Eircell - A PKI Case Study

1
Eircell - A PKI Case Study

• Robbie Ingle
• Business Technical Architecture Manager
• Eircell

2
Agenda

• Eircells Goal
• Mobile Banking
• Visa Cash
• WAP-based Banking
• WAP-based Shopping
• Conclusions

3
The Trusted Personal Device

• Trusted
• Privacy, Authentication,Integrity,
  Non- repudiation
• Personal
• Key to a set of personalised services
• Small, lightweight, fashionable
• Device
• Not necessarily a phone

4
Security Modes

• Mode 1
• Customer doesnt know or trust Merchant
• Merchant doesnt know or trust Customer
• Mode 2
• Customer knows and trusts Merchant
• Merchant doesnt know or trust Customer
• Mode 3
• Customer knows and trusts Merchant
• Merchant knows and trusts Customer

5
Mobile Banking

• AIB Bank
• Simple Application - no Merchants
• Users check Balances on Mobile Phone
• SMS used as transport
• SIM ToolKit (STK) based
• Very popular
• Many phones supported
• Easy to use

6
Mobile Banking

• Symmetric system
• End-to-end security
• Security Mode 3
• Inflexible
• Amendments require new SIM card

7
VISA Cash

• Eircom Information Age Town - Ennis
• Worlds first mobile cash download
• Three security levels
• 0 Purse (Visa Cash card) to Host
• Triple DES
• 1 Phone to Commerce Bridge
• WTLS ECC 113 56 Bit DES for data SHA-1 for
  MAC
• 2 Phone to server server to host
• Diffe Hellman session key
• Single DES and H/W DES for PIN privacy

8
VISA Cash

• Security Mode 3
• Approved by Visa
• Special purpose hardware
• Commerce Bridge
• Card Reader for Nokia 7110
• No commercial application

9
WAP-based Banking

• Ulster Bank
• Launched at Comms 2000 (April)
• Enquiry facilities at present
• Based on their Anytime Internet service
• Registration model
• Security Mode 3
• Transactions will require WTLS

10
WAP-based Shopping

• Extension of Eircells Eirshop
• Launched at Easter
• Registration Process
• Products
• Chocolates
• Books
• Ready To Go phones
• Records
• Security Mode 3

11
Conclusions

• Eircell has been very progressive
• Built on defined customer constituencies
• Security processes to date have been proprietary
• Lack of flexibility has hampered commercial
  proposition
• PKI with ubiquity and convenience of mobile phone
  will be winning combination