Search

The Chameleon Mini is a portable device that interfaces with the NFC protocol over RFID. This device is designed to facilitate on-the-fly logging of data exchanges between contactless cards and tag readers operating over NFC in the 13.56 MHz band. It is an indispensible tool for researchers, reverse engineers and system penetration testers that perform security analysis over the protocol. The Chameleon Mini also supports emulation of many contactless card types over NFC that are enabled by contributions to its open source embedded firmware. In 2020, we set out to offer a fully functional open source implementation to provide a frequently requested interface to the complex and proprietary DESFire tag command set and internal architecture specification from within the open source firmware for the Chameleon Mini RevG. In this application note, we describe the technologies utilized, applications of this work, and describe the challenges of the low-level implementation of the embedded software.

Near Field Communication (NFC) has become prevalent in access control and contactless payment systems, however, there is evidence in the literature to suggest that the technology possesses numerous vulnerabilities. Contactless bank cards are becoming commonplace in society; while there are many benefits from the use of contactless payments, there are also security issues present that could be exploited by a malicious third party. The inherently short operating distance of NFC (typically about 4 cm) is often relied upon as a means of ensuring intentional interaction on the user’s part and limiting attack vectors. However, NFC is particularly sensitive to relay attacks, which entirely negate the security usefulness of the short-range aspect of technology. The aim of this article is to demonstrate how standard hardware can be used to exploit the technology to carry out a relay attack. Considering the risk that relay attacks pose, a countermeasure is proposed to mitigate this threat. Our countermeasure yields a 100% detection rate in experiments undertaken – in which over 10,000 contactless transactions were carried out on a range of different contactless cards and devices. In these experiments, there was a false positive rate of 0.38% – 0.86%. As little as 1 in every 250 transactions were falsely classified as being the subject of a relay attack and so the user experience was not significantly impacted. With our countermeasure implemented, transaction time was lengthened by only 0.22 seconds.

EMV is the international protocol standard for smartcard payment and is used in over 9 billion cards worldwide. Despite the standard's advertised security, various issues have been previously uncovered, deriving from logical flaws that are hard to spot in EMV's lengthy and complex specification, running over 2,000 pages. We formalize a comprehensive symbolic model of EMV in Tamarin, a state-of-the-art protocol verifier. Our model is the first that supports a fine-grained analysis of all relevant security guarantees that EMV is intended to offer. We use our model to automatically identify flaws that lead to two critical attacks: one that defrauds the cardholder and a second that defrauds the merchant. First, criminals can use a victim's Visa contactless card to make payments for amounts that require cardholder verification, without knowledge of the card's PIN. We built a proof-of-concept Android application and successfully demonstrated this attack on real-world payment terminals. Second, criminals can trick the terminal into accepting an unauthentic offline transaction, which the issuing bank should later decline, after the criminal has walked away with the goods. This attack is possible for implementations following the standard, although we did not test it on actual terminals for ethical reasons. Finally, we propose and verify improvements to the standard that prevent these attacks, as well as any other attacks that violate the considered security properties. The proposed improvements can be easily implemented in the terminals and do not affect the cards in circulation., Comment: Accepted for IEEE S&P 2021

Contactless smart card technology serves various applications ranging from personal identification to financial payment. A well-known brand, Mifare cards, supplies more than three-quarters of the world's smart contactless cards. When left unprotected and unattended, these cards are potentially vulnerable to external threats that enable an attacker to read the card and steal the UID (Unique Identifier) and write to the card, potentially corrupting it. This study assesses the risk of unattended Mifare Classic smart cards through a simulation of the attack. The mobile applications NFC Tools and Mifare Classic Tool which were installed on an NFC-capable smartphone were utilized as the primary card reader/writer to perform the said functions to the cards. The attack was performed against a Mifare Classic 1K card; Its contents were read and written to and its UID was duplicated/cloned using a UID-writable card and a Proxgrind Chameleon Mini Rebooted. The duplicates/clones were tested on a simulated card system scanner that was built using a CH340G Arduino board and an RC522 module that was designed to accept only the genuine Mifare Classic 1K card. The simulation of the attack presents that cards can easily be accessed, even when placed inside relatively thick layers of wrapping such as inside a wallet and a bag. Once accessed, the UID of the cards was obtained and its memory can also be read and written to. The duplication/cloning process was successfully executed as the simulated card system scanner accepted and recognized the duplicates/clones as if they were the original card.

