# SAM-PAY: A Location-Based Authentication Method for Mobile Environments +
## 5 Service Exploiting the SAM-PAY Method for Mobile Authentication
### SAM-PAY Based Refueling Service at the Self-Service Gas Stations  
Starting from the SAM-PAY authentication method, we designed a secure self-service at the gas stations in which the customers do not use cards for payment operations but rather dedicated UT devices (as briefly described in Section 3) and OTC codes. Moreover, the usage of an OTC code is limited both in time--because an OTC expires after a time interval, e.g., 15 min, and in space--because an OTC can be known only if the UT (and implicitly the customer) is localized in a restricted area at the gas station, and their position is certified by the LE acting as a trusted third party. The architecture and the workflow of the refueling service exploiting the SAM-PAY method for mobile client authentication are illustrated in Figure 5. In our current approach, the SP is part of a Private Payment System (PPS), which can manage both the payments performed with the UT device as described in this section, as well as the payments performed with traditional methods in which the clients use traditional credit or debit cards. However, in the tested scenario, we developed procedures to accept and manage only the first type of payment, i.e., the one performed with the UT. In a PPS, both the issuer of the payment cards (like credit cards) and the acquire, whose role is to provide and manage the POS machines used during payment operations, are part of the same system. In this way, the PPS is able to manage all payment transactions performed with the cards (or e-wallets) issued and recognized by himself (named \"on-us\" payments) without involving external circuits like Visa or Mastercard. Nevertheless, the PPS is also connected to external card circuits via a communication gateway so that it can manage payments performed with cards issued by external card issuers, which are typically referred to as \"non-on-us payments\". During the design phase of the proposed refueling service, we considered several components:  
1. The user performing a payment operation has a personal UT (as described in Section 3), which is used together with the human-machine interface (HMI) for controlling the operations related to the transaction. The UT is certified by the PPS so that any payment operation originating from the UT can be considered an \"on-us\" payment, and it can be managed without requiring interaction with external circuits. 2. The UT is considered \"trusted\" by the owner to perform payments, and any other considerations on storing the secret information (i.e., the \(KS_{e}\) key) in a tamper-resistant security module on the UT is out of scope in this work. If the UT device is lost or stolen, the user must have the possibility to promptly inform the SP about this event via an emergency phone number, as happens presently with green numbers made available by any bank or credit card issuer. We also assume that it should be impossible for a malicious application to copy the sensitive data stored on a UT, even if the user presents the correct PIN code. 3. The HW/SW architecture of the UT allows the receipt and processing of signals of the GPS and EGNOS systems (and in the future of Galileo) by performing measurements on two distinct levels: (a) at a high level, where the coordinates (X, Y, Z) and the time information are processed; (b) at a low level, where the pseudorange measurements between the UT and each of the satellites reachable by the UT are processed. 4. The UT can manage two types of communication channels: (a) short-range communication, e.g., Zigbee, used for exchanging data with the POS of the gas-station provider; (b) long-range (GPRS)--used for exchanging data with the LE group component and the SP of the Payment System. 5. The LE is a server with GPRS communication capability and navigation functionality, which determines (upon request from the SP) the certified position of a UT. 6.