Read my latest exclusive for Wired in full below or by following this link.

Imagine a piece of software that would allow the soldiers, aid workers and government officials thrown together after a disaster to quickly and securely communicate with each other whatever device they hold in their hands. Imagine too the same approach used to allow you to pay easily for your coffee on your mobile after entering a simple four digit code.

 

If you can, then you share the same dream of “spontaneous security” that Professor Bill Roscoe and his team from the University of Oxford have been chasing for ten years: the ability to easily and cheaply create secure ad hoc communication networks between two or more people who have never had any need to communicate before.

 

 

It isn’t just theoretical musing either, with $1 million from the US Navy and £100,000 from our own cash-strapped Ministry of Defence helping to turn daydreams into a real-life family of human interactive security protocols (HISP). Security protocols are the rules that govern the use of algorithms to ensure that data is securely transmitted between two or more parties, some of which require human involvement, some of which don’t.

 

Last year the British Army took the software that uses these protocols on manoeuvres to Kenya. This year the software’s application in mobile payments has been spun off by Oxford’s commercialisation company Isis Innovation into a company called OxCept. PayPal has already shown an interest in Roscoe’s research. In a first for an Oxford spin-out the company is going to be based in London and Silicon Valley in a confident attempt to grab slice of the mobile payment market — KPMG estimates that mobile payments will exceed $1 trillion in 2015.

 

“What we have been working on all this time is contextual authentication: ways of identifying someone by the context they are in when you don’t have their mobile number, name or anything like that,” says Bill Roscoe.

 

The contextual data used can vary depending on the application. It can be geographically based — using, for example, your position on Google Maps — if you are Oxfam, or face-to-face if you are Starbucks. Once you are convinced of the identity of who you are communicating with, a simple four digit key allows you to set up a secure channel of communication with them that “piggybacks on top of an unsecure network like the Wi-Fi in a café or the internet itself,” explains Roscoe.

 

Scottish-born Roscoe studied Maths at Oxford before becoming interested in computer security in the 1990s. He now heads one of the world’s leading research teams into methods of building ad hoc secure networks of communications using these human interactive security protocols rather than traditional PKIs (Public Key Infrastructure). PKIs are expensive to set up and maintain because of the amount of data they require to be shared to authenticate each user.

 

“A couple of other groups in Switzerland and Finland came up with protocols with similar properties to ours at about the same time, but no-one else seems to be using them in the area of payments. We have a patent application covering this use of such protocols as well as a granted patent on our own protocols.”

 

The inspiration for his research came from work he had been doing on improving Bluetooth security for the military but which never came up with a protocol that was 100 percent secure if someone was actively trying to break it.

 

“Then I realised what the solution was: human interactive security protocols, where two or more parties can pass secure information between them over an unsecure network like Wi-Fi or the internet by first transmitting and comparing a very small amount of information over an out-of-band channel which is derived from the context they are in.”This then allows much larger amounts of data to be transmitted in an encrypted form.

 

Roscoe’s “big idea” was the application of exactly the same technology to payment.

 

“While how we pay for things has changed a lot, one thing has stayed the same: you have to put in a great deal of information to verify who you are to the person you want to pay,” he explains.

 

“Now if you use these protocols you don’t have to pass on any more info other than a unique token that just says I am prepared to pay you the money.

 

“So if you have both the protocol and run it will be able to identify you both. The chances are infinitely small that a nasty guy could copy this contextual data.”

 

For Perry Anderson, CEO and co-founder of OxCept, Roscoe and his team have achieved nothing less than the “missing piece of the puzzle” in mobile payment. Anderson is an experienced investment banker and a graduate of Oxford University’s Said Business School.

 

“Even though mobile payment is going to be very large, security issues still remain a critical problem. What Bill and his Oxford-based team have developed is the missing piece of the puzzle as they allow us to transfer money or data without fear of it being intercepted.

 

“The original research for these protocols was funded by the US military, which is a great validation for us, but we know that they have much wider applications as well.”

 

According to Professor Christopher Mitchell, “Without the use of security protocols we would be unable to do security remotely.” Mitchell is an expert in cybersecurity from Royal Holloway College, University of London.

 

“However, the goal is the maximum amount of security for the least amount of work as we are all busy people, and some of these protocols have a human element like Bill’s and some don’t. So a lot of work has been done on trying to combine passwords and face to face, as having someone there who can enter a security key can make it more secure.”

 

As he says, there is a “really high amount of interest in this research” because by “getting people together in the right way” you can end with a “trust network” that “combines untrusted networks with authentic networks”. Authentic networks are networks where you know that you are communicating with the person you are supposed to be communicating with.

 

“And yes it is unbreakable, it is mathematically proven, but only if you follow instructions.” For Mitchell the big difference between using these protocols for paying for things rather than for emergency relief is that when you are dealing with money there are “obvious risks”, as “there is a lot more incentive to break it. So however good the protocols they can all be undone if the phone has malicious software on it.”

“What we have been working on all this time is contextual authentication: ways of identifying someone by the context they are in when you don’t have their mobile number, name or anything like that”

 

Success, Mitchell thinks, will depend on the “knowledge and ability” of the scientists behind the technology and on its being released in at “the right place and time”. Many innovative technologies remain stuck in the laboratory. Perry Anderson believes that “the timing could not be better” for the results of Bill Roscoe and his team to be spun out, “as we certainly have industry dynamics working in our favour”.

 

Although, as Roscoe says, “it will make paying on mobile more easy and secure”, one of his students has just completed a project funded by the Oxford Martin School into the use of the same technology in medicine, “as sensors, devices and implants are sending more and more information across wireless networks and cheap security is absolutely vital.”

In the long run, he points out, “the wider application of this technology is astonishing.”