A new security architecture for mobile commerce
Michael Turega Chongyan Ren
Department of Computation
University of Manchester, Institute of Science and Technology (UMIST)
Sackville Street, Po Box 80, Manchester M60 1QD, UK
Abstract: The next generation network (NGN), possible using IPV6, will seamlessly combine broadband wireless
networks and wired IP networks together. This convergence of mobile and wired IP access technology will
provide new avenues for growth, creating more opportunities and attracting more users in mobile commerce. In
this environment, end-to-end security become more and more important, its absence hinders the mass acceptance
of m-commerce. Cryptography is the foundation of security in mobile commerce and traditionally, the RSA
public key scheme is commonly used in e-service system to construct the security infrastructure. This paper
proposes a security solution for mobile commerce systems based on the ECC (Elliptic Curve Cryptograph) and
ECDSA (Elliptic Curve Digital Signature Algorithm) public key schemes in order to meet the new requirements
of small computation machines in wireless environment. Also, because wireless access is intrinsically more
unreliable than fixed access, there is a need for new transaction protocols to operate efficiently in this
environment, in particular the need for a new non-repudiation protocol. This paper identifies the initial work in
these areas.
Key words: mobile commerce, wireless/mobile access, ECC, security
1 Introduction
In recent years Internet technology has emerged as the
major driving force for new developments in
telecommunication areas, the Internet has also become
part of people’s normal life. As the Internet goes
mobile there will be a trend towards moving Internet
applications onto mobile devices.
Mobile commerce is a natural result of mobile access
will soon become commonplace [2]. New
technologies will allow portable device to access the
Internet more conveniently and faster, growth in
wireless Internet access is expected to surpass the
traditional fix Internet access in the near future. This
has opened up tremendous opportunities in the mobile
commerce market [7].
End-to-end Security and speed of information
delivery are both main concerns in electronic
commerce systems [3] [8]. Traditionally, the RSA
public key scheme is used to construct the PKI (Public
Key Infrastructure) and is now well accepted in fixed
IP networks, It is however, not necessarily suitable for
mobile commerce access via small and portable
device such as mobile phones and Personal Data
Assistants because of the constraints in these mobile
device: a less powerful CPU, less memory, limitation
on power consumption, etc. To solve the problem, in
this paper, an ECC public key scheme is proposed
providing equivalence in security but with a much
shorter key length.
Mobile Internet access today is through existing
wireless networks such as 2G GSM systems and 2.5G
GPRS, providing good coverage in urban areas, but
with limited bandwidth. Third generation CDMA
systems potentially bring new communication
properties into the mobile commerce transaction
process, but as yet coverage is very sparse and the
network is unproven in mass usage. The properties of
wireless networks are related to the characteristics of
the wireless environment (for example limited
bandwidth, limited geographical coverage, long
latency, less stability of connections, less predictable
availability) [3] and call for a new transaction
protocols (in particular payment and non-repudiation)
which should be able to operate within the limitations
of wireless networks.
hotels, theatre tickets, placing a bet or most other ecommerce activities will become commonplace,
occurring when the requirement arises, not saved up
for a session in the office.
This paper examines the prospect for mobile
commerce; provides an analysis of security
requirements and discussed the usability of the ECC
public key scheme. Finally, an outline proposal for a
secure mobile commerce model is presented.
3 Security issues in M Commerce
2 M commerce, new frontier
In order to be successful in mobile commerce, security
measures must be strong enough to protect the user from
illegal abuses and to win the confidence of the participated
entities [5].
The advantages that Mobile Commerce brings in
terms of convenience and time saved will inevitably
lead to its increasing use. [5]
3.1: Security requirements in electronic
commerce
In an e-commerce system, trust must be established
between the user end and server end. In order to
achieve trust the following security function must be
achieved:
2.1: Telecommunication convergence
The
development
of
existing
and
new
telecommunication technologies, such as GPRS,
UMTS, 3GPP, wireless LAN/WAN, means that
mobile/wireless users can conveniently and
seamlessly access Internet services. The Internet will
continue to become more and more available and
ubiquitous. Data and information based applications
will play an ever increasingly important role in
people’s lives. [1].
 To ensure privacy of transmission content during
the conference.
 To ensure each party be able to authenticate its
counterpart [5], to make sure the message
received really from the trust counterpart.
