Existing schemes in the realm of mobile healthcare (also, e-Healthcare) based on cloud and IoMT (Internet of Medical Things) do not ensure end-to-end security and are not compliant with HIPAA (Health Insurance Portability and Accountability Act). It is also very difficult often for these schemes to obtain evidence from the cloud in case of security breaches. In addition to these issues, mobile healthcare applications are prone to various types of attacks and formal proof is often unavailable. In this work, we propose our community cloud framework in an IoMT setting that ensures end-to-end security and circumvents many of the existing negative aspects using the Trusted Platform Module (TPM). We provide necessary proofs using BAN logic and Scyther tool. Also, we show that the energy consumption and the costs of communication and computation for our proposed protocol are far less than that of the existing protocols. We have implemented our protocol using Kotlin language in Android Studio ensuring all the required security properties.

The unprecedented growth of mobile applications promoted the usage of these mobile applications for payments. The current research works in mobile payments and commerce are prone to reverse-engineering attacks and lacked transport layer protection, so these research works do not ensure security. Therefore, such attacks on Mobile Payment Applications (MPA) will be successful, which leads to severe financial loss. To address these issues, we propose a secure framework incorporating a defense-in-depth approach for Near Field Communication (NFC) based mobile payment frameworks. Our defense-in-depth approach has three levels, i.e., Defense at hardware, mobile application, and communication level. We have proposed a NFC based Secure Protocol for Mobile Transaction (NSPMT) protocol and successfully verified a mobile payment protocol with BAN (Burrows, Abadi, and Needham) logic and Scyther tool, and our proposed protocol overcome multi-protocol attack, RAM (Random Access Memory) scrapping attack, DOS (Denial Of Service), DDOS (Distributed Denial Of Service), and Phlashing attacks. Our proposed mobile Payment system overcomes the known mobile application vulnerabilities, including Heartbleed and ROBOT (Return Of Bleichenbacher’s Oracle Threat). Our proposed protocol ensures all the security properties and the energy and communication cost and computational cost are far less than the existing works in the literature. Finally, we have successfully implemented our protocol using kotlin language in Android Studio, with two Mobile Payment Applications (MPA) and POS Payment Application (PPA), Elliptic Curve Digital Signature Algorithm (ECDSA) is used and Advanced Encryption Standard (AES) with GCM (Galois/Counter Mode) mode is used for encryption and decryption of Customer Payment Data at MPA and PPA.

Telecare Medical Information Systems(TMIS) is a highly focused and unique domain providing healthcare services remotely, the development and advancement in the realm of information and communication technologies boosted the development of TMIS. Smartphones, IoT devices, Mobile Healthcare Applications (MHA) and hospital servers are the building blocks of TMIS. Emergen Research predicts that IoT based healthcare security market will reach USD 5.52 Billion in 2028. Existing IoT based healthcare solutions are facing many security problems which includes information leakage, false authentication, key loss and are not in compliance with Health Insurance Portability and Accountability Act (HIPAA) regulations as IoT devices and sensors used are prone to Blue Borne, DoS (Denial of Service), DDoS (Distributed Denial of Service) and Reverse-engineering attacks. In addition to these healthcare applications in the IoT devices/sensors and mobile healthcare applications in the smart phone of the patient are vulnerable to repackaging attacks and lacked transport layer protection. This paper proposes a SRSTMIS (Secure and Resilient Scheme for Telecare Medical Information Systems) containing its architecture, a procedure to verify the safety and security of patients credentials and Mobile Healthcare Applications (MHA) and finally proposed a secure protocol. White-Box Cryptography (WBC) ensures the safety and security of the keys in the healthcare applications and in the SE, UICC and TPM. We have threat modeled our proposed healthcare framework using STRIDE approach and successfully verified using Microsoft Threat Modeling tool 2016. Our proposed secure and lightweight authentication scheme has been successfully verified with BAN (Burrows, Abadi, and Needham) logic and Scyther tool, and our proposed protocol overcome DoS (Denial of Service), multi-protocol attack, Blue Borne attack, DDoS (Distributed Denial of Service) attack, reverse engineering, insider, outsider and Phlashing attacks. SRSTMIS overcomes information leakage from sensors during rest and during transit, key loss from healthcare applications of the sensors and smart phone and false authentication and ensures HIPAA regulations. Proposed protocol was successfully implemented in Android Studio. We have compared our proposed work with the existing works and found to better in terms of security, resisting attacks, and in consumption of resources.

In this paper, we propose a secure NFC mobile payment protocol based on biometrics (SNMPBs) using wireless public key infrastructure (WPKI) and universal integrated circuit card (UICC). Electronic signatures generated in this protocol are considered qualified signatures as they are generated in UICC which is tamper resistant device. A procedure for the personalisation of mobile payment application (on the UICC) (by the issuer/bank) is proposed. Our SNMPB resolves disputes efficiently among stakeholders by collecting evidence using transaction counters, transaction log, forensics mode and cryptographic audit log techniques. SNMPB ensures end-to-end security (i.e., from mobile payments application in UICC to the bank server) thereby achieving confidentiality, authentication, integrity and non-repudiation properties, prevents double spending and over spending. Our proposed SNMPB protocol withstands replay, man in the middle (MITM), impersonation and multi-protocol attacks as SNMPB is formally verified successfully using BAN logic and Scyther tool.

In this paper, we propose a new payment instrument, i.e., mobile traveller's check (MTC) in the realm of mobile commerce. This payment instrument provides the merits of both e-cash and e-check, i.e., MTC can be used freely as an e-cash and it is as secure as an e-check. We present the mobile payment protocol based on MTC which uses elliptic curve digital signature algorithm (ECDSA) for generating and verifying digital signatures and DES for encrypting and decrypting the messages which are suitable for resource constrained devices like mobile phones. We use 'extended BAN' logic (Abadi et al., 1993) to provide a concise and clear understanding of this secure payment instrument (MTC). We formalise and verify the interactions and trust relationships among engaging entities.

In this paper we propose a Secure Mobile Payment Framework based on Biometric (SMPB) using WPKI (Wireless Public Key Infrastructure) and UICC (Universal Integrated Circuit Card). Our proposed Biometric based Mobile Payment Framework (SMPB) is compared with recent works and found to be better in terms of ensuring end to end security (i.e. from Mobile Payments Application in UICC to the Bank Server). Our proposed mobile payment protocol originating from Mobile Payment Application (which is on UICC) to the Bank Server realizes Fair Exchange ensures Confidentiality, Authentication, Integrity and Non Repudiation, prevents double spending, over spending and money laundering, and withstands replay, Man in the Middle (MITM) and Impersonation attacks.