DIY IoT Payment System With Google Firebase (KhadashPay Firebase Edition V1.0)

Nowadays, there are many payment systems available on the market, most of which are quite convenient to use. However, there's no such thing as a free lunch, and that convenience comes at a price. If a seller wants to use an established payment system, they must buy an expensive payment terminal and pay fees for its setup and maintenance. As a client, you pay the issuance and maintenance fees for your debit/credit card. Furthermore, when you buy something, the seller has to pay a fee for each transaction, and to cover this cost, the seller may increase the price of their goods. That's why some sellers put a "PAY CASH PAY LESS" sign in their stores because they rather subtract those fees from the final price and even give you a small discount than pay those fees and spend their time and resources dealing with the bank, payment equipment provider, and other adjacent entities.

I'm writing this because I believe that I might've found a solution to at least some of these issues.

The payment system I've developed doesn't require the seller to buy an expensive payment terminal and pay fees for each transaction (unless of course, your business becomes so successful that you exceed the Spark Plan offered by Google), it doesn't require the clients to pay maintenance fees, and it doesn't require a bit of the client's personal information to create an account. Moreover, with KhadashPay, clients can create multiple accounts using a single RFID card, provided they use a different PIN for each account. The account information is encrypted and securely stored in the cloud, and part of the encryption key is derived from the RFID card UUID, ensuring that not even the payment terminal owner can decrypt the client's data. Additionally, KhadashPay has useful features such as "Belonging Check" and Integrity Verification.

Anyway, at least I tried.

The name KhadashPay consists of two parts: Khadash (which means "new" in Hebrew) and Pay.

Before you continue reading this tutorial, please note that this payment system is not connected to any existing financial institution. All the "money" kept in it is nothing more than just numbers entered by the operator, encrypted by the 3DES + AES + Blowfish + Serpent encryption algorithm In CBC mode, and stored in the cloud.

You can also read this tutorial on Medium, Hackster, and Maker Pro.

Supplies for the payment terminal:

• ESP32 x1
• 2.4 Inch TFT LCD with ILI9341 x1
• Mifare RC522 RFID Reader x1
• Arduino Uno x1
• 4x4 Keypad x1
• Arduino Nano x1
• 4.7k resistors x2
• PS/2 Keyboard x1 *optional
• PS/2 Port x1 *optional
• 10µF capacitor x1 *optional
• Access Point x1
• 5V Power Supply x1

Supplies for a client:

• RFID card x1

The "3DES + AES + Blowfish + Serpent" encryption algorithm in cipher block chaining mode first appeared in the Midbar V2.5. And since then has been utilized by the Midbar (Raspberry Pi Pico Version), Midbar V3.0, Midbar V4.0, KhadashPay V2.0, Midbar (Raspberry Pi Pico Version) V2.0, KhadashPay V2.0 (Raspberry Pi Pico Version), Midbar V5.0, Midbar (STM32F401CCU6 Version), KhadashPay V3.0 (STM32F401CCU6 Version), KhadashPay V3.0, Midbar (STM32F401CCU6 + Arduino Uno Version), KhadashPay V3.5, Black Swan V2.0, Midbar (Teensy 4.1 Version), Hash Latch, Midbar (Teensy 4.1 Version) V2.0, Midbar (ESP8266 Version) V2.0, Midbar (STM32F407VET6 Version), Midbar (STM32F407VET6 + Arduino Uno Version) and DIY IoT Data Vault With Google Firebase (Midbar Firebase Edition V1.0).

Although the "3DES + AES + Blowfish + Serpent" encryption algorithm ain't exactly what I would call "a cryptographically weak encryption algorithm," operating it in a weird derivation of the ECB mode, the way it was done by the Midbar V2.0 wasn't the best idea that I had. Even though that wouldn't've allowed the attacker to produce the legitimate ciphertext by swapping the blocks within the ciphertext, an attacker could still make a legitimate ciphertext by replacing the nth block of the ciphertext N1 with the nth block of the ciphertext N2. To fix that vulnerability (instead of just notifying the user that the decrypted ciphertext might've been forged), I made the "3DES + AES + Blowfish + Serpent" encryption algorithm work in CBC mode. So, if an attacker replaces a block of ciphertext, they spoil not just that block but also the subsequent one.

I'll be honest with you, the bit-flipping attack "kinda works," but I doubt that it would ever go unnoticed because of the "HMAC-SHA256"-based integrity verification feature

And let's not forget that this encryption algorithm performs the operation called superencryption.

As defined by NIST, superencryption is an encryption operation for which the plaintext input to be transformed is the ciphertext output of a previous encryption operation.

Such organization of the encryption algorithms makes a combined encryption algorithm that is at least as strong as the strongest one in the cascade, has a longer key, might be more resistant to some attacks, and might produce a ciphertext with higher entropy. Anyway. It won't hurt to have an additional layer of security (or several of them).

Another cool feature provided to you by KhadashPay is the "HMAC-SHA256"-based integrity verification.

Before encrypting the user data, KhadashPay computes the tag for that data and encrypts it alongside data.

Later on, when KhadashPay decrypts your data, it also decrypts the previously calculated tag and computes a new tag for the newly decrypted data. It then compares both tags. If they don't match - KhadashPay will promptly notify you that the integrity verification has failed.

Even though KhadashPay can't decrypt user data without the user's card, I still decided to add an additional check, just in case. 

