This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

Digital Object Identifier

State of the Art: Secure Mobile Payment

WENZHENG LIU1 , XIAOFENG WANG 2 , WEI PENG3
1
College of Computer, National University of Defense Technology, Changsha 410073, China (910972029@qq.com)
2
College of Computer, National University of Defense Technology, Changsha 410073, China (xf_wang@nudt.edu.cn)
3
College of Computer, National University of Defense Technology, Changsha 410073, China (wpeng@nudt.edu.cn)
Corresponding author: Xiaofeng Wang (xf_wang@nudt.edu.cn),Wei Peng (wpeng@nudt.edu.cn)
This research was supported in part by a project of the National Key Research and Development Program of China under Grant
2017YFB0802300.

ABSTRACT With mobile payments popular around the world, payers can conduct a payment anytime
and anywhere. While providing great convenience, mobile payment also brings many payment security
issues. This paper is the first comprehensive review of secure mobile payment. We classify the mobile
payment into TPC(third-party payment company)-led mobile payment and Bank-led mobile payment, and
based on this, summarize the system structure of mobile payment. Then we discuss the mobile payment
security technology framework from Tokenization, PAN(bank card primary account number) binding, and
Secure Payment Authentication, respectively. Besides, this paper introduces secure technologies(hardware
and software) used in these procedures, discusses and analyzes the security issues that they have been
encountered, summarise open issues, and proposes future development directions. In the end, we give the
discussion and comparison of popular and representative mobile payment applications, including Alipay,
Wechat Pay, Apple Pay, Samsung Pay, and Google Pay.

INDEX TERMS Tokenization, symmetric cryptosystem, hybrid cryptosystem, PAN binding, TOTP, remote
payment, near-field payment.

I. INTRODUCTION personal computer, etc.

Since modern times, payment methods have tremendously
changed remarkably. In the beginning, people paid in cash.
Then, the bank card was invented as a new medium for
payment. Today, modern technology even further put bank
cards into mobile phones. In China, Alipay and WeChat
are two main mobile payment providers. Mobile payment is
blooming in China and gradually creates a no cash society. In
the United States and Europe, Apple, Google, and Samsung
have joined MasterCard, Visa, and other card organizations
to promote their respective payment programs. And In other
parts of the world, such as Southeast Asia, South America,
and Africa, are gradually being covered [16] by it. Mobile
payment has become a general trend in the world and consti-
tutes an increasingly substantial portion of payments [15].
Mobile payment is defined by the Mobile Payment Fo-
rums1 to be “ transaction of both parties for specific goods
or service, using a mobile terminal device as a carrier, and
a commercial transaction implemented through a mobile
communication network.” The mobile payment terminal may
be a mobile phone, a personal digital assistant, a portable
1 Mobile Payment Forum is a global, cross-industry alliance of leading
organizations from the mobile and financial industries dedicated to realizing
the full potential of mobile commerce.
The classification of mobile payment varies from different
perspectives. According to the distance of mobile payment,
it can be divided into the near-field payment and the remote
payment. According to the communication of the user’s
mobile terminal, it can be divided into offline payment and
online payment.
CONTRIBUTION
By analyzing mainstream mobile payment applications and
their secure payment technologies, we divide mobile pay-
ment into TPC-led(third-party payment companies led) and
Bank-led payment. TPC-led mobile payment is organized
by a third-party payment company that is responsible for
the payment authentication and fund settlement functions.
The representative providers are Alipay, Tencent, Paypal,
etc. On the contrary, for the Bank-led mobile payment, the
bank is responsible for the payment authentication and fund
settlement functions directly, which representative providers
are Apple, Google, and Samsung.
In both TPC-led and Bank-led mobile payments, payment
security is the most crucial requirement. In this paper, mobile
payment security is divided into the Tokenization, PAN(bank
card primary account number) binding, and secure payment

VOLUME 10, 2019 1

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

authentication, respectively. the list of acronyms used in this paper. These acronyms are
For the Tokenization, we start with a brief overview of not only used in the text but also used in figures and tables.
motivation to use tokenization in mobile payment and then
summarise and analysis centralized tokenization and dis- TABLE 1. List of acronyms used in this paper
tributed tokenization, respectively. Finally, this paper pro-
poses several open issues and present a recommendation for PAN primary account number
TOTP time-based one-time password
further research. TPC third-party payment company
For the PAN binding, we focus on how a PAN is bound to TSP token service provider
the mobile phone, which can be divided into third-party trust TR token requestor
URL uniform resource locator
protocol and PAN anti-leakage protocol. This paper detailed NFC near-field communication
introduces the third-party trust protocol, sets a security model MST magnetic secure transmission
for PAN anti-leakage scene, and discusses the technology TEE trusted execution environment
that may use for it. SE secure element
HCE host-based card emulation
For the Payment Authentication, we concentrate on how FPE format-preserving encryption
a bank or third-party company authenticates the transaction CCEP contactless card emulation payment
information. All mobile payment authentication is divided IB-FPE identity-based format-preserving encryption
into remote payment authentication, time-based one-time
password (TOTP) payment authentication, and card emula-
tion payment authentication: A. MOBILE PAYMENT SYSTEM STRUCTURE
• remote payment authentication: first, there is an intro- In this subsection, we show the system structure of the entire
duction for its payment method and process of authentica- mobile payment. In the introduction section, the mobile
tion. Furthermore, we summarize its representative academic payment is divided into TPC-led mobile payment and Bank-
research; led mobile payment. So our description will be based on this
• TOTP payment authentication: we begin to introduce the classification. In Figure 1, starting from the bank card, the left
deployment of TOTP payment, and then detailed discussed part represents the Bank-led mobile payment, and the right
the algorithm of TOTP payment. In the end, we give a part represents the TPC-led mobile payment.
discussion and propose several open issues; First, we list main participating entities:
• card emulation payment authentication: this paper first • Payer: The entity that initiates the transaction;
describes the authentication algorithm, and then summarises • Mobile terminal: It is an internet mobile device with a
its security issues encountered and points out the future mobile payment application installed;
research direction. • Payee: The entity that accepts the transaction;
In the last section, it has a discussion and comparison in • Bank-led payment provider: It cooperates with banks
terms of security, usability, and availability for popular mo- or card organizations and use their advantages of hardware
bile payment applications. Then we analyze their strengths and software to support Bank-led payment. Representatives
and weaknesses with the reasons that cause them, discuss are Apple, Samsung, and Google, etc;
the possible future development of secure mobile payment • TPC-led payment provider: It is responsible for per-
technologies, and highlighted some issues that need to be forming payment authentication and fund settlement func-
resolved. tions in place of the bank in the TPC-led payment. Repre-
sentatives are Alipay and Wechat, etc;
ORGANIZATION • Mobile payment provider: All bank-led payment
In conjunction with the objective mentioned above objec- providers and TPC-led payment providers are collectively
tives, the remainder of this study is organized based on called mobile payment provider;
the primary research areas of mobile payment security: in • Card organization: It authorizes members(usually
Section II, we introduce the mobile payment system struc- banks) to issue cards, accepts card transactions, and operates
ture and security technology framework. In Section III, we its own international regional processing network;
present the tokenization technology. In Section IV, PAN • Bank: It issues the bank card, and cooperates with the
binding technology is reviewed. Section V contains remote card organization for mobile payment;
payment authentication security. Section VI introduces TOTP • Token service provider: It is responsible for generating
payment security. In Section VII, we focus on the Bank- and managing tokens which are generally provided by card
led payment security and give a comprehensive comparative organizations or banks.
discussion of popular mobile payment applications. Next, we describe the procedure of mobile payment.
The first step is bank card binding. Different from tradi-
II. MOBILE PAYMENT SYSTEM STRUCTURE AND tional bank card payments, PANs are not allowed to store on
SECURITY TECHNOLOGY FRAMEWORK the phone or the server of mobile payment providers. PANs
In this section, we summarise the mobile payment system are also cannot be transmitted frequently over the insecure
structure and security technology framework. Table 1 shows channel. Thus, the token is required in place of the real PAN.
2 VOLUME 10, 2019

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

Payer

P1: Apple pay, Google pay,Samsung pay P1:Alipay,Wechat,Paypal

Token is stored Bank card
in the SE
QR code Audio
B1:Encry_k(Token)
MST T1:TOTP
O1:URL
P5:Token QR code
NFC P2:PAN
P2:PAN O1:URL
P5:Token
Payee O2:Payment
T2:TOTP request
Bus Shop Subway
Bank-led payment
company company
provider
Street vendor Third-party payment
provider
B2: Encry_k(Token)
P3:PAN
Internal
T3.1:
payment
P5:Token
T3.2:PAN
P4:PAN P3:PAN
P4:Token OR
P5:Token
B3,T3.2:PAN Bank
B3,T3.2:Token Card
organization
Token service
provider PAN

Bank

FIGURE 1. Mobile payment system framework.