The work described in this paper was developed a system, which allows the use of smart cards as a contactless cards, without physical contact with any terminal. This system is composed of two blocks: a card control terminal and a special wallet, where you may put in the smart card when contactless operation is necessary. This wallet is powered by a solar cell array, when illuminated from a light source into the card control terminal. Contactless operations are especially suitable for quickly data transactions, hands-free operations and applications in high security areas. The system works as a bi-directional infrared data-interface between the smart card and the card control terminal. The operational range is of up to one meter, with an angular mismatch within emitter and receiver of ± 30° in both horizontal and vertical planes. The data rate is 9.6 Kbauds, although the data interface is able to work up to 115 Kbauds. The actual operational range is voluntary limited. We are developing new strategies to improve this limitation.

International audience; Disruptive innovations in digital payments are happening in a large number of countries around the world. In this paper, we investigate how merchants’ acceptance of a contactless card technology affects card sales. Using score matching and difference-in-difference techniques on a unique sample of about 275,580 merchants in France, we find that accepting contactless payments in 2018 increases the card-sales amount by 15.3 percent on average (and by 17.1 percent the card-sales count) compared to merchants who do not accept contactless payments. We also find evidence that accepting contactless payments exerts a positive spillover of about 1.3 percent in the amount of contact card sales, and thus significantly increases the average annual card-sales amount and count for small merchants and new entrepreneurs

This paper explores the impact of contactless payment on consumers’ demand for cash at an early stage of diffusion. The specific devices that are investigated are debit and credit cards, in which the feature is embedded. A novel balanced panel dataset drawn from representative surveys on consumer payment behavior in the USA from 2009 to 2013 is analyzed to account for unobserved heterogeneity in cash usage. The results show that contactless credit and debit cards exert no statistically significant effect on cash usage after controlling for unobserved heterogeneity. Consumers’ decision to use contactless payment is an endogenous choice. Card-affined individuals replace conventional card payments with contactless card payments. Hence, the overall effect on cash usage remains unaffected.

Since 2017, the payment cards industry has undertaken a concerted effort to bring contactless “tap-and-pay” credit and debit card products to consumers. Payment networks, card issuers, and banks have worked to ensure that contactless cards, which communicate payment information wirelessly to point-of-sale terminals through Near Field Communication technology, are at the forefront of consumers’ minds when they make a purchase. Missing from the discussion of contactless payments, however, is an understanding of consumer interest in the technology; indeed, the current activities are a relaunch of a product that underwhelmed consumers in the mid-2000s. The authors discuss environmental and technological developments that make the current market more receptive to contactless cards and describe the results of a consumer survey on the topic. We conclude that while adoption of contactless card payments is more likely, the path to full adoption has notable barriers that are revealed in the survey results.

Near Field Communication (NFC) is a very short-range type of radio communication that is compatible with other contactless communication technologies. It provides enormous possibilities, particularly given that it does not require any particular communication infrastructure. NFC technology has found possible application in contactless cards and mobile phone devices as a communication infrastructure which provides a platform for the development of NFC-based business services. This paper proposes a novel approach to forecasting the number of new users of NFC mobile phones based on fuzzy logic and the Norton-Bass diffusion model. The proposed approach is demonstrated through the case study.

