1. 2.6.2006 Josef Noll Payment and Access 1 Payment and Access through the Mobile Phone Josef Noll 1,2, Erzsébet Somogyi 3, Gyorgy Kalman 1, Ola Høiby 1 1 UniK, 2 Telenor R&D, 3 Canaldigital josef@unik.no, erzsebet.somogyi@telenor.com, gyorgy@unik.no, hoiby@unik.no

2. 2.6.2006 Josef NollPayment and Access2

3. 2.6.2006 Josef NollPayment and Access3 Leading questions What do I fear? –That somebody steals my identity and I can't do anything about it. –That biometrics takes it all. What can I use to make life more comfortable? –Reduce number of “secure devices” I have to carry (BankID, Telenor Sharepoint ID, keys, money, credit card, …) –Have a device which is secure (enough). Why is my phone the security infrastructure? –Because I can ask Telenor to block it, if it gets stolen. –Because it is not an insecure Microsoft device. What challenges does Telenor face, when it comes to authentication and security?

4. 2.6.2006 Josef NollPayment and Access4 B3G: Device, Networks, Services original: Eurescom P1145 “Beyond 3G” (2001) Beyond 3G: Personalised Broadband Wireless Services Personal and Public Devices Personal Area Network (PAN) Roaming access across networks public GSM/GPRS/UMTS Mobility: GSM/GPRS, Mobile IP, n.n. BSC HA, FA NT(1) Wire- less Ethernet home xDSL, cable PrivatSupport Wire- less Ethernet hot-spot/ corporate LAN 1G: 197019801990 2000 2010 3G: 2G: B3G: Mobile telephony Mobile telephony, SMS, FAX, Data Multimedia communication Personlised broadband wireless services EAP/SIM, Telenor demo at the GSM world congress

5. 2.6.2006 Josef NollPayment and Access5 Agenda “Payment and Access" Seamless SIM access in wireless systems: –Near Field Communication (NFC) –Bluetooth, Wifi, –GSM/UMTS Service access examples Seamless access to home content: my pictures, my music Community services: Contact information Bank transactions: SIM & PKI Supported by demonstrations

6. 2.6.2006 Josef NollPayment and Access6 Device Authentication SIM with NFC & PKI

7. 2.6.2006 Josef NollPayment and Access7 New role: Telenor as authentication provider Seamless authentication Physical access VPN Home access,.mp3,.jpg Service access

8. 2.6.2006 Josef NollPayment and Access8 Example: Picture gallery “your content, independent of the device” Access from “anywhere” and “any device” Supports mobile and home network access Identifies user through WAP gateway –Alternative: username/password Identifies device through WAP gateway PC mobil

9. 2.6.2006 Josef NollPayment and Access9 Banking from the mobile phone Security considerations Equally secure as SMS (get your account status) Easy to use Advanced functionality through PIN (if required)  Seamless phone (SIM) authentication Advanced security when required –BankID or –PIN Welcome Josef: SIM authentication Account status Transfer, payments Information: Advanced functionality Using SIM, no customer input required BankID or PIN (double security)

10. 2.6.2006 Josef NollPayment and Access10 MyBank example: Banking from the mobile phone User incentive: “My account is just one click away” “enhanced security for transactions”  Phone (SIM) authentication  Level 2 security through PKI/BankID/PIN?

11. 2.6.2006 Josef NollPayment and Access11 Community service: Contact info User incentive: “change your phone, and miss your contacts” “my wife has the phone number, not me”  Contacts database in Wap Each member with specific addresses –Child: family, friends –Mother: family, companies, her friends –Father: family, companies, work

12. 2.6.2006 Josef NollPayment and Access12 NFC activities in Telenor R&D Payment on coffee machine Registration of containers RFID card in 2007? Tests in OSL and Arlanda RFID cards Think Tromsø life trial: Tromsbuss Payment, Entrance

13. 2.6.2006 Josef NollPayment and Access13 Current prototype: SMS key access Service Centre Application 1) Send SMS 2) Send service to phone 3) Send info to recipient 4) Enters house with NFC access

14. 2.6.2006 Josef NollPayment and Access14 SMS key access How does it work? “Josef” want to gives access to “Inge” to his home He registers Inge as a legal recipient “reg Inge 90025643” Sends Key to Inge’s phone “rfid number lock date time” –Access is only granted to “known” people –Other formats also okay Inge receives welcome message and key Inge opens the door

15. 2.6.2006 Josef NollPayment and Access15 NG interactive TV It’s me, get my services (seamless authentication) Extra information, IP services: http://JamesBond.com Extra channels My personal EPG Remote control

16. 2.6.2006 Josef NollPayment and Access16 Conclusions “The last time we were connected by a wire was at birth!” [Motorola] All services from your mobile –Music –Pictures, addresses, … Seamless service access –Personalised –Adapted to device Payment and access through NFC Telecom as authentication provider

17. 2.6.2006 Josef NollPayment and Access17 Authentication Knowledge based: Username/password authentication Widely used Not comfortable Bad passwords, not secure Seamless authentication Comfortable Trusted third party might be needed Security issues Property-based Biometric Knowledge- based Seamless authentication

18. 2.6.2006 Josef NollPayment and Access18 Seamless authentication with WAP HTTP request 94815894 Hash HTTP request cTHG8aseJPIjog== Pictures for ’ rzso ’. Password:1234 sID: cTHG8aseJPIjog==

19. 2.6.2006 Josef NollPayment and Access19 Challenges: Standardisation of NFC/SIM connection Major challenges Communication with SIM card Set-up of other communication (WLAN, Bluetooth,…) Phone compatibility Smartcard interfaces ISO/IEC 7816 NFC communication unit SIM NFC reader NFC2SIM

20. 2.6.2006 Josef NollPayment and Access20 Future ideas: DRM handling Internet Home access,.mpg,.mp3,.jpg NFC communication unit SIM with DRM keys NFC2SIM 4. Request DRM key for selected content 5. Return DRM key 1. Request for home content 2. Seamless authentication and redirect to personalised content 3. Streaming of encrypted content NFC