The red road P in the right part of Figure 1 shows the
bank card binding process in TPC-led mobile payment. The
process is as follows:
P1, a user opens the third-party payment application in-
stalled in the mobile terminal and enters the PAN on the bank
card binding interface;
P2, the mobile terminal sends the PAN to the server of the
third-party payment company via the secure channel;
P3, the server interacts with the card organization;
P4, the card organization uses the token management
module of the token service provider to generate a token and
contacts the issuing bank to obtain the confirmation message;
VOLUME 10, 2019
P5, the third-party payment company obtains the token of
the bank card, saves it locally and returns it to the mobile
terminal.
The red road P in the left part of Figure 1 describes the
bank card binding process at Bank-led mobile payment :
P1, the user opens the payment application and enters the
PAN on the bank card binding interface;
P2, the mobile terminal sends the PAN to the server of the
mobile phone manufacturer via the secure communication
network. Remainders of the processes match steps P3, P4,
and P5 of the TPC-led mobile payment process.
No matter which payment application users use, the token
3

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access
is always required to binding on the phone.
After completing the binding process, we begin to describe
the payment process.
1) The Payment Process of TPC-led Mobile Payment
In the TPC-led mobile payment, the user only interacts with
the TPC. After completing the settlement, the TPC sever
communicates with the card organization and bank.
TPC-led mobile payment mainly consists of two payment
methods, one is the TOTP payment, and the other is the
remote payment.
The blue road T in the right part of Figure 1 describes
the payment process of TOTP payment. The process is as
follows:
T1, the mobile terminal generates a time-based one-time
password (TOTP) and sends it to the PoS machine through
the quick response(QR) code or audio;
T2, the PoS machine sends the TOTP and transaction
information to the payment service provider’s server via a
secure communication channel. Then, the server validates
the TOTP(detailed in section V), and confirms the payer and
transaction information;
T3.1, case 1, If the user is paying with a third-party
account balance, the server internally settle and complete the
transaction;
T3.2, case 2, If the user uses a token(also called virtual
bank card) to pay, the server sends the token and transaction
information to the card organization (such as China Union-
Pay, Visa, MasterCard, etc.). After the card organization re-
ceives the token, it retrieves the corresponding PAN through
de-tokenization and contacts the issuing bank to complete the
transaction.
The yellow road O in the right part of Figure 1 describes
the payment process of remote payment. The process is as
follows:
O1, a user uses the mobile phone to scan the QR code
in the store counter or the other way to obtain the URL or
interface and use it to initiate a payment request;
O2, after receiving the payment request from the user, the
TPC server validates the user’s identity(detailed in section
IV) through the authentication algorithm. The remainder
process matches steps T3.1 or T3.2 of the TOTP payment
process.
attention: We need to explain why TPC-led mobile pay-
ment users can use balance payments without the need to
use a bank card. Generally, third-party payment companies
have their accounts in the bank. For instance, the process of
transferring money to users’ Alipay accounts is to transfer
money to the Alipay bank account. Thus, when a user pays
with the account balance, the money is still in the bank
account of Alipay and has not moved.
2) The Payment Process of Bank-led Mobile Payment
Various bank and mobile phone manufacturers jointly pro-
vide Bank-led mobile payment. In order not to change peo-
4 VOLUME 10, 2019
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
W.L et al.: State of the Art: Secure Mobile Payment
ple’s habit of swiping cards and reuse of existing infras-
tructure, mobile phone manufacturers utilize their hardware
advantages to corporate with banks directly and use mobile
phones to simulate the payment of the physical bank card.
The green road B in the left part of Figure 1 describes the
payment process of card emulation payment. The process is
as follows:
B1, the user activates the mobile payment using fingerprint
or PIN, and the mobile terminal interacts with the PoS
machine using NFC to simulate the process of contactless
card payment. Samsung mobile phone has the technology to
simulate the magnetic stripe card payment by MST;
B2, after the PoS machine authenticates the mobile ter-
minal and obtains the payment information, it interacts with
the card organization and sends the encrypted data which the
same as IC card authentication required;
B3, once the card organization obtains the token, it can
find the corresponding PAN by de-tokenization and contact
the issuing bank to complete the transaction.
B. MOBILE PAYMENT SECURITY TECHNOLOGY
FRAMEWORK
According to the payment procedure in mobile payment sys-
tem, we divide security technologies into tokenization, PAN
binding, and secure payment authentication. This subsection
provides a conceptual introduction to these technologies and
their sub-technologies from a framework perspective, which
shows of Figure 2. Detailed discussion and analysis are
presented in later sections.
Tokenization technology is presented in the left part of
Figure 2, which is used to generate tokens for PAN. It
can be divided into the centralized tokenization scheme and
distributed tokenization scheme.
Centralized tokenization is a conventional and database-
centric solution for tokenization, which all token re-
questors(TR) need to apply token in a common token server
provider(TSP).
In distributed tokenization schemes, the generation of tok-
enization is not concentrated in one server but distributed in
various places. Each place can generate its unique token.
In the middle of Figure 2 is the PAN binding technology.
It is used to protect bank card information from being leaked
when requesting the token. Generally, it can be divided into
third-party trust protocol and anti-leakage protocol.
Third-party trust protocol allows users to directly send the
bank card information to a third-party company and entrust
them to interact with the card issued bank and bind the token.
PAN anti-leakage protocol allows users to complete the
bank card binding and token application without the third-
party company knowing the bank card information.
The right part of Figure 2 shows secure payment authenti-
cation. It can be divided into remote payment authentication
and near-field payment authentication.
Remote payment authentication is consists of PIN authen-
tication and biometric authentication. Users need to obtain
a payment interface or website from the entity which he
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

Secure mobile payment

Tokenization PAN binding Secure payment authentication

Centralized Distributed Third PAN Near-field Remote

tokenization tokenization party trust anti-leakage payment payment
protocol authentication authentication
protocol

Database Distributed PIN code

TOTP Card emualtion Biometric
system authentication
authentication authentication authentication

Magnetic Contactless
Random Lookup TOTP QR code Audio stripe card card
FPE Face Fingerprint Biometric PIN code
number table authentication
Magnetic MST NFC Contactless authentication authentication
protocol protocol protocol
stripe card card
authentication authentication
protocol protocol

Symmetric Hybrid
cryptosystem cryptosystem

FIGURE 2. Mobile payment security technology framework.

wants to pay. And then, users choose his financial account
to complete the payment after they input his PIN code or
show his biometrics(such as the face, fingerprint, and iris)
to confirm.
Near-field payment authentication is consist of time-
based one-time password (TOTP) authentication payment
and card emulation authentication. In the TOTP authen-
tication scheme, users generate a TOTP from the TOTP
generation algorithm; each password is valid for a specific
period of time and can pay only once. Its payment com-
munication mediums are the quick response(QR) code and
Audio. Card emulation authentication simulates the payment
authentication as a physical bank card, such as a contactless
card and magnetic stripe card. It payment communication
mediums are near-field communication(NFC) and magnetic
secure transmission(MST).
There are secure hardware basement technologies that play
a significant role in protecting the mobile user’s stored sen-
sitive data and sensitive operation: secure element(SE) and
Trusted Execution Environment(TEE). There is no separate
section to discuss hardware security in this article since there
is quite some literature [25] [26] [27] [28] [29] [30] [31]
about it. But we will point out the function of mobile hard-
ware security technology when introducing and discussing
mobile payment security technologies.
VOLUME 10, 2019
SE is a platform that can install, personalize, and man-
age applications. It is a combination of hardware, software,
interfaces, and protocols that can securely store and use
credentials for payment, authentication, and other services.
An attacker can not extract sensitive information stored at the
SE. Conceptually, SE [25] [26] can be divided into hardware-
based SE, which include eSE(embedded SE) and UICC-
based SE(removable SE) and software-based SE, which is
HCE.
The TEE is a secure area of the main processor of a
connected device that ensures sensitive data is stored, pro-
cessed and protected in an isolated and trusted environment.
There are three main technological implementations of TEE
[27]: 1)TrustZone, 2)Software Guard eXtension(SGX), and
Memory Encryption Technology (MET). TrustZone [28] is
a flexible hardware-assisted security technology proposed by
ARM, which partitions the hardware and software resources
of a System-on-a-Chip, by distinguishing the context of
execution in the secure and normal world. SGX [29] is an in-
novative secure extension to the Instruction Set Architecture
(ISA), a TEE based on a mechanism of "reverse sandbox"
in which sensitive processes address space is protected – at
CPU level – even against OS. MET [30] [31] is the hardware-
assisted TEE scheme released by AMD that encrypts and
protects system memory.
5

