More Than Just Plastic

The magnetic strip credit card era is coming to an end. The technology is antiquated, prone to security vulnerabilities, and has no self-destruct capability if lost or stolen.

In its place are near-field technologies coupled with smart devices—think Apple Pay, Android Pay, Samsung Pay, digital wallets, MasterCard’s PayPass—and now near-field communication (NFC) chips inside of cards. But they all share one trait—there is little or no physical verification. As a result, security relies on techniques and technology, and the users of those devices.

“In the old days, when everyone did their banking in person, it developed relationships that not only helped to speed things through, but there was the physical verification of knowing an individual,” said Steven Woo, vice president of Enterprise Solutions Technology at Rambus.

That kind of personal security is long gone. But is technology a good replacement?

Security is relative
We pretty much know what the vulnerabilities for swipe card are, but we don’t yet have a firm handle on the same issues for contactless devices. According to Patrick Nielsen, senior security researcher at Kaspersky Labs, “the most interesting security issue at present is the convergence of virtual and physical payment technology.” Exactly what that will look like when it happens, is still a bit fuzzy.

Vendors claim they are more secure than magnetic-stripe cards because contactless cards contain a “key” that will, for each transaction, generate a unique verification code for that transaction. This is a one-shot activity that belongs to that transaction. The code cannot be re-used, so even if it is compromised it is useless for future transactions. Additionally, the transaction keeps some of the critical cardholder data from being transmitted.

“Intrinsically, NFC communications tend to be secure for a couple of reasons; first, it is very difficult to intercept such short range communications, and second, because the NFC technology itself is pretty secure, because it is low-level,” said Ian Morris, principal applications engineer for RF connectivity solutions at NXP. “However, NFC security is only as good as the weakest link, which is usually the software at one end or the other, or perhaps an intermediate link that supports the technology.”

However, there is an interesting conundrum that occurs with the contactless payment technologies. The leaders, Google and Apple, have found hackers are using these platforms to do exactly the thing they were designed to protect against. For example, noted Nielsen, Apple Pay is specifically designed to protect against ‘cross-channel’ fraud” [See reference 1]. “But with Apple Pay, if a hacker gets a data dump, they can take that data and add it to an Apple Pay card, and use Apple Pay without having the actual credit card.”

There is another big problem. At present, no identity verification is required in most cases. While there is security in the transaction itself, there is no way to verify the user. Currently, there is no signature, pin, or ID required by whomever is doing the transaction. For now, there are simple measures to detect unauthorized use, such as transaction dollar limits and number of transactions over a certain period of time. But for these technologies to become the de facto standard for mobile payments, better authentication procedures will have to evolve.

“The real question is,” said Woo, “can enough procedures and checkpoints be put in place that the transaction has all the appropriate means of trust and verification along the transaction path.”

There is traction on that. The trust and checkpoint can be technologies such as biometrics, which is high on the list of potential solutions. Fingerprint, retina, or other biometric identification integrated into the NFC transaction can add a significant layer of security.

Using biometric options, such as a fingerprint, eye scan, or a heart rate sensor as an additional form of authentication brings the transaction deep into the security realm. The combination of biometric authentication, an embedded secure element, and tokenization is a much more robust security platform than card swipes, taps or chip and PIN. In fact, Samsung’s Galaxy S5 is going to offer that exact model soon, allowing fingerprint authentication technology to make payments through PayPal. It isn’t into NFC yet, but once biometrics come into the mainstream, it will offer a platform that will take contactless payments to the next level.

Courtesy: Telecoms.com

The technologies
The fundamental benefit of contactless transactions is they offer greater security. NFC payments are designed as an improvement over the mag stripe cards because they implement a cryptographic protocol that prevents re-using information leaked from a particular merchant to make fraudulent transactions at a different merchant.

“Chip and pin or secure element devices also use strong cryptography with challenge-response capability so such devices are extremely difficult to clone,” said Steve Grobman, CTO of Intel Security.

One way it works is when payments are made with phones incorporating NFC capability, the tokenization platform creates a token with a unique code that is sent from the device to the merchant’s NFC-enabled checkout. However, in this case the credit card number is not part of the communication. So if a breach occurs only the card information used for the transaction will be exposed. In this scenario, the card information is stored either with the card provider network (Visa, American Express, Discover, MasterCard, etc.), or is stored in the cloud in what is called host card emulation (HCE). It also can be stored in a secure element within the phone.

The token is good only for that particular transaction, and becomes unusable going forward. Therefore if a hacker intercepts a transaction, the best they can get is access to the single-use token but not the card details.

The financial payments industry is starting to integrate multiple layers of security within payment systems to help protect any and all parties involved in payment transactions. They are focused on device-independent technology for transferring the payment account information device to the merchant point of sale system. And they have started to add advanced implementation for online authorization, risk management, and fraud detection systems for early detection of potential fraudulent activity for all credit or debit card payment transaction.

With contactless payments, the financial industry is paying special attention to both the contactless device, as well as in the processing systems and networks. “Challenges on the infrastructure side involve being able to handle a lot of transactions simultaneously,” explains Kin-Yip Liu, senior director of systems engineering and segment marketing at Cavium. “This means that platforms like fraud detection and authentication have to happen very quickly.”

