Secure Identity Management and Mobile Payments Using Hand-Held Devices
Total Page:16
File Type:pdf, Size:1020Kb
KUOPION YLIOPISTON JULKAISUJA H. INFORMAATIOTEKNOLOGIA JA KAUPPATIETEET 14 KUOPIO UNIVERSITY PUBLICATIONS H. BUSINESS AND INFORMATION TECHNOLOGY 14 KONSTANTIN HYPPÖNEN Open Mobile Identity Secure Identity Management and Mobile Payments Using Hand-Held Devices Doctoral dissertation To be presented by permission of the Faculty of Business and Information Technology of the University of Kuopio for public examination in Auditorium ML1, Medistudia building, University of Kuopio, on Friday 13th March 2009, at 12 noon Department of Computer Science University of Kuopio JOKA KUOPIO 2009 Distributor: Kuopio University Library P.O. Box 1627 FI-70211 KUOPIO FINLAND Tel. +358 40 355 3430 Fax +358 17 163 410 www.uku.fi/kirjasto/julkaisutoiminta/julkmyyn.shtml Series Editors: Professor Markku Nihtilä, D.Sc. Department of Mathematics and Statistics Professor Hannu Tanninen, D.Sc. (Econ) Department of Business and Management Author’s address: Department of Computer Science University of Kuopio P.O. Box. 1627 FI-70211 KUOPIO FINLAND Tel. +358 40 355 2208 E-mail: [email protected] Supervisors: Docent Elena Trichina, Ph.D. Department of Computer Science University of Kuopio Professor Martti Penttonen, Ph.D. Department of Computer Science University of Kuopio Reviewers: Professor Günter Müller, Ph.D. Department of Telematics University of Freiburg, Germany Professor Tuomas Aura, Ph.D. Department of Computer Science and Engineering Helsinki University of Technology, Finland Opponent: Professor David Naccache, Ph.D. Département d’Informatique École Normale Supérieure Paris, France ISBN 978-951-781-993-0 ISBN 978-951-27-0112-4 (PDF) ISSN 1459-7586 Kopijyvä Kuopio 2009 Finland Hyppönen, Konstantin. Open Mobile Identity: Secure identity management and mobile payments using hand-held devices. Kuopio University Publications H. Business and Infor- mation Technology 14. 2009. 79 p. ISBN 978-951-781-993-0 ISBN 978-951-27-0112-4 (PDF) ISSN 1459-7586 Abstract Identity proofs play an important role in our lives. They are performed both in face- to-face situations and remotely via computer networks. With the recent switch to new electronic identity documents such as biometric passports and chip-based identity cards, an increasing proportion of identity proofs takes place in the electronic realm. However, the security of new electronic documents is primarily focused on counterfeit protection, whereas privacy issues have been addressed only marginally. At the same time, when documents are read by electronic means, a lot of information is not only revealed but also can be copied, stored and processed without our consent. In this thesis, we present a technology for performing identity proofs using one’s own hand-held device. The technology is based on the design for privacy principle, enabling the user to provide flexible identity proofs that reveal only the minimally required set of personal information. This controlled identity revelation technique turns the hand- held device into the user’s personal identity assistant that can replace electronic identity documents in many circumstances. In addition, we show how privacy-aware biometric authentication can be performed as part of an identity proof. The system relies on the currently available handset technology. The user’s identity information is securely stored on the standard subscriber identity module (SIM) of a GSM mobile phone. The information is accessed through a program called identity proxy and communicated to identity verifiers only if the user’s consent for this is acquired. We show how to perform strong two-factor mobile user authentication remotely using credentials stored on the SIM, without using the mobile network operator’s authentication services. Furthermore, we demonstrate how such authentication can be used in a secure mobile payment system based on a government-supported public key infrastructure (PKI). Other scenarios include using the hand-held device as a secure authentication token for producing one-time passwords, challenge responses, or digital signatures. In conclusion, the studies presented in this thesis demonstrate how one’s own hand- held device can be used as a reliable and trustworthy electronic identity document and payment tool. Universal Decimal Classification: 004.056, 004.056.523, 621.395.721.5, 654.034, 658.88 AMS (MOS) Classification: 94A60, 94A62 INSPEC Thesaurus: security; security of data; mobile communication; telecommuni- cation security; mobile handsets; mobile computing; electronic commerce; electronic money; public key cryptography; message authentication; data privacy; biometrics (access control) Acknowledgments In the course of doing this research work I received help and support from many people