Security Enhancements in EMV Protocol for NFC Mobile Payment

Nour El Madhoun (1) , Guy Pujolle (1)

1 Phare

Today, by integrating Near Field Communication (NFC) technology in smartphones, bank cards and payment terminals, a purchase transaction can be executed immediately without any physical contact, without entering a PIN code or a signature. Europay Mastercard Visa (EMV) is the standard dedicated for securing contactless-NFC payment transactions. However, it does not ensure two main security proprieties: (1) the authentication of the payment terminal to the client’s payment device, (2) the confidentiality of personal banking data. In this paper, we first of all detail EMV standard and its security vulnerabilities. Then, we propose a solution that enhances the EMV protocol by adding a new security layer aiming to solve EMV weaknesses. We formally check the correctness of the proposal using a security verification tool called Scyther.

Mots clés: Confidentiality; EMV; mutual authentication; NFC; NFC smartphone; payment; scyther; security

Domaines: Cryptographie et sécurité [cs.CR]

Nour El Madhoun, Guy Pujolle. Security Enhancements in EMV Protocol for NFC Mobile Payment. The 15th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom-16), Aug 2016, Tianjin, China. ⟨hal-01340315⟩