Smart Card & Identity News A New Flavour for eCash

Such standards help the industry work together and benchmark best practices but they remain just one
fundamental element of contributing to successful mobile payment security. Technology that makes the security
of provisioning mobile payment applications as secure as issuing cards is also required, to build that much
needed consumer confidence.
Consumer fear around fledgling mobile payments techniques often centre on security issues. Much of this
reticence to adopt mobile payments comes from the perceived risk of data being intercepted during a
transaction. But threats exist at every stage of the mobile payment lifecycle, including how to get a payment app
onto a phone securely and efficiently in the first place. Building the data needed to issue a payment application
and create the secure messages to personalise a handset can be a lengthy and inefficient process, the numerous
cryptographic functions posing a risk of exposing sensitive data.
This initial set-up process or ‘provisioning’ normally happens over-the-air (OTA). It is a process that increases
security risks due to the number of parties involved - typically the payment application provider (usually a bank),
a Trusted Service Manager, the Mobile Network Operator, and the end user. A critical success factor is keeping
this process highly secure to ensure that no data is compromised. Successful provisioning uses unique
personalisation keys, to not only protect the loading of information onto a device but also the subsequent
transactions made by the application.
As secure as traditional cards
By applying the latest cryptography methods, users can ensure that ‘provisioning’ happens as securely as possible
and at the same level as issuing traditional payment cards. Providers of physical cards tend to prefer Hardware
Security Modules (HSMs), which generate and protect the encryption keys that are essential to managing
issuance risk. This approach is also relevant for provisioning services to a mobile phone and can greatly simplify
the process while simultaneously avoiding the vulnerability of keys stored in software. Overall, the main benefit
of an HSM is to secure encryption keys and sensitive data in a way which ensures that such data is never
exposed. In this way, the risk for the service provider is significantly reduced.
However, while encryption is essential to the security of mobile payments, it isn’t the sole answer. For maximum
security in this new payments channel, encryption must be teamed with authentication technologies that provide
protection for data exchange and authorisation.
Minimise the risk
As the mobile payment world continues to evolve at lightning speed, industry best practices are far from being
agreed, with operators and related parties still undecided about who should control the mobile wallet. But one
thing that lies firmly beyond discussion is that security remains the primary barrier to adoption for most
consumers.
Overcoming this concern is no easy task, requiring a combination of robust standards and best practice, coupled
with the right technical path to guarantee the experience is safe from the second that a user decides to download
a payment app. If any business wants to take advantage of the impending explosion in mobile payments, security
needs to be at the foundation of their approach to minimise risk and encourage widespread consumer adoption.
Smart Card & Identity News • March 2012
11