MODELING A SECURE PAYMENT SYSTEM FOR MOBILE COMMERCE AND BANKING USING GRAPHICAL PASSWORD AND ENHANCED TOKEN

Abstract

The growth of mobile commerce follows the increasingly popular ownership and use of mobile personal, programmable communication devices, including mobile phones and PDAs. These devices are effective for authorizing and managing payment and banking transactions, offering security and convenience advantages compared to online payment via PCs. The goal is to create an authentication system that is both secure and highly usable based on graphical password and enhanced token. The user can easily pick up some sets of images from the stored list of images to initiate secure mobile system, instead of typing complicated username and password in each transaction. The enhanced tokens are user specific unique codes which are issued to the user. This code is similar to One Time Password (OTP) and one code is used only once. They form the basis for authentication of the transaction. In this work, an Advanced Encryption Standard (AES) technique is used to keep the image. The user can easily pick up some sets of images from the stored list of images to initiate secure mobile system, instead of typing complicated username and password in each transaction. The enhanced tokens are user specific unique codes which are issued to the user. This code is similar to OTP (One time password) and one code is used only once. They form the basis for authentication of the transaction. A detailed threat analysis demonstrates that the proposed model is secure against various types of internet attacks like phishing, man-in-the-middle, viruses etc. The system was developed using PHP and MySQL and tested on various machines that meet the system requirement.