IEEE Consumer Electronics Magazine - April 2017 - 80

In the January 2017 issue of IEEE Consumer Electronics
Magazine, we discussed a new system called Swing-Pay as a
method of contactless payment using biometric authentication
[2]. However, the current article presents Pay-Cloak, a system
that uses both the tokenization principle and Bluetooth and can
be installed as a back cover on an NFC-enabled smartphone. Due
to tremendous developments in the smartphone industry and
mobile computing, smartphones are capable of use as portable
computers. Thus, researchers are developing smartphone-based
systems to handle payment-related needs. In the Swing-Pay article, we introduced a method and a device that can handle all
types of payment-related needs independently. But those who
carry an NFC-enabled smartphone can process these transactions
using their smartphone alone-they do not need to carry a separate device with them, making the system more secure.
Pay-Cloak uses fingerprint authentication and a tokenization scheme for verification and security. Swing-Pay and PayCloak both have the same functioning and processes. The key
difference is that Swing-Pay is a separate module that can
handle all payment and identity needs, whereas Pay-Cloak
can be attached with existing NFC-enabled smartphones to
process the transactions and identity virtualization.
In 1983, when Walton patented his revolutionary radiofrequency identification (RFID) technique [4] for shortrange communication, a new form of payment, known as
contactless payment, came into existence. The first contactless payment was implemented in 1995 in Seoul Bus transport, followed by Speedpass in 1997 to pay fuel charges in
U.S. gas stations [5]. In 2003, the International Organization
for Standardization (ISO) and the International Electrotechnical Commission (IEC) approved NFC technology, which is
considered a successor of RFID [6]. Since then, it has
attained popularity in contactless payment technologies.
NFC involves two different modules: a tag and a reader. The
reader acts as the active part, whereas the tags may be active or
passive. If the tags are active, they are powered by an external
power source; passive tags get energy from the reader tag when
it is within range [7]. The antenna coil inside the reader produces a magnetic field around it that exhibits an electromotive
force. When this reader comes close to any NFC passive tag, or
if any passive tag enters within the magnetic field of the reader
antenna, the tag is energized by the RF waves propagating from
the reader antenna. After verification of the tag, the reader couples with the tag and creates a small amount of ac current. The
tag converts this ac current into dc to send a RF signal back to
the reader; in this manner data transmission is established
between the NFC tag and reader.
This data transmission is standardized in ISO/IEC 18092,
which is compatible with smart card standard ISO 14443 [7]. It
has a significant advantage over RFID due to its P2P communication feature, by which two active devices can communicate
between each other. Because communication occurs within
very small range, NFC reduces the risk of eavesdropping and
man-in-the-middle attacks, which makes it ideal for paymentrelated applications [8]. NFC provides better security than
RFID, using an embedded module called the secure element. In
80 IEEE Consumer Electronics Magazine

APRIL 2017

2007, Barclay Card first implemented NFC-based credit cards
in the United Kingdom [9]. As NFC technology is currently
embedded in smartphones, users can conduct money transactions with their phones in place of traditional payment cards.
Due to significant developments in mobile operating systems and mobile computing, there has been a steady increase
in the use of smartphone-based apps and facilities. This
trend has also been seen in the payment industry with the
development of several mobile wallets and mobile banking
features. As shown in [10], 50% of people have smartphones
but only 37% possess a bank account. In 2011, Google introduced an NFC antenna on its Nexus-S smartphone [11]. NFC
allows communication between two active devices using a
P2P mode. Google also launched a mobile wallet application,
known as Google Wallet [12], which uses the HCE feature of
NFC, rather than transmitting credit card information, in a
contactless POS terminal.
Soon after, companies like PayPal came up with mobile
payment wallets [13]. In 2014, Apple unveiled a mobile payment feature known as Apple Pay [14]. This wallet uses both
fingerprint authentication and tokenization to secure sensitive
data like credit card information. Samsung followed the same
path and launched Samsung Pay in 2015, which also incorporates a technology known as magnetic secure transmission
(MST) [15]. A timeline of mobile app-based payment system
development is depicted in Figure 3.
Tokenization is a system in which information like credit
card numbers, card verification values, and expiration dates are
replaced with a unique, randomly generated token. These
tokens are formatted with proper cryptography concepts to
ensure data security. The card information is provided to a highly secure server, known as a vault, as shown in Figure 4. The
vault then saves the card information, generates a unique token,
and returns that token to the merchant payment environment for
further process. The token is used as a dependable substitute for
credit card information [16]. Tokenization is important because
it reduces the merchant's risk for data breach by removing sensitive card information from the merchant's environment [17].
Another payment technique has evolved using QR codes.
Anyone with a smartphone can scan the QR code in a retail
outlet and pay instantly via mobile [18]. PayPal is now incorporating this QR code feature, which makes purchases much
easier on the Internet [19]. Starbucks is also accepting QR
code-based payments, where the merchant scans the QR code
generated by the buyer's mobile app [20]. Zapper is another
payment company, focused primarily on the restaurant business. With Zapper, buyers scan the merchant QR code in the
Zapper wallet app and pay instantly [21].
In the current article, we describe a hardware prototype,
which features a fingerprint scanner, that can be attached to
the back of a smartphone. The prototype is connected to an
Android application installed on the smartphone via Bluetooth. The application can be used as a POS terminal at merchants offering QR code and P2P payments using NFC. It
can also be used for virtualization of identity cards such as
voter IDs, passports, and driver's licenses.

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - April 2017