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access
All of these technologies are working together to protect
our private information and to secure each mobile payment.
III. FUNDAMENTAL OF VIRTUAL BANK CARD:
TOKENIZATION
In this section, we discuss the tokenization technology. First,
we start with a brief overview of the motivation to use
tokenization in mobile payment. So the reader will be able
to better appreciate the steps taken in the ongoing activity.
Then we summarise and analysis centralized tokenization
and distributed tokenization in Section III. A and Section
III.B, respectively. Finally, we propose several open issues
and present a recommendation for further research.
In the digital payment field, the bank card is a mainstream
payment medium. With the increasing popularity of business
through on the Internet, each company needs to maintain its
customer’s bank card information in some form. Bank card
data leakage is considered to be one of the severe threats to
any company [17] [18]. Such violations will not only bring
severe economic losses to banks and companies but also
severely damage its brand image and reduce people’s trust
in digital payment.
Payment Card Industry Security Standards Council (PCI
SSC) is an organization established by payment card com-
panies, which is responsible for the development and de-
ployment of payment security technologies and ensures the
security of credit card data. In particular, PCI SSC has
developed a PCI Data Security Standard (PCI DSS) [10].
The standard specifies the security mechanism which card
data are required to guarantee during payment. PCI DSS
requires organizations that process card payments to protect
cardholder data when they store, transmit, and process them.
Enterprises, merchants, and payment providers face severe
challenges to secure their high-value sensitive data. Replac-
ing PAN with a token is one of the data protection and audit
scope reduction methods recommended by the PCI DSS.
In 2014, the international chip card standardization organi-
zation EMVCo set token as a substitute in the physical bank
card [19]. The token can be used the same as PAN, which
means that there is no need to update the already installed
PoS (Point of Sale) terminals. Tokenization is a process of re-
placing a traditional bank card PAN to a token with a unique
numeric value. Payment token can be used in all aspects
of bank card transactions and can be used across industries
so that it has versatility. The procedure of token generation
is done by the token service provider (TSP). When TSP is
issuing a token, it can flexibly make some restrictions, such as
the use for individual businesses, online application, offline
application, etc. It can also limit the value, time, and location
of tokens. When necessary, tokens can be destroyed and re-
issued. Deployment of tokenization technology can save a lot
of money since it ensures compatibility with existing infras-
tructure. For security, the EMVCo Payment Token Specifi-
cation Technical Framework v2.1 [19]provides examples of
secure storage of tokens on a device. For instance, it can be
transferred into the trusted execution environment(TEE) or
6 VOLUME 10, 2019
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
W.L et al.: State of the Art: Secure Mobile Payment
stored at the secure element(SE). For usability, tokens can be
transferred through the most communication medium, such
as NFC, Internet, and Bluetooth, etc.
To summarise, the tokenization scheme has its advantages
in three aspects of mobile payment:
first, its deployment cost is very low, which ensures com-
patibility with existing infrastructure;
second, it protects the user’s sensitive information, since
cardholder’s card number and the validity of the card does
not appear in the transaction;
third, it restricts adversary’s action, because tokens only
can be used in the limited transaction scenario;
finally, it reduces the probability of fraudulent transactions.
Summarizing from the EMVCo Payment Token Specifica-
tion Technical Framework v2.1 [19], PCI Security Standard
Council v3.2.1 [10], and requirement of card organizations
[12], we conclude that a tokenization scheme needs to satisfy
the following four requirements:
• the generated token does not change the format of the
bank card PAN;
• the bank identification code(BIN) of a token cannot be
identical to the BIN of the original PAN;
• tokens satisfy the Luhn algorithm;
• tokens can be flexibly made with some restrictions.
Attention: Many readers confuse the token in the mobile
payment with the token in the identity authentication, and
they believe that the payment can be authenticated as long
as the token is presented. This is incorrect. In the field of
mobile payments, tokens are a string of unique numbers that
are used instead of PANs for storage and transmission. The
conceptions of the token in the different fields of computer
security have a different meaning.
A. CENTRALIZED TOKENIZATION TECHNOLOGIES
Centralized tokenization(Figure 3) is a conventional and
database-centric solution for tokenization, which all token
requestors(TR) need to apply token in a common token server
provider(TSP).
TR
TSP
FIGURE 3. tokenization service provider of centralized tokenization
Summary from [9] [10] [11] [13] [14], a TSP of centralized
tokenization system generally has the following components:
• An algorithm for token generation : It is a process to
create a token corresponding to the primary account number
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

(PAN). Some of the algorithm options are format-preserving

encrypt, cryptographic hash functions, and random number TR
generators.
• Card-Vault : It is a repository that typically stores TSP
pairs of PANs and tokens together with other information TSP TSP
needed for token mapping. Since it contains PAN, it must
be specially protected according to PCI DSS requirements. TSP TSP
• Cryptographic Key Management : This module is a
set of mechanisms for creating, using, managing, storing, TSP TSP
and protecting keys used to protect PAN data and other data TSP
involved in the tokenization system.
Article [11] discusses the security of tokenization systems
in which the author consider three different attack scenarios:
• IND-TKR : Tokens are only public. This represents the
most realistic scenario where an adversary has access to the FIGURE 4. tokenization service provider of distributed tokenization

tokens only, and the card-vault data remains inaccessible.

• IND-TKR-CV : The tokens and the contents of the card-
vault are public. This represents an extreme scenario in which is not concentrated in one server but can be distributed in
the adversary gets access to the card-vault data also. various places. Each place can generate its unique token.
• IND-TKR-KEY: This represents another extreme sce- Distributed tokenization technology has gradually become
nario in which the tokens and the keys are public. a hot spot for research, and several patent works have been
Let T KR[CV ] : K×X×D → T ×Y be a tokenizer. Then produced.
the advantage of an adversary A in the sense of IND-TKR, In the scheme of Terence [32], It set up a static lookup table
IND-TKR-CV and IND-TKR-KEY are defined as in each TSP and proposed a hierarchical system for handing
definition 1 : AdvTind−tkr
KR (A) = |P r[Exp − IN D − sensitive strings of characters. MICRO proposed a scheme
A 1 based on Feistel Cipher and a hierarchical structure [33].
T KR ⇒ 1] − |,
2 In 2016, Mattsson [34] proposed a table-connect distributed
definition 2 : AdvTind−tkr−cv
KR (A) = |P r[Exp − IN D − scheme.
A 1 Summary from the requirement of [19] [10] [12] [33]
T KR − CV ⇒ 1] − |,
2 [32] [34], we believe a ideal distributed tokenization system
definition 3 : AdvTind−tkr−key
KR (A) = |P r[Exp − IN D −
1 should have the following components:
A
T KR − KEY ⇒ 1] − |, • A algorithm for distributed token generation : It is a
2
K, a key generation algorithm; X is a finite set of primary process to create a token corresponding to a primary account
account numbers; D is a finite set of associated data; T is a number (PAN), and all distributed TSP can generate token
finite set of tokens; Y is a string associated with the token; locally. A PAN can request different tokens from multiple
CV is a card-vault; T KR is a tokenizer. TSP.
All definitions follow the style of a chosen-plaintext attack • A distributed token mapping procedure : It refers to
and may be made stronger by giving the adversary additional the procedure used to associate a token with a PAN. TSP must
power of obtaining PANs corresponding to tokens of its be able to translate any token generated by any TSP at any
choice. time to the correct PAN.
• A distributed Cryptographic Key Management : This
module is a set of mechanisms for creating, using, managing,
B. DISTRIBUTED TOKENIZATION TECHNOLOGIES storing, and protecting keys used to protect PAN data and
Although traditionally centralized tokenization has been other data involved in token generation at the distributed
widely used, it also has been exposed to some critical prob- environment.
lems [33]:
• Complexity and cost: Managing large replicated token Figure 6 shows the structure of distributed tokenization
databases is both difficult and expensive, and increases the scheme, which summary from the latest schemes [33] [32]
scope of PCI audits; [34]. Tokenization equipment can be used for tokenization
• IIntegrity: Inaccurate analytics and other application and de-tokenization. And it can have multiple and distributed
correlation due to credit card numbers sometimes being in different geographical locations. User A may exchange
replaced by more than one token; tokens for PAN in tokenization equipment A and can also
• Performance and scale: Tokenization performance is request de-tokenization operations in tokenization equipment
slow and very difficult to scale. B, and vice versa. In this way, there is no central database to
To deal with these problems, people proposed distributed store PANs and tokens.
tokenization(Figure 4), in which the generation of the token
VOLUME 10, 2019 7

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

De-token De-token De-token De-token

request Client A request Client C request Client B request Client D

TOKENIZAION EQUIPMENT 1 TOKENIZAION EQUIPMENT 2

Tokenization Database D1-A Database D2-A

Tokenization
server T1-A Token generator server T2-A Token generator
Hardware platfom A Hardware platfom A

Tokenization Database D1-B Database D2-B

Tokenization
server T1-B Token generator server T2-B Token generator
Hardware platfom B Hardware platfom B

Token request Token request Token request Token request

Client A Client B Client C Client D

FIGURE 5. The structure of Distributed Tokenization System

C. OPEN ISSUES AND RECOMMENDATION FOR IV. PAN BINDING SECURITY

FURTHER RESEARCH
For the generation algorithms of the token, neither the tra-
ditional secret key encryption scheme nor the public key
encryption scheme can achieve this goal since generated
token need meet special requirements(mentioned at the be-
ginning of this section). Because their encrypted ciphertext
far exceeds the length of bank cards, and can not preserve the
format. Therefore, centralized tokenization schemes gener-
ally use random number generators(RNGs) based database
[10] [19], and distributed tokenization use the encryption
based on lookup table [33] [32] [34].
Format-preserving encryption(FPE) [2]can be a useful
method since it have been used to solve many similarly
issues [3] [4] [5] [6]. To apply FPE in either centralized or
distributed tokenization schemes is a research direction.
From our perspective, the decentralized tokenization
scheme is the future research direction, since it improves
security and tokenization efficiency, and reduce storage cost.
However, the research status of the distributed tokenization
system is still work-in-progress. Terence [32] and Ulf [34]
only implement distributed tokenization operation, but the
de-tokenization operation still requires a centralized server.
Although Mirco [33] implements distributed tokenization
and de-tokenization operations, all TSPs store the same
fractional token table. Existing format-preserving encryption
algorithms are difficult to apply in distributed tokenization
schemes. But in 2017, Bellare [1] proof the security of
identity based format-preserving encryption(IB-FPE). After
analysis Bellare’s IB-FPE scheme, we find it has many
distributed properties. Therefore, we believe that there is
a significant breakthrough for tokenization technology to
design distributed tokenization schemes based on IB-FPE.
8 VOLUME 10, 2019
PAN binding is the process that the user binding the bank
card for mobile payment. PAN binding security is to protect
the user’s sensitive information at the binding process, which
consists of Third-party trust protocol and PAN anti-leakage
protocol.
In this section, we first describe the process at Third-party
trust protocol from the perspective of security. Then, we
propose the concept of the PAN anti-leakage protocol and
give a discussion for open issues.
A. THIRD-PARTY TRUST PROTOCOL
In Third-party trust protocol, users and banks trust the secu-
rity of third-party companies completely and send sensitive
information directly to them. The detailed protocol process
is as follows:
1, user open the payment application which installed at the
mobile terminal to start binding the bank card, and enter the
PAN;
2, the mobile terminal sends the PAN over the encrypted
channel(such as Secure Sockets Layer) to the server of the
payment service provider;
3, the payment service provider initiates a binding request
to the bank card organization or bank
4, the card organization confirms the binding with the card
issuing bank. The bank then sends a random code to the
user’s mobile phone via a short message, allowing the user to
enter the random code on the mobile phone for confirmation.
5, after the user confirms, the issuing bank will reply with
confirmation information to the card organization. The card
organization uses the TSP to generate a token and return it
to the payment service provider, which then stores the token
with the user’s account on the server and sends it to the user’s
mobile phone.

