It's tricky for two reasons. One, because the requirement for security—and the stringency of that security—is going to intensify as devices are used to store and exchange ever-more sensitive information. And two, because the whole promise of wireless transactions is convenience. Even as expectations of functionality and security reach new heights, users will expect their devices to operate faster and more effortlessly than ever before.
These two seemingly contrary sets of demands pose a major challenge to device manufacturers whose products are already constrained in terms of bandwidth, power and processing capability. Yet with security-minded designs based on efficient, well-established methods and using compact algorithms like ECC (elliptic curve cryptography), the challenge can be met.
At the point of purchase
Pilot tests in Japan and Europe have shown that the transactional possibilities of mobile devices are virtually unrestricted. Contactless payment, public transportation ticketing and event ticketing have been singled out as key areas for what are sometimes referred to as "mobile proximity transactions".
The recent LocPay project led jointly by Visa, Nokia and financial-services company Nordea provides a straightforward example. Over several months in 2003 and 2004, the companies and a number of Finnish retail partners experimented with a contactless point-of-sale payment system. Merchants ranging from restaurants and sporting-goods vendors to travel agencies, video stores and hair salons were outfitted with point-of-sale RFID readers. These were configured to interact with RFID transceiver-equipped Nokia phones given out to 150 Nordea Visa Electron cardholders. Rather than swipe their magnetic-stripe Visa cards, users passed their phones over the reader to trigger payment processing.
The Mobile electronic Transactions Forum, aka MeT, has identified a number of requirements for the successful implementation of mobile-transaction systems, from usability and low power consumption to clear definition of the payment architecture. But topping the list, not surprisingly, are security and privacy.
