Introduction to M-Commerce Overview n n n

Introduction to M-Commerce

Overview n n n n What is M-Commerce? Security Issues Usability Issues Heterogeneity Issues Business Model Issues Case Studies / Examples Q&A

What is M-Commerce? n n n E-Commerce with mobile devices (PDAs, Cell Phones, Pagers, etc. ) Different than E-Commerce? No, but additional challenges: n n n Security Usability Heterogeneous Technologies Business Model Issues But first, let’s learn a little about wireless technologies…

Wireless Technologies n Link Layer (examples…) n n n WAN: Analog / AMPS CDPD: Cellular Digital Packet Data TDMA/GSM: Time Division Multiple Access, Global System for Mobile Communications (Europe) CDMA: Code Division Multiple Access Mobitex (TDMA-based) LAN: 802. 11 Bluetooth Devices: Cell Phones, Palm, Win. CE, Symbian, Blackberry, …

Examples of PDA Devices PDA Microprocessor Speed Palm, Handspring Motorola Dragonball 16. 6 – 20 MHz RIM Interactive Pager Intel 386 10 MHz Compaq Aero 1530 NEC/VR 4111 MIPS RISC 70 MHz HP Jornada 820 Intel/Strong. ARM RISC SA 1100 NEC/VR 4121 MIPS 190 MHz ARM 710 36 MHz Digital/Arm 7100 18 MHz Casio Cassiopeia E 100 Psion Revo Psion Series 5 131 MHz

Application Layer Technologies n n Micro-browser based: WAP/WML, HDML: Openwave i. Mode (HTML): NTT Do. Co. Mo Web Clipping: Palm. net XHTML: W 3 C Voice-browser based: Voice. XML: W 3 C Client-side: J 2 ME: Java 2 Micro Edition (Sun) WMLScript: Openwave Messaging: SMS: Part of GSM Spec.

Example: WAP n n WAP: Wireless Application Protocol Created by WAP Forum n n Founded June 1997 by Ericsson, Motorola, Nokia, Phone. com 500+ member companies Goal: Bring Internet content to wireless devices WTLS: Wireless Transport Layer Security

Basic WAP Architecture WTLS SSL Web Server Internet WAP Gateway

Example: WAP application

Security Challenges n Less processing power on devices n n n Slow Modular exponentiation and Primality Checking (i. e. , RSA) Crypto operations drain batteries (CPU intensive!) Less memory (keys, certs, etc. require storage) Few devices have crypto accelerators, or support for biometric authentication No tamper resistance (memory can be tampered with, no secure storage) Primitive operating systems w/ no support for access control (Palm OS)

Wireless Security Approaches n Link Layer Security n n GSM: A 3/A 5/A 8 (auth, key agree, encrypt) CDMA: spread spectrum + code seq CDPD: RSA + symmetric encryption Application Layer Security n n n WAP: WTLS, WMLScript, & SSL i. Mode: N/A SMS: N/A

Example: Security Concerns n Performance: we’ll do an example: should we use RSA or ECC for WTLS mutual auth? n Control: WAP Gap data in the clear at gateway while re-encryption takes place

Example: WTLS– ECC vs. RSA? n WTLS Goals n n n Authentication Privacy Data Integrity Authentication: Public-Key Crypto (CPU intensive!!!) Privacy: Symmetric Crypto Data Integrity: MACs

WTLS: Crypto Basics n Public-Key Crypto n n RSA (Rivest-Shamir-Adelman) ECC (Elliptic Curve) n Certificates n Authentication n None, Client, Server, Mutual

WTLS w/ Mutual-Authentication • Mutual-Authentication Client Hello 1. Verify Server Certificate ------> <------ Server. Hello Certificate. Request Server. Hello. Done Certificate Client. Key. Exchange (only for RSA) 2. Establish Session Key Certificate. Verify 3. Generate Signature Change. Cipher. Spec Finished ------> <-----Application Data Finished <-----> Application Data

WTLS Handshake Timings (Palm VII) • Mutual-Authentication: RSA Operation Cryptographic Primitive(s) Time Required (ms) Server Certificate Verification RSA Signature Verification (Public decrypt, e=3) 598 Session Establishment RSA Encryption (Public encrypt) 622 Client Authentication RSA Signature Generation (Private encrypt) 21734 TOTAL 22954 Key

WTLS Handshake Timings (Palm VII) • Mutual-Authentication: ECC Operation Server Certificate Verification Session Key Establishment Client Authentication TOTAL Cryptographic Primitive(s) CA Public Key Expansion ECC-DSA Signature Verification Server Public Key Expansion Key Agreement ECC-DSA Signature Generation Time Required (ms) 254. 8 1254 254. 8 335. 6 514. 8 2614 The cryptographic execution time for mutually-authenticated 163 -bit ECC handshakes is at least 8. 64 times as fast as the cryptographic execution time for mutually-authenticated 1024 -bit RSA handshakes on the Palm VII.

WAP Gap: One Alternative… n Dynamic Gateway Connection WTLS Class 2 SSL Operator WAP Gateway Internet Content Provider n WAP Gateway Other alternatives also exist… SSL Web Server

Usability Challenges n Hard Data Entry n n n Small Screens n n Poor Handwriting Recognition Numeric Keypads for text entry is error-prone Poor Voice Recognition Further complicates security (entering passwords / speaking pass-phrases is hard!) i. e. , can’t show users everything in “shopping cart” at once! Voice Output time consuming

Usability Approaches n n n Graffiti (Scaled-down handwriting recognition, Palm devices) T 9 Text Input (Word completion, most cell phones) Full alphanumeric keypad & scrollbar (Blackberry) Restricted Voice. XML grammars for better voice recognition Careful task-based Graphical User Interface & Dialog Design Lots of room for improvement!

Heterogeneity Challenges n n Many link layer protocols (different security available in each) Many application layer standards Businesses need to write to one or more standards or hire a company to help them! Many device types: n n Many operating systems (Palm OS, Win CE, Symbian, Epoch, …) Wide variation in capabilities

Heterogeneity Approaches n n n HTML/Web screen scraping Protocol & Mark-up language translators Standardization

Business Models Issues n Possible Models: n n n n Slotting fees Wireless advertising (text) Pay per application downloaded Pay per page downloaded Flat-fees for service & applications Revenue share on transactions Trust issues between banks, carriers, and portals Lack of content / services

Case Studies n n n NTT Do. Co. Mo’s I-Mode Palm. net Sprint PCS Wireless Web

NTT Do. Co. Mo I-Mode n n n 20 million users in Japan HTML-based microbrowser (supports HTTPS/SSL) on CDMA-based network 10’s of thousands of content sites, ring tones, and screen savers Pay per application downloaded and pay per page models Invested in AT&T Wireless so we may see it here in US in next few years!

Palm. Net n n Low 100 K users in USA Web Clipping (specialized HTML) microbrowser on Mobitex (TDMA) – based network run by Bell. South (>98% coverage in urban areas) 100’s of content sites (typically no charge for applications) Palm VII devices now selling for $100 due to user adoption problems. (Service plans range from $10 - $40 per month. )

Sprint PCS Wireless Web n n n Low, single-digit millions of US users Multi-device strategy: WAP/HDML based microbrowser on phones, Web Clipping on Kyocera, both on CDMA network ~50 content sites slotted, many others available (very hard to enter URLs, though) Slotting-fee + rev-share on xactions model $10 per month flat-fee to users, most phones already have microbrowser installed.