ElasticPay：由印度理工學院印多爾分校開發的新型離線數位支付系統

ElasticPay 是一種點對點離線數位支付系統，它使用三個關鍵組件：可信任平台模組(TPM)、可信任執行環境(TEE) 和安全元件(SE)，以確保您的資金安全發送或接收，即使在您沒有連接到網路。

People traditionally used paper money to purchase items. With the advent of the digital age, transactions shifted online, allowing users to pay for goods and services using credit cards, smartphone applications, or online banking. However, these systems rely on the internet to connect a buyer's bank with the seller's bank to facilitate the transfer of funds.

人們傳統上使用紙幣購買物品。隨著數位時代的到來，交易轉移到網路上，用戶可以使用信用卡、智慧型手機應用程式或網路銀行支付商品和服務費用。然而，這些系統依靠網路將買方銀行與賣方銀行連接起來以促進資金轉移。

To address the need for a secure and efficient offline digital payment system, researchers from the Indian Institute of Technology (IIT) Indore have developed a new system called ElasticPay. This system aims to enhance the ease and security of digital payments, even in the absence of an internet connection.

為了滿足對安全、高效的離線數位支付系統的需求，印度理工學院 (IIT) 印多爾的研究人員開發了一種名為 ElasticPay 的新系統。該系統旨在提高數位支付的便利性和安全性，即使在沒有網路連線的情況下也是如此。

ElasticPay functions as a peer-to-peer offline digital payment system, utilizing three key components to ensure secure transactions. Trusted Platform Modules (TPMs) serve as digital vaults, securely storing critical information. Trusted Execution Environments (TEEs) create a protected space within a user's device, enabling sensitive operations to occur without being monitored by other components. Finally, Secure Elements (SEs) are chips that handle secure transactions and store important keys. ElasticPay combines these technologies to ensure the safe transfer or receipt of funds, even without an internet connection.

ElasticPay 充當點對點離線數位支付系統，利用三個關鍵組件來確保安全交易。可信任平台模組 (TPM) 可作為數位保管庫，安全地儲存關鍵資訊。可信任執行環境 (TEE) 在使用者設備內創建一個受保護的空間，使敏感操作能夠在不受其他元件監控的情況下進行。最後，安全元件（SE）是處理安全交易和儲存重要金鑰的晶片。 ElasticPay 結合了這些技術，即使沒有網路連線也能確保資金的安全轉移或接收。

ElasticPay facilitates direct payments from one smartphone to another. When a user wishes to make a payment, ElasticPay generates a special token, akin to a digital check, which contains the transaction amount, recipient details, and a digital signature. This signature prevents any modifications to the token without rendering it invalid. ElasticPay ensures that each token can only be used once, preventing individuals from attempting to spend the same funds multiple times. Additionally, transaction details remain private throughout the process, ensuring data privacy and security.

ElasticPay 促進從一部智慧型手機到另一部智慧型手機的直接付款。當用戶希望付款時，ElasticPay 會產生一個特殊的令牌，類似於數位支票，其中包含交易金額、收件者詳細資料和數位簽名。此簽章可防止對令牌進行任何修改，而不會使其無效。 ElasticPay 確保每個代幣只能使用一次，從而防止個人嘗試多次使用相同的資金。此外，交易細節在整個過程中保持私密，確保資料隱私和安全。

Other key features of ElasticPay include:

ElasticPay 的其他主要功能包括：

Double Spending Protection: ElasticPay ensures each transaction is processed securely on a trusted device, preventing the use of the same payment token for multiple transactions. The token's cryptographic signature makes it tamper-proof, safeguarding against misuse or redirection of funds.

雙重支出保護：ElasticPay 確保每筆交易都在受信任的設備上安全處理，從而防止在多個交易中使用相同的支付令牌。代幣的加密簽名使其防篡改，防止資金被濫用或重定向。

Replay Attack Prevention: The system detects and prevents the unauthorized reuse of a valid token by checking its usage history in both the sender's and receiver's Trusted Execution Environments (TEEs) and at the bank server.

