Multi level Contextualization Framework for Authentication of

Document Sample
Multi level Contextualization Framework for Authentication of Powered By Docstoc
					             A Multi-level Contextualization Framework for Authentication of Mobile
                                      Payment Applications
                            Deveeshree Nayak                                        Srini Ramaswamy
                    KIIT University, Bhubaneswar, India                        Industrial Software Systems
                                             ABB India Corporate Research Center

Abstract: In this paper, the emerging need for a user-driven
contextualized approach towards security authentication for           II. Context Modeling Approaches
today’s emergent mobile e-commerce applications is outlined.          Current approaches to context modeling can be broadly
The main advantages of contextualizing user-driven                    classified into the three main categories: These include [1]:
authentication is that it can be almost impregnable by malicious
users who attempt to get personal details through various             1.    Object-role based context modeling: these approaches are
intrusion techniques or by plain theft of a mobile device.                  called fact-based context modeling approaches, have
Drawing on existing work on context modeling, in this paper we              evolved from data base modeling techniques, and they
develop a 4-layer framework that can support the provisioning               attempt to create formal models of context to support
of trustworthy authentication measures for mobility applications            automated processing for queries and reasoning. It also
to garner widespread public adoption. If appropriately evolved,             supports software engineering tasks such as analysis and
such technology might allow banking institutions in growing                 design. Tools such as CML [2-4], based on OML [5], have
markets to leapfrog credit-card based payment schemes and                   been developed for this need. Such tools provide a
rapidly reach an untapped ‘banking market’ segment of mobile                database-style management of context information and
users in new and emergent economies.                                        typically offer interfaces for applications to query context
                                                                            information or receive notifications on context changes.
I.   Introduction
                                                                      2.    Spatial context modeling: Spatial context modeling is
In most modern day applications, there exists a dire need for a             relevant for developing context-aware applications that are
user-driven contextualized approach towards security                        primarily location-based, for example mobile information
authentication. Such needs are often evolved through contexts,              systems. Such information may include the position of
wherein a context refers to the information which can be used to            entities as well as its spatial relation to other related entities.
characterize the situation of an entity under consideration. An             This may be an area, range or distances to other entities.
entity may be a person, location, object, etc. which are                    Typical queries for such a context management platform
considered to be relevant for the behavior of an application.               will include support for queries that help determine,
These contexts then need to be applied to address security                  position, range, nearest neighbor, geometric / symbolic
authentication challenges through the use of policies. To                   coordinates, etc. [6]. Tools for special context modeling
establish contexts, researchers have applied context modeling,              have been in the market by several vendors [8, 9, 10].
which is an attempt to describe not just the entities involved in a         However, a major drawback of this approach will be the
system but also their relationships. Such context modeling can              effort that it takes to gather and organize location data, as
be accomplished through either bottom-up or top-down                        well as to keep it current.
techniques. In real-world applications (ex. mobile wallet) that       3.    Ontology-based context modeling: In this approach
have crept into the daily lives of millions of people, such                 researchers attempt to support applicative needs that require
contextualization must necessarily include some regionalization             a thorough representation of knowledge. Ontological
and localization for the needs of usable security authentication.           representations attempt to describe complex context data
To determine such regional and application-specific contexts,               that cannot be otherwise described by simple languages, by
there must be a delicate and well-defined balance between the               allowing for formal semantics based data descriptions,
complexity of the authentication measure and the relative                   thereby making it available for relationship consistency
simplicity and ease of use by any individual. Thus the main                 checks. While it is highly expressive and could also support
scientific contribution of this paper is the development of a               interoperability, it can be too complex and inappropriate for
compelling case for personal and application-specific                       certain kinds of applications (such as ‘thin’ mobile-based
contextualization and a proposed that can accomplish this                   payment systems). However, in [6], the authors have
successfully. Such context-aware techniques have the potential              evolved a multi-tiered approach for ontology based
to support the development of pervasive, user-centered                      contextual modeling, based on a 5-tiered ontology
computing applications that are flexible, adaptable, and capable            presented in [7]; namely, physical reality, observable
of acting autonomously on behalf of their users.                            reality, object world, social reality and cognitive agents.