and institutions. I am grateful to the East Finland Graduate School in Computer Science and Engineering, whose research grant made it possible for me to concentrate on research. I thank the Department of Computer Science for the financial support of my research and for travel grants. I am profoundly indebted to my principal supervisor, Dr. Elena Trichina, who gave her time and knowledge generously, encouraging my work and assisting me in each step to complete this thesis. I thank my second supervisor, Prof. Martti Penttonen, for his support, help and guidance not only during my postgraduate studies but all the time since 2001, when I came to Kuopio. Prof. Günter Müller and Prof. Tuomas Aura, the officially appointed pre- examiners of this dissertation, are gratefully acknowledged for their constructive criticism of this work and for their detailed comments which helped to improve this dissertation. I thank Marko Hassinen, my main colleague and co-author, for his participa- tion in this research, and his enthusiasm and guidance. His experience, openness to any ideas, and sense of humour all have been of great help. I thank Keijo Haataja for his assistance and for doing other security-related research together with me. I express my gratitude to the staff of the Department of Computer Science for friendly work atmosphere and for relaxing coffee breaks and lunches. Many have supported this work directly, most importantly Tapio Grönfors, Virpi Hotti, Seppo Lammi and Pekka Toivanen. Pekka Kilpeläinen, Paavo Pakoma, Jyrki Wessman, Merja Leppänen and Leila Tiihonen have been of great help in administrative issues, and not only in them. I thank Vivian Michael Paganuzzi for the careful revision of the language of this thesis. I am the only person responsible for any remaining errors in the text. My special gratitude goes to my international friends: Darius, Rimant˙e, Martin, Boryana, Gogo, Laura, Roman, Olli, Ursi, Ferdinand, Viktoria, Sveta, Rustam, Irina, Jakub for exciting parties, tasty dinners, mökki weekends, sport activities, and many discussions which were often related to postgraduate studies. I also thank my Russian friends: Yury Vinokur and the whole families of Kornilov, Grigoriev, Grebeshov, Fridriksson, and Talbonen for keeping in touch and for providing all the support that I could ask for. Thanks go to my whole family, who have been an important and indispensable source of spiritual support. Ñïàñèáî! And finally, but not least, I thank my wife Jelena for everything that I told you many times already, and for much more that I cannot put in words. List of original publications This dissertation is based on the following publications, which are referred to in the text by their Roman numerals (I–V): I Marko Hassinen, Konstantin Hyppönen. Strong Mobile Authentication. Pro- ceedings of the 2nd International Symposium on Wireless Communication Systems, pp. 96–100. IEEE, 2005. II Marko Hassinen, Konstantin Hyppönen, Elena Trichina. Utilizing national public-key infrastructure in mobile payment systems. Electronic Commerce Research and Applications 7 (2), pp. 214–231, Elsevier, 2008. III Konstantin Hyppönen, Marko Hassinen, Elena Trichina. Pseudonymous Mo- bile Identity Architecture Based on Government-Supported PKI. Proceedings of the TRUST2008 Conference on Trusted Computing, Villach, Austria, March 11–12, 2008. Vol. 4968 of Lecture Notes in Computer Science, pp. 107–118, Springer, 2008. IV Konstantin Hyppönen, Marko Hassinen, Elena Trichina. Combining Biomet- ric Authentication with Privacy-Enhancing Technologies. Proceedings of the TRUST2008 Conference on Trusted Computing, Villach, Austria, March 11–12, 2008. Vol. 4968 of Lecture Notes in Computer Science, pp. 155–165, Springer, 2008. V Konstantin Hyppönen. An Open Mobile Identity Tool: An Architecture for Mobile Identity Management. Proceedings of the Fifth European PKI Work- shop (EuroPKI 2008), Trondheim, Norway, June 16–17, 2008. Vol. 5057 of Lecture Notes in Computer Science, pp. 207–222, Springer, 2008. Author’s contribution This dissertation is the result of research carried out within an informal security group at the Department of Computer Science, University of Kuopio, during 2005–2008. The research work of the group was focused on the security and reliability of embedded systems, wireless network security, and cryptoalgorithms and protocols. Publication I introduces the idea of using a national public key infrastructure for strong authentication of mobile users. Furthermore, it envisages the use of such authentication for message exchange and mobile payments. Smart card implementation and simulation software were developed by the author. The original payment protocol introduced in the paper was designed by Marko Hassinen. He also implemented software for the mobile phone and back-end systems. Publication