Authentication for resource-constrained devices is seen as one of the major challenges in current wireless communication networks. The HB + protocol by Juels and Weis provides device authentication based on the learning parity with noise ( LPN ) problem and is appropriate for resource-constrained devices, but it has been shown to be vulnerable to a simple man-in-the-middle attack. Subsequent work has focused on modifying the cryptographic properties of the original protocol to mitigate this problem. We propose that this attack could be mitigated using physical layer measures from distance-bounding protocols and simple modifications to devices’ radio receivers. We take the HB + as a reference protocol and combine it with distance-bounding techniques. This hybrid solution, the HB + DB protocol is shown to provide resistance against the man-in-the-middle attacks on HB + as a result of the additional physical-layer mechanisms. We analyze the security of the proposed HB + DB protocol against active man-in-the-middle attacks and present experiments showing how it is practically possible to limit the success of a practical man-in-the-middle attack. We also briefly discuss the possibility that HB + DB could provide some resistance to basic threats scenarios meant to be mitigated by distance-bounding protocols. We make a practical implementation to verify that our proposed method is feasible. Finally, we discuss a proof-of-concept channel for our scheme implemented on a platform equivalent in resources to a contactless smart card/NFC device.

It is carried out the analysis of the share of cash outside the banks in the money supply in Ukraine within 2013-2017 and the integral indicator of the level of the shadow economy in Ukraine for 2010-2017. The dynamics of the main indicators of functioning of the payment cards market of Ukraine during 2012-2017 is analysed. The main tendencies of development the market of payment cards in Ukraine are considered. In particular, the dynamics of the number of holders of payment cards and their issuing banks, the development of electronic payment infrastructure, the types of payment cards issued by Ukrainian banks by types of carriers etc. formations, in terms of payment systems, dynamics of the structure of operations using payment cards by volume and quantity are considered in this research. On the basis of the results of the analysis, we have concluded that there is a development of cashless payments by payment cards in Ukraine. The strategic direction for the development of cashless settlements in transport infrastructure has been revealed due to the use of payment contactless cards as an innovative means of payment for services of transport organizations.

In this digital era, two entities can exchange the messages over internet even through the physical distance between them is much far. Before exchange they require to authenticate each other via authentication scheme. Biometric is one of the unique feature for each entity and can be accustomed to identify the authenticity of the entity. Motivated by this, many researchers had proposed the various schemes based on biometric feature for authentication using smart card. As smart card is not a temper resistance consummately, various attacks have been identified by the researchers in the biometric based authentication schemes. In this paper we review Wen et al.’s scheme and we find that Wen et al.’s scheme is vulnerable to insider attack, denial of service attack and user anonymity cannot achieve by them. Then we propose new remote user authentication algorithm where our algorithm is secure.

Smart cities are characterised, among other things, by high levels of connectivity and relative availability of transport services. In this respect, airports play a crucial role as they provide a dense network of connections among major cities. While there is abundant literature on the social and economic impacts of airports and air transport operations in general, relatively less attention has been paid on the importance of connections between airports and the surrounding territory. Very often, and especially for major airports and hubs, the connection between the terminals and the city is secured by trains. In this paper, we propose a welfare analysis of the adoption of smart payment tools for trains serving airports. In particular, we focus on the possibility for passengers to pay with contactless cards, that is to use credit cards as sort of dematerialised tickets, instead of queuing at ticket desks or selling machines. This new tool has the advantage to save time and may induce individuals to use the train, with consequential benefits in terms of reduction in external costs. We conclude our paper with a broader policy discussion regarding the role of smart payment for transport services and associated business models.

We provide causal evidence on how the improved convenience of electronic payments affects consumer payment choice and cash demand. We study the staggered introduction of contactless debit cards by a retail bank between 2016-2018. Our analysis is based on account-level data for a random sample of 30’000 bank clients and follows a pre-analysis plan. The timing of access to the contactless payment technology is quasi-random across clients, depending only on the expiry date of the pre-existing debit card. We isolate a “convenience effect” of electronic payments by comparing small-value transactions which are eligible for contactless authentication to large value transactions which are not. On average, consumers increase their use of debit cards for small-value payments in response to receiving a contactless card. Contactless cards increase the frequency of transactions among existing card users but do not cause more consumers to use debit cards. Relative to average consumer cash spending on small-value items, the average increase in debit card use is limited. The impact of contactless cards on cash demand is thus economically small and statistically insignificant.

