Oxford scientists develop security protocol for m-payments

Isis Innovation, the University of Oxford's technology transfer company, is looking for commercial partners to help develop a new cryptographic application for securing person-to-person mobile payment transactions.

  0 4 comments

Oxford scientists develop security protocol for m-payments

Editorial

This content has been selected, created and edited by the Finextra editorial team based upon its relevance and interest to our community.

The technology has been developed by a team of Oxford University scientists led by professor Bill Roscoe, who specialises in cryptographic protocols and the theory of security.

It uses a system in which the payer checks whether a short numeric code (4-8 digits for most applications) generated within their own phone is the same as the one generated by the payee. This number is random and does not have to be kept secret. This ensures that the customer's mobile is connected to the correct store, or to the mobile of the person they wish to pay.

Payment then occurs without the exchange of sensitive details such as credit card numbers or PIN. It is expected that no hardware modifications to the phones will be needed, and the Oxford team have built demonstration systems to show a variety of uses.

Says Roscoe: "The core of our technology is a new security protocol that enables strong cryptographic keys to be created with the least possible work. The key to the protocol is that it prevents anyone from doing any searching to break into the transaction."

He says that banking industry plans to phase out the use of cheques in the UK by 2018 has heightened the need for secure replacement payment systems.

"A key requirement of new payment systems will be the ability to make payments from person to person, such as paying a builder or a friend," says Roscoe. "What we have is technology which enables anyone to easily create a secure connection between two devices: it can work via Bluetooth, WiFi, the internet or across ordinary telephone or SMS connections.

The next steps are for further demonstrators of the technology to be built and for these to be taken through industry testing. Standards will need to be developed for how the protocols are to be used and how to prevent unauthorised use of the payment features on phones, says Isis which welcomes inquiries from commercial partners interested in being involved in further development.

Sponsored [New Event Report] AI’s Role in the US Financial Services Sector: Balancing Innovation and Compliance

Related Company

Comments: (4)

Steven Klebe

Steven Klebe Retired at Ex CyberSource, Google, Stripe

The primary flaw that I see in this approach is the statement, "It uses a system in which the payer checks whether a short numeric code (4-8 digits for most applications) generated within their own phone is the same as the one generated by the payee."

The security has to be embedded for mass adoption.  It cannot involve the users, except perhaps for a one-time set up but even that introduces significant friction.

A Finextra member 

Sadly I do agree that anything requiring the users extra awareness and input will ultimately be reliant on the user for its successful operation. However in the case of sensitive communications such as m-payments it is reasonable to assume that the user will exercise a certain amount of caution and effort when making a payment.

The human factor seems to be the inherent point of weakness with almost all security methods, thus we must protect the majority of users from themselves.

My preferred approach to virtual security is through the use of embedded and automated technology that requires little or no human intervention to set-up or use.

I note the statement, "Standards will need to be developed for how the protocols are to be used and how to prevent unauthorised use of the payment features on phones". Isn't this the point of any security method regardless of the protocol in use?

Ketharaman Swaminathan

Ketharaman Swaminathan Founder and CEO at GTM360 Marketing Solutions

My company is interested in becoming a commercial partner. Would appreciate any pointers on who to contact at ISIS Innovation.

A Finextra member 

I am not going to attempt to debate tech-stuff with ISIS (I am sure its very 'Whizzy'). However I can comment on 'Commercial'...... Commercial, to me, has at least two major meanings, (1) surrounds funding, and (2) focuses on routes to market. ISIS may be looking for (1)  but what they really need is (2).

A business model predicated on paying a mate back £10 or to paying a builder/white van man (dont they always prefer cash in hand?) is going to struggle.... Therefore the trick, for ISIS will be to find the Niches from which they can generate traction and revenues and then emerge into a wider market.  These Niches do exist, generally in the developing world!  So find your route to market first ISIS, tune your product in the Lab, then find funding & delivery partners, you will stand a much better chance of going the distance. Good luck.

[On-Demand Webinar] Next Gen Payment Processing: How banks can embrace the futureFinextra Promoted[On-Demand Webinar] Next Gen Payment Processing: How banks can embrace the future