Mobile commerce security, technology, culture and availability challenges

¶ … wireless Web is truly' the next major wave of Internet computing

A its potential for bringing people together and expanding commerce is even greater than that of the wired Internet."

Edward Kozel, board member and former CTO of Cisco systems (AlterEgo, 2000, p. 12)

The integration of the Internet into our modern culture as a driving force behind business, convenience, services and merchandise acquisition has created a new set of desires for modern consumers. The trend started with the ease and availability of services and products being offer4ed through radio and television advertising, and then infomercials and shopping channels. The internet brought the availability to purchase products, goods, and information from our desks and kitchens. Now trough wireless hotspots and wireless devices, society is following their desires toward a marketing distribution channel which motivates them to pay for internet access, and mobile commerce (m-commerce) anytime, anywhere, and instantly. These sets of desires, which growing numbers of consumers are willing to pay for, is creating a market-based demand for increased availability to wireless networks.

According to Nadel, (2002) by 2005 more than 500 million m-commerce users worldwide will be generating revenues of over 130 billion [pounds sterling] for those using the m-commerce value chain,. Those organizations sharing in this evolving revenue stream include the network operator, and technology supplier, to the content provider and online merchants.

If even the most conservative forecasts are to be believed, communications professionals involved in developing end user technology applications should take the business imperative of m-commerce seriously. Mobile technology enables a unique customer communications channel which is based solely on the desires of that customer. Nowhere is the impetus stronger for this level of individualized control over marketing than at the point of delivery, in the palm of the consumer's hands, and among the mobile network operators for whom m-commerce means direct access to the consumer. In addition, when combined with the power of proactive, predictive customer relations management, (CRM) presents a real opportunity to counter the ongoing effects of customer churn and focus on boosting average revenue per user for all wireless systems. (Nadel, 2002)

Currently, there are 4 factors which affect the development of an effective, reliable global m-commerce industry. Lagging behind the development curve are individual facets of the M-commerce industry which are all needed in order to form the glue which will hold this evolving value chain together. In order to make this shift to m-commerce possible on a global scale, the factors which need to work together are technology, culture, availability, and security.

Technology Development curve

Technology which is currently available is not sufficient to handle the expected demands of broad-based m-commerce. The wireless networks currently offer little in the way of personalized and easy to use content. Using a wireless device with scaled down features to browse a standard internet website is cumbersome, and not likely to satisfy the customer. If m-commerce means anything, it means simplicity and instant availability. Devices which do not supply this kind of instant interactivity will not be favored by consumers who have become used to finding instant access to goods and services through a desk top, or laptop PC. The service providers need to address, and offer a similar experience, convent, reliable, and instantaneous if they are to engage the desires of the growing wireless m-commerce community.

Culturally, consumers' experience in e-commerce is setting the standard for how shoppers will perceive m-commerce. When the Internet came of age in the late 1990's businesses were convinced that personal interaction could be replaced by flashy internet access to goods and services. However, the bricks and clicks model proved superior to a strictly internet-based business model. Customers want to have access to individual attention when in need of customer service, verification of purchase, etc. An m-commerce model must also meet these desires for the customer if he is to be satisfied with the experience.

Availability is a significant issue. Current wireless devices make up a minority of internet broad band traffic. According to Neil Montrefiore, executive of Singapore mobile operator M1 "Within five years, individual e-commerce services will be primarily delivered by wireless and the wireless terminal will become the window of choice to the transactional e-world," (Hoffman, 2000, p.20). If this is true, then wireless networks will have to be able to handle the bandwidth without coverage brownouts if they are to attract and build the confidence of new customers. In the new decade, the call for information technology will be information, any time, any place and on any device.

