Foolproof cell phone payments

The technology is designed to work in almost all situations: Person-to-person, in a shop or restaurant, at a vending machine, online, or as part of telephone chats.

“A key requirement of new payment systems will be the ability to make payments from person to person, such as paying a builder or a friend,” said Bill Roscoe, professor at the Oxford University’s Computing Lab.

Consider the following scenarios: Emma chooses a ticket online on her PC and pays with her phone. Her phone and the agency connect by telephone. She enters the code and confirms the payment, perhaps by entering her PIN.

A child has run out of credit. He rings his mother, who transfers money without fuss: she has previously created a permanent key between their phones that allows her to transfer credit without the child needing to take any action. “What we have is technology which enables anyone to easily create a secure connection between two devices: It can work via Bluetooth, WiFi, the internet or across ordinary telephone or SMS connections,” Roscoe added.

“The core of our technology is a new security protocol that enables strong cryptographic keys to be created with the least possible work. The key to the protocol is that it prevents anyone from doing any searching to break into the transaction,” Roscoe pointed out. The Oxford technology uses a system in which the payer checks whether a short numeric code (4-8 digits for most applications) generated within their own phone is the same as the one generated by the payee.

This number is random and does not have to be kept secret. This ensures that the customer’s mobile is connected to the correct store, or to the mobile of the person they wish to pay.

Payment then occurs without the exchange of sensitive details such as credit card numbers or the PIN, said an Oxford release. It is expected that no hardware modifications to the phones will be needed.