Junctions. Friends can also take advantage of NFC to have
their phones interact in peer-to-peer multi-party applications.
For example, people may want to play a peer-to-peer game,
share their playlists, or exchange photos. It is simple and
direct if we can just launch an application, touch our phone
with our friends, and have their phone automatically run the
same application (after user confirmation). To facilitate this
class of applications, we propose the notion of a Junction
URI, which provides the context necessary for a device to join
a peer-to-peer application in progress. Because phones do not
have static IP addresses, a Junction URI specifies a (secure)
channel, consisting of the chat session on a rendezvous server
and an ID for the session. From the Junction URI, a device
can also find out where the application can be downloaded.
1.3 Contributions
This paper describes and analyzes a large number of novel applications
made possible by integrating NFC into the smart
phone. We classify these applications into three categories
depending on the kind of contextual application invocations
(CAI) used: attachments to transactions, virtual tokens for
replacing physical real-world tokens, and junctions for connecting
arbitrary peer-to-peer applications on mobile devices.
We have created a Junction programming platform and have
created prototypes of a large class of multi-party applications
on the platform including profile exchanges, games, and collaborative
playlists.
Contextual application invocations can potentially be dangerous
too; we need to prevent malware from triggering unwanted
applications and actions on our phone through NFC.
This paper discussed security measures to protect against security
attacks on various CAI methods, including a use of
NFC itself to protect the loss of our phones.
The organization of the rest of the paper is as follows. Sections
2 to 4 describe the three kinds of CAI: transaction attachments,
peer-generated virtual tokens, and the Junction
platform. Section 5 describes how we secure the phone using
NFC itself. Section 6 discusses related work and Section 7
concludes.
2. TRANSACTION ATTACHMENTS
NFC was designed to interoperate with existing deployments
of near-field radio technologies, including contactless payments
and access to public transit systems. Moving these
transactions to the phone may help reduce the number of
things a person carries, but there are other more significant
benefits.
We can improve the usability of ticketing for a public transit
system by using the phone as our pass. The connectivity
on the phone allows us to purchase the pass from anywhere,
without waiting in line at a kiosk. We can also see how
many rides we have available or how much credit is left in
our account from anywhere. All the while, we can still swipe
into the transit system quickly and also verify our ticket to a
conductor onboard. [7]
We can improve the security of credit card transactions by
moving the contactless payment to an active, programmable
device by supporting one-time use credit cards. One-time use
credit cards are tremendously useful for reducing credit card
fraud—instead of giving a merchant our credit card numbers,
we can request our bank to give us credit card numbers that
can be used only once. So far the cumbersome procedures
required to get single-use cards have limited adoption. With
NFC on a phone, users can run an application that stores
one-time credit card numbers securely and easily, and the
application can present these one-time numbers to merchants,
on behalf of the user. Users don’t have to know about the
added layer of security, using their phone to make payments
as they would a contactless card. The phone may negotiate
several one-time use numbers in advance so that payments
can be made with the phone offline.
With these applications moved to the phone, we can further
enhance the mobile experience by leveraging the contextual
information gleaned from them. We first describe several such
applications, then discuss the security considerations for NFC
transactions.
2.1 Applications
Receipts, reimbursements, and money management.
As an add-on to contactless payments, we imagine the transaction
results in a receipt being sent to the user’s phone.
The receipt may be transmitted as part of an enhanced standard
for contactless payments, or may occur as an additional
transaction during the same NFC scan. The phone keeps a
local database of transactions and receipt objects, and allows
programmatic access to them (with appropriate security restrictions).
This will enable, for example, an application for
managing receipts.
Another application can help file reimbursement claims. After
a business trip, a user could select purchases from a list
of gathered receipts over some span of time. With a few
clicks, she can email this list to file a reimbursement claim.
The receipt data is stored privately on the phone, and is only
released at the user’s discretion.
In Situ check-ins. Check-in services such as foursquare and
Facebook Places have grown in popularity. If a user makes a
payment at a restaurant, for example, the phone can receive
details about that user’s whereabouts. If a user labels an
establishment as a “favorite,” the check-in may occur automatically,
or an application can make the check-in available
with the press of a button. Using NFC for contextual awareness
is a much lower-power solution than using GPS and is
also more accurate. We also imagine dedicated NFC tags
that a business may put out explicitly for making check-ins
easy.
Reviews. Our phones will be able to determine the products
we buy, the restaurants we visit, and the movies we see.
The data can be kept privately, and applications can request
permission to view different classes of data. If the user has a
movie application installed, it may request access to movierelated
events from the user’s activity stream. This allows
the user to plug into any of her favorite sites.
Sporting events. We can use our NFC-enabled smart
phones as a ticket for entry into sporting events. After scanning
in, the phone launches an application associated with
the event. It is loaded knowing the user’s seat, and can be
used to order concessions for delivery. Payment can occur
through the application as well for a smoother user experience.
The application can also better connect the user to the