Finally, security will be the backbone of the new system. Many internet customers are just becoming confident enough to enter their financial information online and make internet purchases. The future of m-commerce will depend on developing a reliable and hack resistant wireless security system. This aspect of the wireless m-commerce revolution will be the most difficult for the companies to negotiate. Currently internet-based e-commerce solution providers operate independently, and can take a number of hours to place, verify, and record transactions. The entire system is based on wireline transmissions, and is connected by computers which have the power of land-based connections, desktop hardware etc. The wireless community, and m-commerce which will be taking place in the wireless community, want to be able to transact the same kind of business transactions from devices which fit in a shirt pocket. The communication protocols, interconnectivity, and bank transactions will need to be real time and secure in order to enable the m-commerce systems.

E-commerce is poised to witness an unprecedented explosion of mobility, creating virtually a new domain of mobile commerce. The ability to purchase goods anywhere through a wireless Internet-enabled device will slowly transform our social culture in the same way fax machines and cell phones did in the last decade. Mobile commerce, which refers to any transaction with monetary value that is conducted via a mobile network, will allow users to purchase products over the Internet without the use of a PC. This proliferation of wireless capability has created an emerging opportunity for e-commerce to expand beyond the traditional limitations of the fixed-line personal computer, and evolve into a completely mobile commerce delivery system.

The magnitude of the m-commerce Internet revolution will pressure current e-commerce business models, create opportunities for new mobile Internet companies, engender a stream of change among established e-commerce paradigms, and lead to a reconfiguration of value propositions in many industries (Evans & Wurster, 1997). M-commerce is still not without its limitations. According to Clarke (2001) the problems it must overcome include:

uniform standards: in order for devices to communicate with diverse networks, a set of uniform standards must be devised for the industry.

A ease of operation: devices need to have simple operating systems, which may become unique to the industry, rather than scaled down versions of traditional desktop applications.

A security for transactions: Digital authorization at the point of purchase, authorization at the delivery end of the purchase, and encrypted communications are each an important piece of the m-commerce system.

A minimum screen size: mobile devices must be able to deliver detailed content with ease.

A billing services: merchants will have to be able to verify bank records in real time in order to verify purchases.

Due to current technological limitations, limited service availability, and varying mobile consumer behavior patterns, business strategies developed for m-commerce applications will need to emphasize characteristics which are unique from traditional e-commerce strategies (Barnett, Hodges & Wilshire, 2000). Rather than building on the e-commerce identity, and simply adapting it to mobile devices, m-commerce will need to have its own identity, with unique offerings. The old marketing strategy of offering different and better solutions is a part of the motivators to adapt consumer behaviors. If a system is only different, consumers have no reason to change. If the system claims to be better, again, consumers have no reason to take the risk of leaving what is familiar and reliable to verify the claims of better. However, a system which is different and better has the capacity to deliver new customers.

Successful m-commerce providers will need to understand that consumers are unwilling to spend long periods "surfing' on these inherently less user-friendly wireless devices (Albright, 2000) in order to facilitate their m-commerce transactions. Wireless users will demand packets of personalized information, not scaled-down versions of generic information. Therefore, technology-focused wireless Internet business models will likely be replaced by models which best integrate the unique characteristics of wireless m-commerce - such as personal customization, instant access, and reliable transactions. As such, the long-term success of e-commerce may be partially dependent upon the successful development of consumer-oriented m-commerce business strategies. "Mobile commerce is per se not included in the traditional e-commerce market models. M-commerce will be able to increase the overall market for e-commerce, because of its unique value proposition of providing easily personalized, local goods and services anytime and anywhere" (Durlacher, 2000, p. 12).

This level of constant connectedness will be empowered by the security of wireless internet services providers. Customers, while they are willing to gain instant access to online information and commerce, are not willing to trade their safety, or security of their financial data for the convenience. While the m-commerce system is evolving in hardware technology, shaping customer culture and expectations, and moving toward truly global delivery systems, the security of individual transactions are perhaps the most important aspect of the evolution.

Security Elements and Protocols

Smart Cards.

