Read my latest exclusive for Wired in full below or by following this link.
Imagine a piece of software that would allow the soldiers, aid workers and government officials thrown together after a disaster to quickly and securely communicate with each other whatever device they hold in their hands. Imagine too the same approach used to allow you to pay easily for your coffee on your mobile after entering a simple four digit code.
If you can, then you share the same dream of “spontaneous security” that Professor Bill Roscoe and his team from the University of Oxford have been chasing for ten years: the ability to easily and cheaply create secure ad hoc communication networks between two or more people who have never had any need to communicate before.
It isn’t just theoretical musing either, with $1 million from the US Navy and £100,000 from our own cash-strapped Ministry of Defence helping to turn daydreams into a real-life family of human interactive security protocols (HISP). Security protocols are the rules that govern the use of algorithms to ensure that data is securely transmitted between two or more parties, some of which require human involvement, some of which don’t.
Last year the British Army took the software that uses these protocols on manoeuvres to Kenya. This year the software’s application in mobile payments has been spun off by Oxford’s commercialisation company Isis Innovation into a company called OxCept. PayPal has already shown an interest in Roscoe’s research. In a first for an Oxford spin-out the company is going to be based in London and Silicon Valley in a confident attempt to grab slice of the mobile payment market — KPMG estimates that mobile payments will exceed $1 trillion in 2015.
“What we have been working on all this time is contextual authentication: ways of identifying someone by the context they are in when you don’t have their mobile number, name or anything like that,” says Bill Roscoe.
The contextual data used can vary depending on the application. It can be geographically based — using, for example, your position on Google Maps — if you are Oxfam, or face-to-face if you are Starbucks. Once you are convinced of the identity of who you are communicating with, a simple four digit key allows you to set up a secure channel of communication with them that “piggybacks on top of an unsecure network like the Wi-Fi in a café or the internet itself,” explains Roscoe.
Scottish-born Roscoe studied Maths at Oxford before becoming interested in computer security in the 1990s. He now heads one of the world’s leading research teams into methods of building ad hoc secure networks of communications using these human interactive security protocols rather than traditional PKIs (Public Key Infrastructure). PKIs are expensive to set up and maintain because of the amount of data they require to be shared to authenticate each user.
The inspiration for his research came from work he had been doing on improving Bluetooth security for the military but which never came up with a protocol that was 100 percent secure if someone was actively trying to break it.
“Then I realised what the solution was: human interactive security protocols, where two or more parties can pass secure information between them over an unsecure network like Wi-Fi or the internet by first transmitting and comparing a very small amount of information over an out-of-band channel which is derived from the context they are in.”This then allows much larger amounts of data to be transmitted in an encrypted form.
Roscoe’s “big idea” was the application of exactly the same technology to payment.
“While how we pay for things has changed a lot, one thing has stayed the same: you have to put in a great deal of information to verify who you are to the person you want to pay,” he explains.
“Now if you use these protocols you don’t have to pass on any more info other than a unique token that just says I am prepared to pay you the money.
For Perry Anderson, CEO and co-founder of OxCept, Roscoe and his team have achieved nothing less than the “missing piece of the puzzle” in mobile payment. Anderson is an experienced investment banker and a graduate of Oxford University’s Said Business School.
“Even though mobile payment is going to be very large, security issues still remain a critical problem. What Bill and his Oxford-based team have developed is the missing piece of the puzzle as they allow us to transfer money or data without fear of it being intercepted.
According to Professor Christopher Mitchell, “Without the use of security protocols we would be unable to do security remotely.” Mitchell is an expert in cybersecurity from Royal Holloway College, University of London.
As he says, there is a “really high amount of interest in this research” because by “getting people together in the right way” you can end with a “trust network” that “combines untrusted networks with authentic networks”. Authentic networks are networks where you know that you are communicating with the person you are supposed to be communicating with.
Success, Mitchell thinks, will depend on the “knowledge and ability” of the scientists behind the technology and on its being released in at “the right place and time”. Many innovative technologies remain stuck in the laboratory. Perry Anderson believes that “the timing could not be better” for the results of Bill Roscoe and his team to be spun out, “as we certainly have industry dynamics working in our favour”.
Previous Heat engines: Stirling Silver?
Next Autonomous vehicles: how safe are trucks without human drivers?