In this paper, we design and implement the transaction device based on two operation methods, i.e., with contact and without contact with smart cards. The system can be divided into three parts: hardware (transaction device), software (transaction application), and server. In this work, we focus on the hardware design that comprises smart card reader hardware, LCD display - touch panel, and battery charger circuit. ATMEGA 328P was chosen as a data exchange controller between the smart card and smart card reader. In contrast, the Raspberry Pi 3 Model B (single-board computer) was utilized as an application processor due to several features offered, such as I/O, graph processing unit, and enough memory. Our electronic transaction device can be connected to the thermal printer. Therefore, the transactions report (e.g., Top-up, balance check, payment activity, and so on) can be printed out. The developed device has a tiny dimension and lightweight to carry, hence it can be categorized as a portable device (easily moved everywhere).

Europay MasterCard and Visa (EMV) is the most popular payment protocol with almost 7.1 billion EMV based credit and debit cards around the world. This payment protocol supports different kinds of payment transactions such as Chip & PIN, Chip & signature, contactless card, and mobile payment transactions. This paper focuses on the EMV contactless card transactions and highlights one of such transactions’ vulnerabilities that allows attackers to gain access to most of the EMV card sensitive information using off-the-shelf hardware and software. In the EMV card payment protocol, the EMV card must authenticate itself as a genuine card to the point of Sale (POS) in each transaction while the reverse is not happening. An attacker can take an advantage of such vulnerabilities in the EMV specifications especially in contactless cards due to the wireless connectivity between the cards and POSs. In this paper, we propose a cost-effective mutual-authentication solution that relies on two-way challenge-response between EMV contactless cards and POSs in order to prevent sniffing attacks launched by NFC enabled readers or smartphones. To demonstrate the viability of the proposed authentication protocol, we present a Java framework to illustrate the practicality of the proposed solution. The paper argues that the proposed protocol can be easily integrated into the EMV infrastructure with minor changes at the personalization and transaction phases.

Advancement in payment technologies has an important impact on one's quality of life. Emerging payment technologies create both opportunities and challenges for the future. Being a quick and convenient process, contactless payment gained momentum, especially with merchants, with throughput being the main parameter. However, it poses risks to issuers, as no robust customer verification method is available. Thus, efforts have been underway to evolve and sustain a well-organized, efficient, reliable, and secure unified payment system, which may contribute to the smooth functioning of the market by eliminating obstacles in business.

MIFARE Classic is the most popular contactless smart card, which is primarily used in the management of access control and public transport payment systems. It has several security features such as the proprietary stream cipher Crypto 1, a challenge-response mutual authentication protocol, and a random number generator. Unfortunately, multiple studies have reported structural flaws in its security features. Furthermore, various attack methods that target genuine MIFARE Classic cards or readers have been proposed to crack the card. From a practical perspective, these attacks can be partitioned according to the attacker’s ability. However, this measure is insufficient to determine the optimal attack flow due to the refined random number generator. Most card-only attack methods assume a predicted or fixed random number, whereas several commercial cards use unpredictable and unfixable random numbers. In this paper, we propose optimal MIFARE Classic attack procedures with regards to the type of random number generator, as well as an adversary’s ability. In addition, we show actual attack results from our portable experimental setup, which is comprised of a commercially developed attack device, a smartphone, and our own application retrieving secret data and sector key.

Nowadays, electronic commerce (e-commerce) has brought facilitation to people’s daily lives. Smart-card-based systems are widely used as an implementation, where smart cards act as a secure carrier for small-sized data. However, most of these systems are developed and managed by each service provider individually and repeatedly, which causes both unnecessary work and difficulties in future maintenance. Besides, advantages of smart card technology are not full-fledged for the lack of enough consideration in flexibility and security. To propose a solution, this article presents a Universal Application Storage System, including card side, terminal side, and back-end system. The card side provides a universal and secured infrastructure for data storage, where data are organized and stored in a card file system with several security mechanisms. In the terminal side, a framework for accessing various forms of secure element is presented to simplify the procedures involved in manipulating smart cards. Through this framework, the back-end system is able to establish a direct connection to the card, and performs authorized operations by exchanging commands in a secure channel. The validity of the proposed system is verified at the end of this article, illustrated by an e-coupon system.