III. Contextualization for Security Authentication                         monitors, collects and distributes micropayments, which are
                                                                           categorized as a small sum of money in exchange for
Given the above brief survey on contextualization for                      something made available online. Due to the small nature of
development of pervasive applications, specifically for the need           the transaction micropayments typically accumulate until
to develop personalized and regionally / culturally relevant               they are collected as a single, larger payment.
security authentication measures we foresee the following
challenges: (i) First for each application and cultural /               While mobile payments add immense degree of user flexibility,
regionalization need, one needs to define a suitable context            security of these transaction mechanisms and ease of use of
model for such systems to act as the primary basis for the policy       these interaction exchanges is of immense interest to both
generation. (ii) Second, the security authentication policies           customer and the financial institutions. Security, trust and
themselves have to be derived from this contextual model. (iii)         privacy are therefore critical for organizations to cultivate an
Third, such a policy must also be enabled along with appropriate        effective, mutually rewarding relationship with the customer.
context management, i.e., the efficient management of context           Additionally, typically such services also involve other
information and feasible context representations in order to            significant barriers to entry such as (i) High costs: For example
allow reasoning.                                                        if one wants to use services such as IBM’s context service [12],
                                                                        which integrates different context information required by the
The design of such societally pervasive systems thus cannot be          client application from the different sources. However, it is
highly application-centric – which has been the case thus far,          often left to the customer to explore further integration to
and appropriate focus need to be paid to personally identifiable        provide information spanning multiple instances. (ii) Low
information (PII) and the management of such PII information
from a contextual perspective. Moreover, while such context
information must be rich enough to evaluate whether there is a
chance for the user to understand the authentication measure
with the application environment and policy situations that are
prevalent locally, it should support decision making when
adaptation to the context is necessary due to changes in the
regional context that will additionally also require reasoning
capabilities. Hence a framework for such systems must support
multi-level context development, whereby higher level context
information may be utilized to support emerging needs such as
appropriate consistency verification and support in-depth
reasoning about unforeseen, complex situations.                           Figure 1. Classification of Mobile Payment Schemes

IV. Authentication Measures for Mobile Payments in a                    payout rates - operators also see high costs in running and
    Regional Context                                                    supporting transactional payments which results in payout rates
                                                                        to the merchant being as low as 30% (usually this is around
Mobile payments add a degree of flexibility for the end
                                                                        50%) (iii) Low follow-on sales - once the payment message has
customer while reducing office / retail space costs for a vendor
                                                                        been sent and the goods received there is little else the consumer
and hence are increasingly viewed as a significant business
                                                                        can do. It is difficult for them to remember where something
opportunity by all kinds of vendors. Typically, as shown in
                                                                        was purchased or how to buy it again. In such a nebulous
Figure 1, mobile payment mechanisms can be classified as one
                                                                        business environment, it is easy for security authentication
of the below three broad categories.
                                                                        measures to not receive the necessary attention. For example,
1. Account-based schemes: Account-based schemes are based
                                                                        the SMS/USSD encryption ends in the radio interface, thereafter
    on the principle that a customer will ‘open’ or maintain an
                                                                        the message is often via plaintext.
    account, using which they will be billed. Such schemes may
    be either direct cash based or token based (which map to
                                                                        As a case study we will discuss the contextualization of security
    some cash value) and typically are not small transactions.
                                                                        authentication for mobile payment applications motivated
    They can be further classified into phone based (some
                                                                        through an Indian context. Further we propose a context based
    carriers in India allow ‘deposit’ of money / credit to facilitate
                                                                        framework for the development of such applications. Mobile
    such account-based schemes, card-based or point-of-sale
                                                                        wallet generally refers to payment services operated under
    (using a merchant). An interesting twist in this scheme that is
                                                                        financial regulations and performed either from, or via, a mobile
    popular in the Indian market segment is COD (cash-on-
                                                                        device. Financial institutions, credit card companies, internet
    delivery), where in the customer has established a degree of
                                                                        companies like Google, telecommunication companies, etc.
    trust with the vendor and hence the valuable purchased is
                                                                        now-a-day shave accepted using mobile payments as an
    shipped and payment received on delivery.
                                                                        alternative payment method to cash, checks or credit cards.
2. Mobile Wallet: Mobile wallet is a functionality that resides
                                                                        Using this facility, a consumer can use a mobile phone to pay
    in a mobile device and supports secure interactions to
                                                                        for a wide range of services such as music, videos, ringtones,
    digitally transact using the wireless backbone. They can help
                                                                        online game subscription or items, transportation fares (bus,
    facilitate mobile payments, mobile commerce, manage
                                                                        subway or train), parking meters and other such services. All
    mobile identify and engage in banking / financial
                                                                        over the world mobile payments have begun to grow and are
                                                                        being adopted in different ways. The combined market for all
3. Micro payments: In a micropayment the user and seller each
                                                                        types of mobile payments is expected to reach more than double
    establish an account with a third-party service provider who
                                                                        today’s value and reach $600B globally by 2013. Additionally
contactless       NFC         (near-field
communication) transactions are also
rapidly evolving; money transfers
through such mechanisms is expected
to exceed $300B globally by 2013. In
this context, the security of mobile
payments which still remain a key
customer concern needs to be
addressed         effectively.       The
availability of a more efficient trusted
and secure means to enable issuers to
provision wallets or other means of
transaction mechanisms over the air
to mobiles will undoubtedly pay huge
dividends in the market place for
organizations.                                                          Figure 2. Multi-level Authentication Framework

In markets such as India, issues such as poor reliability and           themselves in every regional context, but combined within the
slower network speeds, etc. assumes greater significance.               4-tier contextualization, they can provide a very resilient
Furthermore, unlike many western countries, in several                  authentication framework for mobile applications. Such a
countries such as India, where there are deep layers of                 mapping is presented in Figure 3.
