Security

We start our quest by considering the breakdown of security in integrity, availability, and confidentiality, and continue with other security concepts that are specific to payment systems, such as fairness and resistance to impersonation attacks, among others.

Integrity is defined as the assurance that information is not altered or modified except by properly authorized individuals. Thus, for integrity purposes, maintaining the consistency, accuracy, and trustworthiness of data over its entire life cycle becomes crucial. In the context of payment systems, integrity is important when it comes to the integrity of payment records and payment requests. That is, no unauthorized party should be able to alter the contents of a particular payment request without invalidating the payment request itself or being detected. Common measures to enable data integrity verification against intentional or accidental data modifications include the use of cryptographic techniques, such as cryptographic checksums. Other measures involve controlling the physical environment of networked terminals and servers, restricting access to data, and maintaining rigorous authentication practices. Data integrity can also be threatened by hardware failures or environmental hazards, such as heat, dust, and electrical surges.

Availability ensures that the payment system can serve authorized user requests, and fulfill its purpose whenever the service is supposed to be active. Ensuring this property expands to many aspects of the payment system. Moreover, providing adequate communication bandwidth and preventing the occurrence of bottlenecks are equally important when designing secure payment systems.

Apart from the basic security requirements, security in payment systems has been commonly bound to the fairness of the underlying payment mechanism, as well as to the resistance to impersonation attacks and accountability.

Fairness requires that a particular individual cannot commit to more payments than its assumed account balance. For example, users should not be able to use their credit card to pay more than their credit limit, or use their debit card to pay more than their debit account balance. This property is also commonly known as balance [3] in the literature. On the other hand, resistance to impersonation attacks requires that no one should be able to impersonate other users or perform payments on behalf of other users without their consent.

Nonrepudiation is another aspect of the same property that requires that a user should not be able to deny a transaction that he or she carried/authorized.

Finally, accountability requires that a user who misbehaves (i.e., behaves against the regulation of the account holder or the law) can eventually be accountable for his or her acts. This concept of security is also strongly associated with nonrepudiation.

Common mechanisms and concepts to provide integrity, confidentiality, and (implicitly) availability in payment systems enforce strong authentication and proper authorization. Authentication is the method or mechanism for ascertaining that somebody really is who they claim to be. Authorization, on the other hand, refers to rules that determine who is allowed to do what in a system.