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access
W.L et al.: State of the Art: Secure Mobile Payment
6, finally, mobile terminals store the token at hardware for
mobile payment transactions.
B. PAN ANTI-LEAKAGE PROTOCOL AND OPEN ISSUES
In the beginning, the vast majority of mobile payment
providers are large Internet companies, and their security
is relatively reliable. Therefore, they are eligible for real
bank card information. However, with the development of
mobile payment, many small and medium-sized companies
participate in the mobile payment. These companies are far
less reliable than the previous payment service providers, and
they are no eligible to contact real bank cards. Therefore,
there is a gradual need to design a PAN anti-leakage protocol
for mobile payments.
In this paper, we set the security model for such issues.
There are three kinds of entities:
• mobile terminal;
• Third-party mobile payment company;
• bank and card organization.
we assume that:
• Third-party mobile payment company will store the
sensitive information or hijacked by the adversary A;
• messages are communicated over an insecure channel;
• the communication channel is susceptible to eavesdrop-
ping, deletion, or modification, which are executed by adver-
sary A.
The target of the PAN anti-leakage protocol: users
must complete the binding operation with the bank without
exposing the PAN to any other entities.
In 2016, Alibaba Group proposed a protocol [36] based
on an authorization certificate. In this protocol, the mobile
terminal communicates with the card organization or banks
through the secure channel to send the default certificated
instructions issued by the payment service provider. Al-
though there are very few schemes designed directly for
PAN binding, there are some for similar scenes. Similar
to Alibaba’s scheme, these related schemes use certificates
based on asymmetric passwords.
From a different perspective, we find that the field of
public cloud data auditing maybe provides efficient solutions
to this problem. There are also have three kinds of entities
are involved in the scenario, namely data owners, the cloud
server, and a third-party auditor (TPA). TPA is responsible for
checking the integrity of cloud data on behalf of cloud users
in case they do not have the time, resources, or feasibility to
monitor their data and return audit reports for them. However,
due to regulatory and financial incentives, cloud servers are
unable to disclose managed data to TPA [8]. These two
issues have very similar technical requirements. Besides,
zero-knowledge proof may also help solve the issues. A zero-
knowledge proof of knowledge protocol [56] enables a prover
(P) to convince a verifier (V) that some statement is true, but
the verifier learns nothing except the validity of the statement.
VOLUME 10, 2019
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
V. TPC-LED PAYMENT SECURITY: REMOTE PAYMENT
AUTHENTICATION
Remote payment is a method that the mobile terminal of the
payer can complete the payment far from the payee. This
approach is similar to web page payment. But it takes full
advantage of mobile terminals, allowing users to complete
identity authentication and confirm payment anytime, any-
where. Its payment process has been described in section
II.A.
In this section, we focus on authentication methods and
algorithms used in remote payment. First, we introduce the
remote payment authentication method widely used. Then we
discuss the relevant authentication methods in the academic
area, analyze their advantages and disadvantages, and pro-
pose possible future development directions.
A. THE AUTHENTICATION METHOD OF REMOTE
PAYMENT
There are two types of authentication methods for remote
payment, one is PIN code authentication, and the other
is biometric identification. The biggest difference between
these two types is that the former needs to authenticate PIN
at the remote server, while the latter is usually authenticated
biometric locally. In essence, both payment methods are
based on the hybrid cryptosystem. After the user applies for
these two payment methods, the third-party server sends a
certificate containing the public key pk and the private key sk
to the user. pk and sk ensure the security of remote mobile
payments.
1) PIN code authentication
PIN authentication is a traditional authentication method and
is widely used in physical bank card payment.
The process of PIN code authentication is:
1, user input a 6 digits PIN number;
2, user’s mobile terminal encrypts the PIN and other infor-
mation:
M = Signaturesk (P IN, transaction inf ormation),
and sends them to the payment service provider;
3, if the PIN passes the verification V alidatepk (M ), the
payment service provider will accept the payment, otherwise,
reject.
2) Biometric identification
The process of biometric identification is:
1, the user inputs his biometric feature;
2, the user’s terminal collects the user’s biometrics and
compares them with the biometrics stored at local hard-
ware(usually at SE);
3, if the user’s biometrics passed the certification, the
mobile terminal will send certification information and trans-
action information
M = Signaturesk (C, transaction inf ormation) to the
payment service provider;
4, the payment service provider accepts the payment if it
passes the verification V alidatepk (M ).
9
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

TABLE 2. Comparision with the previous proposed remote authentication schemes

security attributes Odelu [59] H.Shen [61] Tseng [58] et al. Tsai-Lo [57] Roy [62] Chatterjee [63]
Cryptography ECC
√ ECC
√ ECC Pairing
√ Hash Function
√ Chaotic
√ Map
Stolen mobile device attack √ √ NA
√ √ √ √
replay attack √ √ √ √ √ √
Password guessing attack √ √ √ √ √ √
Privileged insider attack √ √ √ √ √ √
DoS attack √ √ √ √ √ √
Known session key secrecy √ √ √ √ √ √
Forward secrecy √ √ √ √ √
User impersonation attack √ × √ √ √
Server impersonation attack √ ×
√ × √ √ √
Ephemeral secret key leakage attack √ √ × √ √
Revocation √ NA
√ NA √ √
Secure mutual authentication × √ ×
√
No server database × × √ √ × ×
No registration server database × × √ ×
√ ×
√
Low communication overhead × × √ × √ √
Low computation overhead × × √ ×
Black/white free list for user ×
√ ×
√ √ ×
√ × ×
√
New user scalability ×
Biometric remote authenticate × × × × × ×

Biometrics verify entirely locally, which is the reason why
the payment app does not support biometric authentication
after devices been rooted or jailbroken.
B. OPEN ISSUES AND RECOMMENDATION FOR
FURTHER RESEARCH
To authenticate the user’s identity, there was a lot of protocol
proposed for authentication. Lee [52] proposed a fingerprint
based remote user authentication scheme using smart cards.
To overcome the weaknesses of Lee [52], Kim [53] proposed
a new fingerprint based authentication scheme using smart
cards. In 2010, Chun Tang Li [54] has proposed a new
biometrics-based authentication using smart cards. Then, Li
Xiong [55] proposed a scheme to overcome the weaknesses
in [54] scheme.
With the widespread use of the distributed system, the
design of biometrics based authentication scheme for dis-
tributed environments become a focus issue. There are a lot
of schemes based on Fuzzy extractor [83], ECC and bilinear
pairing. Yoon [60] and Shen [61] proposed a biometrics
based authentication scheme for the distributed environment
using ECC. Tsai [57] and Tseng [58] refer to the existing
scheme and use the bilinear pairing to make the registration
center no longer participate in the authentication. Roy [62]
proposed a lightweight remote user authentication scheme
without use ECC and pairing. In 2018, Chatterjee [63] pro-
posed a new authentication scheme using chebyshev chaotic
map, which has high security and low computation. Table
2 shows the representative proposed scheme on the multi-
servers environment.
Summarizing the current results, we find that the exist-
ing remote biometric authentication scheme has made great
progress in security. The main direction of the research is to
lower the computation and communication overhead. While
most of the proposed schemes use PIN and biometrics to
encrypt the secret key issued by the registration service.
10
During the authentication process, the user completes the PIN
or biometrics verification locally to decrypt the secret key
and then using the secret key for server side authentication.
All the authentication factors neither authenticated by the
server. From our perspective, It is a future research direction
to design a scheme in which the server can confirm a remote
authentication user input a plurality of factors provided at the
time of registration.
In addition to cryptography, neural network is gradually
being applied to the authentication of biometrics. More than
20 years ago, there are scholars proposed neural network for
human face detection [39] [40] [41]. But it was not realized
at the time. Now, with the development of deep learning,
deep learning neural network has been used for biometric au-
thentication [42] [43] [44] [45]. Its authentication efficiency
and usability far exceed cryptography-based solutions. In
our opinion, to design a deep learning neural network based
remote payment scheme is a very practical research direction.
VI. TPC-LED PAYMENT SECURITY: TOTP PAYMENT
AUTHENTICATION
TOTP payment is a payment method that can complete
one transaction with once one-way information transfer(from
user to PoS machine). This type of payment method is
gradually occupying the global payment market.
The payment applications using TOTP include Alipay,
WeChat, etc. Figure 6 shows the 18-digit digitally-generated
QR codes using by WeChat.
In this section, we begin to introduce the deployment of
TOTP payment, and then detailed describe the algorithm of
TOTP payment. In the end, we give a discussion and propose
several open issues for it.
VOLUME 10, 2019

