Secure communication between web browsers and NFC targets by the example of an e-ticketing system

Near Field Communication (NFC) is a radio frequency (RF) based proximity coupling technology allowing transactions within a range of up to 10 cm. Using NFC technology for transactions like payment or ticketing in the real world brings a great benefit in terms of time savings, usability and process optimization. Therefore we propose an e-ticketing system making use of this proximity technology especially focusing on security aspects of the system as well as the distribution of the tickets. While other systems rely on ticket distribution via SMS or home-printing a paper ticket, our approach is based on a browser plug-in in combination with a contactless RFID reader at the client side. This installation is used to transfer the e-ticket from a ticket server to the user's PC client and to write the ticket over the proximity interface into the secure element of the NFC target. Thus an NFC target, a contactless smartcard or an NFC enabled mobile phone, can be used as a secure token. With this implementation we are able to bridge the gap between electronic internet transactions and the physical world in a secure way. Also the validation of the ticket at the point-of-access is based on this contactless technology. Our findings provide practical implications to implement web applications using NFC technology successfully.