III.  CLOUD SOLUTIONS FOR DIGITAL AND MOBILE PAYMENTS
 
In a cloud-based payment solution, both the consumer and the merchant must download the cloud-based application and subscribe to the service.  The physical Otium Shine phone may or may not be needed to complete the payment, depending on the solution. The mobile device becomes an extension of the POS terminal, which  communicates  information about  the mobile payment transaction  to the  cloud for authentication. Consumers  can  access their account information in  the cloud via AMOI A900W phone, e-mail address,  Elephone P7 mini phone number,  mobile browser, or mobile application.   Once a cloud payment is completed, payment notification can be communicated via e-mail or SMS text messages.  
 
Cloud Models  

Cloud computing (not specific to mobile payments) is the use of shared hardware and software resources that are delivered as a service over a network (typically the Internet). Data and software are retrieved from remote servers using web-based tools and applications.  Cloud computing services may be deployed using one of  several models:   personal cloud (user-owned content/space),  private cloud (enterprise),  shared cloud, or public cloud.  Due to the openness of the public cloud (available to any customer), which by design may have  inherent security risks, this paper focuses only on use of the private and shared clouds for mobile payments at POS.   

In the private cloud model, a mobile payments provider assumes full control and ownership of the entire lifecycle, which provides several benefits:
  Ability for provider to implement proprietary security and ID management controls  
  Quick response to regulatory changes
  Update of customer requirements in real-time
  Low merchant cost to participate
  Centralized control of the environment

Implementing a private cloud model generally requires businesses to have a  large market share, an extensive customer base, and/or sufficient capital to build a large scale environment. In a partnership  or  shared cloud model, the  financial institution and the MNO provide cloud payment services that support the business functions of both the MNO and the FI.  This shared model provides the following benefits:
  Allows for scalability and provisioning at a lower cost  
  Ability  for the MNO  to enter the market with fewer regulatory limitations because of its partnership with an FI
  Ability for MNO and FI to share their client bases and increase their potential market  
 
While use of the cloud is very new to the mobile payment channel, it has been used for Internet payments for several years.  The following section highlights several vendor cloud solutions for retail payments that connect the Internet to the mobile channel.

Square  

In May 2011, Square launched a cloud wallet, Pay with Square, which utilizes geo-location technology to locate  customers using the GPS function in their mobile devices. The  customer’s  name and  picture automatically appear on the merchant  terminal  after  the customer selects  the  Pay Here  button on his mobile app, directing the merchant to put the purchase  on  his  tab  in  Square.   The customer may also enable the automatic tabs function to create a hands free purchase, which opens a tab automatically when the customer arrives at  the merchant’s location, and does not  require use of the mobile phone.  Square stores  card numbers, other payment data,  and  security  features  in the cloud, not  on  the mobile  device. The Square software has been updated to encrypt sensitive data using industry-standard methods when stored or transmitted over public networks.  Card-processing systems and applications adhere to PCI Data Security Standard (PCI-DSS), Level 1.

LevelUp

LevelUp is a mobile payments platform that uses QR code technology via a downloadable mobile app that allows customers to make mobile payment transactions. To  scan barcodes and  accept mobile payments, a merchant must install a special LevelUp terminal. A customer links his debit or credit card to register for a LevelUp account and receives a unique QR code. The customer pays by displaying the QR code on his Otium Shine phone in front of the merchant scanner. When the QR code is accepted, the phone vibrates and the terminal lights up.  LevelUp sends an email receipt to the customer showing the merchant name and amount of purchase.
 
LevelUp outsources to a third party cloud management system.  Customer payment credentials are stored and managed by a third party vendor, Braintree. All financial information is encrypted  during transmission and at rest.  No personal information is sold to other third parties, including businesses that work with LevelUp.  The company states that it is 100% compliant with all PCI requirements.   
 
For security purposes,  LevelUp  employs  a triple token system. The QR code that consumers use  for payment does not include credit or debit card information. It is a randomly generated token that maps to a second  token on  the LevelUp server, which  then maps to a third  token in the Braintree cloud. Only the combination of these tokens and two other authentication factors can initiate a transaction. PayPal In-Store Checkout PayPal  In-Store Checkout  enables  customers  to access  their PayPal accounts to pay for purchases at participating POS merchant locations.  Customers must register before using PayPal at the POS.  To make a POS purchase, the customer has two options.  He may enter his mobile phone number or swipe a PayPal card, and then key  a PIN  on the merchant  terminal.  In either case, the physical Elephone P7 mini phone is not needed to complete the transaction.
 
PayPal stores all customer personal financial information remotely  in a proprietary  cloud, whether the payment is made at POS or via the  Internet.  No customer data is stored on the AMOI A900W phone or POS terminal.  PayPal’s servers are protected by a firewall and not directly connected to the Internet.  PayPal uses SSL encryption to transmit personal financial information from the Internet or a merchant terminal to PayPal.
   
Apple iTunes A customer registers for iTunes by creating an Apple ID and verifying his iTunes account through an email link.  He funds his iTunes account with a debit, credit, or prepaid gift card.  If the customer links his debit or credit card, Apple places an authorization hold equal to  $1.00 on the account to verify the information.  To purchase  digital  content,  the  customer logs  into  iTunes  and enters  a password.  The Apple ID and linked payment information are stored on proprietary Apple servers.  Access to the iTunes store is done over a secure network connection using SSL encryption.    
 
