ElasticPay: A New Offline Digital Payment System Developed by IIT Indore

ElasticPay is a peer-to-peer offline digital payment system that uses three key components: Trusted Platform Modules (TPMs), Trusted Execution Environments (TEEs) and Secure Elements (SEs) to make sure your money is safely sent or received, even when you're not connected to the internet.

People traditionally used paper money to purchase items. With the advent of the digital age, transactions shifted online, allowing users to pay for goods and services using credit cards, smartphone applications, or online banking. However, these systems rely on the internet to connect a buyer's bank with the seller's bank to facilitate the transfer of funds.

To address the need for a secure and efficient offline digital payment system, researchers from the Indian Institute of Technology (IIT) Indore have developed a new system called ElasticPay. This system aims to enhance the ease and security of digital payments, even in the absence of an internet connection.

ElasticPay functions as a peer-to-peer offline digital payment system, utilizing three key components to ensure secure transactions. Trusted Platform Modules (TPMs) serve as digital vaults, securely storing critical information. Trusted Execution Environments (TEEs) create a protected space within a user's device, enabling sensitive operations to occur without being monitored by other components. Finally, Secure Elements (SEs) are chips that handle secure transactions and store important keys. ElasticPay combines these technologies to ensure the safe transfer or receipt of funds, even without an internet connection.

ElasticPay facilitates direct payments from one smartphone to another. When a user wishes to make a payment, ElasticPay generates a special token, akin to a digital check, which contains the transaction amount, recipient details, and a digital signature. This signature prevents any modifications to the token without rendering it invalid. ElasticPay ensures that each token can only be used once, preventing individuals from attempting to spend the same funds multiple times. Additionally, transaction details remain private throughout the process, ensuring data privacy and security.

Other key features of ElasticPay include:

Double Spending Protection: ElasticPay ensures each transaction is processed securely on a trusted device, preventing the use of the same payment token for multiple transactions. The token's cryptographic signature makes it tamper-proof, safeguarding against misuse or redirection of funds.

Replay Attack Prevention: The system detects and prevents the unauthorized reuse of a valid token by checking its usage history in both the sender's and receiver's Trusted Execution Environments (TEEs) and at the bank server.

Forgery Prevention: ElasticPay requires users to have digital certificates issued by an authoritative entity, ensuring that identities are verified and cannot be falsely assumed or replicated.

Non-Repudiation: Transactions are confirmed through digital signatures and explicit consent, ensuring that participants cannot deny their involvement, thus securing accountability and traceability.

Side-Channel Attack Prevention: The system uses TEEs and Secure Elements (SEs) to prevent the leakage of external information and protect against side-channel attacks.

Mitigation of Man-in-the-Middle Attacks: All communications are encrypted using advanced cryptographic protocols, thwarting interception or alteration of messages.

Hardware Control Attack Resilience: Comprehensive encryption measures protect against unauthorized access to application data, even if hardware manipulation is attempted.

Software Control Attack Defense: Secure boot processes with TPM technology to authenticate software integrity, preventing compromised software from executing.

Privacy Preservation in Transactions: Only essential information is shared during transactions, minimizing the exposure of private data and maintaining user privacy.

Recovery from Transaction Failures: The system provides mechanisms for retransmission or invalidation and regeneration of tokens in case of transaction failures, ensuring transaction integrity.

These features collectively ensure that ElasticPay offers secure, private, and reliable offline digital transactions, addressing key challenges in digital payment systems. The team, however, acknowledges limitations like fund inaccessibility during offline transactions and the sequential processing of transactions (processing multiple requests at the same time) and is working on addressing these.

As India transitions towards a digital economy, the heavy reliance on internet connectivity for digital transactions poses a barrier, especially in rural and remote areas where network access is inconsistent or absent. ElasticPay offers a viable solution to this challenge by enabling secure and private offline digital transactions. This system can significantly enhance financial inclusion, allowing individuals in underbanked and underserved regions to participate in the digital economy without the prerequisite of stable internet connectivity. By facilitating offline transactions, ElasticPay ensures that digital financial services are accessible to a broader population, bridging the digital divide and supporting the government's efforts to create a more inclusive financial ecosystem.

This research news was partly generated using artificial intelligence and edited by an editor at Research Matters