 To achieve end-to-end confidentiality and
integrity during message transmission. [4]
 To supply non-repudiation service, which prevent
entities from denying the bargained business deal.
2.2: Mobile commerce, a new frontier
Electronic commerce, despite recent setbacks has
matured and continues to see phenomenal growth. So
far most e-commerce system development involves
wired infrastructures which are inflexibility and
inhibit use mainly to home or office. Fortunately, the
possibility of making the Internet accessible via
mobile telephones and PDAs has generated an avenue
providing new and more convenient e-commerce:
mobile commerce. We believe the combination of
wireless communication networks together with
ubiquitous IP networks will be a driving force to the
growth in mobile commerce. [2]
Therefore, in order to provide a reliable and security
e-commerce system, privacy of the transmission, endto-end confidential and integrity during message
transmission; together with non-repudiation of a
transaction should be guaranteed.
At present, PKI and CA system based on RSA public
key scheme are widely used in fixed e-application
systems. Most security protocols involve these
technologies.
3.2: Problems of wireless computation device
Mobile commerce together with other new mobile
applications will bring revolutionary (and as yet
unclear) changes to people‘s lifestyle. In the same
way that the mobile telephone has freed individuals
from the tyranny of the fixed line, mobile commerce
will free people from the fixed computer. Booking
Mobile commerce, should not only guarantee the ecommerce security properties, but should also take
into account the new problems encountered. These
are:
2
 Constraints (Low memory, less powerful CPU
and limitations on power consumption) of small
computation machine [3] [4].
 Time delays during a transaction. In general, the
mobile user will require a rapid response because
of the nature of the activity.
 Bandwidth constraints using wireless Internet
access
 Unreliable and potentially intermittent network
service
Fig. 2 End-End m commerce system
3.3: Secure by ECC public key scheme
The above limitations of mobile Internet access by
wireless device make the current crypto algorithms
(RSA) and transaction protocols unsuitable for
constructing a mobile commerce system security
infrastructure. Hence direct secure services between
mobile device and mobile commerce server can be
problematical.
Elliptic Curve Cryptosystem (ECC) potentially
provides equivalent security to RSA based systems
but with a much shorter key length and ECC is
becoming accepted as a viable alternative to the
public-key cryptography algorithm RSA in small
wireless computation device. [6]
One current approach used today in mobile commerce
systems is to adopt Agent Technology (figure 1). In
agent-based systems, security is handled by the agent
where messages sent by a mobile device are decrypted
and re-encrypted (usually with SSL) before being sent
to the mobile commerce server. Despite the
connection between agent and web server being
secure, the end-to-end security is compromised. This
results in a serious deterrent for any organization
considering a security-sensitive service for wireless
user.
The following (Table 1) is the key length comparison
of ECC and RSA providing equivalent security.
Time to
RSA
ECC
RSA/ECC
break in
Key size
Key size
Key size
MIPS year
(Bits)
(Bits)
Ratio
104
512
106
5:1
108
768
132
6:1
11
10
1,024
160
7:1
1020
2,048
210
10:1
1078
21,000
600
35:1
Table 1. Key size equivalent strength comparison [9]
Table 2 shows the digital signature and verification
timings for RSA and ECDSA
Operation
RSA-1024
ECDSA-168
(e=3)
(Over GF (p))
Signature
43
5
Verification
0.6
19
Key Generation
1100
7
Table 2. Digital signature timing (in milliseconds) on
a 200MHZ Pentium Pro [9]
3.4: A non-repudiation m-commerce
transaction protocol
Fig.1 Agent based m commerce system
This leads us to consider an alternative security
infrastructure.
The use of Digital Signature technology can guarantee
that both participants in a transaction are who they say
3
they are and also can prevent repudiation of a
transaction.
at least 160Kbps on GPRS and possibly much more
on 3G although as yet the technology needs to prove
itself in a busy urban environment.
Potential repudiation can however occur when the
communication link fails during the two way
confirmation process. This problem is exacerbated by
a ‘less than perfect’ communications link. This is
precisely the situation that can occur with mobile
commerce. For example a mobile purchaser may click
the purchase confirmation button immediately before
the train he is travelling on enters a long tunnel and
the link is lost. Did the transaction go through? Was
payment taken? These are all relevant questions to
both e-commerce and m-commerce is it simply a
question of degree and the likelihood of this
occurring. In a wireless/mobile access environment,
the fact the user may be roving, intermittent coverage
of the service or shielding (especially in built up
areas) may result in short term or long term
interruptions to the network service.