E-commerce and emerging technologies of m-commerce are motivating the financial services industry to explore smart cards as a portable means of authenticating online identities. At the same time, smart cards are being used to provide value-added services to cardholders, says Carl Stefannelli, vice-president, global e-business, MasterCard International.

Recent studies indicate growing consumer interest in using smart cards for e-commerce. By using a card with confidential data encoded in the on board chip, soon consumers perceive a higher level of security in their transactions. But, countering this to some extent, the major reason given by consumers for not shopping online is their concern about using payment cards and entering their information online. While a recent study of consumers said that a majority of consumers believe that a cashless society is coming at some point in the future, more relevant to the smart card payment industry is "the fact that 86% thought the tool that most improved their financial performance was the debit/check card. Another significant feature is that 350m units of the 1790m smart cards sold by Schlumberger went to the banking and retail sector. Given these figures and the fact that fraud in internet credit card transactions is higher than in traditional commerce, it is no surprise that the smart card industry is burgeoning." (Bansal, 2001)

The acceptance of smart cards has been dependent on the development of global standards for reader applications, security and operating system compatibility. With a consistent set of specifications for payment cards now being adhered to and multi-application operating systems becoming available, the smart card is open to a much larger market. Industry leaders predict that payment cards with standard-compliant chips will be an important differentiator for financial institutions to win over and retain clients. The deployment of international industry standards has ensured that cards, readers and software can work together securely.

Resistance to smart cards has come mainly from retailers, who cite such issues as infrastructural upgrade costs, implementation costs and fears that the smart card will increase the transaction processing time, as authentication and data transfer would require the card to be connected to the server for longer. Many of the nation's larger retailers invested a high amount in developing their own proprietary POS and authentication systems. Although points of sale (POS) terminals with a high functionality that connect to a central database are being developed, most retailers have their own custom POS systems. This means upgrading costs are high and incentive to change is low.

Today's intelligent smart cards have a larger storage capacity and are capable of handling multiple applications simultaneously. Unlike the simple smart card, commonly used as pre-paid, disposable telephone cards, the new "smarter" cards can store and secure information. They offer read/write capability and more advanced versions may also incorporate a special processing circuit for cryptographic digital signature to validate information. Intelligent smart cards are capable of making independent computations needed to increase security and perform application functions. The microprocessor chip card has proven to be more secure than the simple magnetic strip, as the intelligence is now embedded within the integrated circuit chip rather than in a central database. The IC chip protects the information being stored from theft and damage. This improved capability makes it an ideal choice for mobile and online payments.

Another driver for the smart trend is that chip technology makes it possible for banks to integrate their products across traditional POS and ATM channels, as well as emerging e-business channels such as the internet and m-commerce. The smart card greatly decreases the capital costs currently incurred for maintaining loyalty records and sending out vouchers. (Bansal, 2001)

Wireless Application Protocol (WAP)

At the heart of successful wireless delivery is a set of unified application codes which all subscribers, service providers, banking institutions and merchants can use in order to create a universal and seamless experience. Users must be able to use their wireless devices universally in order to continue to drive the high demand toward m-commerce. WAP, making its appearance in 2000, was highly touted as the universal savior as devices sought an unfettered and universal device communication channel.

The idea behind WAP was to develop wireless Internet solutions that were open, non-proprietary to devices or delivery systems, and fully interoperable.

True WAP technologies did not depend on a single mobile device or network operator. They worked seamlessly across independent wireless networks and allowed applications to scale easily across multiple transport options and mobile devices. The multiple steps which are included in the m-commerce communication channel are the very issue which created the difficulty of developing a universal WAP standard. The WAP 1.0 standard integrated terminal-resident and network services to telephony, communications applications, information services and operator services. The initial WAP architecture was able to constitute the standard software to hardware dock with the World Wide Web.

In order to be effective and universal, WAP dealt with two levels of interoperability: device-to-device compatibility and application-level issues. At the device to device, or gateway level, manufacturers now focused their attention toward working to ensure interoperability among their handsets and network terminals. Work also was done at the application level to ensure that various devices, which may render content in dramatically differing ways, all operated smoothly and seamlessly.

