A Summer Internship Project Report On Analysis and Design of Browser for secure mobile payments Carried out at the Institute of Development and Research in Banking Technology During 20th May – 20th July 2014 Submitted by: SUHANI GARG Integrated M.Tech 3rd Year Mathematics and Computing 11412EN005 IIT-BHU (Varanasi) Under the Guidance of Dr. V.N.Sastry Professor IDRBT, Hyderabad Date of Submission: 18th July 2014 1 ABSTRACT Mobile banking is easy, saves a lot of effort and time. Losses attributed to financial fraud are alarming. Mobile banking via a mobile browser is similar to home banking. Browsing-based threats for smartphones are just the same as those for computers which mean mobile security is just as important as PC security. Apart from various browsers available in market, there are several proxies which infect web browser by taking advantage of vulnerabilities in browser security, thereby modifying ones transactions and web pages content. Authentication is a technique to identify a person’s identity. Transaction authentication includes id and password, IP address, geolocation, computer hardware, time of day and previous user pattern of behaviour. Geolocation authentication is an important type of transaction authentication. The aim of the project is to make a comparative analysis of the various desktop and mobile browsers available in the market, study their features and to develop a new secure mobile browser especially for banks including a new way of authentication which includes security of mobile transactions. So, in addition to id and password, geolocation tells banks from which place transaction are going to take place. Hence, it helps banks to provide secure transactions. 2 CERTIFICATE This is to certify that the summer internship project report entitled “Analysis and Design of Browser for Secure Mobile Payments” submitted by SUHANI GARG, I.M.D.(MnC) 3rd Year, IIT-BHU(Varanasi) to Institute for Development and Research in Banking Technology (IDRBT), Hyderabad is a record of bonafide work carried out by her under my supervision and guidance during 20th May 2014 to 18th July 2014. (Dr. V.N.Sastry) Professor, IDRBT. Project Guide 3 DECLARATION I SUHANI GARG hereby declare that this Dissertation entitled “ANALYSIS AND DESIGN OF BROWSER FOR SECURE MOBILE PAYMENTS” submitted by me under the guidance and supervision of Dr. V.N. Sastry, Professor, IDRBT, is a bonafide work. I also declare that it has not been submitted previously in part or in full to this University or other University or Institution for the award of any degree or diploma. Date:18/07/2014 Name: SUHANI GARG Signature of the Student 4 ACKNOWLEDGEMENTS First, and foremost I would like to express my sincere gratitude to my project supervisor Dr. V.N.Sastry, Professor, IDRBT, Hyderabad, who guided me all through the project and showed me the right path. His engagement in my project and his stream of ideas have been absolutely essential for my results presented here. I am very thankful that he has spent so much time with me during my project work. My honourable thanks to Shri.B.Sambamurthy, Director, IDRBT for providing excellent labs and library. I would also like to thank IDRBT staff. I thank IDRBT for providing me with necessary infrastructure and technical support that was required for this project. Finally, I express my gratitude to my parents and friends for their valuable suggestions and moral support. SUHANI GARG Integrated M.Tech 3rd year Department of Mathematical Sciences IIT-BHU (Varanasi) Email: [email protected] Ph: +91-7704094623 5 CONTENTS Abstract Acknowledgement Certificate 1. Introduction 1.1 Websites 1.2 Browsers 1.3 Protocols 1.4 Authentication 1.5 Browser Web Development Tools 1.6 Conclusion 2. Analysis and Comparison of Desktop Browsers 2.1 Desktop browser and Mobile browser 2.2 Analysis of various desktop browsers 2.3 Best Browser 2.4 Present usage share and future trend of web browser 2.5 Conclusion 3. Analysis and Comparison of Mobile Browsers 3.1 Analysis of various mobile browsers 3.2 Mobile platforms and Security basis 3.3 Mobile Screen Resolution 3.4 Disadvantages of Mobile Internet 3.5 Mobile Networks and Protocols 3.6 Inter-operability 3.7 Future of Mobile browsers 3.8 Conclusion 6 4. Design and Implementation of Browser for secure Mobile Banking 4.1 Secure mobile banking 4.2 Browser attacks on banking 4.3 Design and Implementation 4.4 Conclusion 5. Conclusions and Future Work References 7 Chapter 1 : Introduction In this chapter, basics about websites, their features, various types of websites available. Browser and their distinguishing features, list of some browsers are presented. Then it describes about various protocols and its layers, authentication and different types of authentication available. Lastly, the various common web development tools i.e. advantages of using HTML, HTML5 and XML are presented. 1.1 Websites Website is the very first thing that we see in a browser. A website is set of web pages hosted on at least one web server. It is accessible via an Internet or local area network through Uniform resource locator. There are various characteristics to make an effective website. 