Web Commerce Interest Group

W3C Web Payments: Information Control and Information Flow

Posted on April 5, 2015 by Erik Anderson

Information Controls and Information Flows pretty much covers the entire transactional messaging world of financial services.

Do you like the sound of the below then read on:
1) Identity based encryption? Separate credentials and access controls per element of information?
2) Dynamic & recoverable encryption keys so you can have a unique security for every transaction?
3) A scalable security architecture so ACH, Browsers, Bitcoins, a decentralized file server can all benefit.
4) Hacker breaks into your Apple account and your personal pictures/data were stolen but still 100% secure.
5) Dynamic key constructed at time of need and immediately destroyed after usage. Role based access to protected content. Even bitcoin private keys can be inherited by your loved ones.
6) Guaranteed confidentiality with that government boogieman because YOU granted them the access controls for x time period but only to that small bit of information the courts Ok’ed.
7) Manage information control over time be it centralized, decentralized, TOR network, blockchain, bank, web browser. The security of the environment does little to nothing to affect the security of the data itself.
8) Verifiable Information chain of custody: document went from A, to B, to C. Non-repudiation of an electronic signature.
9) Protection of transaction/data is maintained regardless of what networks the data transfers over or where the data is finally stored.
10) Each Government, Institution, Bank can manage its own risk vs security tradeoffs. Biometrics, hardware tokens, pins, passwords are theirs to define.
11) Compromise of 1 banks Vendor account, 1 corporate executive PC does little to impact the integrity of the data.
12) Governments and financial institutions all have their own favorite approved algorithms so we need to make sure to use an encryption schema not an encryption algorithm so the solution works across these political barriers.
13) That 1 master key or backdoor shouldn’t exist. No more MTGox. One person should never hold THE key. Government boogiemen nor a CEO.
14) User can rent and download digital content that expires after 7 days? Two 3D printings.

From startups to large organizations. So many are trying to redo financial systems, standards, and boil oceans. I haven’t found an approach that isnt trying to boil rivers, lakes, or even the entire ocean.

Everyone wants faster, transparent, and secure transaction systems be they ACH, Bitcoin, Ripple. Everyone is doing their own thing with so little collaboration. Each of their ideas are unique, their approach is the best, and their developers are the best on the planet.

Its obvious, you cant have faster payments without first making them more secure. Chip & Pin cards with a MPOS is the silver bullet?

Wait, along comes the W3C trying to put payments into the browser and woh, brings a whole new meaning to “card not present transaction”.

Well, I guess the W3C will help boil the waters just a little bit more. Can the W3C come up with some new WebCrypto+ to magically protect the worlds financial institutions? Obviously Governments nor financial service have any expertise in protecting their own systems.

FinTech, Federal Reserve, Bitcoin, encryption, federated electronic ID, the answers must be out there without boiling the waters of the world. Its 2015, its inconceivable we need a new technology nor a browser standard to solve these issues.

For the last 6+ months I have been researching existing ISO’s, Crypto 2.0, ANSI, NIST, X9 documentation centered around electronic transaction systems and security that can be used as a common infrastructure not just for browser based payments but for everyone. I have been convinced that Financial Services has the answers somewhere but those answers just never made it mainstream.

Bitcoin has all the answers! All of the true innovation is occurring in the cryptocurrency space! Crypto 2.0 started in Bitcoin. OOPS, I lost my bitcoin private key and I lost my entire 401k. Hum… Maybe not. I just dont think that will go over well.

Is there a way to align everyone’s approaches? Aligning financial payment standards, internet security standards, Federal Reserve & Government payment system improvements, crypocurrency approaches.

The browser is suppose to be the center of the world when it comes to collaboration & interoperability. Certainly there must be something W3C can do for the financial services world other than adopt an XML messaging standards? Perhaps W3C can leverage its amazing reach to solve browser payment standards and security frameworks.

A co-worker and friend of mine, Matthew Rawlings, is the expert. He has been providing a lot of documentation links, connections, hours of explanations, etc. The most recent connection was with TecSec.

This connection was the jackpot. I grabbed my family and took 2 days of “workation” at TecSec near DC.

Thanks Jay, Ed, John, and Ron from TecSec.

TecSec has a wonderful set of technologies and ISO/X9 standards that can be used to eliminate a lot of the issues with today’s information flow and information control.

From an existing standards aspect W3C can accomplish Web Payments with 3 standards
X9.69 = Framework for Key Management Extensions (aka Constructive Key Management and Key Usage Control)
X9.73 = Cryptographic Message Syntax
ISO 20022 = XML messaging standard for financial services

Can be used to solve all of the above bullet points and so muchhhh more.