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access
W.L et al.: State of the Art: Secure Mobile Payment
135201604588241400
FIGURE 6. Time-based One-time payment password
A. THE DEPLOYMENT AND AUTHENTICATION
PROCESS OF TOTP PAYMENT
For clear description, we provide Figure 7 to show the entire
process:
1) Deployment Process
1, when the user first uses the TOTP payment in the pay-
ment application, the server generates a unique device ID
corresponding to the token and send it to the user’s terminal
together:
• Token: The seed used to generate the TOTP code. This
token is what we have introduced in section II;
• Device ID: It is used to identify the mobile terminal
uniquely;
2, After sending the token and the device ID to each
terminal, the server needs to store the mapping relationship
between the token and the device ID.
2) Authentication Process
1, When the user starts a TOTP payment, he/she needs to
open the payment interface, then the terminal will immedi-
ately generate a TOTP using the token, ID, timestamp, and
TOTP algorithm;
2, the mobile terminal passes TOTP to the PoS machine
by near-field communication method(generally is QR code
or audio);
3, then the PoS machine transmits the TOTP and transac-
tion information to the payment service provider;
4, finally, the payment service provider uses the same
token, ID, and decryption algorithm to verify the TOTP.
B. TOTP PAYMENT AUTHENTICATION ALGORITHM
Many banks have enhanced their security by using One-
Time Password (OTP) as another authentication method in
addition to the traditional username and password method
[76] [77]. Then OTP is used for transaction verification at the
mobile terminal [79] [78]. Recently, Google uses the 2-step
authentication framework to enhance the OTP approach [38].
But the place where OTP shines is Time based One-Time
Password(TOTP) payment, which nearly billion of OTPs
consumed every day in the world [80].
1) TOTP Generation Algorithm
In Figure 8, we summarise an algorithm that widely used in
TOTP payment, in which the terminal calculates the dynamic
VOLUME 10, 2019
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
password by using the pre-stored token, device ID, and the
current time as input.
The present algorithm may be an arbitrarily formed irre-
versible algorithm.
• time synchronization algorithm (TOTP);
• event synchronization algorithm (HOTP);
• the challenge-response algorithm (OCRA);
The process of the algorithm is as follows:
1, the mobile terminal uses the timestamps, token, and
HOTP algorithm to generate a dynamic password;
2, then it merges dynamic password and device Id to
generate one-time identity password;
3, it generates first information by using the token, one-
time identity password, and hash algorithm;
4, it merges first information and the one-time identity
password to generate TOTP.
2) TOTP Authentication Algorithm
The authentication algorithm is as follows:
1, the server of payment server provider finds the cor-
responding token with the device ID of the authentication
password;
2, the server uses the token and the first default algorithm
to verify the dynamic password:
1) the trusted dynamic password list is first to be calculated
(the trusted dynamic list includes multiple trusted dynamic
passwords);
2) if it found that a specific trusted dynamic oral delivery is
consistent with the above-mentioned dynamic password, the
dynamic password verification passes;
3) the server uses the first information and the second
present algorithm to verify the second information.
The latest TOTP algorithm of Alipay and WeChat may
differ from this, but we can sure that the basic ideas and
methods are similar.
C. OPEN ISSUES AND RECOMMENDATION FOR
FURTHER RESEARCH
The security issues of TOTP payments are receiving
widespread attention. Not only because it has a lot of users,
but it does also have a lot of security risks. It cannot avoid
the security issues encountered by traditional OTP, such as
Trojans, man-in-the-middle attack, relay attack, etc.
Xiao long Bai [81] proposes an attack called STLS, where
an active attacker can sniff a payment token, and stop the
transaction by various means. Then the attack can quickly
transmit the token to the colluder which uses it for different
transactions. This attack poses a realistic threat to TOTP
payment.
Subsequently, Alipay proposed a solution in the latest
patent [37], which uses the front camera of the mobile
terminal to scan the PoS to obtain a unique code, so that
the generated TOTP is bound to the current PoS machine.
However, by the time we finish the manuscript, the solution
11
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
Mobile Terminal
sends the token and the token corresponding device ID
writes token and
device ID to
hardware storage
scans the password
generates a
dynamic password
FIGURE 7. The deployment and process of Time-Based One-Time password Payment.
of the patent has never been applied, and this secure issue
always existed.
Spolaor [82] uses the public charger to steal information
from the charging mobile terminal. In this attack, as long as
the user opens the payment interface, the adversary can get
the QR code.
The security of TOTP payment is a very important issue,
but there are little academic researches on it.
In this section, we set the security model for such issues.
There are three kinds of entities:
• mobile terminal;
• PoS machine;
• Third-party mobile payment company;
we assume that:
• mobile terminal are in an environment that is easy to
monitor;
• messages are communicated over a public insecure chan-
nel;
• messages in public channel are susceptible to eaves-
dropping; deletion or modification, which are executed by
adversary A.
• users present a TOTP once to complete a transaction.
We believe that when generating TOTP, it is a good idea
to bind it with PoS machine related information. But this
is also a contradiction because the user’s mobile terminal
does not know any information about the PoS machine when
the user producing the TOTP. From our perspective, perhaps
information around the PoS machine is what we need, such
as the approximate location of the PoS machine. Because the
payment mobile terminal is close to the PoS machine, so it
has a high probability of providing the same approximate
location, but the adversary in other places and the PoS
12
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
10.1109/ACCESS.2019.2963480, IEEE Access
W.L et al.: State of the Art: Secure Mobile Payment
PoS machine Server
queries the token
and send the
corresponding to
password to the
the device ID
server
verifies the
returns the verify result password
in his hands cannot provide. There are already have some
location-based authentication schemes [46] [47] [48] [49].
But they are not currently suitable for TOTP payment. In
these schemes, in order to complete the authentication, the
user must interact with other entities multiple times. It is not
meet the requirement of TOTP payment, which completes
one transaction with once one-way information transfer, and
even on the offline environment. But we believe that apply
location-based authentication schemes to TOTP payment is a
research direction.
VII. BANK-LED PAYMENT SECURITY: CARD
EMULATION PAYMENT AUTHENTICATION
Banks and mobile phone manufacturers jointly provide
Bank-led mobile payment. Banks and EMVCo mainly offer
interactive authentication protocol [20] [21] for mobile pay-
ments card emulation payments. And mobile phone manu-
facturers provide hardware support for the specifications, and
responsible for mobile terminal security.
The contactless card emulation payment(CCEP) is the
main representative of Bank-led payment, which is advanced
quickly in recent years. Its market size is estimated to grow
from USD 6.70 Billion in 2016 to USD 17.56 Billion by 2021
[64].
The first contactless card payment was implemented in
1995 by Seoul Bus Transport. Since then, many IT leading
companies (Apple, Google, Samsung) started to integrate a
contactless card payment process into mobile phones. Google
first launched a CCEP system in 2011, which called Google
Wallet. Apple Pay and Samsung Pay then followed in 2014
and 2015, respectively. After that, Google rebrands Google
Wallet to Android Pay.
VOLUME 10, 2019
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

Current time Token

HOTP
algorithm

Dynamic password (n digits) Device ID(m digits)

combination
Token
One-time identity
password(n+m digits)
HMAC-SHA algorithm

First information(K digits) combination

TOTP(First information(K digits) ||

One-time identity password(n+m digits) )

FIGURE 8. Time-Based One-Time Password Algorithm for TOTP Payment.

Magnetic stripe card emulation is the card emulation au-
thentication scheme proposed by Samsung. It is a technology
that simulates the mobile terminal as a traditional magnetic
bank card. The MST sends a magnetic signal from the user’s
device to the reader of the PoS machine (which can simulate
the physical card swiping without upgrading the terminal’s
hardware). Almost all PoS machines with card readers can
use MST technology. Since magnetic stripe cards are gradu-
ally being phased out in the market, so it is only used as an
auxiliary payment method for CCEP.
In this section, we first describe the CCEP authentica-
tion algorithm. Then, we summarise the security issues en-
countered in CCEP. Finally, we give a comparison between
mainstream mobile payment applications, including Alipay,
Wechat, Apple Pay, Google Pay, and Samsung Pay.
A. CONTACTLESS CARD EMULATION PAYMENT
AUTHENTICATION ALGORITHM
According to the EMVCo Specifications [20] [21], the pro-
cess is based on the specifications of physical contactless
cards.
First, we need to explain the meaning of some concepts in
contactless card emulation payment authentication:
• tokenization: It is a procedure to replace sensitive PAN
values with non-sensitive token values;
• token: It is a string of numbers that has the same format
as the PAN. In some technical essay or literature about
tokenization, they called token to virtual PAN(VPAN) or
digital PAN(DPAN), but according to the requirement of [19]
[10] [12], token is the most accurate name;
• cryptographic password [70] : It contains encrypted
data derived from the token, timestamp, and Application
VOLUME 10, 2019
Transaction Counter (ATC). Cryptographic password is the
token mentioned in some related literature, which misleads
many readers;
• cryptographic key [70] : This key, stored in the secure
hardware(TEE or SE), is static or dynamic, depending on the
card brand/network. Static cryptographic keys are used over a
relatively long period of time and in multiple key exchanges,
whereas a dynamic key is generated for each exchange. Some
articles confuse the cryptographic key and token, which also
mislead many readers.
Then, we introduced SE-based card emulation and HCE-
based card emulation [13].
In SE-based card emulation payment, sensitive informa-
tion stored in SE. token stored at SE, and cryptography key
generator applications host in the SE. SE act as the role of the
bank card integrated chip.
In HCE-based car emulation payment, a remote server of
SEs termed the cloud of secure elements is proposed. The
study reports a smartphone with HCE functionality remotely
using a SE, hosted on a server, through the establishment of a
secure TLS channel. Token and cryptography key generator
applications are hosted in the remote SE which usually
located at TSP. This payment method has the following
difference between the SE-based one:
• All service providers who want to provide HCE-enabled
NFC services need to make business agreements with their
TSP.
• For an HCE-based NFC Service of a service provider, the
only cost is the NFC reader and backend server installation
and maintenance.
• After de-tokenization of user token and application token
values on TSP’s server in each transaction, the authorization
13