SSL protocol based on PKI and CA architecture is
proposed in order to establish an end-to-end secure
tunnel between mobile users and mobile commerce
service providers. ECC is proposed as the Public Key
algorithm used to realise the CA certificate that means
we use ECC instead of the traditional RSA Public Key
algorithms. By using ECC, we gain equivalent
security to RSA but with less memory usage and CPU
consumption and at an increased speed [6].
In the application layer, a non-repudiation transaction
protocol is proposed in order to enable sufficient trust
between the participants to make m-commerce viable.
A security API library for applications would be
implemented in the mobile device. The ECC key pair
would be generated and the private key securely
stored within the mobile device.
We recognise the need (perhaps not fully achievable)
for a guaranteed non-repudiation protocol. Our initial
work has started looking at peer to peer and agent
based alternatives for providing this guarantee.
5 Conclusion and future work
In this paper, we present a proposal for a secure
mobile commerce infrastructure. We believe that the
ECC public key scheme is suitable and beneficial to a
security infrastructure for mobile commerce; it is
easier and cheaper to implement security functions for
small computational devices whilst still providing
users and mobile commerce system providers with
sufficient security and convenience.
4 A proposal of security solution
We present an outline proposal for a secure mobile
commerce system which will overcome some of the
shortcomings of existing system, in particular, the
need for more efficient encryption and the need for an
effective non-repudiation protocol. (Fig.3)
Security
W
A
E
Work is also progressing in the area on nonrepudiation protocols and to this end we are
undertaking practical experiments to determine the
dynamic properties of mobile Internet access via
GPRS, a prerequisite to specifying the requirements
for the non-repudiation protocol.
Payment Ware
Transaction ware
Client Security Ware
API
Wireless Profiled HTTP
Transport layer security
Wireless profiled TCP
(wireless access) IP
Wireless/mobile communication
References
[1] Lu, W.W.; “Compact multidimensional
broadband wireless: the convergence of wireless
mobile and access” IEEE Communications Magazine,
Volume: 38 Issue: 11, Nov 2000 Page(s): 119 -123
Fig. 3 Simple security m commerce architecture
First, it is assumed that the mobile user accesses the
Internet via GPRS or 3G mobile communication
networks. This theoretically guarantees a data rate of
4
[2] Varshney, U.; Vetter, R.J.; Kalakota, R.; “Mobile
commerce: a new frontier” Computer, Volume: 33
Issue: 10, Oct 2000 Page(s): 32 –38
[3] Soriano, M.; Ponce, D.; “A security and usability
proposal for mobile electronic commerce” IEEE
Communications Magazine, Volume: 40 Issue: 8, Aug
2002 Page(s): 62 -67
[4] Hsiao-Kuang Wu; Shu-Ching Yang; Yung-Tai
Lin; “The sharing session key component (SSKC)
algorithm
for
end-to-end
secure
wireless
communication” Security Technology, 2000.
Proceedings, IEEE 34th Annual 2000 International
arnahan Conference on, 2000 Page(s): 242 -250
[5] Van Thanh, D. “Security issues in mobile
ecommerce” Database and Expert Systems
applications, 2000. Proceedings, 11th international
Workshop on, 2000 Page(s): 412 -425
[6] Omidyar, G.; “Internet services over mobile and
wireless networks architectures and protocols”
Universal Multiservice Networks, 2000, ECUMN
2000. 1st European Conference on, 2000 Page(s): 1-4
[7] Gupta, V.; Gupta, S.; “Securing the wireless
Internet” IEEE Communications Magazine, Volume:
39 Issue: 12, Dec 2001 Page(s): 68 -74
[8] Liu, J.K.; Wei, V.K.; Siu, C.; Chan, R.L.; Choi, T.;
“Multi-application smart card with elliptic curve
cryptosystem certificate”EUROCON'2001, Trends in
Communications, International Conference on. ,
Volume: 2, 2001
[9] E.; Emarah, A.E.; El-Shennawy, K.; Mohammed,
“Elliptic curve cryptosystems on smart cards”
Security Technology, 2001 IEEE 35th International
Carnahan Conference on, Oct 2000
5