Feeds

SQUEEEEE! Microsoft goes retro with pay-by-squawk NFC tech

Slow acoustic data transfer could work with any mobe

Security for virtualized datacentres

Researchers at Microsoft Research India have proposed a new form of near-field communication (NFC) for mobile phones, one that even works on devices that lack any kind of specialized NFC hardware.

The technique is a modern throwback to the earliest days of computer communications, and a big clue to how it works can be found in the name the boffins gave it: Dhwani, a Hindi word that translates roughly to "sound."

"A key advantage of Dhwani over conventional NFC is that it is a purely software-based solution, that can run on legacy phones, including feature phones, so long as they have a speaker and a microphone," Microsoft researchers Rajalakshmi Nandakumar, Krishna Kant Chintalapudi, Venkata N. Padmanabhan, and Ramarathnam Venkatesan write in their joint paper.

In essence, Dhwani works like the analog modems of old, using an acoustic software-defined radio to translate data into sound, which then can be picked up and decoded by a receiver.

The researchers say their current implementation can handle data rates of up to 2.4Kbps, roughly comparable to the top speed of a Hayes Smartmodem in the late 1980s. In other words, you wouldn't want to use it to swap MP3s – an 8MB file would take about 7.5 hours – but it should be fast enough for most typical NFC transactions.

In fact, such data rates are actually quite a feat when you consider that the sender and receiver aren't even connected over a hard line, the way the old 2400bps modems were. By comparison, the really old modems that used acoustic couplers never got over 1200bps.

Photo of a vintage analog modem with an acoustic coupler

The good old days of using sound to transmit data could be here again

Because NFC is used for mobile payments, however – that's the Holy Grail, anyway, no matter what else it gets used for – the researchers had to bake in a sophisticated security model to ensure that Dhwani communications can't be snooped by a nearby eavesdropping device.

Your humble Reg hack lacks the telecom engineering background to do proper justice to the Dhwani security technique, dubbed JamSecure by its inventors. But in a nutshell, it works by having the receiving device transmit pseudorandom noise that jams the sender's transmission, preventing an eavesdropper from picking it up. The receiver then takes that noise signal, known only to it, and performs self-interference cancellation to recover the original transmission and decode the data.

To add an additional layer of protection, Dhwani packets are scrambled using AES encryption, to prevent an eavesdropper from picking up even a partial message from a signal that has been insufficiently jammed.

So is it secure? As the researchers note, these measures should be enough to render man-in-the-middle attacks on Dhwani ineffective. But it could still be vulnerable to denial-of-service attacks (blasting a bunch of white noise), or to attacks that either disable the receiver's jamming signal or boost the sender's signal so that its strength exceeds the jamming. So: not perfect, but pretty darn secure.

One point the boffins don't discuss, however, is just how much processing power might be needed to do all of the necessary calculations in real time. They did their tests using a Samsung Galaxy S2, an HTC Sapphire, and an HP Mini notebook. It's not clear whether the typical feature phone sold today – and around 85 per cent of all phones sold in India are feature phones – would be able to support Dhwani.

But phones are only half of the mobile-payments equation. For stores to accept payment-by-bonk, they must be set up to use NFC, too – and as the paper's authors point out, most aren't.

"The prevalence of NFC-enabled point-of-sale (POS) terminals is also low – under 5% today and expected to rise to only about 49% globally by 2017," the Microsoft techs write. "Even disregarding the optimism that usually colours such forecasts, it seems likely that the majority of phones and POS terminals globally will not be NFC-enabled even 3-4 years from now."

Given NFC's slow adoption rate, it seems feasible that pay-by-bonk could be replaced by pay-by-squawk in the short term, particularly in developing markets. But even in advanced markets such as the US and the UK, where NFC-enabled phones are becoming more common, NFC-based mobile payment systems have yet to catch on in a big way. The question is: will Dhwani fare any better? ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Let it go, Steve: Ballmer bans iPads from his LA Clippers b-ball team
Can you imagine the scene? 'Hey guys, it's your new owner – WTF is that on your desk?'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
iPAD-FONDLING fanboi sparks SECURITY ALERT at Sydney airport
Breaches screening rules cos Apple SCREEN ROOLZ, ok?
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
The British Museum plonks digital bricks on world of Minecraft
Institution confirms it's cool with joining the blocky universe
Turn OFF your phone or WE'LL ALL DI... live? Europe OKs mobes, tabs non-stop on flights
Airlines given green light to allow gate-to-gate jibber-jabber
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.