research-article

PSP: private and secure payment with RFID

Authors:

Erik-Oliver Blass,

Thorsten StrufeAuthors Info & Claims

WPES '09: Proceedings of the 8th ACM workshop on Privacy in the electronic society

Pages 51 - 60

https://doi.org/10.1145/1655188.1655196

Published: 09 November 2009 Publication History

Abstract

RFID can be used for a variety of applications, e.g., to conveniently pay for public transportation. However, achieving security and privacy of payment is challenging due to the extreme resource restrictions of RFID tags. In this paper, we propose PSP -- a secure, RFID-based protocol for privacy-preserving payment. Similar to traditional electronic cash, the user of a tag can pay access to a metro using his tag and so called coins of a virtual currency. With PSP, tags do not need to store valid coins, but generate them on the fly. Using Bloom filters, readers can verify the validity of generated coins offline. PSP guarantees privacy such that neither the metro nor an adversary can reveal the identity of a user or link subsequent payments. PSP is secure against invention and overspending of coins, and can reveal the identity of users trying to doublespend coins. Still, PSP is lightweight: it requires only a hash function and few bytes of non-volatile memory the tag.

References

[1]

Alien Technology. Rfid tags, 2009. http://www.alientechnology.com/tags/index.php.

[2]

G. Avoine, E. Dysli, and P. Oechslin. Reducing time complexity in rfid systems. In Proceedings of Selected Areas in Cryptography, pages 291--306, Kingston, Canada, 2005. ISBN 978-3-540-33108-7.

Digital Library

[3]

S. Brands. Untraceable off-line cash in wallets with observers. In Proceedings of Annual International Cryptology Conference, pages 302--318, Santa Barbara, USA, 1993. ISBN 3-540-57766-1.

Digital Library

[4]

A. Broder and M. Mitzenmacher. Network applications of bloom filters: A survey. Internet Mathematics, 1(4): 485--509, 2003. ISSN 1542-7951.

[5]

D. Chaum. Blind signatures for untraceable payments. In Proceedings of Annual International Cryptology Conference, pages 199--203, Santa Barbara, USA, 1982.

[6]

D. Chaum, A. Fiat, and M. Naor. Untraceable electronic cash. In Proceedings of Annual International Cryptology Conference, pages 319--327, Santa Barbara, USA, 1988. ISBN 3-540-97196-3.

Digital Library

[7]

Y. Choi, M. Kim, T. Kim, and H. Kim. Low power implementation of sha-1 algorithm for rfid system. In Proceedings of Tenth International Symposium on Consumer Electronics, pages 1--5, St. Petersburg, Russia, 2006. ISBN 1-4244-0216-6.

[8]

R. Cramer and I. Damgård. Introduction to secure multi-party computations. In Contemporary Cryptology: Advanced Courses in Mathematics, pages 41--87. Birkhauser, 2005. ISBN 3-7643-7294-X.

[9]

Y. Desmedt, C. Goutier, and S. Bengio. Special uses and abuses of the fiat-shamir passport protocol. In Proceedings of Annual International Cryptology Conference, pages 21--39, Santa Barbara, USA, 1987. ISBN 3-540-18796-0.

Digital Library

[10]

T. Dimitrou. rfiddot: Rfid delegation and ownership transfer made simple. In Proceedings of International Conference on Security and privacy in Communication Networks, Istanbul, Turkey, 2008. ISBN 978-1-60558-241-2.

Digital Library

[11]

F.D. Garcia, G.K. Gans, R. Muijrers, P. Rossum, R. Verdult, R. Wichers Schreur, and B. Jacobs. Dismantling mifare classic. In Proceedings of European Symposium on Research in Computer Security, pages 97--114, Malaga, Spain, 2008. ISBN 978-3-540-88312-8.

Digital Library

[12]

S. Glassman, M. Manasse, M. Abadi, P. Gauthier, and P. Sobalvarro. The millicent protocol for inexpensive electronic commerce. In Proceedings of World Wide Web Conference, pages 604--618, Boston, USA, 1995.

[13]

Greater London Authority. Mayor to give away 100,000 free oyster cards, 2007. http://www.london.gov.uk/view_press_release.jsp?releaseid=11611.

[14]

G.P. Hanke. Practical attacks on proximity identification systems. In Proceedings of Symposium on Security and Privacy, pages 328--333, Oakland, USA, 2006. ISBN 0-7695-2574-1.

Digital Library

[15]

G.P. Hanke and M.G. Kuhn. An rfid distance bounding protocol. In Proceedings of International Conference on Security and Privacy for Emerging Areas in Communications Networks, pages 67--73, Athens, Greece, 2005. ISBN 0-7695-2369-2.

Digital Library

[16]

InformationWeek. Visa debuts rfid-enabled card-payment system, 2005. http://www.informationweek.com/news/mobility/RFID/showArticle.jhtml?articleID=60403344.

