Performance of different mobile payment service concepts compared with a NFC-based solution

Performance of different mobile payment service concepts compared with a NFC-based solution and Thomas Bingel Hochschule Darmstadt University of Applied Sciences Department of Computer Science Germany ICIW: 26th May 2009, Venice/Mestre, Italy

Agenda 1. Introduction a. Authentication mechanisms b. Remote and proximity authentication c. Used technologies and authentication methods 2. Implementation and test environment a. Interactive Voice Response (IVR) b. Short Message Service (SMS) c. Wireless Application Protocol 2.0 (WAP) d. Near Field Communication (NFC) e. One Time Password Generator (OTP) 3. Results and evaluation a. End-to-end service time benchmarking b. Overall comparison and evaluation c. Conclusion and outlook 2

Authentication mechanisms Something you know PIN, Passwords, etc. Something you have Credit Card, ID Card, Mobile Phone SIM Something you are Fingerprints, retina Someone you know A Friend, Social Network Combinations of course increase the security 3

Remote and proximity authentication Remote authentication Proximity authentication Making payments world wide Making payments only at one place 4

Used technologies and methods Application Technologies Authentication Method IVR IVR (Envox), Java (J2EE), Oracle Something you know Something you have SMS SMS-Gateway, Java (J2EE), Oracle Something you have OTP Generator SMS-Gateway (WAP Push), Java (J2EE and J2ME), GPRS, MySQL NFC WAP NFC, Java ( J2EE and J2ME), GRPS, MySQL SMS-Gateway (WAP Push), Java (J2EE), GPRS (WAP), MySQL Something you know Something you have Something you know Something you have Something you know Something you have All demo service concepts with its used technologies and authentication methods. 5

General registration SMS Gateway provider paybox SMPP Database SMS Gateway Web server Confirmation Message Uses Web Service Main components for the registration are: Web server (Apache Tomcat) SMS-Gateway, with SMPP (short message peer-to-peer protocol) MySQL-database 6

Use case for general registration Goal Preconditions Step Actor Register mobile phone in the paybox demo system. GSM/GPRS/UMTS, SMS, WAP 2.0, J2ME capable phone 1 Consumer Wants to register at the paybox demo system. 2 Consumer Visits the paybox register website. 3 Consumer Enters phone number (MSISDN), PIN, and phone type. 4 Consumer Submits data. 5 paybox Confirms registration and saves data into the database. 6 paybox The consumer is now registered and ready to access the payment demo applications. 7 Paybox Sends SMS to the consumer as a confirmation. 7

Components of the IVR demo system paybox Calling Database IVR server Web server Uses Web Service Automated voice calls Inbound and outbound calls over GSM Interact with a person Can be used for: Provide information to the consumer Redirect consumers to the right agent Retrieve information from the consumer Example: Deutsche Bahn +49 (1805) 22 11 00 Oracle database: To store customer data, transaction data and payment information Web server: Apache Tomcat to provide web front-end to enter consumer s phone number 9

Sequence diagram IVR Consumer Merchant Payment method "IVR" Redirect to paybox Requests paybox page Requesting phone no. Enters phone no. paybox Technologies: Companies like Envox provide an Integrated Development Environment (IDE) Text To Speech (TTS) or Speech Recognition (SR) IVR Call & Voice prompt Picks up phone Enters PIN Submit PIN Confirmation Confirmation Except for the recognition of complete sentences the dialog between the IVR system and the caller looks e.g. like this: IVR: Please speak the 4 digit PIN into the phone Caller: # # # # IVR: The PIN is correct. We confirm the payment. Thanks for choosing 10

Components of the SMS demo system SMS Gateway provider paybox SMPP Database SMS Gateway Web server Payment information Uses Web Service Sending and receiving text messages Asynchronous service Up to 160 characters Different SMS types Flash SMS show up immediately SMS Push startup Java ME applications SMPP (short message peer-to-peer protocol) 11

Sequence diagram SMS Consumer Merchant paybox Paybox demo system: Payment method "SMS" Redirect to paybox Requesting money Requesting phone no. Enters phone no. Receive SMS Confirm with "YES" Confirm Confirmation Send SMS Oracle database to store customer data, transaction data and payment information Web Server (Apache Tomcat) to provide web front-end for the consumer to enter the mobile phone number SMS-Gateway to send and receive Short Messages to/from the consumer 12

