OverviewOverview nWhat is M-Commerce? nSecurity Issues nUsability Issues nHeterogeneity Issues nBusiness Model Issues nCase Studies / Examples
What is M-Commerce?What is M-Commerce? nE-Commerce with mobile devices (PDAs, Cell Phones, Pagers, etc.) nDifferent than E-Commerce? nNo, but additional challenges: nSecurity nUsability nHeterogeneous Technologies nBusiness Model Issues nBut first, let’s learn a little about wireless technologies…
Wireless TechnologiesWireless Technologies nLink Layer (examples…) nWAN: Analog / AMPS CDPD: Cellular Digital Packet Data TDMA/GSM: Time Division Multiple Access, Global System for Mobile Communications (Europe) CDMA: Code Division Multiple Access Mobitex (TDMA-based) nLAN: 802.11 Bluetooth nDevices: Cell Phones, Palm, WinCE, Symbian, Blackberry, …
Example: WAPExample: WAP nWAP: Wireless Application Protocol nCreated by WAP Forum nFounded June 1997 by Ericsson, Motorola, Nokia, Phone.com n500+ member companies nGoal: Bring Internet content to wireless devices nWTLS: Wireless Transport Layer Security
Security ChallengesSecurity Challenges nLess processing power on devices nSlow Modular exponentiation and Primality Checking (i.e., RSA) nCrypto operations drain batteries (CPU intensive!) nLess memory (keys, certs, etc. require storage) nFew devices have crypto accelerators, or support for biometric authentication nNo tamper resistance (memory can be tampered with, no secure storage) nPrimitive operating systems w/ no support for access control (Palm OS)
Example: Security ConcernsExample: Security Concerns nPerformance: we’ll do an example: should we use RSA or ECC for WTLS mutual auth? nControl: WAP Gap data in the clear at gateway while re-encryption takes place
Slide125WTLS Handshake Timings (Palm VII) •Mutual-Authentication: ECC The cryptographic execution time for mutually-authenticated 163-bit ECC handshakes is at least 8.64 times as fast as the cryptographic execution time for mutually-authenticated 1024-bit RSA handshakes on the Palm VII. Operation Cryptographic Primitive(s) Time Required (ms) Server Certificate Verification CA Public Key Expansion 254.8 ECC-DSA Signature Verification 1254 Session Key Establishment Server Public Key Expansion 254.8 Key Agreement 335.6 Client Authentication ECC-DSA Signature Generation 514.8 TOTAL 2614
WAP Gap: One Alternative…WAP Gap: One Alternative… nDynamic Gateway Connection nOther alternatives also exist… Internet WAP Gateway WTLS Class 2 SSL Operator Web Server SSL Content Provider WAP Gateway
Usability ChallengesUsability Challenges nHard Data Entry nPoor Handwriting Recognition nNumeric Keypads for text entry is error-prone nPoor Voice Recognition nFurther complicates security (entering passwords / speaking pass-phrases is hard!) nSmall Screens ni.e., can’t show users everything in “shopping cart” at once! nVoice Output time consuming
Usability ApproachesUsability Approaches nGraffiti (Scaled-down handwriting recognition, Palm devices) nT9 Text Input (Word completion, most cell phones) nFull alphanumeric keypad & scrollbar (Blackberry) nRestricted VoiceXML grammars for better voice recognition nCareful task-based Graphical User Interface & Dialog Design nLots of room for improvement!
Heterogeneity ChallengesHeterogeneity Challenges nMany link layer protocols (different security available in each) nMany application layer standards nBusinesses need to write to one or more standards or hire a company to help them! nMany device types: nMany operating systems (Palm OS, Win CE, Symbian, Epoch, …) nWide variation in capabilities
Business Models IssuesBusiness Models Issues nPossible Models: nSlotting fees nWireless advertising (text) nPay per application downloaded nPay per page downloaded nFlat-fees for service & applications nRevenue share on transactions nTrust issues between banks, carriers, and portals nLack of content / services
Case StudiesCase Studies nNTT DoCoMo’s I-Mode nPalm.net nSprint PCS Wireless Web
NTT DoCoMo I-ModeNTT DoCoMo I-Mode n20 million users in Japan nHTML-based microbrowser (supports HTTPS/SSL) on CDMA-based network n10’s of thousands of content sites, ring tones, and screen savers nPay per application downloaded and pay per page models nInvested in AT&T Wireless so we may see it here in US in next few years!
Palm.NetPalm.Net nLow 100K users in USA nWeb Clipping (specialized HTML) microbrowser on Mobitex (TDMA) – based network run by BellSouth (>98% coverage in urban areas) n100’s of content sites (typically no charge for applications) nPalm VII devices now selling for $100 due to user adoption problems. (Service plans range from $10 - $40 per month.)
Sprint PCS Wireless WebSprint PCS Wireless Web nLow, single-digit millions of US users nMulti-device strategy: WAP/HDML based microbrowser on phones, Web Clipping on Kyocera, both on CDMA network n~50 content sites slotted, many others available (very hard to enter URLs, though) nSlotting-fee + rev-share on xactions model n$10 per month flat-fee to users, most phones already have microbrowser installed.