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
TABLE 3. Security Issues of CCEP
Bond [22]
Bond [23]
Roland and Langer [65]
Francis [75]
Chothia [72]
WangZhao [74]
Vila [71]
Cavdar [73]
Michael Roland [66]
Michael Roland [67]
Margraf [68]
response is first directed to the Service Provider, enabling
service providers to track transactions and retain their users’
transaction details.
• Users can easily register to the TSP and get support from
it to disable their SE.
Next, we describe the CCEP authentication algorithm
based on what we mentioned above.
• The binding bank card issuer IS has a private sk and a
public pk.
• The mobile terminal M shares a symmetric key K with
its binding bank card issuer IS. It also has a private skm a
public pkm . pkm is signed by IS’s private key sk. All these
keys are stored in the secure element.
The process of authentication consists of five phases:
1, the user activates the contactless simulated payment
function of the mobile terminal by using the PIN code or
biometric identification, and puts the mobile phone into the
sensing range of the PoS machine;
2, PoS machine detects mobile terminal C;
3, PoS machine sends the transaction T to M . Then,
M responds with its public key pkm and card information
such as token and expiration date. If pkm is verified by
PoS, continues. There are three types of data authentication
methods:
• Static Data Authentication;
• Dynamic Data Authentication;
• Combined Data Authentication.
4, PoS sends a random number n to request a cryptogram
generation from M . There are three types of cryptograms
exist:
• Transaction Certificate is used for the offline;
• Authorization Request Cryptogram is used for online;
• Application Authentication Cryptogram is used to cancel
the transaction.
5, Online Verification:
1) M increases its counter CT and generates a secret key
skT C by using CT and K;
2) M generates the cryptogram Authorization Request
Cryptogram: a MAC of n,CT ,T with using skT C ;
3) M sends the cryptogram AC to PoS machine which
relays it to IS with the card information;
4) IS verifies ARQC and possibly validate the information
of M . If ARQC passes verification and card is validated for
14
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
10.1109/ACCESS.2019.2963480, IEEE Access
W.L et al.: State of the Art: Secure Mobile Payment
Attack Remarks
pre-play attack poor random generation
pre-play attack do not impose any encryption between communication
cloning attack adversary learn the necessary data for cloning
relay attack passive monitoring card
relay attack not require a specific hardware
relay attack
relay attack using off-the-shelf NFC-enabled Android devices
relay attack
relay attack relay attacks on Google Wallet
relay attack software-based relay attacks on existing applications
relay attack relay attacks on Apple pay
the transaction, ARC = 1 and IS generates a MAC encrypted
by the secret key skT C , ARQC, and ARC. This MAC is
called as ARPC;
5) IS sends ARPC to PoS machine which relays it to M if
ARC = 1. Otherwise, it cancels the transaction;
6) M verifies ARPC. If the verification value and ARC
are 1, M generates the second cryptogram TC to show
transaction is complete. It generates a random number r and
use skm to sign r, n, CT , T C, timestamps, R1 , and R2 ;
7) M sends the signature and TC to PoS machine;
8) the PoS machine verifies if the signature and the data
are valid;
9) the PoS machine contacts with the IS to receive the
reimbursement;
10) the IS gives the PoS machine proof of transaction
completion and confirms that it execute the reimbursement.
B. SECURITY ISSUES ENCOUNTERED
The security issues encountered by traditional contactless
cards are also difficult to avoid on CCEP. Table 3 sum-
marizes the attacks that CCEP suffered. Bond [22] [23]
show pre-play attacks were detected because of poor random
generation. Roland and Langer [65] discovered a cloning
attack. The most important attack specific for CCEP is relay
attack, which show at Vila [71], Chothia [72], Cavdar [73],
WangZhao [74] and Francis [75] . Chothia [72] provides a
solution of relay attacks for the first. The current EMVco
[20], therefore, take precaution partly against relay attacks
using the solution proposed by Chothia [72]. But the solution
provided by Chothia does not protect against malicious who
can execute relay attacks differently than MiM-adversaries.
Roland applied relay attacks to google wallet and other
existing applications [66] [67]. Margraf [68] shows that relay
attacks cannot be avoided on Apple pay.
C. DISCUSSION AND OPEN ISSUES
Based on the content of this article, We summarize a compar-
ison for mainstream payments in Figure 9.
From the perspective of security technology, Samsung Pay,
and Apple Pay are the most secure scheme, followed by
Google. TOTP payments of Alipay and WeChat are the most
unreliable scheme.
VOLUME 10, 2019
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

TPC-Led Bank-led
Alipay Wechat Pay Apple Pay Google Pay Samsung Pay
Payment method Near-field remote Near-field remote Near-field Near-field Near-field
System System and System support System and System and System and System and
Compatibility
support only hardware only hardware hardware hardware hardware
Hardware cost Low Hign Low Hign Hign Medium Hign
Payment range 0.1-0.6m * 0.1-1m * 0.04-0.1m 0.04-0.1m 0.04-0.1m
Tokenization system Centralized Centralized Centralized Centralized Centralized Centralized Centralized
Payment QR code and
Internet QR code Internet NFC NFC NFC and MST
communication Audio
Interactive × √ × √ √ √ √

TEE √ √ √ √ √ √ √

SE × × × × rSE HCE rSE

PIN or PIN or
Payment PIN or PIN or biometric biometric biometric
TOTP biometric TOTP PIN or biometric
authentication and EMVCo,TOTP and and
EMVCo,TOTP EMVCo,TOTP
Unprotected Unprotected
Sensitive information Locol SE Local SE Local SE Cloud SE Local SE
hardware hardware
Anti-eavesdropping
× √ × √ √ √ √
attack resistance
Relay attack
× × × × × × ×
resistance
Password guessing
√ √ √ √ √ √ √
attack resistance

Root or jailbreak
× × × × √ √ √
attack resistance

Stolen device
× √ × √ √ √ √
attack resistance

Man in the middle

× × × × × × ×
attack resistance
Low
communication √ × √ × × × ×
overhead
Low computation
√ × √ × × × ×
overhead
Secure mutual
× √ × √ √ √ √
authentication

FIGURE 9. Comparison of mainstream mobile payments.

Samsung Pay [69] [70] and Apple Pay [68] use trust-
zone and SE to protect sensitive information and transaction
authentication. They also use the interactive NFC and the
EMVCo protocol to ensure secure transactions. And their
payment range is very narrow, effectively preventing eaves-
dropping attacks.
The difference between Google payment and Samsung
or Apple is the introduction of HCE technology. It can
store sensitive information in the cloud. Google use HCE to
remove the limitation of SE, which effectively reduce costs
and hardware requirement of the mobile terminal without
significantly reducing security. Although it just removed the
SE, it has brought a lot of development possibilities for the
mobile terminal with such high integration.
Alipay and WeChat solutions have no technology to pro-
tect sensitive information except trustzone. Once the device
is lost or invaded, it is easy for others to get valuable informa-
tion. And the combination of QR code and TOTP is natural
to have eavesdropped. Moreover, the recognition distance of
the QR code is very long, and the eavesdropper can even
preemptively scan code and steal the money.
However, from the actual performance in the market, the
VOLUME 10, 2019
case is very different. Alipay and WeChat almost completely
occupy the Chinese market, and they are rapidly spreading
in Southeast Asia and many other developing countries, and
even gradually gain recognition in the European and Amer-
ican markets. While the other three scheme is slow to pro-
mote. Although they are recognized in developed countries,
consumers in these countries seem to prefer cash or physical
bank cards. And their promotion in other developing regions
is struggling.
The high compatibility of Alipay and WeChat pay is the
vital point. Their mere hardware requirements for mobile
devices and the mobility of payment software have much
improved the user experience. For a lot of small merchants,
the scanning code replaces the PoS machine, which greatly
saves the cost of equipment. So Alipay and WeChat almost
ruled mobile payments in some underdeveloped regions and
gradually expanded to developed areas.
The high prices and low compatibility of equipment pro-
duced by Apple, Samsung, and Google is the most important
reason. Besides, Apple Pay and Samsung Pay do not have
their financial account ecology. They are only used to replace
15