By creating a single, open standard, WAP also decreased the barriers and risk to market entry for new equipment manufacturers. Open interoperability encouraged the development of WAP-enabled wireless content, including news, entertainment, financial updates and other time sensitive applications which will likely drive the m-commerce evolution. Therefore WAP interoperability had to allow carriers to offer customized services to narrow market segments, to build brand loyalty and to reduce subscriber churn. (Hamed, 2000)

In 1999, Forrester Research predicted that wireless application protocol (WAP), the standard at the time for reformatting web content for display on mobile devices, would be in use on seven million mobile phones by the end of 2000. Enthusiastic projections concluded that more than 20 million customers would be using WAP enabled devices by 2003. These projections suggested that roughly half the adult population should be shopping, banking, chatting, and surfing on its mobile phones by the end of next year. (Darling, 2001)

However, these fell hopelessly short of actual users. WAP compatible phones which entered the marketplace in 2000 were not well received by consumers. Reports from Nokia, T-Mobile, and the mobile arm of Deutsche Telekom reported that less than one per cent of its subscribers used WAP enabled services and devices with the average user accessing the service just once or twice per-month. (Darling, 2001) The initial setback centered on the consumers desire to continue to purchase inexpensive phones which are simple to operate. However, even though the initial WAP setback hit the market hard, WAP 2.0 has recreated the enthusiasm for manufacturers and service providers.

The entry of Wireless Application Protocol version 2 (WAP 2.0) plays an important role in enabling the mobile operators to continue to advance toward fully integrated m-commerce. The WAP 2.0 standard includes support for mobile multimedia messaging services (MMS), expansion of the capabilities of wireless devices, and support for features and functions to improve the user experience. WAP 2.0 is an evolutionary step and allows application developers to create compelling mobile content using the same tools and techniques they're already familiar with for other Internet applications.

The functions and features in WAP 2.0, which are enhanced, have moved the industry toward better navigation, configuration and adaptation, and security. Navigation Is Enhanced with WAP 2.0 by allowing for rich and interactive content which can be sent to subscribers in a messaging context. Configuration and adaptation is also enhanced with WAP 2.0 by using the MMS standard to sets out interfaces for servers transcoding content, and companies are already preparing products to ease multi-device support. Most importantly, security is enhanced with WAP 2.0 By addressing specific security lapses which were present in WAP 1.0; WAP 2.0 creates a straightforward end-to-end security for content providers. This is made possible without requiring customized infrastructure at the enterprise because WAP 2.0 built into the protocol the concept of secure proxy tunnels which are identical to Internet proxy tunneling.

Thus the advances in WAP establish transaction integrity at its core. The WAP 2.0 builds the network's value, and attracts new services. Secure payments place the mobile operator in the center of every mobile transaction and can result in increased revenue opportunity. The end-to-end security supported in WAP 2.0 together with enhancements made to the Wireless Identity Module (WIM) specifications make it possible for secure transaction services such as brokerage, banking, and card-based payment solutions without the additional costs of deploying enterprise hardware. (Green, 2003)

Public Key Infrastructure (PKI)

According to Edwards, (2000) given all the options, tomorrow's m-commerce security structure likely will be based on public key infrastructure and digital certificate technology. "The future of wireless e-commerce security is PKI... its compact and provides the tools required for securing wireless transactions."

PKI assumes the use of public key cryptography for authenticating the sender of a message and for encrypting and decrypting the message to ensure its confidentiality. Public key cryptography is based on a system which uses a pair of cryptographic keys. One key is private and known only to the user. The second key is public and known to the opposite party in any exchange. PKI consists of a certificate authority that issues and verifies the digital certificates including the public key. A registration authority acts as the verifier for the certificate authority before a digital certificate is issued, and the message verified.

