Abstract:

With the development of mobile communication technology and the popularity of smart phones, mobile payment is becoming more and more popular. However, the security weaknesses of wireless networks, system vulnerabilities in mobile devices, and account hijacking have all contributed to the security of mobile payments. This paper starts with the mobile payment transaction process, analyzes the security threat of mobile payment system, and proposes a risk assessment method, so that both parties can conduct security assessment on the transaction process to make security decisions. The method uses the STRIDE threat model to build an indicator system and uses a fuzzy comprehensive evaluation method to assess the risk of the transaction. A threat mitigation model based on trusted network connection (TNC) is established, and the security of mobile payment system is enhanced according to the evaluation result. Quantitative indicators are used in the assessment and a transaction-level fine-grained risk assessment is achieved. At the end of this paper, the risk assessment method is validated and analyzed by using two typical application scenarios.

Key words: mobile payment, risk assessment, fuzzy comprehensive evaluation