Secure mobile phone wallets
Europe’s adoption of paper money during the 1600s helped the modern wallet become ubiquitous, while the present card-bearing form has been standard since the 1950s. Mobile phones already replace some traditional components of physical wallets; however, such devices cannot yet offer e-IDs because the technology is insufficiently secure. The EU-funded HIGHTRUSTWALLET (A framework for mobile wallets that provides the security levels QAA1-4 in a TSM architecture supporting the use of e-identity cards on the mobile phone) project developed a mobile phone wallet concept. The framework includes systems for payments, collection of loyalty points and identification. The first two applications required hardened software that replaces the current SIM card system. The project’s ID framework needed software running on microSD cards to satisfy security requirements. Team personnel developed a high-security wallet framework potentially compatible with various currently available mobile phone wallet systems. The developments combine a secure software element, improved authentication methods, a wallet server and a Trusted Identity Manager. As a result, the system enables life-cycle management for services at differing security levels. Investigators first defined the requirements, followed by implementation, testing, integration and demonstration phases. Hence, the HIGHTRUSTWALLET consortium achieved a working prototype. The prototype consists of a wallet client including two software secure elements. One element is based on white-box cryptography and the other on technology supplied by a project partner. Additional prototype components include a wallet server for payment and loyalty card applications, and an interface for an e-ID application based on the Trusted Identity Manager. Researchers successfully demonstrated the prototype software. The consortium also developed plans for commercially exploiting the software. The resulting system will benefit providers with low security requirements, by enabling easier access to users and reducing costs. The project’s user-friendliness advances will also help foster eventual development of e-IDs in Europe, and in the process help to improve European government infrastructure. HIGHTRUSTWALLET’s developments potentially replace the familiar card-based wallet in favour of a fully electronic mobile phone-based system that integrates ID and payment functions.
Keywords
Mobile phone wallets, electronic identities, e-ID, HIGHTRUSTWALLET, Trusted Identity Manager