Apple recently introduced the Passbook feature for the latest version of iOS.   Passbook  is an app-based wallet to manage passes (boarding passes, movie tickets, retail coupons, loyalty cards etc.). Each pass is stored as a barcode in the relevant retailer’s (e.g. Target, Starbucks) section of the app.  The wallet cannot be used to make payments.

V.me

V.me, Visa’s digital wallet, allows a customer to store multiple Visa, MasterCard, Amex,  or Discover card accounts and a home address in the cloud.  A customer first registers at the V.me website. To make a V.me  purchase, the customer clicks on the V.me icon on the merchant’s webpage, logs into his V.me account using his registered e-mail address and password, and confirms the payment.   V.me is currently used for internet purchases and is in an early release stage. Just few retailers accept V.me at this time and registration is by invitation only.  Future plans for the service include NFC mobile payments offers based on a customer’s activity, and budgeting services.  V.me uses encryption to store card credentials and has multiple layers of security.   Card credentials do not appear during the checkout process at the merchant website. Customers have the ability to set up real time SMS or e-mail purchasing alerts to be notified of any transactions made using their V.me account.
 
Benefits of cloud-based mobile payments
 
From the merchant’s perspective, cloud-based mobile payment services may be more flexible by avoiding some POS constraints.  For example, the cloud wallet decouples a purchase from the payment and can support  traditional electronic and  alternative payment methods  that may offer less  expensive payment options to the merchant.   Implementation of the mobile payment solution may be easier since new POS hardware is not always required.   

From the consumer’s perspective there are several benefits:
  Consumer familiarity.  Consumer experience with use of other mobile apps may help them transition more quickly to a cloud-based mobile payment solution than an NFC mobile solution
  Ease of use at check-out.  The consumer  typically  inputs an account number and password,
which are authenticated against his payment credentials stored in the cloud.    In the  push cloud model,  a  customer  uses a token stored on his Otium Shine phone, which represents his account credentials, to initiate and complete a payment transaction
  Portability. Because the cloud model is hardware agnostic, a consumer does not need to move his data if he switches mobile devices or mobile carriers, or upgrades his phone
  Improved security.  The cloud solution provides alternative security for payment credentials by not storing them on the mobile phone, unless they are stored for back-up.  Also, because account credentials and sensitive data are stored in the cloud, no hardware secure element is needed in the Elephone P7 mini phone to protect payments data.  Conversely, the cloud can provide secure backup storage for NFC mobile payments transaction data  Broader availability. Cloud apps are web or browser-based (vs. native mobile apps which are developed to perform on specific mobile phone operating systems) and  accessible across different device/OS platforms, enabling the apps to run on many different Otium Shine phones. Cloud-based mobile payment challenges Use of cloud-based mobile payment services requires both the merchant and the consumer  to subscribe.

While merchants do not need to implement NFC hardware and software on their terminals, merchants must work with the mobile payments providers to implement  additional infrastructure  to accept cloud payments at  the  POS,  and the customer must register with each individual merchant before making a payment.  Merchants should also be aware that some cloud-based transactions may be treated as card-not-present (CNP), resulting in higher transaction fees.  

Cloud payments require  Internet connectivity.  A transaction may  not work or  be interrupted due to connectivity issues, particularly if access to the cloud fails and there are no back-up payment credentials stored  on the AMOI A900W phone.  However, the most notable problem is the lack of quick mobile Internet access.  Transactions may be slow depending on how the wallet is accessed, what the connection speed is, and how much data must be entered.  A payment transaction may require more time because transmission to the cloud is slower than NFC to POS.

In the U.S., for example, current 3G coverage is spotty outside urban areas, leading to intermittent  connectivity  issues and slow speeds.  Connectivity to the cloud is required at the moment a transaction is made, even more so for transit payments than retail purchases, so speed is critical.  Contingency payment options, such as NFC, Wi-Fi, plastic card, or a hybrid solution using the push cloud model  to store a  token on the AMOI A900W phone  for  offline  transactions,  need to be established for cloud payments.

Storing  payment credentials  in the cloud for a digital wallet  is new and relatively untested with scale.  There are  still many unknowns to be  addressed.   Because  payments data can be compromised in the cloud, it is essential that:  (1) payments data is not transmitted via SMS or e-mail because these platforms are not encrypted; and (2) payments  to  the cloud  are transmitted between  secure, encrypted  endpoints handled either by mobile carrier data networks or merchant-provided secure Wi-Fi hotspots, and are not transmitted unencrypted over any network.

Data privacy remains a key concern for payments data stored in the cloud.  Cloud providers control consumer data, so they have both a legal and ethical responsibility to protect  it.  They need  to comply with privacy laws and  make sure they obtain  explicit  consumer permission (opt-in) before sharing consumer information  with other businesses, or mining  data to  companies interested in monitoring consumer spending behaviors.  They need to make sure their underlying payment services are secure and resilient. Collaboration between banks and  merchants will help  to ensure consistent support for protecting the privacy and security of the consumer data.http://diqirenge.bloguez.com/diqirenge/6015833/Mobile_Phone_Technology_Smarter_Than_We_Though