Implementation of a Micropayment System for Mobile Devices. Diplomarbeit

Transcription

1 Implementation of a Micropayment System for Mobile Devices Kennzahl J151 Matrikel-Nr.: Diplomarbeit Eingereicht von Klaus Brosche am Institut für Informationsverarbeitung und Informationswirtschaft, Abteilung für Angewandte Informatik insbesondere Betriebsinformatik an der WIRTSCHAFTSUNIVERSITÄT WIEN Studienrichtung: Betriebswirtschaft Begutachter: Ass.Prof.Univ.Doz. Dr. Andreas Geyer-Schulz Wien, Tag. Monat Jahr

2 Ehrenwörtliche Erklärung Ich erkläre hiermit ehrenwörtlich, daß ich diese Diplomarbeit selbstständig verfaßt, keine anderen als die angegebenen Hilfsmittel und Quellen verwendet, mich auch sonst keiner unerlaubten Hilfsmittel bedient und diese Diplomarbeit weder im In- noch im Ausland in irgendeiner Form als Prüfungsarbeit vorgelegt habe. Klaus Brosche Tag. Monat Jahr

3 Inhaltsverzeichnis I Part I Theory 1 1 Introduction 2 2 Payment Different Kinds of Payment and their Transfer Costs cash banktransfer credit card and Secure Electronic Transaction Protocol ec - card Micropayment What is Micropayment? Existing Systems e-cash paybox How to avoid Transfer Costs? Market Perspectives Mobile Devices Types of Mobile Devices Special Requirements Communication Standards for Mobile Devices SMS WAP Irda Bluetooth GSM GPRS UMTS Mobile Security Standards HBSCI

4 4.4.2 Wireless Transport Layer Security Smart Cards Architecture Usability Programming Languages Java 2 Micro Edition The architecture of J2ME J2ME profiles Java 2 ME and its Alternatives II Part II Practical 8 7 Analysis 9 8 Design 10 9 Prototyping Maintainance Source Code 13 4

5 Zusammenfassung The goal of this dissertation submitted for a diploma is to describe the basics of micropayment which are necessary to implement a payment system on a small device like a cellular phone and to write a prototype of such a payment system. It will be devided up into two parts. The first part will handle the theory of micropayment, like discussing the term and describing existing communication protocols, mobile payment and the technologies which are used. The second part will be the practical one in which i will try to design and implement such a micropayment system on a cellular phone as a prototype. The term micropayment consists of two words. The first one micro describes the value of a good which is offered for sale - the amount we are talking about, is in the range of 1 cent up to 10 euro. Second part of this term is payment. It describes how the payment - we also can say transfer of the amount - is executed. The main question in this context is: How large are the costs for this transfer and how can we reduce the transfer costs for a payment transaction to verify that there is a maximum profit for the sale of the good? To describe the problem of transfer costs i will list the costs for the encashment of: payment on delivery: sending an invoice: 3 euros 2 euros paying by creditcard: 3% of the turnover plus a fixed accounting fee - all in all about 1 euro paying by ec-card: 1 euro account debit: 3 cent but if the payment is refused the cost raise up to 4 euros

6 For example if you buy a cup of coffee in a shop for about 1.50 euro and pay it by credit card and deduct the costs for payment the turnover (without transfer costs) for the shopowner will be 50 cent. He still has to deduct the costs for the coffee, for the rent of the shop, and and and. This example should ilustrate the need for real micropayment systems which can reduce the transfer costs, provide a maximum of profit and which are as convenient as a credit card and as cheap as cash payment. As we are already living in a mobile world - for example more than 81% [Wirtschaftskammer, 2002] of the austrian population are mobile phone users - the next step for micropayment is to combine it with mobile technologies. This idea to combine these two technics is not a new one. Existing mobile payment systems are traditionaly based on a client - server system, where all the status information is situated on the server side. I personaly think there is a need to break this tradition and try to bring the logical part of the payment to the client side. For such a system it is possible to use the smart card which is used as SIM card to store the data of the cellular phone provider. On this card the whole source code as well as passwords and payment information can be stored. Existing mobile payment systems work with relativly complex technologies which make it rather difficult to use them. Paybox is a german company which used strategic partnerships like one whith the Deutsche Bank to build up a payment system, to guarantee a large acceptance of their standard in five countries. As an first example the next graph [1] will show the steps which are necessary to run a payment via a mobile phone for buying a good using the paybox system. 2

7 customer tells shopassistent phone number shop calls paybox center and submits customer data paybox calls customer to verify the payment data customer verifies payment with password amount will be paid via account debit Abbildung 1: Payment via Paybox 3