The pre-paid nation-wide interoperable transportation card, which an pay fee of bus, subway, train, and highway with just one card, released in June. 2014. It has started and operated from Seoul, Gyeonggi, and major local metropolitan area. In this paper, after starting of service, we evaluate conformance and interoperability of nation-wide interoperable transportation card system in real situation. Through this, we check the status of its technical operation. For this, we choose 6 region included Seoul, Gyeonggi which are serviced by different transport vendors and check recognition and billing result from field of transportation card terminal. As a result, we can reach that the major nation-wide interoperable transportation card operate normally and deliver CONFIG DF query command. It means nation-wide interoperable transportation card system which use only one card stably adapt the public transport system and it can make user`s public transport use convenience higher through the extension of service area.

We present a method of contactless smart card protocol modeling suitable for finding vulnerabilities using model checking. Smart cards are used in applications that require high level of security, such as payment applications, therefore it should be ensured that the implementation does not contain any vulnerabilities. High level application spec- ifications may lead to dierent implementations. Protocol that is proved to be secure on high level and that uses secure smart card can be implemented in more than one way; some of these implementations are secure, some of them introduce vulnerabilities to the application. The goal of this paper is to provide a method that can be used to create a model of arbitrary smart card, with focus on contactless smart cards, to create a model of the protocol, and to use model check- ing to find attacks in this model. AVANTSSAR Platform was used for the formal verification, the models are written in the ASLan++ language. Examples demonstrate the usability of the proposed method.

Contactless smart card systems have gained universal prevalence in modern metros. In addition to its original goal of ticketing, the large amount of transaction data collected by the smart card system can be utilized for many operational and management purposes. This paper investigates an important problem: how to extract spatiotemporal segmentation information of trips inside a metro system. More specifically, for a given trip, we want to answer several key questions: How long does it take for a passenger to walk from the station gantry to the station platform? How much time does he/she wait for the next train? How long does he/she spend on the train? How long does it take to transfer from one line to another? This segmentation information is important for many application scenarios such as travel time prediction, travel planning, and transportation scheduling. However, in reality, we only assume that only each trip's tap-in and tap-out time can be directly obtained; all other temporal endpoints of segments are unknown. This makes the research very challenging. To the best of our knowledge, we are the first to give a practical solution to this important problem. By analyzing the tap-in/tap-out event pattern, our intuition is to pinpoint some special passengers whose transaction data can be very helpful for segmentation. A novel methodology is proposed to extract spatiotemporal segmentation information: first, for nontransfer trips, by deriving the boarding time between the gantry and the platform, and then, for with-transfer trips, by deriving the transfer time. Evaluation studies are based on large-scale real-system data of the Shenzhen metro system, which is one of the largest metro systems in China and serves millions of passengers daily. Onsite investigations validate that our algorithm is accurate and that the average estimation error is only around 15%.

Disruptive innovations in digital payments are happening in a large number of countries around the world. In this paper, we investigate how merchants' acceptance of a contactless card technology affects card sales. Using score matching and difference-in-difference techniques on a unique sample of about 275,580 merchants in France, we find that accepting contactless payments in 2018 increases the card-sales amount by 15.3 percent on average (and by 17.1 percent the card-sales count) compared to merchants who do not accept contactless payments. We also find evidence that accepting contactless payments exerts a positive spillover of about 1.3 percent in the amount of contact card sales, and thus significantly increases the average annual card-sales amount and count for small merchants and new entrepreneurs.