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access
bank cards for internet and near-filed payment, which will
result in very few financial transactions they can do. The last
but not the least, It is very inconvenient to use at roadside
stalls or small shops. These shops have low profits will not
want to prepare a PoS machine for such payment. These
reasons have greatly reduced people’s motivation to use
them.
In the future, we believe that the research direction of TPC-
led payment should be security. The first is the protection of
sensitive information, followed by the study of TOTP pay-
ment anti-eavesdropping, and finally, the payment protection
of lost devices. For Bank-led payments, the main research
direction should be payment portability. The first is to reduce
the cost of use, then the payment method without adding
any hardware(such PoS machine), and finally to increase the
scope of their financial business.
From our point of view, in the field of mobile payment, Ad-
vanced technology cannot thoroughly dominate the market as
the requirements and capabilities of consumers vary. But the
technologies that meet the economic strength and lifestyle of
local people can adapt to the market.
ACKNOWLEDGMENT
This work is supported by the National Key Re-
search and Development Program of China under Grants
2017YFB0802300.
REFERENCES
[1] Bellare, Mihir, and Viet Tung Hoang. “Identity-Based Format-Preserving
Encryption.” In Proceedings of the 2017 ACM SIGSAC Conference on
Computer and Communications Security - CCS ’17, 1515–32. Dallas,
Texas, USA: ACM Press, 2017. https://doi.org/10.1145/3133956.3133995.
[2] Bellare, Mihir, et al. "Format-Preserving Encryption." Lecture Notes in
Computer Science 45.5(2009):295-312.
[3] Liu Z, Jia C, Li J, et al. "Format-preserving encryption for DateTime[C]//
IEEE International Conference on Intelligent Computing & Intelligent
Systems." 2010.
[4] Weiss M, Rozenberg B, Barham M. "Practical Solutions For Format-
Preserving Encryption[J]." Computer Science, 2015.
[5] LIiu Z L, Li M, You X Y, et al. "Format-preserving encryption for PNG
image[J]." Transaction of Beijing Institute of Technology, 2013, 33(12):
1263-1268.
[6] Palgon G, Chambers J, Konisky D. "System and methods for format
preserving tokenization of sensitive information", U.S. Patent 8,458,487[P].
2013-6-4.
[7] Li Min, Liu Zheli, You Xiaoxiao, et al. "Format-preserving encryption
model for sensitive information[J]." Journal of Nankai University(Natural
Science), 2012(5).
[8] Yu, Yong , et al. "Public cloud data auditing with practical key update and
zero knowledge privacy. " Australasian Conference on Information Security
& Privacy Springer International Publishing, 2016.
[9] Shmueli, Erez , et al. "Implementing a database encryption solution, design
and implementation issues." Computers & Security 44(2014):33-50.
[10] PCI Security Standards Council. "Payment Card Industry(PCI)
Data Security Standard, v.3.2.1, 2018." Available at "https:
//www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf?
agreement=true&time=1565925137854".
[11] Díaz-Santiago, S., Rodriguez-Henriquez, L. M., & Chakraborty, D. (2016).
"A cryptographic study of tokenization systems." International Conference
on Security and Cryptography (Vol.15, pp.413-432). IEEE.
[12] Tokenization Payment Solution of UnionPay Card Networking Joint Tech-
nical Specification, v2.1, China UnionPay, 2015. Available at "https://max.
book118.com/html/2017/0304/94286515.shtm".
16
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
W.L et al.: State of the Art: Secure Mobile Payment
[13] Busra, Ozdenizci , O. Kerem , and C. Vedat . "A Tokenization-Based
Communication Architecture for HCE-Enabled NFC Services." Mobile
Information Systems 2016(2016):1-20.
[14] JeffStapleton, and RalphSpencerPoore. "Tokenization and Other Meth-
ods of Security for Cardholder Data." Information Systems Security
20.2(2011):9.
[15] Del Rowe, Sam. "Information supplement: The Rise of Mobile Wallets,
CRM Magazine 2017." Available at "https://www.questia.com/magazine/
1G1-499761586/the-rise-of-mobile-wallets-and-what-marketers-need".
[16] Chainnews. "The rise of e-wallet: overview of the global mobile pay-
ment market in 2018." Available at "https://www.chainnews.com/articles/
930281876657.htm".
[17] Jeb Su. "Data Breach Alert: Over 1 Million Credit Card Data From The
U.S., South Korea Have Been Leaked", Forbes, 2019.
[18] Tara Siegel Bernard; Tiffany Hsu; Nicole Perlroth; Ron Lieber. "Equifax
Says Cyberattack May Have Affected 143 Million in the U.S.." The
New York Times, 2017. Available at "https://www.nytimes.com/2017/09/
07/business/equifax-cyberattack.html".
[19] EMVCo. "Payment Tokenisation Specification, v.2.1, 2019". Available at
"https://www.emvco.com/document-search/?action=search_documents&
emvco_document_technology[]=payment-tokenisation/".
[20] EMV Contactless Specifications for Payment Systems, Book C-2: Kernel
2 Specification
[21] EMV Integrated Circuit Card Specifications for Payment Systems,
Book2:Security and Key Management
[22] Bond, Mike , et al. "Be Prepared: The EMV Pre-play Attack." IEEE
Security & Privacy 13.2(2015):56-64.
[23] Bond, Mike; Omar Choudary; Steven J. Murdoch; Sergei Skorobogatov;
Ross Anderson. "Chip and Skim: Cloning EMV Cards with the Pre-Play
Attack." In 2014 IEEE Symposium on Security and Privacy, 2014, 49–64.
San Jose, CA, IEEE. https://doi.org/10.1109/SP.2014.11.
[24] Alves T. "TrustZone : Integrated Hardware and Software Security[J]."
White Paper, 2004.
[25] Coskun V; Ozdenizci B; Ok K. "A Survey on Near Field Communication
(NFC) Technology[J]." Wireless Personal Communications, 2013, 71(3),
2259-2294.
[26] Roland M; Langer J; Scharinger J. "Relay Attacks on Secure Element-
Enabled Mobile Devices[C]." IFIP International Information Security Con-
ference, 2012.
[27] L. Coppolino; S. D’Antonio; G. Mazzeo; L. Romano, "A comprehensive
survey of hardware-assisted security: From the edge to the cloud." Internet
of Things, 2019, vol. 6, p. 100055, Jun.
[28] Maene; Pieter, et al. "Hardware-Based Trusted Computing Architectures
for Isolation and Attestation." IEEE Transactions on Computers. 2018, 67.3,
361-374.
[29] F. McKeen; I. Alexandrovich; A. Berenzon; C.V. Rozas; H.Shafi; V.
Shanbhogue; U.R. Savagaonkar. "Innovative instructions and software
model for isolated execution." in: Proceedings of the 2nd International
Workshop on Hardware and Architectural Support for Security and Privacy,
HASP, 2013.
[30] D. Kaplan. "AMD x86 Memory Encryption Technologies." USENIX
Association, Austin, TX, 2016.
[31] S. Mofrad; F. Zhang; S. Lu; W. Shi. "A Comparison Study of Intel
SGX and amd Memory Encryption Technology." 2018, pp. 1–8, doi
10.1145/3214292.3214301.
[32] Terence Spies, Mountain View, CA(US),Richard T.Minner, Carmichael,
CA(US), "system for protecting sensitive data with distributed tokeniza-
tion." U.S. Patent 8595850 B2, 2013,11.26.
[33] Micro Focus. "Secure Stateless Tokenization (SST)." Available at "http:
//files.asset.microfocus.com/4aa6-5576/en/4aa6-5576.pdf".
[34] Ulf Mattsson. Cos Cob, CT(US), "table-connected tokenization." US
9237006 B2, 2016, 1.12.
[35] Ulf Mattsson. Stamford, CT(US), "distributed tokenization using several
substitution steps." US 8745094 B2, 2014, 6.3.
[36] Jun Yi. Alibaba Group, CN(China). "Method and device for account
binding and business processing." CN 107204957 A, 2016, 3.16.
[37] Xiaoxiao Mao. Alibaba Group, CN(China), "Scan code operation method
and device." CN 107231389 A, 2016, 3.23.
[38] Grosse, Eric , and M. Upadhyay . "Authentication at Scale." IEEE Security
& Privacy 11.1(2013):15-22.
[39] JUELL. "A hierarchical neural network for human face detection." Pattern
Recognition 29.5(1996):781-787.
[40] Lawrence, Steve, et al. "Face recognition: a convolutional neural-network
approach." IEEE Transactions on Neural Networks 8.1(1997):98-113.
VOLUME 10, 2019
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access
W.L et al.: State of the Art: Secure Mobile Payment
[41] Lin, Shang Hung, S. Y. Kung, and L. J. Lin. "Face recognition/detection by
probabilistic decision-based neural network." IEEE Transactions on Neural
Networks 8.1(1997):114-32.
[42] Sun, Yi, X. Wang, and X. Tang. "Deep Learning Face Representation by
Joint Identification-Verification." (2014).
[43] Wang, Weihong, et al. "Face Recognition Based on Deep Learning. Human
Centered Computing." 2014.
[44] Liu, Jianzheng, C. Fang, and C. Wu. "A Fusion Face Recognition Ap-
proach Based on 7-Layer Deep Learning Neural Network." A Fusion Face
Recognition Approach Based on 7-Layer Deep Learning Neural Network.
2016.
[45] Lebedev, A., et al. "Face verification based on convolutional neural net-
work and deep learning." IEEE East-west Design & Test Symposium 2017.