[17]

InformationWeek. Rfid helps feed parking meters, 2005. http://www.informationweek.com/news/mobility/RFID/showArticle.jhtml?articleID=174900727.

[18]

A. Juels and S.A. Weis. Defining strong privacy for rfid. In PerCom Workshops, pages 342--347, White Plains, USA, 2007. ISBN 978-0-7695-2788-8.

Digital Library

[19]

C.H. Lim and T. Kwon. Strong and robust rfid authentication enabling perfect ownership transfer. In Proceedings of Conference on Information and Communications Security, pages 1--20, Raleigh, USA, 2006. ISBN 3-540-49496-0.

Digital Library

[20]

S. Micali and R.L. Rivest. Micropayments revisited. In Proceedings of RSA conference, pages 149--163, San Jose, USA, 2003. ISBN 3-540-43224-8.

Digital Library

[21]

NXP Semiconductors. Mifare 1k, 2009. http://mifare.net/products/smartcardics/mifare_standard1k.asp.

[22]

R. Di Pietro and R. Molva. Information confinement, privacy, and security in rfid systems. In Lecture Notes in Computer Science, Volume 4734, pages 187--202, 2007. ISBN 978-3-540-74834-2.

Digital Library

[23]

F. Putze, P. Sanders, and J. Singler. Cache-, hash- and space-efficient bloom filters. In Proceedings of Workshop on Experimental Algorithms, pages 23--36, Rome, Italy, 2007. ISBN 978-3-540-72844-3.

Digital Library

[24]

R.L. Rivest. Peppercoin micropayments. In Proceedings of Financial Cryptography, pages 2--8, Key West, USA, 2004. ISBN 3-540-22420-3.

[25]

R.L. Rivest and Adi Shamir. Payword and micromint-two simple micropayment schemes. In Proceedings of International Workshop on Security Protocols, pages 69--87, Paris, France, 1997. ISBN 3-540-64040-1.

Digital Library

[26]

A. Shamir. Squash -- a new mac with provable security properties for highly constrained devices such as rfid tags. In Proceedings of Fast Software Encryption (FSE), pages 144--157, Lausanne, Switzerland, 2008. ISBN 978-3-540-71038-7.

Digital Library

[27]

The Guardian. Oyster data use rises in crime clampdown, 2006. http://www.guardian.co.uk/technology/2006/mar/13/news.freedomofinformation.

[28]

Transport for London. London busses, 2009. http://www.tfl.gov.uk/corporate/modesoftransport/1548.aspx.

[29]

Transport for London. Oyster online, 2009. https://oyster.tfl.gov.uk/oyster/entry.do.

[30]

Transport for London. Key facts, 2009. http://www.tfl.gov.uk/corporate/modesoftransport/londonunderground/1608.aspx.

[31]

Transport for London. London travel report 2007, 2008. http://www.tfl.gov.uk/assets/downloads/corporate/London-Travel-Report-2007-final.pdf.

[32]

G. Tsudik. Ya-trap: yet another trivial rfid authentication protocol. In Proceedings of International Conference on Pervasive Computing and Communications Workshops, Pisa, Italy, 2006. ISBN 0-7695-2520-2.

Digital Library

[33]

H.C.A. van Tilborg, editor. Encyclopedia of Cryptography and Security. Springer Verlag, 2005. ISBN 038723473X.

Digital Library

[34]

S. Vaudenay. On privacy models for rfid. In Proceedings of ASIACRYPT, pages 68--87, Kuching, Malaysia, 2007. ISBN 978-3-540-76899-9.

Digital Library

[35]

G. Venkataramani and S. Gopalan. Mobile phone based rfid architecture for secure electronic payments using rfid credit cards. In Proceedings of International Conference on Availability, Reliability and Security, pages 610--620, Vienna, Austria, 2007. ISBN 0-7695-2775-2.

Digital Library

[36]

Visa USA. Visa paywave, 2009. http://usa.visa.com/personal/cards/paywave/index.html.

[37]

S.A. Weis, S.E. Sarma, R.L. Rivest, and D.W. Engels. Security and privacy aspects of low-cost radio frequency identification systems. In Security in Pervasive Computing, pages 201--212, Boppard, Germany, 2003. ISBN 3-540-20887-9.

[38]

Wired. Mcdonald's tries out new rfid-enabled pay-by-phone coupons, 2008. http://blog.wired.com/gadgets/2008/05/mcdonalds-tries.html.