Smart card data contains a lot of useful information, so both of urban bus and intercity bus are built up the contactless smart card system in Taiwan. Although smart card data can offer useful information, it’s still limited to how the passengers are being charged. This paper focuses on the estimation of the destination of the passenger who takes the bus twice a day and presents an algorithm to estimate the destination location for each individual boarding of the bus with a smart card. To evaluate the accuracy of destination estimation algorithm, this paper selected Taichung urban bus which uses mileage charges as a case study area. According to the results, the estimated accuracy is 63% with the 600 m tolerance distance (allowable walking distance), after considering 500 m of the value of tolerance distance error the accuracy increases to 90%.

This paper focuses on relay attacks against EMV based contactless payment cards. EMV is a standard for payments via smart cards. In a typical relay attack on contactless cards, the attacker launches the attack by relaying the legitimate user’s card information to another malicious device, in proximity to the verifier. This technique is used by the attacker to burglarize money from the victim’s card. Designing an efficient distance bounding protocol is a promising solution to defeat relay attacks. We study the dominant payment protocols in EMV contactless cards (Visa’s payWave, Mastercard’s PayPass, and PaySafe) and identify the existing vulnerabilities in these protocols. A practical relay attack on the latest EMV payment protocol - PaySafe is performed. Contactless payments are fast becoming a key instrument in the payment industry, and the future technologies must aim towards convenience and security. We propose a light weight protocol that suits well with the current EMV specification. Our protocol is based on LFSR, which supports exchange of a small string of bits through a time critical channel.

This Innovate Practice Work in Progress paper is about education on Cybersecurity, which is essential in training of innovative talents in the era of the Internet. Besides knowledge and skills, it is important as well to enhance the students’ awareness of cybersecurity in daily life. Considering that contactless smart cards are common and widely used in various areas, one basic and two advanced contactless smart card experiments were designed innovatively and assigned to junior students in 3-people groups in an introductory cybersecurity summer course. The experimental principles, facilities, contents and arrangement are introduced successively. Classroom tests were managed before and after the experiments, and a box and whisker plot is used to describe the distributions of the scores in both tests. The experimental output and student feedback implied the learning objectives were achieved through the problem-based, active and group learning experience during the experiments.

