Towards secure IoT-based payments by extension of payment card industry data security standard (PCI DSS)

• Main Authors: Muhammad Nasir Mumtaz Bhutta, Surbhi Bhattia, Mohammed Ali Alojail, Kashif Nisar, Yue Cao, Shehzad Ashraf Chaudhry, Zhili Sun
• Format: Article
• Language: English; English
• Published: John Wiley & Sons, Inc 2022
• Subjects: QA76.75-76.765 Computer software
• Online Access: https://eprints.ums.edu.my/id/eprint/33665/1/Towards%20secure%20IoT-based%20payments%20by%20extension%20of%20payment%20card%20industry%20data%20security%20standard%20%28PCI%20DSS%29.ABSTRACT.pdf; https://eprints.ums.edu.my/id/eprint/33665/2/Towards%20Secure%20IoT-Based%20Payments%20by%20Extension%20of%20Payment%20Card%20Industry%20Data%20Security%20Standard%20%28PCI%20DSS%29.pdf; https://eprints.ums.edu.my/id/eprint/33665/; https://doi.org/10.1155/2022/9942270; https://doi.org/10.1155/2022/9942270

IoT emergence has given rise to a new digital experience of payment transactions where physical objects like refrigerators, cars, and wearables will make payments. These physical objects will be storing the cardholder credentials and will directly make payments with the vendors over insecure public networks. For such payment transactions, government regulations and standards organizations require to implement PCI DSS for adapting similar set of security measures at the global level. The current version of PCI DSS is not suitable for IoT-based payment systems due to characteristics of IoT such as resourceconstrained nature of devices and updating software/firmware of so many physical devices. Also, there arises an emergent need of implementing PCI DSS requirements and assessments for security of all stakeholders that store or process the user credentials in a payment. This paper is an initial effort to bring the researcher’s attention to make upcoming versions of PCI DSS suitable for IoT and thus securing the new ways of IoT-based payment systems. The paper has reviewed the traditional payment process along with considerations for IoT-based payment systems to make recommendations to modify the PCI DSS in a suitable way for IoT.