Using GSM to enhance e-commerce security

Today, an e-commerce transaction is typically protected using SSL/TLS@. However, there remain some risks in such use of SSL/TLS@. These include that of information being stored in clear at the end point of the communication link and lack of user authentication. Although SSL/TLS does offer the latter, the security service is optional and usually omitted. This is because of the fact that users typically do not have the necessary asymmetric key pair. Since SSL/TLS protects data only while it is being transmitted, the merchant has access to sensitive information such as the debit/credit card number. The storage of unencrypted debit/credit card information at the merchant server therefore represents a risk that is not currently addressed by the use of SSL/TLS to secure electronic payment transactions.In this paper, we propose a payment protocol in which the risk of having debit/credit card details stored at a merchant server is eliminated. User authentication is also provided. This is achieved by utilising the GSM data confidentiality service to encrypt sensitive information. The GSM security service is also used to provide user identity authentication. The additional security is realised in such a way that no management overhead is imposed on the user.