However the technology and cryptography of this approach is immensely challenging. Its very easy to get it wrong and 1 bug can make data unrecoverable.

TecSec chairs the data security group of financial services (X9). TecSec has a runtime engine called Constructive Key Management 7 (CKM7) that they have agreed to open source. TecSec CKM7 + Enterprise Builder is an implementation of X9.69 & X9.73.

If we add CKM7 runtime as an open source to the browser world we can use it as a wrapper around financial messaging like ISO 20022, chat protocols, password management systems, secure user interfaces, user identity protection, merit based identity, dynamic electronic signatures, dynamic cryptographic keys, time based access controls. CKM already has support for biometrics (fingers, facial, voice, retina), passwords, hardware tokens, geolocation & geofencing.

CKM7 has incredibly advanced cryptography but it has a cryptographic schema to manage access to the raw cryptographic algorithms and dynamic key management. CKM has a schema so its easily extensible to include new innovations, mobile and biometric sensors, etc.

I am sure lots of you have heard about ISO 12812. Secure element, trusted execution environment, managed dedicated execution contexts, trusted user interface, Mobile Financial Service Provider, Trusted Service Manager, authenticate the application downloaded, ensuring the secure execution of the mobile financial applications. Some of the approaches ISO 12812 is about physical security of the device. This is not necessary if you provide the proper implementations of information security.

I don’t believe ISO 12812, in its current form, can be directly used by the browser world. This would likely mean a lot of custom browser development for different devices. If its mathematically infeasible to impersonate the financial institution or individual even on a compromised device. A mathematical approach can still is superior to trying to maintain the security of hardware elements themselves. The browser must always assume itself to be a compromised environment so I think W3C stance must be stronger on information security side and more agnostic to the physical hardware.

A more generic approach like CKM’s architecture for administering credentials, keys and for an encryption schema will allow all to benefit from a stronger information security stance. This will provide a common and inter-operable approach from native applications to the browser.

IMO, the only unusable part of W3C Web Payments approach should be the transactional message format itself (like ISO 20022)

ISO 12812, in its current implementation, will end up creating a lot of inoperable services with incompatible messaging and security mechanisms. ISO 12812 is too specific to a financial transaction.

“AS IS” ISO 12812 will cause a lot of issues for W3C and browser vendors so we should probably need to get involved ISO 12812 while it is still a draft.

Dont get me wrong, I agree with the general direction ISO 12812 is trying to go, but its just not easily achievable. There is too much wiggle room in 12812 to make bad architecture decisions. Most certainly ISO 12812 cant achieve success without W3C and browser vendor support. W3C Web Payments needs to get very active with ISO 12812 if we are going to adopt it.

TecSec CKM7 runtime is a great security architecture wrapped with standards. It will give financial institutions and browser vendors a plug-n-play engineering solution to some very difficult problems.

CKM7 by no means restricts the world to a TecSec only solution. Its built from standards so other can try and implement the X9.69 & X9.73 backends to the CKM7 runtime. This will be a heck of a challenge but other companies can try. TecSec has over 25 years of experience in this field so lets leverage those standards and their experience to accomplish success.

IMO, its in W3C Web Payments interests to:
1) Adopt X9.69 and X9.73
2) Adopt CKM7 a browser standard implementation of X9.69 and X9.73. Add to WebCrypto charter.
3) Adopt ISO 20022
4) If we are going to adopt ISO 12812 then we need to get involved in its final drafts.
5) Write a W3C standard covering JavaScript payment API and adoption of the above

The above “W3C Web Payments Security & Messaging Standards Diagram” is a rough overview of the approach we came to consensus at the TecSec office. This approach has been provided to the Federal Reserve to see if this is compatible with the direction financial services is heading.

The “W3C Web Payments Mind Map” is a brainstorm of mine, a mind map, of how I see W3C fitting into the finance transactional space. Not just payments but any financial transaction conducted over a browser.

Comments are welcome.

Erik Anderson
Bloomberg R&D & W3C Web Payments Co-Chair

Web Payments IG Meeting in Utrecht – Getting My Feet Wet (and Moving)

Posted on February 19, 2015 by Ian Jacobs

I am new to W3C’s Web Payments Interest Group and also to the payments industry. So it was very exciting to meet the group at their recent face-to-face meeting in Utrecht (Netherlands), hosted by Rabobank.

I spent an afternoon in Amsterdam visiting friends before taking the train to Utrecht. I had difficulty paying for my train ticket with my US credit card. I don’t know enough about how payment networks work to understand what went wrong. But I hoped that by the next time I visit, we will have made it easier to make this sort of payment.

