Provably unlinkable smart card-based payments

Sergiu Bursuc; Ross Horne; Sjouke Mauw; Semen Yurkov

doi:10.1145/3576915.3623109

Provably unlinkable smart card-based payments

Sergiu Bursuc, Ross Horne, Sjouke Mauw, Semen Yurkov

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution book

11 Downloads (Pure)

Abstract

The most prevalent smart card-based payment method, EMV, currently offers no privacy to its users. Transaction details and the card number are sent in cleartext, enabling the profiling and tracking of cardholders. Since public awareness of privacy issues is growing and legislation, such as GDPR, is emerging, we believe it is necessary to investigate the possibility of making payments anonymous and unlinkable without compromising essential security guarantees and functional properties of EMV. This paper draws attention to trade-offs between functional and privacy requirements in the design of such a protocol. We present the UTX protocol - an enhanced payment protocol satisfying such requirements, and we formally certify key security and privacy properties using techniques based on the applied π-calculus.

Original language	English
Title of host publication	CCS '23
Subtitle of host publication	Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security
Place of Publication	New York, NY
Pages	1392-1406
Number of pages	15
ISBN (Electronic)	9798400700507
DOIs	https://doi.org/10.1145/3576915.3623109
Publication status	Published - 15 Nov 2023
Event	30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023 - Copenhagen, Denmark Duration: 26 Nov 2023 → 30 Nov 2023

Conference

Conference	30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023
Country/Territory	Denmark
City	Copenhagen
Period	26/11/23 → 30/11/23

Funding

Semen Yurkov is supported by the Luxembourg National Research Fund through grant PRIDE15/10621687/SPsquared. We thank the reviewers for their thorough analysis of our threat model and assessment of the scope of related work on tools.

Keywords

payment protocols
protocol design
security analysis

Access to Document

10.1145/3576915.3623109Licence: CC BY 4.0

Bursuc-etal-CCS-2023-Provably-unlinkable-smart-card-based-paymentsFinal published version, 1.11 MBLicence: CC BY 4.0

Cite this

@inproceedings{ad2d30b6c2f24738a3cb378eac45a7a3,

title = "Provably unlinkable smart card-based payments",

abstract = "The most prevalent smart card-based payment method, EMV, currently offers no privacy to its users. Transaction details and the card number are sent in cleartext, enabling the profiling and tracking of cardholders. Since public awareness of privacy issues is growing and legislation, such as GDPR, is emerging, we believe it is necessary to investigate the possibility of making payments anonymous and unlinkable without compromising essential security guarantees and functional properties of EMV. This paper draws attention to trade-offs between functional and privacy requirements in the design of such a protocol. We present the UTX protocol - an enhanced payment protocol satisfying such requirements, and we formally certify key security and privacy properties using techniques based on the applied π-calculus.",

keywords = "payment protocols, protocol design, security analysis",

author = "Sergiu Bursuc and Ross Horne and Sjouke Mauw and Semen Yurkov",

year = "2023",

month = nov,

day = "15",

doi = "10.1145/3576915.3623109",

language = "English",

pages = "1392--1406",

booktitle = "CCS '23",

note = "30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023 ; Conference date: 26-11-2023 Through 30-11-2023",

}

Bursuc, S, Horne, R, Mauw, S & Yurkov, S 2023, Provably unlinkable smart card-based payments. in CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. New York, NY, pp. 1392-1406, 30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Denmark, 26/11/23. https://doi.org/10.1145/3576915.3623109

TY - GEN

T1 - Provably unlinkable smart card-based payments

AU - Bursuc, Sergiu

AU - Horne, Ross

AU - Mauw, Sjouke

AU - Yurkov, Semen

PY - 2023/11/15

Y1 - 2023/11/15

N2 - The most prevalent smart card-based payment method, EMV, currently offers no privacy to its users. Transaction details and the card number are sent in cleartext, enabling the profiling and tracking of cardholders. Since public awareness of privacy issues is growing and legislation, such as GDPR, is emerging, we believe it is necessary to investigate the possibility of making payments anonymous and unlinkable without compromising essential security guarantees and functional properties of EMV. This paper draws attention to trade-offs between functional and privacy requirements in the design of such a protocol. We present the UTX protocol - an enhanced payment protocol satisfying such requirements, and we formally certify key security and privacy properties using techniques based on the applied π-calculus.

AB - The most prevalent smart card-based payment method, EMV, currently offers no privacy to its users. Transaction details and the card number are sent in cleartext, enabling the profiling and tracking of cardholders. Since public awareness of privacy issues is growing and legislation, such as GDPR, is emerging, we believe it is necessary to investigate the possibility of making payments anonymous and unlinkable without compromising essential security guarantees and functional properties of EMV. This paper draws attention to trade-offs between functional and privacy requirements in the design of such a protocol. We present the UTX protocol - an enhanced payment protocol satisfying such requirements, and we formally certify key security and privacy properties using techniques based on the applied π-calculus.

KW - payment protocols

KW - protocol design

KW - security analysis

U2 - 10.1145/3576915.3623109

DO - 10.1145/3576915.3623109

M3 - Conference contribution book

AN - SCOPUS:85179849427

SP - 1392

EP - 1406

BT - CCS '23

CY - New York, NY

T2 - 30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023

Y2 - 26 November 2023 through 30 November 2023

ER -

Provably unlinkable smart card-based payments

Abstract

Conference

Funding

Keywords

Access to Document

Fingerprint

Cite this