That requires a lot of processing power, and users want the transaction to happen instantaneously, so the infrastructure is designed to run all of these security algorithms quickly and efficiently. Therefore crypto operations such as key exchanges and authentication, as well as fraud detection, work better via the specialized crypto hardware from companies like Cavium, Rambus, Andes Technology, and others. Typical crypto chips in infrastructure hardware include accelerators for cryptography functions, as well as firewall blocks, intrusion detection and other security operations.

Andes Technology has begun adding security into a multi-core architecture using a pipelining approach to connect what it calls niche cores. “We have two niche cores, one for extension and one for security,” said Frankwell Lin, the company’s president and co-founder. “We have a secure MMU and a secure debugging board and power protection. We started to deliver a security core two years ago. We have a few customers doing projects based on that. We certainly see more opportunity in secure IoT operations. We see opportunities in authentication or identification with an embedded volatile memory. We will deliver secure application solutions so our customers will learn how to do security projects.”

This kind of sophisticated hardware at the system level enables payment networks to automatically detect and reject any attempt to use the same transaction information more than once. So even if a fraudster was able to extract information from any type of contactless transaction, the information would be useless.

The missing key
Secret keys are used, ubiquitously, at the contactless device level. For best-of-breed security, contactless cards and NFC devices each have a unique, built-in secret “key.” Most use standard 128-bit encryption technology. Each time a transaction happens, it will generate a unique card verification value or cryptogram, which exclusively marks each transaction. There are no duplicate keys, and no devices will share the same key. Nor is the key ever transmitted.

Keys allow for the processing of contactless payments where there is no need for the cardholder name to be exchanged between card and terminal. In fact, today’s best practices do not include the cardholder name in the contactless chip. Taking that a step further, the real cutting-edge devices in contactless payment eliminate the user’s actual account number but apply an “phony” number associated with a payment account, which was provided by the issuer’s backend processing system.

NFC payment technology does not change the relationship between the bank, the cardholder or smart device holder, and the retailer, but is simply another method to exchange information between buyer and seller.

Battle of the security platforms
For years, secure elements seemed to be the direction the industry was going. “That is, basically, taking the same chip that is on the chip card and putting it into the phone,” explained Simon Blake-Wilson, vice president of products and marketing for Rambus’ Cryptography Research Division.

However, there was an issue with secure element (SE), which is what this is called. By putting that into the SIM card in the NFC device, both the carrier and the bank had an interest. The melding of the two turned into a bit of a posturing match. The carrier was good with it because it had control, but the banks wanted a piece of the financial action, which the carrier wasn’t too excited about. In a nutshell, neither, was willing to budge and this is still being worked out. But that opened the door for a competitive technology, host-card emulation (HCE).

Still, the technology is sound and SE is a solid platform. An SE is a chip integrated into an NFC-enabled device. It is built upon a tamper-resistant platform, designed to securely host applications and their confidential data and provide a secure environment for applications that require a very high level of security – particularly payment applications. Data is housed within the secure element, and SE protects critical data.

Currently, there are three different form factors of SE: Universal Integrated Circuit Card (UICC), embedded SE and microSD. The UICC and microSD are removable, so for NFC devices such as phones, the form factor of choice is the UICC integrated into the NFC controller.

The SE typically consists of a security CPU and crypto co-processor, and non-volatile memory. It is hardened, to some degree, against tampering and attacks. It also contains an OS, perhaps Java, or Multos. And it is capable of multiple system interactions, mobile network operators (MNOs), trusted service managers (TSMs), POS transactions, and similar. Figure 2 is a diagram of a typical NFC transaction and the SE and NFC modules.

Fig. 2: Courtesy, Smart Card Alliance.

As the bickering between carriers and financial institutions around SE continued, Google stepped up to the plate with HCE technology, which connects NFC circuitry to the apps processor, making the NFC circuit behave as if it is connected to a secure element. “Essentially that allows an application to run on the apps processor that looks just like a secure element,” Blake-Wilson said. “There has been the perception that one needs dedicated hardware to do secure payments. But now, HCE has come along and challenged that. It can work, to an extent, without dedicated hardware.”

Going forward, the future landscape of these two technologies is going to be one of co-existence. Both are here to stay, and it is expected that hybrid versions will be developed, as well.

Missive
Contactless payment technologies are slowly gaining traction, although the United States is behind the curve. “The main reason for that is simply that we have a lot of legacy hardware out there,” says Intel’s Grobman.

The changeover will produce some growing pains. Legacy hardware and systems are pervasive, and we know how they work. In addition, wide-scale technology upgrades are painful, both economically and from the standpoint of getting everything to work together seamlessly. It is also time-consuming and in many cases there is a learning curve – not so much with swipe, tap, or bump, but with how the backend needs to be set up to make it work transparently.

But change is coming. The systems of the future cannot support legacy hardware for a number of reasons, so getting past that is a given—eventually. NFC networks will have different issues than legacy and they are not, fundamentally, compatible.

And finally, technology moves on. Contactless payment is easy, fast, efficient and, frankly, cool.

Reference 1: Cross channel fraud occurs when a hacker uses resources from the institution across different channels or payment types. This works because, in general, because financial institutions manage fraud by payment channel rather than by individual customer.