We met for three days just a few steps from the train station, in the Jaarbeurs Utrecht conference center. I enjoyed all three main parts of my stay: the work agenda, the relationship building, and the swing dancing.

I’ve written a summary of the work agenda. At a high level, the group is currently working on a set of Web Payments Use Cases that will define the initial scope of our work. These will include topics like initiating a payment from a Web site, choosing from among available payment instruments (e.g., credit cards, cryptocurrencies, coupons, paypal, etc.), and making a payment on a site without needing to register with the site.

At the same time as the group is developing these use cases, it is working on a glossary of terms that will be shared among the use cases. The group recognizes that a lot of work has been done for decades to create industry vocabularies, and so it wants to reuse existing standards as much as possible. At the same time, the group recognizes the need to speak to Web developers who may not be familiar with these terms.

One of the primary goals of the group is to reduce fraud, both online and in brick-and-mortar stores. Because there is so much work in this area (both inside and outside W3C), we launched a Security Task Force to enhance our liaisons with other groups. We are particularly interested in how to align payment industry needs with the extent same-origin security model for the Web.

At the same time as the group is elaborating a set of use cases, we have begun discussion about a “payment agent” architecture capable of addressing the use cases. We have been using the phrase “payment agent” rather than “digital wallet” for several reasons, including “digital wallet” being overloaded with meanings beyond payment, and for also to align with W3C’s term “user agent.” A payment agent will be capable of executing transactions on an entity’s behalf (such as a user or merchant). I believe the group’s goal is to define a payment agent architecture that is flexible enough to allow a large number of business models and payment schemes, while being specific enough to create real interoperability.

Here’s how I see it all coming together:

The Interest Group will create a stable set of use cases.
The group will propose a payment agent architecture and a specific set of requirements that would need to be met to be able to implement the architecture.
The group will evaluate existing technologies and then propose new work items (or changes) for standardization.

We still have a lot of technical work ahead, but it was very exciting to see people gathering around the white board talking about architecture. Pat Adler (US Federal Reserve Bank of Minneapolis) and I volunteered to create a Communications Strategy Task Force because we know that we will need to share news of our work with people in the payments industry as well as Web developers.

Possibly even more valuable than the discussions during the meeting were the great opportunities to get to know one another (and our diverse perspectives) at coffee breaks, at the white board after the meeting had adjourned, and during evening meals —Borobudur for Indonesian, and Mahanakorn for Thai. I am really glad to have spent my first three days in the group at a face-to-face meeting, and look forward to the next one in a few months.

I also mentioned swing dancing. I want to thank the friendly people from Swing in Utrecht who organize a weekly swing event at de Winkel van Sinkel. I was rusty but enjoyed dancing shortly before I left Utrecht.

Linking web identities with real-world identities

Posted on February 13, 2015 by Dave Raggett

The Web Payments Interest Group is seeking to reduce fraud for online payments. The challenges include finding ways to support use cases such as securely gaining access to your bank account from your web browser, and installing and activating payment instruments like credit cards into your digital wallet.

There was strong support at the September 2014 W3C workshop on Authentication, hardware tokens and beyond for W3C to extend the Open Web Platform to support strong authentication based upon public key pairs and second factors (e.g. a PIN, a biometric such as a finger print, or a hardware token, possibly a wearable like a smart watch or pendant), drawing upon work by external groups such as the GlobalPlatform, SmartCard Alliance, FIDO Alliance, and SIM Alliance. This would give web sites greater confidence that the user who just logged in is the same person who registered the account by making it much harder to spoof the user’s credentials. This doesn’t address the challenge of tying web identities to real world identities, something essential to the above use cases.

One approach would be for your bank to rely on the PIN it has issued you for your bank card. This is sent to your name and address as a computer generated paper letter that no one other than you gets to see, not even bank officials. This assumes that it is safe for you to type your debit card PIN into your device (e.g. a notebook computer, phone or tablet). The risk is that your device has been subjected to a malware hack that collects your keystrokes. This could be mitigated by the use of trusted UI based upon trusted execution environments. An alternative would be to send you a one time password.

Another approach is for the bank to rely on a trusted third party to vouch for your real world identity. One possibility would be a government issued credential, e.g. national identity card, passport or driving license. Another would be the SIM in your smart phone that is activated by a mobile network operator following a recognised process to verify your identity when setting up a phone contract with you.