[46] Ashfield, James; David Shroyer; Douglas Brown. "Location based authen-
tication of mobile device transactions." U.S. Patent No. 8,295,898. 23 Oct,
2012.
[47] Govindarajan, Gunasekaran. "Location-based authentication." U.S. Patent
Application No. 11/586,932, 2012, 23 Oct.
[48] Hammad, Ayman, and Patrick Faith. "Location based authentication." U.S.
Patent No. 9,721,250. 2017,1, Aug.
[49] Zhang, Feng, Aron Kondoro, and Sead Muftic. "Location-based authenti-
cation and authorization using smart phones." 2012 IEEE 11th International
Conference on Trust, Security and Privacy in Computing and Communica-
tions, 2012.
[50] Zhengwei Zhu. "Sound wave payment method and related devices" CN
103761648 A[P], 2014.
[51] C Zhang , J Huang. "Sound wave payment method and system." CN
103927657 A[P], 2014.
[52] Lee, J. K., S. R. Ryu, and K. Y. Yoo. "Fingerprint-based remote
user authentication scheme using smart cards." Electronics Letters
38.12(2002):554.
[53] H.S. Kim, S.W. Lee, and K.Y. Yoo, “ID-based password authentication
scheme using smart cards and fingerprints.” ACM SIGOPS Oper. Syst. Rev.,
vol. 37, no. 4, pp. 32–41, Oct. 2003.
[54] Chun Tang. Li and M.S. Hwang, “An efficient biometrics-based remote
user authentication scheme using smart cards.” J. Netw. Comput. Appl., vol.
33, no. 1, pp. 1–5, Jan. 2010.
[55] Li, Xiong , et al. "Cryptanalysis and improvement of a biometrics-based
remote user authentication scheme using smart cards." Journal of Network
and Computer Applications 34.1(2011):73-79.
[56] Schnorr, C. . "Efficient Identification and Signatures for SmartCards."
Workshop on the Theory & Application of of Cryptographic(1989).
[57] Tsai, Jia Lun , and N. W. Lo . "A Privacy-Aware Authentication Scheme
for Distributed Mobile Cloud Computing Services." IEEE Systems Journal
9.3(2015):805-815.
[58] Tseng, Yuh Min , et al. "List-free ID-based Mutual Authentication and Key
Agreement Protocol for Multi-server Architectures." IEEE Transactions on
Emerging Topics in Computing 4.1(2016):102-112.
[59] Odelu, Vanga, Ashok Kumar Das, and Adrijit Goswami. “A Se-
cure Biometrics-Based Multi-Server Authentication Protocol Using Smart
Cards.” IEEE Transactions on Information Forensics and Security 10, no. 9
(September 2015): 1953–66. https://doi.org/10.1109/TIFS.2015.2439964.
[60] Yoon, Eun Jun , and K. Y. Yoo. "Robust biometrics-based multi-server
authentication with key agreement scheme for smart cards on elliptic curve
cryptosystem." Journal of Supercomputing 63.1(2013):235-255.
[61] H. Shen, C. Gao, D. He, and L. Wu, "New biometrics-based authentica-
tion scheme for multi-server environment in critical systems." Journal of
Ambient Intelligence and Humanized Computing 6.6(2015):825-834,2015.
[62] Roy, Sandip, Santanu Chatterjee, Ashok Kumar Das, Samiran Chattopad-
hyay, Neeraj Kumar, and Athanasios V. Vasilakos. “On the Design of
Provably Secure Lightweight Remote User Authentication Scheme for
Mobile Cloud Computing Services.” IEEE Access 5 (2017): 25808–25.
https://doi.org/10.1109/ACCESS.2017.2764913.
[63] Chatterjee, Santanu , et al. "Secure Biometric-Based Authentication
Scheme Using Chebyshev Chaotic Map for Multi-Server Environment."
IEEE transactions on dependable and secure computing, 2018.
[64] "Contactless payment market by solution, service, payment mode, vertical
- global forecast to 2021." https://www.marketsandmarkets.com/Market-
Reports/ contactless- payments- market- 1313.html
[65] Roland. Michael, J. Langer. "Cloning credit cards: a combined pre-
play and downgrade attack on EMV contactless." Proceedings of the 7th
USENIX conference on Offensive Technologies USENIX Association,
2013.
VOLUME 10, 2019
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
[66] Roland M. "Applying recent secure element relay attack scenarios to the
real world: Google Wallet Relay Attack[J]." Computer Science 2012.
[67] Roland M. "Software-Based Relay Attacks on Existing Applications[M].
Security Issues in Mobile NFC Devices." Springer International Publishing,
2015.
[68] Margraf M, Lange S, Otterbein F. "Security Evaluation of Apple Pay at
Point-of-Sale Terminals[C]." International Conference on Next Generation
Mobile Applications, 2016, IEEE.
[69] "Platform Security." Available at "https://developer.samsung.com/
tech-insights/knox/platform-security".
[70] "Device-side Security: Samsung Pay, TrustZone, and the TEE." Available
at "https://developer.samsung.com/tech-insights/pay/device-side-security".
[71] Vila, José; Rodríguez, Ricardo J. "Practical Experiences on NFC Relay
Attacks with Android." Revised Selected Papers of the International Work-
shop on Radio Frequency Identification Springer-Verlag New York, 2015,
Inc.
[72] Chothia, T. , et al. "Relay Cost Bounding for Contactless EMV Payments."
Financial Cryptography and Data Security, 2015, Springer Berlin Heidel-
berg.
[73] Cavdar, D.; E. Tomur. "A Practical NFC Relay Attack on Mobile De-
vices Using Card Emulation Mode." In 2015 38th International Con-
vention on Information and Communication Technology, Electronics
and Microelectronics (MIPRO), 2015, 1308–12. Opatija, Croatia: IEEE.
https://doi.org/10.1109/MIPRO.2015.7160477.
[74] Wang, Zhao , et al. "Implementation and analysis of a practical NFC relay
attack example." Second International Conference on Instrumentation IEEE
Computer Society, 2012.
[75] Francis, Lishoy, et al. "Practical NFC Peer-to-Peer Relay Attack Using
Mobile Phones." Radio Frequency Identification: Security and Privacy
Issues. Springer Berlin Heidelberg, 2010.
[76] Subpratatsavee, Puchong , and P. Kuacharoen . "Transaction Authentica-
tion Using HMAC-Based One-Time Password and QR Code." Computer
Science and its Applications. Springer Berlin Heidelberg, 2015.
[77] Mulliner, Collin , et al. "SMS-Based One-Time Passwords: Attacks and
Defense." International Conference on Detection of Intrusions & Malware
Springer-Verlag, 2013.
[78] Chow, Yang Wai , et al. "Authentication and Transaction Verification
Using QR Codes with a Mobile Device." International Conference on
Security, Privacy and Anonymity in Computation, Communication and
Storage Springer International Publishing, 2016.
[79] Barmawi, Ari Moesriami . "A Visual One-Time Password Authentication
Scheme using Mobile Devices." International Conference on Information &
Communication Security 2014.
[80] Huandian Technology, "The world consumes hundreds of millions
of QR codes every day." Available at "http://baijiahao.baidu.com/s?id=
1643551736838897329&wfr=spider&for=pc".
[81] Xiaolong Bai and Zhe Zhou and XiaoFeng Wang and Zhou Li and
Xianghang Mi and Nan Zhang and Tongxin Li and Shi-Min Hu and Kehuan
Zhang. "Picking Up My Tab: Understanding and Mitigating Synchronized
Token Lifting and Spending in Mobile Payment." 26th USENIX
Security Symposium (USENIX Security 17), 2017, 978-1-931971-
40-9, Vancouver, BC, 593–608, Available at "https://www.usenix.org/
conference/usenixsecurity17/technical-sessions/presentation/bai",USENIX
Association.
[82] Spolaor, Riccardo , et al. "No Free Charge Theorem: a Covert Channel
via USB Charging Cable on Mobile Devices." International Conference on
Applied Cryptography & Network Security Springer, Cham, 2017.
[83] Dodis, Yevgeniy , L. Reyzin , and A. Smith. "Fuzzy Extractors: How
to Generate Strong Keys from Biometrics and Other Noisy Data." In-
ternational Conference on the Theory and Applications of Cryptographic
Techniques Springer, Berlin, Heidelberg, 2004.
17
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2019.2963480, IEEE Access

W.L et al.: State of the Art: Secure Mobile Payment

WENZHENG LIU received the M.S. degree in

Applied Math from Zhejiang University in 2016.
He is currently a PH.D student at College of
Computer, National University of Defense Tech-
nology, from 2017. His research interests include
applied of identity-based cryptography, Internet of
Thing, stream cipher, financial cryptography,data
security,and mobile cloud computing.

XIAOFENG WANG received the ph.D. degree

from the National University of Defense Technol-
ogy. His current research interests include trusted
network, network security and distributed intelli-
gent data processing. The corresponding author,
email: xf_wang@nudt.edu.cn.

WEI PENG was born in Dayi City, Sichuan,

China, in 1973. He received the M.S. and
Ph.D. degrees in computer science from the Na-
tional University of Defense Technology (NUDT),
China, in 1997 and 2000, respectively. From 2001
to 2002, he was a Research Assistant with the
School of Computer, NUDT, China, where he has
been a Research Fellow since 2003. His major
research interests are Internet routing, network
security, and mobile wireless networks.

18 VOLUME 10, 2019

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.