entrenched administrative bureaucracy, there are also issues
with respect to using only personally identifying information           Since the knowledge factor – for example, using information
(PII - such as name, DOB, father / mother’s name, etc.) for             such as passwords, is acknowledged as a weak mechanism.
authentication. For example, several tidbits of commonly used           Hence in our proposed framework we differentiate two types of
PII data for authentication are often widely available across           PII knowledge – residual, imprinted and private PII knowledge
multiple stakeholders – from schools, colleges, doctor’s offices,       of a mobile user from publically attainable PII information
other government service offices, etc. Hence there needs to be          which is more widely available and needed for gaining essential
augment such authentication measures along with more ‘private’          societal services. In many regions, cultures and societies such
measures of authentication. For example, many would very                private PII knowledge will not be widely known in many
much remember who their favorite historical figures are in some         context beyond the user themselves (ex. date of their first date,
ranked order, their first crush, their favorite heroes, heroines, or    name of their first crush, etc.). In our approach, we recommend
what was their most unforgettable day (not essentially birth            utilizing such private PII knowledge for the first (Question-
day), etc.; roles / people / events, etc., that tend to resonate with   Answer based Authentication) QA tier, since we deem such
a lot of the masses and thus be more personal and retained              private and personal knowledge to be of increasing value for
internally in their memories. Other such measures may be things         user identification. While they may sound the same, there are
such as favorite food, favorite movie, etc.                             important differences between authentication and identification.
                                                                        While authentication refers to the process of confirming or
                                                                        denying a person’s claimed identity while identification refers to
V. A Contextualized Model for Authentication for                        the process of establishing a subject’s identity. Hence we
   Mobile Wallet Applications                                           propose to use such residual, imprinted and private knowledge
 In this section we extend and adapt                                    at Tier-1 for rapid user identification. In certain contexts, these
from the tired model developed in [6] to
present a multi-level authentication
framework         for     contextualized
authentication of mobile wallet and
related applications. Items in physical
procession, especially in a mobile
context, in certain regions of the world
are more susceptible to theft and
subsequent jail breaking to gain more
access to the device. The 4-tier
approach (shown in Figure 2), to user
authentication presented in this section
blends the three factors (i.e. (i)
Knowledge: something you know, (ii)
Possession: something you have, and
(iii) Being: something you are), for
stronger user authentication in a multi-
level mobility application authentication
framework. As widely known, all these              Figure 3. Authentication Measures Mapped to Mobile Contextualization Framework
three methods are not fail-safe by
may also be used in tier-3 at the server level for additional         Since this involves human interaction, use cases of appropriate
authentication. Such knowledge is different from PII                  scope and depth must be developed to capture the regional /
information that a user might be required to enter in any other       localized contexts of this interaction. Tier 2 (Level 2) will
stored form that is not immediately under the user’s control, etc.    involve device-level authentication measures, where in
ex. for receiving a service – medical form information such as        password-based, PIN-based, biometric-based, and multi-touch
date of birth, blood group, or name, address, parents’ name,          based authentication schemes can be effectively used to support
previous addresses, etc. that may be needed in some university /      the necessary authentication needs. Combined with the Tier-1
college applications, etc. As shown in Figure 2, Tier (Level) 1       identification measures, this two-level scheme forms the first
and Tier 2 based authentications therefore become a part of           line of intrusion defense for any mobile device; especially in
every interaction between the user and the mobile device. In all      case of theft, which is rampant in developing countries. The
such interaction schemes, temporal and special activity profiling     mapping of strong authentication measures to the proposed
algorithms can be used to validate user accesses and actions.         tiered contextualization framework is shown in Figure 3. Figure
                                                                      4 presents three different use-case scenarios that are specific to
In the proposed framework, at the Tier 1 level question-answer        the mobile payment context for which appropriate context
(QA) based authentication schemes are employed using private          mapping models have to be developed.