PKI technology can be used in any data exchange requiring identification and authorization of parties involved in the transaction. It provides privacy and confidentiality, access control, proof of document transmission, and document archiving and retrieval support. Because the message is verified before it is set, encrypted during transmission, and then requires verification before being decrypted on the other end, PKI has all the elements which can be used in m-commerce transactions.

While many security vendors currently incorporate some type of PKI technology into their software, differences in design and implementation have prevented interoperability between products. Each vendor has created a system which is still very proprietary. With the increased demand for universal m-commerce seamless applications, hopefully software vendors will gradually shift away from proprietary solutions toward industry wide security standards, This won't happen over-night, but a shift to an accepted standard within the next few years seems likely. (Edwards, 2000)

As the wireless e-commerce industry searches for a security standard, e-merchants and their wireless service partners are left to choose solutions from any of several wireless security tool vendors. While each vendor has their own strengths and weaknesses, the industry needs to develop a universal PKI code in order to satisfy a growing m-commerce trend.

For example, Diversinet, a Toronto-based security solutions provider, uses PKI in its wireless security solutions. The company says it's the only security vendor offering "anonymous" digital certificates by presenting only essential credentials during wireless transactions. This anonymity enhances the privacy of a principal by hiding true identity from eavesdroppers. "The technology works like a credit card, disclosing only the relevant financial information without releasing other personal data," says Verne Meredith, Diversinet's vice president of sales and marketing. (Edwards, 2000)

VeriSign offers the widest selection of m-commerce security tools. The San Jose, Calif.-based company's markets 'Wireless Personal Trust Agent', a transparent micro-client code that can be embedded into handheld devices to support private keys and digital certificates. Another VeriSign technology, wireless server certificates, provides wireless-optimized "mini-digital certificates" offering both authentication and real-time certificate validation for low-footprint mobile devices. The company also offers a gateway-assisted PKI- which is a unique roaming model that lets small footprint devices digitally sign transactions by storing subscriber certificates in a directory that's accessible only by the subscriber's private key.

VeriSign's is the one company moving toward complete wireless trust infrastructure, including trust agents, certificate services and a gateway. Their approach needs to be accepted by the entire m-commerce industry, as the value chain participant's move in the direction of a total one-stop shopping solution.

As the wireless Internet becomes a part of everyday life, users can expect security technology to become more transparent. The current piecemeal approach will evolve into standardized, interoperable solutions. For most wireless e-commerce industry players, security is just one part of a grand experiment which is being driven by consumers increased desired to have access to commerce, information and services at the click of a handheld mouse button.

Conclusion

Some industry watchers believe that the m-commerce industry will have to ensure that all end user devices, not just mobile handsets, come with smart card readers as standard. I this way, the concept of the anytime/anywhere wallet being accessible to every potential m-commerce customer will be wired into the existing banking - ATM infrastructure. However, with the establishment of an m-commerce environment on the back of higher wireless data speeds, mobile users will be empowered to buy not just niche mobile services and applications but also physical goods. At that point, m-commerce will have arrived as a universal commercial channel, and may warrant the creation of a separate distribution channel, and financial transaction channel which is separate and apart from the ATM - banking infrastructure.

Regarding the universal usage of m-commerce, no one other than those who are ignorant of the lessons of the internet boom, and bust of the last decade is suggesting that consumers will make a wholesale migration to mobile purchasing. But on this evidence there can be little doubt that as the relevant technologies become more integrated, m-commerce will offer an ideal and logical business model for the delivery of a diverse range of services and products.

The powerful functionality of smart card technology combined with the mobile device gives it the potential to be customized to a high degree. The application of PKI or biometric identification also opens up a myriad of opportunities for the service provider, and the technology producer to create solutions which can revolutionize the market. Through the interconnectivity of wireless devices and predictive CRM software, the modern enterprise will have an unprecedented opportunity to predict, and deliver, the services and products they actually want.