You bank would need confirmation of your name and address, and possibly additional attributes. The starting point is when you go online to your bank’s website to gain access to your accounts. You will need to provide some information to allow the bank to link you to your accounts. The bank could then request your browser to set up a web identity using say the FIDO protocols. To verify your real-world identity, the bank would need to ask you to grant access to your government or phone credentials. This could be done in a way that maximises privacy.

Brainstorming some more, we can envisage an intent-based protocol where the bank makes a request setting out which parties it accepts for proving real world identity. Your web browser then asks you for your consent, and in the process enabling you to select between matching alternatives where available. The verification of your real world identity is based upon string comparison of attributes, e.g. your full name and postal address, but potentially others such as your date of birth and so forth. These could be passed by your bank as part of the request. The response could be a digitally signed certificate that the bank can validate. More generally, it could be a zero knowledge proof for simple expressions over attributes of your real world identity. I can also envisage the possibility where you can set up a new bank account online, where the bank requests the attributes of your real-world identity from the trusted third party, again subject to your explicit consent.

This process replaces the general need for pre-provisioned keys by an intent based mechanism for verifying real-world identities, along with the means for registering trusted agents with the browser. The latter isn’t critically dependent upon open standards, although the former is for it to be widely useful.

The bottom line is that W3C should consider chartering a work item on identity verification!

W3C Web Payments highlighted in the Banker magazine

Posted on January 9, 2015 by J. Alan Bird

Jeff Jaffe and Stephane Boyera published an article describing the role and objectives of the W3C Web Payments Initiative in the Banker magazine. The Banker is an English-language monthly international financial affairs publication owned by The Financial Times and edited in London. It is read most widely in banks, financial institutions, multilateral corporations, central banks and finance ministries around the world.

The article highlights the need for a coordinated action from all stakeholders in the payment chain, and the role of banks in particular, to address the challenges that electronic payments are facing today.
it details the rationale behind the launch of the activity at W3C and the expected outputs.

W3C has republished this article courtesy of The Banker.

W3C Web Payments Presented at US Federal Reserve Retail Payments Risk Forum

Posted on December 3, 2014 by David Ezell

In November, the Retail Payments Risk Forum had a meeting in Atlanta, Georgia. This meeting was hosted by the US Federal Reserve Bank, and the W3C Web Payments IG was invited to describe ongoing work for bringing payments to the web. The participants are all well established in greater the payments community.

The Web Payments Activity was represented at the meeting by David Ezell (co-chair of the IG). His introduction highlighted results of the first face-to-face meeting of the IG, held in Santa Clara in October.

See the agenda document for more details on the meeting, as well as the presentation given on behalf of the IG .

Continue reading →

Summary of Web Payments first Face-to-Face

Posted on November 12, 2014 by J. Alan Bird

On October 27 and 28, the W3C Web Payments IG ran its first face to face meeting, as part of TPAC.

The agenda was split in various sections. The first day was dedicated to reviewing various specifications from ISO, X9 and a few other standardization bodies. We also reviewed existing work at W3C, on the Recommendation Track (Web Crypto WG, NFC WG, Sysapp WG), in Community Groups (Web Payments CG, Credential CG) and future work in areas like trust and permissions (see the recent workshop on this topic). Continue reading →

Get Involved in the Web Payments Interest Group

Posted on October 15, 2014 by J. Alan Bird

Here’s how to get involved in the Web Payments Interest Group!

Chairs: Erik Anderson (Bloomberg) and David Ezell (NACS)
W3C Staff Contact: Stephane Boyera <boyera@w3.org>
List of Participating W3C Members
List of individual representatives (W3C Member-only)

We Want Diverse Participation

The Web Payments Interest Group encourages active participation from a diverse community. You should consider participating in this Interest Group, in particular if you are in one of the following communities:

Banks & Card networks
Payment System providers
Transaction processors
Payment Industry Standardization bodies
Payment industry companies (POS providers, secure element providers,
etc.)
Payment Regulators
E-commerce companies & Web & physical Merchants
Browser Vendors
Digital Wallet Providers
Telecom operators
Mobile Service Provider

How to Join

If you’re affiliated with a W3C Member organization:

(If you don’t have any W3C Member account) Use the W3C Member account request form and get a W3C account,
(If your organization has not yet joined the group) Ask your AC Representative (Member-only) to join the group using the join form,
And then ask your AC Representative (Member-only) to nominate you using the nomination form.

When you have joined the group, you will also be automatically subscribed to the group’s Member-only mailing list. See the Instructions for joining the Web Payments Interest Group for the details of the participation procedure.

If you do not work for a W3C Member organization, please first consider whether your employer can join W3C and get the benefits of Membership.

If that is not an option and you think that you have the expertise and availability to participate, please contact Stephane Boyera.