PII information, which can be effectively contextualized from a
regional / cultural perspective. In this level, the system will not   Tier-3 (Level 3) authentication methods will be outside of the
store any pre-structured information either in the device or the      ‘local (device and individual) system and will be effectuated at
server and will effectively serve as the first line of                the server-level, and may include a combination of techniques
authentication – for example using questions that are personally      that are automated. This can involve Capthas and other similar
contextualized. For added complexity, reverse QA schemes can          schemes that may include additional publically available PII
also be employed (where the user chooses the correct questions        (generic information stored at the server – during registration
for a particular answer – information for which only the user         process, etc.) and a more general set of QAs that are not so
knows the correct context).                                           deeply contextualized. However, the need for Tier-3
                                                                      authentication will not be triggered until there are some alerts

                                            Figure 4. Normal and Escalated Use Case Scenarios
that are raised due to deviations from normal behavior patterns       technology might then allow for millions of users to buy into
mined through low cost special-temporal algorithms at the             such services, and as a result banking institutions in such
device level. Upon unsatisfactory authentication at Tier-3 the        growing economies, may even leapfrog ‘credit-card’ based
system escalates the authentication need to involve a human in        payment schemes, making them obsolete.
the loop who may be required to call an alternate number (home
phone), or other kinds of schemes. Cumulatively, the approach         VII.      References
presented in this paper, principally to distinguish public and        1.  C. Bettini, O. Brdiczka, K. Henricksen, J. Indulska, D. Nicklas, A.
private PII information to derive regional / localized contexts for       Ranganathan, D. Riboni, “A Survey of Context Modelling and
user identification at the device level, can provide a scalable,          Reasoning Techniques”, Pervasive and Mobile Computing,
light-weight, yet strong authentication measure for mobility              Elsevier, 2010
applications.                                                         2. K. Henricksen, J. Indulska, A. Rakotonirainy, “Modeling context
                                                                          information in pervasive computing systems”, 1st Intnl.Conf. on
                                                                          Pervasive Computing, vol. 2414 of LNCS, Springer, 2002.
VI. Conclusions                                                       3. K. Henricksen, J. Indulska, “Modelling and using imperfect
                                                                          context information”,1st Workshop on Context Modeling and
In this paper, we have proposed the need for contextualized,              Reasoning (CoMoRea), PerCom’04 Workshop, IEEE Comp.
multi-level, multi-factor authentication mechanisms for user              Society, 2004.
authentication in emerging mobile applications. We have               4. K. Henricksen, J. Indulska, “Developing context-aware pervasive
proposed a notional framework for such authentication that                computing applications: Models and approach”, Pervasive and
accommodates deep personalization of authentication measures              Mobile Computing 2 (1) (2006) 37–64.
                                                                      5. T. A. Halpin, “Information Modeling and Relational Databases:
(possibly from regional and cultural perspectives). The tiered            From Conceptual Analysis to Logical Design”, Morgan Kaufman,
framework draws from existing literature on contextualization             San Francisco, 2001
and adapts it to the emerging needs for mobile-based payment          6. C. Becker, D. Nicklas, “Where do spatial context-models end and
services.                                                                 where do ontologies start? A proposal of a combined approach”, J.
                                                                          Indulska, D. D. Roure (eds.), Proceedings of the First
However, it is clear that significant future work is needed to            International Workshop on Advanced Context Modelling,
address the issue of personalization and contextualization and it         Reasoning and Management, in conjunction with UbiComp 2004,
assumes enormous business significance as the world rapidly               Nottingham, England: University of Southhampton, 2004.
advances to deploy mobile services for the common man. In             7. A. U. Frank, “Ontology for Spatio-Temporal Databases”. M.
                                                                          Koubarakis et al. (Ed): Spatio-Temporal Databases— The
countries such as India or similar developing countries, where            CHOROCHRONOS Approach. LNCS, Springer 2003
some of the normally used QA based PII-driven authentication          8. A. Leonhardi, K. Rothermel, “Architecture of a Large-scale
information are more easily attainable and where theft of                 Location Service”, Proceedings of the 22nd Conference on
personal mobility devices is significant, such approaches to              Distributed Computing Systems ICDCS, Short Paper, 2002
addresses security and authentication is of dire significance to      9. ESRI,                       Arclocation                    Solutions,
assure customers, and thereby build trust, to transition to using
such systems. If simplicity of use, and user anxiety and              10. Intergraph, Intelliwhere,
apprehension in using these methods are adequately and                11. Webraska, Smartzone,
                                                                      12. H. Lei, D. Sow, J. Davis II, G. Banavar, M. Ebling, “The design
appropriately addressed, such mobility-based payment systems
                                                                          and applications of a context service”, ACM SIGMOBILE Mobile
carry significant potential for success as they will be incredibly        Computing and Communications Review, volume 6(4), 2002.
useful for people in rural towns and villages, where there is
already a very strong proliferation of mobility devices. Such

Shared By:
dominic.cecilia dominic.cecilia http://