Pričujoča magistrska naloga prinaša pregled zgodovinskega ozadja za pričetek brezgotovinskega poslovanja ter razvoj plačilnih kartic od prvih reliefnih kartic preko kartic z magnetno stezo do sodobnih pametnih kartic s čipom. Prinaša natančno razlago uporabe različnih vrst plačilnih kartic, ki so v uporabi, pa morda uporabniki ne poznajo razlike med njimi. Predstavlja tudi pasti poslovanja s plačilnimi karticami za nepoučene uporabnike. Glavni namen naloge je predstaviti trenutne trende v razvoju kartičnega poslovanja oziroma razvojno naravnanost brezgotovinskega plačilnega sistema. Dejstvo je, da je področje zelo obsežno in hitro rastoče, saj se število uporabnikov teh storitev veča, prav tako se veča tudi vrednost sredstev, ki se na ta način prenašajo. Tem uporabnikom je potrebno zagotoviti varen brezgotovinski prenos denarja s čim manjšo možnostjo zlorab. Trend, ki se trenutno že močno uveljavlja, je brezstično poslovanje. Podatki kažejo, da že več kot 50 % izdanih plačilnih kartic po svetu omogoča brezstično poslovanje, do leta 2020 pa bi naj vsi POS terminali tako obliko plačevanja že omogočali. Naslednji zaznani trend je razvoj multifunkcijske plačilne kartice, saj se potrošniki zadnje čase srečujejo z motečim kopičenjem kartic. Dejstvo, ki ovira hitrejši razvoj te kartice, je visok strošek njene izdelave, kar lahko vpliva na njeno razširjenost kasneje. Najnovejši trend, ki s pojavom dovolj razvitih tehnologij sedaj končno lahko stopi v veljavo, je pojav mobilnega prenosa denarja, za kar je potrebna uporaba mobilne naprave. Ker je največja ovira pri uvajanju novih trendov zagotavljanje varnosti opravljenih transakcij, je seveda posledično zelo veliko napora vloženega v razvoj mehanizmov, ki bi učinkovito ščitili pred zlorabami. Za storitvami stoji vedno bolj kompleksna tehnologija, ki pomaga razvijati visoke tehnološke varnostne procese, ti pa zajemajo uporabo umetne inteligence, posebne kriptografske protokole, spreminjajoče se kode, ugotavljanje geolokacije ter uporabo biometričnih identifikacij. Nekateri od teh procesov so zaenkrat še v začetni fazi, a poskusni programi testiranja kažejo optimistične rezultate. This master's thesis starts shows the historic background which led to the start of cashless business and the development of payment cards from the first embossed payment cards past the cards with magnetic strip and ending at modern smart cards with an embedded chip. It gives a detailed explanation of how different types of payment cards in use are used, but an average user may not be aware of the differences between them. It also portrays some of the traps that are present in card payments for non-educated users. The main purpose of this work is to present the current trends in the development of card business as well as the developmental orientation of the entire cashless payment system. The fact is that this field is very large and is rapidly expanding, as the number of users of cashless payment methods is increasing, and the total value of funds being transferred in these ways is also growing. These users must be ensured a safe transfer of funds with minimal possibility of abuse. One of the latest trends, which is currently being used extensively, is contactless payment. Data shows that more than 50 % of the payment cards issued worldwide enable contactless transactions, and by the year 2020 all the POS terminals should enable this form of payment. The next notable trend in payment cards is the development of a multifunction payment card which should reduce the number of cards an average consumer carries with him. Development of such a card is hindered by high production costs and this may later affect its prevalence. The latest trend, which can finally come into effect with the emergence of sufficient technology, is mobile money transfer, which requires the use of a mobile device. As the biggest obstacle present in introducing new trends is ensuring the security of the transactions being made there is a lot of effort involved in developing safety mechanisms that effectively protect against abusive practices. Behind these services stands an increasingly complex technology that helps in developing security processes, which include the use of artificial intelligence, special cryptographic protocols, changing codes, the use of biometric user identifications and geolocating. Most of these processes are still in their initial phases, but experimental testing programs are showing promise and we can expect to see them implemented in the foreseeable future.

International audience; Multi-application smart card technology has gained momentum due to the Near Field Communication (NFC) and smart phone revolution. Enabling multiple applications from different application providers on a single smart card is not a new concept. Multi-application smart cards have been around since the late 1990s; however, uptake was severely limited. NFC has recently reinvigorated the multi-application initiative and this time around a number of innovative deployment models are proposed. Such models include Trusted Service Manager (TSM), User Centric Smart Card Ownership Model (UCOM) and GlobalPlatform Consumer-Centric Model (GP-CCM). In this paper, we discuss two of the most widely accepted and deployed smart card management architectures in the smart card industry: GlobalPlatform and Multos. We explain how these architectures do not fully comply with the UCOM and GP-CCM. We then describe our novel flexible consumer-centric card management architecture designed specifically for the UCOM and GP-CCM frameworks, along with ways of integrating the TSM model into the proposed card management architecture. Finally, we discuss four new security issues inherent to any architecture in this context along with the countermeasures for our proposed architecture.

Financial fraud has been increasing along with credit card usag e. Magnetic stripe cards have vulnerabilities in that credit ca rd information is exposed in plaintext and cardholder verification is untrustworthy. So they have been replaced by a smart card scheme to provide enhanced security. Furthermore, the FinTech t hat combines the IT with Financi al product is being prevalent. For that reason, many mobile device based payment schemes have been proposed for card present transaction. In this paper, we propose a virtual credit card number payment scheme based on pu blic key system for efficient authentication in card present transaction. Our proposed scheme is able to authenticate effici ently in card present transaction by pre-registering virtual cr edit card number based on cardholder's public key without PKI. And w e compare and analyze our proposed scheme with EMV.Keywords: Card Present Transaction, Virtual Credit Card Number, Authenti cation, EMV, FinTech I.서 론 *