重播攻擊預防：系統透過檢查發送者和接收者的可信任執行環境 (TEE) 以及銀行伺服器中的使用歷史記錄來偵測並防止未經授權地重複使用有效令牌。

Forgery Prevention: ElasticPay requires users to have digital certificates issued by an authoritative entity, ensuring that identities are verified and cannot be falsely assumed or replicated.

防偽：ElasticPay要求用戶擁有權威機構頒發的數位證書，確保身分得到驗證，不能被假冒或複製。

Non-Repudiation: Transactions are confirmed through digital signatures and explicit consent, ensuring that participants cannot deny their involvement, thus securing accountability and traceability.

不可否認性：交易透過數位簽章和明確同意進行確認，確保參與者無法否認其參與，從而確保問責性和可追溯性。

Side-Channel Attack Prevention: The system uses TEEs and Secure Elements (SEs) to prevent the leakage of external information and protect against side-channel attacks.

側通道攻擊防護：系統透過TEE和SE（Secure Elements）來防止外部資訊洩露，防止側通道攻擊。

Mitigation of Man-in-the-Middle Attacks: All communications are encrypted using advanced cryptographic protocols, thwarting interception or alteration of messages.

減輕中間人攻擊：所有通訊均使用高級加密協定進行加密，阻止訊息被攔截或更改。

Hardware Control Attack Resilience: Comprehensive encryption measures protect against unauthorized access to application data, even if hardware manipulation is attempted.

硬體控制攻擊彈性：全面的加密措施可防止未經授權的應用程式資料訪問，即使嘗試硬體操作也是如此。

Software Control Attack Defense: Secure boot processes with TPM technology to authenticate software integrity, preventing compromised software from executing.

軟體控制攻擊防禦：使用 TPM 技術保護啟動流程，以驗證軟體完整性，防止受感染的軟體執行。

Privacy Preservation in Transactions: Only essential information is shared during transactions, minimizing the exposure of private data and maintaining user privacy.

交易隱私保護：交易過程中僅共享必要信息，最大限度減少私人資料暴露，維護用戶隱私。

Recovery from Transaction Failures: The system provides mechanisms for retransmission or invalidation and regeneration of tokens in case of transaction failures, ensuring transaction integrity.

交易失敗恢復：系統提供交易失敗時代幣重傳或失效、再生的機制，確保交易完整性。

These features collectively ensure that ElasticPay offers secure, private, and reliable offline digital transactions, addressing key challenges in digital payment systems. The team, however, acknowledges limitations like fund inaccessibility during offline transactions and the sequential processing of transactions (processing multiple requests at the same time) and is working on addressing these.

這些功能共同確保 ElasticPay 提供安全、私密且可靠的離線數位交易，解決數位支付系統中的關鍵挑戰。然而，該團隊承認離線交易期間資金無法存取以及交易的順序處理（同時處理多個請求）等限制，並正在努力解決這些問題。

As India transitions towards a digital economy, the heavy reliance on internet connectivity for digital transactions poses a barrier, especially in rural and remote areas where network access is inconsistent or absent. ElasticPay offers a viable solution to this challenge by enabling secure and private offline digital transactions. This system can significantly enhance financial inclusion, allowing individuals in underbanked and underserved regions to participate in the digital economy without the prerequisite of stable internet connectivity. By facilitating offline transactions, ElasticPay ensures that digital financial services are accessible to a broader population, bridging the digital divide and supporting the government's efforts to create a more inclusive financial ecosystem.

隨著印度向數位經濟轉型，數位交易對網路連線的嚴重依賴構成了障礙，特別是在網路存取不一致或缺乏的農村和偏遠地區。 ElasticPay 透過支援安全且私密的離線數位交易，為這項挑戰提供了可行的解決方案。該系統可以顯著增強金融包容性，允許銀行服務不足和服務不足地區的個人在沒有穩定網路連線的前提下參與數位經濟。透過促進線下交易，ElasticPay確保更廣泛的人群能夠獲得數位金融服務，彌合數位落差並支持政府創建更具包容性的金融生態系統的努力。

This research news was partly generated using artificial intelligence and edited by an editor at Research Matters

這研究新聞部分是使用人工智慧產生的，並由 Research Matters 的編輯編輯