Components of the WAP demo system SMS Gateway provider paybox SMPP Database SMS Gateway Web server WAP WAP Push Uses Web Service Basically: Access the internet from a mobile phone or PDA WAP 1.2: Accessing WAP pages written in WML over WSP, WTP (WTLS) and WDP WAP Push and User Agent-Profile WAP 2.0: XHTML pages with end-to-end HTTP Sending multimedia messages (MMS) 13

Sequence diagram WAP 2.0 Consumer Merchant paybox Payment method "WAP" Redirect to paybox Requests paybox page Request phone no. Send phone no. Send WAP Push Receive WAP message Requesting WAP page Send information about the payment Send PIN Confirmation Confirmation 14

Components of the NFC demo system paybox GPRS/UMTS Database Web server Uses Web Service Combines the interface of a smartcard and a RFID reader into a single device storing credit cards Communicating with another NFC device Speed: 106-424 kbit/s Range: 10 cm Initiator ISO/IEC 14443 15

Sequence diagram NFC Consumer Merchant paybox NFC application areas: Payment method "NFC" Mobile commerce in general creates new payment Confirms creation E-Wallet / smart Wallet Keys (for car, house, office, hotel room, etc.), smart poster Touches RFId tag Application starts Ticketing (Movie Theater, Plane, event, Public transportation, etc.) Requesting open payment for POS Remote configuration (W-LAN) Sends payment information Submits PIN Confirms payment Confirms payment Transport initiator (Turn on Bluetooth, Send data, Turn off Bluetooth) Medical (Patient touches a medical device with the phone at home, the phone sends the report to the doctor) Initialize connection to other devices (Camera to printer, phone to headset) 16

Components of OTP demo system paybox Database Web server Uses Web Service Implemented as Java Micro Edition application (Midlet) over GPRS / UMTS with file, synchronization and authentication server Passwords that can be used only one time Password List Time synchronized Challenge response 17

End-to-end service time benchmarking Average [s] Median [s] Minimum [s] Maximum [s] 80% - Percentile [s] 90% - Percentile [s] 95% - Percentile [s] Standard deviation [s] Variance [s] IVR 35,60 36,00 25,00 39,00 38,00 39,00 39,00 2,98 8,86 SMS 27,93 28,00 20,00 36,00 34,00 35,00 35,00 5,08 25,80 WAP 38,14 39,00 29,00 47,00 44,00 45,00 46,10 5,51 30,37 NFC 21,98 22,00 18,00 26,00 24,00 25,00 26,00 2,39 5,73 OTP 26,43 26,00 18,00 35,00 29,00 31,00 32,00 3,29 10,80 Table: End-to-end service time measurements for the demo mobile payment service concepts 19

Comparison and evaluation Weighting Company Consumer Moderate High Tech. Conservative IVR SMS WAP NFC OTP Costs for consumer 10 4 3 5 95% 40% 80% 15% 80% Costs for company 1 8 5 6 55% 75% 90% 50% 70% Scalability 1 8 5 5 50% 70% 85% 85% 85% Security 10 10 10 10 95% 50% 90% 90% 95% Risk of fraud 8 8 8 8 85% 30% 80% 75% 75% Usability 8 7 8 4 70% 50% 70% 90% 80% Speed 8 7 8 3 75% 80% 70% 90% 85% Technology coverage 8 4 2 10 100% 100% 85% 15% 85% Lifestyle factor Maintainability Company: Conservative Company: High tech. Company: Moderate Consumer 5 5 10 1 50% 30% 90% 100% 50% 3 7 7 8 80% 80% 95% 40% 40% 81,33% 64,17% 84,92% 58,33% 76,50% 73,64% 55,83% 83,48% 75,30% 73,26% 74,63% 60,00% 83,75% 69,71% 75,51% 82,82% 56,69% 81,45% 63,95% 78,63% 20

Market penetration and coverage 21

Thank you very much for your attention! Any questions? Questions and discussion 22

Average score over time 23