Cited By

Blass EKurmus AMolva RStrufe T(2019)PSPComputer Communications10.1016/j.comcom.2012.10.01236:4(468-480)Online publication date: 5-Jan-2019
https://dl.acm.org/doi/10.1016/j.comcom.2012.10.012
Yohan ALo NRandy VChen SHsu M(2016)A Novel Authentication Protocol for Micropayment with Wearable DevicesProceedings of the 10th International Conference on Ubiquitous Information Management and Communication10.1145/2857546.2857565(1-7)Online publication date: 4-Jan-2016
https://dl.acm.org/doi/10.1145/2857546.2857565
Frosch TSchäge SGoll MHolz T(2016)On Locational Privacy in the Absence of Anonymous PaymentsData Protection on the Move10.1007/978-94-017-7376-8_4(75-100)Online publication date: 2016
https://doi.org/10.1007/978-94-017-7376-8_4
Show More Cited By

Index Terms

PSP: private and secure payment with RFID
1. Applied computing
  1. Electronic commerce
2. Security and privacy
  1. Human and societal aspects of security and privacy
  2. Software and application security
    1. Domain-specific security and privacy architectures

Recommendations

PSP: Private and secure payment with RFID

RFID can be used for a variety of applications, e.g., to conveniently pay for public transportation. However, achieving security and privacy of payment is challenging due to the extreme resource restrictions of RFID tags. In this paper, we propose PSP - ...
RFID system with fairness within the framework of security and privacy
ESAS'05: Proceedings of the Second European conference on Security and Privacy in Ad-Hoc and Sensor Networks

Radio Frequency Identification (RFID) systems are expected to be widely deployed in automated identification and supply-chain applications. Although RFID systems have several advantages, the technology may also create new threats to user privacy. In ...
Impossibility results for RFID privacy notions
Transactions on computational science XI

RFID systems have become increasingly popular and are already used in many real-life applications. Although very useful, RFIDs introduce privacy risks since they carry identifying information that can be traced. Hence, several RFID privacy models have ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences

WPES '09: Proceedings of the 8th ACM workshop on Privacy in the electronic society

November 2009

130 pages

ISBN:9781605587837

DOI:10.1145/1655188

General Chair:
Ehab Al-Shaer
De Paul University, USA
,
Program Chair:
Stefano Paraboschi
Università di Bergamo, Italy

Copyright © 2009 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 09 November 2009

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

CCS '09

Sponsor:

SIGSAC

CCS '09: 16th ACM Conference on Computer and Communications Security 2009

November 9, 2009

Illinois, Chicago, USA

Acceptance Rates

Overall Acceptance Rate 106 of 355 submissions, 30%

Upcoming Conference

CCS '24

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 14 - 18, 2024

Salt Lake City , UT , USA

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

7
Total Citations
View Citations
508
Total Downloads

Downloads (Last 12 months)4
Downloads (Last 6 weeks)0

Reflects downloads up to 26 Sep 2024

Other Metrics

View Author Metrics

Citations

Cited By

Blass EKurmus AMolva RStrufe T(2019)PSPComputer Communications10.1016/j.comcom.2012.10.01236:4(468-480)Online publication date: 5-Jan-2019
https://dl.acm.org/doi/10.1016/j.comcom.2012.10.012
Yohan ALo NRandy VChen SHsu M(2016)A Novel Authentication Protocol for Micropayment with Wearable DevicesProceedings of the 10th International Conference on Ubiquitous Information Management and Communication10.1145/2857546.2857565(1-7)Online publication date: 4-Jan-2016
https://dl.acm.org/doi/10.1145/2857546.2857565
Frosch TSchäge SGoll MHolz T(2016)On Locational Privacy in the Absence of Anonymous PaymentsData Protection on the Move10.1007/978-94-017-7376-8_4(75-100)Online publication date: 2016
https://doi.org/10.1007/978-94-017-7376-8_4
Rupp ABaldimtsi FHinterwälder GPaar C(2015)Cryptographic Theory Meets PracticeACM Transactions on Information and System Security10.1145/269990417:3(1-31)Online publication date: 27-Mar-2015
https://dl.acm.org/doi/10.1145/2699904
Rupp AHinterwälder GBaldimtsi FPaar C(2013)P4R: Privacy-Preserving Pre-Payments with Refunds for Transportation SystemsFinancial Cryptography and Data Security10.1007/978-3-642-39884-1_17(205-212)Online publication date: 2013
https://doi.org/10.1007/978-3-642-39884-1_17
Hinterwälder GZenger CBaldimtsi FLysyanskaya APaar CBurleson W(2013)Efficient E-Cash in Practice: NFC-Based Payments for Public Transportation SystemsPrivacy Enhancing Technologies10.1007/978-3-642-39077-7_3(40-59)Online publication date: 2013
https://doi.org/10.1007/978-3-642-39077-7_3
Armknecht FChen LSadeghi AWachsmann C(2010)Anonymous Authentication for RFID SystemsRadio Frequency Identification: Security and Privacy Issues10.1007/978-3-642-16822-2_14(158-175)Online publication date: 2010
https://doi.org/10.1007/978-3-642-16822-2_14

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents