 ICACT20260106 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Secure NFC Communication in Mobile Payments: Evaluating Privacy and Authentication in Tap to Pay Systems
By
Nolwazi Ndlovu and Khutso Lebea |
| ICACT20260106 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
Agenda:
Introduction & Problem Statement
Literature Review
Comparative Evaluation
Proposed Model
Benefits & Challenges
Conclusion & Future Work
Q&A
|
| ICACT20260106 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
Near Field Communication (NFC) has emerged as a cornerstone
of modern mobile payment ecosystems, enabling
short-range, contactless transactions that combine speed, convenience,
and integration across devices and platforms. Tapto-
pay functionality, now widely adopted across Android, iOS,
and legacy mobile devices, has transformed consumer payment
behaviour by reducing transaction times and eliminating the
need for physical card handling
|
| ICACT20260106 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
While traditional authentication mechanisms provide a baseline for NFC payment security, they fail to adequately address evolving data breach risks posed by sophisticated attack vectors.
Emerging NFC security frameworks claim to offer higher levels of protection through advanced cryptography, formal verification, and multi-factor authentication, yet their comparative effectiveness across different platforms and against diverse threat models has not been comprehensively quantified.
This creates uncertainty for payment providers, regulators, and consumers when selecting or endorsing specific architectures.
|
| ICACT20260106 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
To address this problem, this paper investigates the extent to which emerging NFC security frameworks mitigate potential data breach risks compared to existing authentication mechanisms in mobile payment systems. The analysis draws from relevant screened studies, focusing on tap-to-pay scenarios across Android, iOS, and legacy platforms.
|
| ICACT20260106 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Host Card Emulation (HCE): A software-based emulation of a payment card, with credentials stored in the mobile operating system environment.
Secure Element (SE): A tamper-resistant hardware module embedded in the device (e.g., Apple’s Secure Enclave) or on a Universal Integrated Circuit Card (UICC).
Hybrid Architectures: Combining HCE flexibility with SE-protected storage for certain credentials |
| ICACT20260106 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
Relay Attacks: Also known as “Mafia fraud,” this involves two colluding devices, one near the victim, one near the legitimate terminal to extend the communication range and impersonate the victim without physical theft of their device. Studies confirm successful proof-of-concept demonstrations on Android HCE and theoretical feasibility on SE-based systems.
Token Misuse and Lifting: Poorly implemented tokenization can result in static or long-lived tokens that attackers can extract from device memory or intercept during transmission, then reuse to authorise fraudulent transactions.
|
| ICACT20260106 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
Backend Exploits: Even when NFC channel security is intact, cloud synchronisation, API endpoints, and Trusted Service Manager (TSM) provisioning may be susceptible to phishing, SIM-swapping, or man-in-the-middle attacks on backend links.
Biometric Spoofing: Where biometric verification (e.g., fingerprint or face ID) is employed, spoofing attacks or replayed biometric data may be used to bypass user authentication.
|
| ICACT20260106 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
Data Leakage: If NFC payloads or metadata are insufficiently encrypted, adversaries can intercept transaction data using specialised equipment within range of the POS.
Tracking via Identifiers: Persistent IDs or static tokens allow merchants or malicious third parties to correlate transactions over time.
Backend Data Exposure: Cloud token synchronisation, TSM compromise, or misconfigured APIs can leak user account details even when the NFC channel is secure.
|
| ICACT20260106 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
NSPMT (NFC-based Secure Protocol for Mobile Transactions) applies a defense-in-depth strategy with elliptic curve cryptography (ECC), AES-GCM encryption, and formal verification. It scores highly on cryptographic strength and verified protocol soundness, with demonstrated resistance to relay and token-reuse attacks.
Privacy-Preserving Protocols emphasise offline session key generation, MAC-based authentication, and hash chaining. They offer strong privacy guarantees and resilience to tracking and replay, though deployment complexity and user transparency remain considerations.
|
| ICACT20260106 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
Gesture-Based Biometrics authenticate transactions using device motion sensors and machine learning classifiers. While highly usable and resistant to certain spoofing attacks, their cryptographic coverage is limited, and performance may degrade with sensor inconsistencies.
TSM-Centric Privacy Models remove sensitive data from merchant systems and rely on secure backend provisioning. They address backend compromise risks effectively but depend on robust TSM infrastructure and governance.
|
| ICACT20260106 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
POSAUTH (Point-of-Sale (POS) authentication) Protocol uses ephemeral keys and mutual authentication to protect against relay and replay attacks. Its theoretical strength is high, though real-world deployment evidence is limited.
Trusted Tapping Protocol (TTP) uses tap patterns, proximity cues, and environmental sensing to verify intent, showing strong empirical resistance to relay attacks without imposing significant transaction delays.
|
| ICACT20260106 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
Comparative evaluation. |
| ICACT20260106 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
1) Cryptographic Core: ECC for key exchange and AESGCM for payload encryption, ensuring strong confidentiality and integrity.
2) Privacy Layer: MAC anonymisation and hash chaining to decouple user identity from transaction metadata and prevent tracking.
|
| ICACT20260106 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
3) User Authentication: Gesture-based biometric verification using accelerometer and gyroscope data to confirm physical presence and resist relay exploitation.
4) Backend Assurance: TSM-managed provisioning with formal verification (ProVerif) to secure credential lifecycle and prevent backend compromise.
|
| ICACT20260106 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
The relationship between security and convenience is inversely proportional |
| ICACT20260106 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
1) Field trials of integrated frameworks in live merchant environments to obtain empirical performance and adoption data.
2) Adaptive, context-aware authentication that adjusts security levels based on transaction value, geolocation, or detected anomalies.
|
| ICACT20260106 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
3) Exploration of federated learning to personalise gesture or behavioural models while preserving user privacy.
4) Formal verification of hybrid and adaptive protocols to prove robustness against evolving threats, including those posed by post-quantum adversaries.
|
| ICACT20260106 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
Thank you.
|
| ICACT20260106 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
Link to the center for Cyber Security at the University of Johannesburg: https://cybersecurity.org.za/people.html |
