taxpayer complete the appropriate safety certification to Fiscal Cash Register using the user IC card and tax control IC card, collect tax data (stored in a tax-memory), invoices data (stored in the invoice memory), etc., send the data to the tax authorities' Fiscal Cash management system, the tax authorities return information to Fiscal Cash Register and tax control IC card by the user IC card. Tax control IC card is used to control tax-data, to identify the identity of Fiscal Cash Register, mutual authentication of the user IC card and tax administration system, to store user information and to ensure that data is not tampered with tax control, to generate Invoice Tax Code and Tax data transmission electronic signatures. With the introduction of the national standard GB and national series of principles and policy formulation, promotion and application of Fiscal Cash Register is entering a stage of rapid development. But due to use of smart cards as a medium, a user has to hold a user IC card to the tax administration which is often not convenient enough, sometimes will also affect the user's work under special circumstances. In January 9, 2008, China's invention patent (No ) disclosed a built-in tax control machine which proposed to embed tax control machine into Pc. The solution is not only complex, high cost, and cannot meet the user's mobile business needs. With the rapid development of mobile communication technology, mobile terminals (mobile phones, PDA, etc.) has gradually become a personal business platform, a large number of small businesses have mobile phones, they have strong desire to transform the phone into a mobile POS which bring mobile commerce tax control a pressing issue. communicating with the administration console and the security module setting in the mobile phone, it also includes mobile phone installed with the implementation for the tax-data input / output operations and the liaison unit, which is to contact the device including credit card, printing equipment via the data communication interface, such as data lines, non-contact IC card, IrDA, Bluetooth, RFID, NFC and USB device control interface. Mobile commerce business processes using Fiscal Cash Register is designed as follows: CD Tax system is a front-end of tax administration system which can be installed and to be updated on the smart mobile phones by the way of OT A Tax system provides friendly interface through the smart phone display for the operator, receiving commerce data and control information from the smart phone's keypad and credit card equipment, and provides customers the transaction information through smart phone Tax system pass the invoice information and the sale of commodity information to the tax control IC card, receive generated encryption key in accordance with the invoice information and the sale of goods to generate invoice data which is stored on the invoice memory for the printer to print invoices; Tax system generate tax control data based on transaction data, reporting data and single volume invoice data stored in the tax-memory. At the same time, it stores report data and invoices data on the user IC card and read monitoring data from the user IC system support remote tax returns, the daily management for back-end server, commodity information uploading and downloading by connecting the network communication control interface. [5] 3.3. Implement Project In actual use, the communication devices can also choose mobile phones, portable computers, PC or PDA, security module can be a SIM with security feature or IC card with TF (T-FLASH) card interface. The solution for mobile phones and IC card with the TF card interface is shown in Figure Operate Process This solution is to provide a simple and easy way to operate tax control for mobile commerce which can greatly facilitate the user's needs. It adopts a technology program: a mobile tax control devices, including the tax control system installed on of mobile phone 5 14i,, 6 Figure 2. Mobile tax control solution 85

5 Control system 2 is a J2ME application installed on the mobile phone 8 with TF card slot 9 plugged the user IC card 3 and tax control IC card 4; it connects to credit card equipment 7 and the printing device 6 via RFID or infrared interface 5, and connects to the tax administration hosts 1 via 3G wireless interface 10. We achieve the Fiscal Business through the following steps: control system provide operator interface through display of mobile phone, receive data from keyboard of mobile phones, and sales data and control information from credit card device through RFID or infrared interface, provide customers withdraw information by display. If the credit card device is the second-generation ID card reader, the control system read the second-generation ID card number and password whose combination is sent to server-side authentication. Actually mobile phone has been converted into a mobile tax control POS machines, users need not go out for paying taxes. Here we give the design of the user IC card and tax control IC card shown in Figure 3: the chip ATmega 16L is a system control chip, chip-cg 100 is a low-power data communication transceiver chip to support SDIO 1.0 TF card specification produced by C-Guys Ltd., which use its high-speed UART (HS-UART) interface to connect ATmega 16L for the serial communication. Security module adopts the Ming-Hua company's smart card chip SmartCOS-XC, in line with IS protocols. The ATmega 16L controls card reset and 110 port. Tax system will send invoice information and sale information through CG100 to SmartCOS-XC completion of data encryption, decryption and digital signatures, as well as secure storage. In the implementation of the case, TF card can be replaced by SIM card, SD card, STK cards and IC card with a USB interface. The RFID or infrared transmission interface can also be replaced by Bluetooth interface, NFC interface and data line interface instead. 1F COl 00 UAR ATlrega 16L ISO 7816 Srmrta:>s-XC 4. Conclusion This paper presents an innovative mobile business solution, whose biggest feature is that using existing tax networks, key types and authentication methods, replacing tax control machine by the smart phones, the user can easily use smart phones to select the appropriate process to pay for the tax in fiscal way; high-quality input and output devices, information storage devices and signal transmission interfaces of smart phones are existing equipments and thus there is no need for additional facilities and cost; by using this technology, smart cards can be exempted from the restrictions. Any smart phone can complete the process, which greatly facilitates users; through the OT A, the user can easily update and upgrade tax control system on the mobile phone. Along with the third generation mobile communication networks, the mobile phones and PDA are gradually developed into a powerful platform for personal business. This method can convert mobile phone into a low-cost mobile phone business sales terminal, which significantly reduces the cost of mobile POS and greatly enhance the quality of the mobile POS hardware. Compared with the current POS on the market, it has obvious quality and price advantage. 5. Acknowledgment The authors wish to thank Ningbo Municipal Natural Science Foundation of China for contract 2009A and Zhejiang Scientific and Technological Foundation of China for contract 2009C31173, under which the present work was possible. 6. References [1] P. Tiejun, Zh. Leina, "M-commerce Security Solution Based on the 3rd Generation Mobile Communication", ISCSCT2008, IEEE Computer Society Washington, DC, USA, , pp [2] John A, "Authentication & key agreement for offportal mobile applications", Information Security Tech, Elsevier Advanced Technology Publications Oxford, UK, , pp User IC card ftax control IC card Figure 3. Design of tax control card [3] M. Stig Frode, "On-line e-wallet system with decentralized credential keepers", Mobile Networks and Applications, Kluwer Academic Publishers Hingham, , pp [4] P. Tiejun, Zh. Leina, "Mobile Payment System by Electronic Security Key", WSEAS TRANSACTIONS on SYSTEMS, WSEAS, Greece, , pp