SECURITY ANALYSIS OF MICROPAYMENT SYSTEM

ABSTRACT

It is examined here the various MicroPayment Systems (MPS) that are currently defining the state of the art in the banking and other financial sectors. MPSs have been developed in the past decade, but for various reasons have not yet penetrated the market. The critical mass of users will probably be reached very soon in some industrial countries where Internet has a deep penetration. This has an effect in the fragile balance between the defenders and the offenders of computing systems. There is a need to analyze this new “player” and understand the new issues that arise by the introduction of MPSs to our everyday life.

1. INTRODUCTION

The electronic payment mechanisms of today have been designed for handling payments of value over five dollars. It, however, seems that these systems cannot manage a large amount of payment transactions below that value level in parallel very well. Together with the envisioned new opportunities in e-commerce, the difficulties have lead to the development of completely new electronic payment mechanisms such as micropayments that have been envisioned to bring solutions to these problems. To meet sufficient security for all participants in electronic commerce, a micropayment system makes it possible to make small payment through electronic communication networks.

The micropayments have special characteristics and requirements, distinct from those set for electronic payment systems in general. Micropayment system provides a means of transferring small monetary amounts and serve as a convenient alternative to traditional payment arrangements. Micropayments refer to low value electronic transactions. They provide an alternative revenue source for content providers beyond advertising and subscriptions (W3C). They may also provide revenue streams for service providers. The new micropayment system is developed using a tamper-resistant device (i.e., smart card), an efficient Message Authentication Code (MAC) technique, and the concept of overall network security.

Micro-payment system involves:

• A buyer / client
• A vendor / data editor
• One or more brokers / intermediates / billing servers

A micro-payment system has buyers, sellers, and a broker. The buyers establish accounts with the broker and provide payment information allowing the broker to invoice the buyers. The sellers establish accounts with the brokers and specify terms for accessing items, including electronic content, available from the sellers. The sellers also provide payment information that allows the broker to credit the sellers for sales of the items. The broker aggregates the buyers’ micro-payment purchases and invoices the buyers. The broker also aggregates the sellers’ micro-payment sales and credits the sellers.

There are two fundamental ways of managing Micropayment systems:

• on-line payments – in which the seller verifies the payment sent by the buyer with a bank before serving the buyer.

Eg:  NetBill, NetCash, MiniPay, MilliCent use on-line or semi-online type of payment validation, which is costly in general.

• off-line payment – in which the double spending is prevented by some previously executed operation, therefore no on-line connection to the bank is required.

Eg: Millicent transactions are not anonymous and mostly off-line. PayWord is an off-line, extremely efficient, credit-based micro-payment scheme

The basic architecture of a micro-payment system consist of:

On the client side:

• A browser,
• A module which is communicating with the micro-payment server
• One or more electronic wallets

On the vendor side:

• An HTTP server

E-Commerce covers a broad spectrum of transactions varying from macro-transactions to micro transactions. In macro-transactions, while the value of each transaction is very high, the challenge lies in providing a higher grade of authentication, payment security, and non-repudiation of transactions. In case of micro-transactions, while the need is to cater to a large volume of transactions of low intrinsic financial value, the challenge is to keep the cost of each transaction to a minimum on an average. Micro-transactions include Internet-enabled services like streaming multi-media, accessing computational power from grids, loadable software’s etc.

minipayments, is used in parallel with the word micropayments. In this case the micropayments refer to sums perhaps under one dollar, while the term minipayments are defined as payments larger than micropayments, but smaller than the traditional payments, e.g. credit card transactions, which are typically the size of 80 dollars in average.