以NFC HCE技術為基礎的行動支付之研究

A Study of NFC HCE-Based Mobile Payment

林哲瑋(Che-Wei Lin)

指導教授 ： 陳彥錚

國立暨南國際大學/管理學院/資訊管理學系/碩士(2015年)

https://doi.org/10.6837/NCNU.2015.00310

摘要

近來NFC手機的普及帶動相關應用服務之發展，其中以行動支付最受矚目。NFC卡片模擬模式可以將手機模擬成信用卡，以安全元件存取應用程式與個人化資料，行動網路業者與服務供應商可透過第三方的信託服務管理平台(TSM)進行安全元件與應用服務的生命週期管理。然而，安全元件之控制權會影響NFC生態系統中商業利益之分配，服務供應商需要額外的成本才能將應用服務透過TSM進行上架。本論文採用HCE技術，使得NFC手機可以不需使用安全元件就可達到NFC卡片模擬的應用服務。本論文亦提出利用加密演算法達到支付系統對於通訊與存取的安全需求，並在交易過程中利用HMAC函式結合時戳與隨機亂數機制對使用者進行驗證，確保行動支付系統運作更為安全。

關鍵字

NFC ； HCE ； 卡片模擬 ； 行動支付

並列摘要

The evolution of NFC-enabled mobile devices promotes the development of NFC-based mobile applications, especially in mobile payments. An NFC-enabled phone, in the card-emulation mode, behaves like a contactless smart card or a credit card, which allows payment applications with personal information stored in the Secure Element (SE). Mobile network operators and services providers control and dominate the lifecycle of SEs and related services through a third-party trust service manager. However, the solution relies on the cooperation of all parties in the NFC ecosystem. This paper presents a secure NFC mobile payment system based on HCE technology. The HCE technology enables the realization of a virtual smart card using software. In HCE mode, the host CPU can process APDU commands sent by an NFC Reader. This study aims to develop a mobile payment scheme without the need of SEs. The proposed system achieves security features based on contemporary AES and RSA encryption algorithms, and two effective authentication schemes are proposed with timestamp and nonce methods respectively.

並列關鍵字

NFC ； HCE ； card emulation ； mobile payment

參考文獻

[1] E. Haselsteiner and K. Breitfuß, "Security in near field communication (NFC)," in Workshop on RFID Security RFIDSec, 2006.

[2] C. Mulliner, "Vulnerability Analysis and Attacks on NFC-Enabled Mobile Phones," in Availability, Reliability and Security, pp. 695-700, 2009.

[3] S.-H. Wu and C. Yang, "Promoting collaborative mobile payment by using NFC-Micro SD technology," in Services Computing (SCC), 2013 IEEE International Conference on, pp. 454-461, 2013.

[4] NFC Forum. What Is NFC? What It Does? Available: http://nfc-forum.org/what-is-nfc/what-it-does/, accessed on March 2015.

[5] M. Strohbach and M. Martin, "Toward a platform for pervasive display applications in retail environments," IEEE Pervasive Computing, pp. 19-27, 2011.