1. Appearance :- A site must be polished, visually appealing and professional outlook. Some guidelines to improve this are meaningful graphics, good use of colour, text easily readable, simplicity and quality photography. 2. Content :- A good site should have relevant and informative substance. Some guidelines to improve this are short and organized copy, speak to visitors, update content regularly, unique content and consider a professional to write and edit. 3. Functionality :- Every component of a website should work correctly and quickly. For this, it should be error free copy. 4. Usability :- Site must be easy to read, understand and navigate. Some guidelines to improve this are fast loading pages, minimal scroll, consistent layout, simplicity, cross platform / browser compatibility and screen resolution. 5. Search Engine Optimized 6. User Friendly 7. Mobile Dominated Web 8. Get on Board with Social Media There are various different types of websites. Some of them are :- 1. Personal websites 2. Writers and Authors websites 3. Photo Sharing websites 4. Community building websites 5. Mobile device websites 6. Blogging websites 7. Directory websites 8. Online Business Brochure/ Catalog websites 9. Informational websites 10. E-Commerce websites 8 1.2 Browsers A web browser is an interface that allows a computer user to gain access to all content that is on Internet as well as hard disk of computer. It allows us to access web pages, images, audio and video files, text documents, etc. We can install multiple browsers in computer. Browsers are developed to access information on World Wide Web. The distinguishing areas of browsers are: Platform : Windows, Mac, BSD, Linux and other Unix Protocols: FTP, SFTP, SAMBA, HTTP, IMAP, etc. Layout Engine: Amaya, Gecko, Trident, KHTML, WebKit Graphical User Interface (GUI) Proprietary HTML5 Support Open Source Mobile Compatibility Some features offered by web browsers include downloads, bookmarks, search engine toolbars password management, spell checking, tabbed browsing, HTML access keys, advertisement filtering and pop-up blocking. Some important web browsers are listed below: Table : Various desktop browsers Browser Release Latest Version Creator URL Year Internet Aug,1995 11.0.9 Microsoft http://microsoft.com/ie Explorer Mozilla Nov,2004 30.0 Mozilla http://mozilla.org/firefox Firefox Google Sep,2008 35.0.1916.153 Google http://www.google.com/chrome Chrome Safari Jan,2003 7.0.5 Apple http://apple.com/safari Netscape Dec,1994 8.1.3. Netscape http://www.netscape.ca/ns/browser Navigator s/7/download/ Opera 1994 22.0.1471.70 Opera http://www.opera.com/ Lynx 1992 2.8.8 Grobe http://lynx.isc.org/ OmniWeb 1995 5.11.2 Omni Group http://www.omnigroup.com/more Konqueror Oct,2000 4.13.1 KDE http://www.konqueror.org/ 9 iCab 1999 5.2 Clauss http://icab.de/ Camino 2002 2.1.2 Apple http://caminobrowser.org/ Maxthon 2003 4.4.1.200 Maxthon http://www.maxthon.com/ Netsurf 2002 3.1 NetSurf http://www.netsurf-browser.org/ 1.3 Protocols A standard set of rules that allow two devices to connect and exchange information across each another is called a protocol. Internet protocols include TCP/IP (Transfer Control Protocol/ Internet Protocol), FTP (File Transfer Protocol), HTTP (Hypertext Transfer Protocol) and SMTP (Simple Mail Transfer Protocol). World’s most famous protocol is internet protocol based on open system, suited for LAN and WAN communications and can communicate to any set of interconnected networks. The two best known are Transmission Control Protocol (TCP) and the Internet Protocol (IP).Internet Protocol Suite provides abstraction of protocols using encapsulation. The four layers are: Application Layer : FTP, DNS, HTTP, SMTP, SNMP, SSH, NTP, SOCKS, SSL, Telnet and more Transport Layer : TCP, UDP, SCTP, RSVP, DCCP and more Internet Layer : IP (IPv4, IPv6), IPsec, ICMP, ECN, ICMPv6 and more Link Layer : DSL, PPP, NDP, ARP and more Internet Protocol version 6 (IPv6) is the current-generation Internet Protocol version designated as the successor to IPv4. IPv6 addresses typically have two parts: a 64-bit network prefix and a 64-bit host address. The IPv6 addressing structure uses hexadecimal notation, normally written as eight groups of four hexadecimal digits, and colons replace the periods used in IPv4. IPv6 has four address types: unicast (one-to-one), anycast (one-to-nearest), multicast (one-to-many), and a reserved class. IPv6 does not support broadcasting. IPv6 runs well in high-performance networks, such as Gigabit Ethernet and ATM networks, and it is also efficient for low- bandwidth networks such as wireless networks. IPv6 offers better security mechanisms, mandating the use of IPsec and IKE. The motivations to bring IPv6 version are fast growing internet and large address space, to provide security feature which is vulnerable as data on internet, to make data prioritization up to date and to make device to have globally unique IP address.