8 In my opinion this procedure for a simple payment transaction is much too complicated. Also the transfer costs of such a payment are very high. The customer hast to pay a yearly fee, the shopkeeper pays 0.25 euro for each transfer or at minimum 5 % of the price. Also the costs for the submitment of the customer data hast to be paid by the shopowner. This shows that the paybox system was not primary designed as a micropayment facility. Of course there are not only disadvantages - one big advantage is the security feature which is offered through its used complexity. As shown in the last paragraph existing mobile payment systems are not designed for micropayment and this is why i will try to design and implement a system which does not need a lot of communication with other systems and which will be easy to use. How could such a system work? The technology will not be a completly new one. The system will be modelled on the existing Quick Chip technology. Quick Chip has the advantage that it does not need to communicate with an external system for each payment, contrasting to the payment with an eccard. This is why the transfer costs are very low and also the yearly fees for the shopholders are lower. The only disadvantage are the security lacks. For example if a Quick Chip is lost everybody can use it. Mostly the mobile services communicate via voice, short message service or wireless application protocol. Why should it not be possible to use existing technologies like the infrared interface? This is what i would like to implement, an open system which is able to communicate via several interfaces and which offers a little bit more security by using a personal identification number to verify payments. Like the Quick Chip it should only work for small amounts. In future there could be a combination of existing systems like the paybox for larger amounts (offering large security features) and a mobile micropayment system easy to use. The implementation will be executed in java2 micro edition which is a programming language designed for devices with small storage capabilities and slower central processing units. The main advantage of this programming language is that the code can easyly be transported onto other platforms. 4

9 Teil I Part I Theory 1

10 Kapitel 1 Introduction 2

11 Kapitel 2 Payment 2.1 Different Kinds of Payment and their Transfer Costs cash banktransfer credit card and Secure Electronic Transaction Protocol ec - card 3

12 Kapitel 3 Micropayment 3.1 What is Micropayment? 3.2 Existing Systems e-cash paybox 3.3 How to avoid Transfer Costs? 3.4 Market Perspectives 4

13 Kapitel 4 Mobile Devices 4.1 Types of Mobile Devices 4.2 Special Requirements 4.3 Communication Standards for Mobile Devices SMS WAP Irda Bluetooth GSM GPRS UMTS 4.4 Mobile Security Standards HBSCI Wireless Transport Layer Security 5

14 Kapitel 5 Smart Cards 5.1 Architecture 5.2 Usability 6

15 Kapitel 6 Programming Languages 6.1 Java 2 Micro Edition The architecture of J2ME J2ME profiles 6.2 Java 2 ME and its Alternatives 7

16 Teil II Part II Practical 8

17 Kapitel 7 Analysis 9

18 Kapitel 8 Design 10

19 Kapitel 9 Prototyping 11

20 Kapitel 10 Maintainance 12

21 Kapitel 11 Source Code 13

22 Literaturverzeichnis [Choi et al., 1997] Soon-Yong Choi, Dale O. Stahl, and Andrew B. Whinston. The Economics of Electronic Commerce. Macmillan Technical Publishing, Indianapolis, IN, [Fritz Steimer, 2001] Mike Spinner Fritz Steimer, Iris Maier. mcommerce: Einsatz und Anwendung von portablen Geräten für mobilen ecommerce. Business and Computing. Addison-Weseley, München, [Geer and Goss, 2001] Ralf Geer and Roland Goss. m-commerce, Geschäftsmodelle für das weltweite Internet. Reihe e-business. Verlag Moderne Industrie, Landsberg/Lech, [Hansmann et al., 2001] Uwe Hansmann, Martin S. Nicklous Lothar Merk and, and Thomas Stober. Pervasive Computing Handbook. Springer, Berlin, Heidelberg, New York, [Hassler, 2001] Vesna Hassler. Security Fundamentals for E-Commerce. Computer Security Series. Artech House, Norwood, MA, [Schreiber, 2000] Gerhard Andreas Schreiber. Schlüsseltechnologie Mobilkommunikation: mcommerce - das Handy öffnet neue Märkte. Dt. Wirtschaftsdienst, Köln, [White and Hemphill, 2002] James P. White and David A. Hemphill. Java2 Micro Edition. Manning Publications Co, Greenwhich, CT, [Wirtschaftskammer, 2002] Österreich Wirtschaftskammer. Der telekommunikationsmarkt in zahlen

23 [Choi et al., 1997] [Hansmann et al., 2001] [Hassler, 2001] [White and Hemphill, 2002] [Geer and Goss, 2001] [Fritz Steimer, 2001] [Schreiber, 2000] 15