The so-called "Belonging Check" (didn't really know what else to call it) is a feature that allows the KhadashPay to verify whether the record with the balance belongs to the card that is taped on the RFID reader or not.

If you've never flashed ESP32 before you need to configure Arduino IDE and install CP210x driver to upload the firmware into the board, you can download the CP210x driver for ESP32 here: https://www.silabs.com/developers/usb-to-uart-bridge-vcp-drivers

Configuring IDE isn't a part of this tutorial. You can read about it here: https://randomnerdtutorials.com/installing-the-esp32-board-in-arduino-ide-windows-instructions/

You can download the firmware for KhadashPay from one of these sources:

• https://sourceforge.net/projects/khadashpay-firebase-edition/
• https://github.com/Northstrix/KhadashPay-Firebase-Edition

TFT_eSPI: https://github.com/Bodmer/TFT_eSPI

Firebase-ESP32: https://github.com/mobizt/Firebase-ESP32

espsoftwareserial: https://github.com/plerup/espsoftwareserial

rfid: https://github.com/miguelbalboa/rfid

Keypad: https://github.com/Chris--A/Keypad

ps2dev: https://github.com/Harvie/ps2dev

PS2KeyAdvanced: https://github.com/techpaul/PS2KeyAdvanced

PS2KeyMap: https://github.com/techpaul/PS2KeyMap

The process of unpacking libraries is typical. You can unpack the content of the archive into the folder: ...\Arduino\libraries. Or open the Arduino IDE, click to the Sketch -> Include Library -> Add .ZIP Library... and select every archive with libraries.

Other required libraries are already present in one way or another.

I would be happy to explain to you how to set up Google Firebase. However, I believe that the article at https://medium.com/firebase-developers/getting-started-with-esp32-and-firebase-1e7f19f63401 does a better job on that. I suggest reading the article up until the "Development Environment Setup" headline.

When setting up the database, save the "Realtime Database URL" and "Web API Key."

These values will be needed later.

TFT_eSPI Library requires the config to be adjusted depending on the display and the board that drives that display. Initially, I wanted to write the mini-guide on adjusting the config for the ILI9341 display to be properly used on the ESP32's HSPI. But then I realized that it would be more convenient to attach the adjusted config to the firmware and tell you where to place it.

Take the "User_Setup.h" file from the "V1.0" folder and place it in the "C:\Program Files (x86)\Arduino\libraries\TFT_eSPI-master" folder.

To make the unauthorized deciphering of the cloud-stored data computationally infeasible - It is crucial to generate your own unique keys and never reuse them.

You are free to choose the key generation method. I can only offer you an option for you.

I've modified one of my previous projects to work as a random number generator. Though the generated output seems "random enough" for me, I haven't run any tests. So, I can't guarantee that it's random.

Use it at your own risk!

To generate the keys - launch gen.exe from the "V1.0\Untested RNG" folder and click the "Generate keys for KhadashPay" button. The background turns from dark gray to light gray when you press that button.

Open the "Firmware.ino" file from the "V1.0\Firmware" folder and put your values to the following variables:

WIFI_SSID

WIFI_PASSWORD

API_KEY

DATABASE_URL

After that, replace my keys with yours.

Also, pay attention to the following lines:

#define MAX_NUM_OF_RECS 999 - Maximum number of slots for the vault part of KhadashPay (doesn't affect the payment terminal part)

String space_and_currency = " USD"; - Space + Currency name

You have to switch the partition scheme to the "Huge APP (3MB No OTA/1MB SPIFFS)" before you continue working with ESP32 because the firmware for the ESP32 is too big for the default partition.

Upload the firmware from the "V1.0\Firmware_for_ESP32" folder into the ESP32. Don't forget to hold the "BOOT" button when the firmware upload starts.

Some boards will flash without any problems.

Unfortunately, that's not the case for all boards. If you configured IDE correctly, installed drivers, selected the corresponding port, and still keep getting this error: A fatal error occurred: Failed to connect to ESP32: Timed out waiting for packet header. Connect a 10µF capacitor to the board while flashing.

Connect the positive lead of the capacitor to the EN pin of the ESP32;

Connect the negative lead of the capacitor (usually indicated by the gray stripe) to the GND pin of the ESP32.

Upload the firmware from the "V1.0\Firmware_for_Arduino_Uno" folder into the Arduino Uno.

Upload the firmware from the "V1.0\Firmware_for_Arduino_Nano" folder into the Arduino Nano.

Assemble the circuit according to the circuit diagram above. I would strongly advise you to double-check the connections after assembling the circuit.

When you're done flashing boards and assembling the circuit, plug the USB cable into the ESP32.

The terminal should connect to your Wi-Fi network and sign up to the Google Firebase.

Once KhadashPay connects to a Wi-Fi network and signs up to Google Firebase, it displays one of the nine random lock screens.

At that point, press any key to get to the next tab.

*Credit for photos:

Be'er Sheva:

Photo by Levi Meir Clancy on Unsplash

Dallas:

Photo by Gabriel Tovar on Unsplash

Frankfurt:

Photo by Igor Flek on Unsplash

Kansas City

Image by Cloud11 from Pixabay

Kuwait City:

Photo by Tayssir Kadamany on Pexels

London:

Photo by Robert Bye on Unsplash

Minneapolis:

Photo by Daniel McCullough on Unsplash

Pittsburgh:

Photo by Yuhan Du on Unsplash

Tel Aviv:

Photo by Shai Pal on Unsplash

To use the KhadashPay, you first need to set the master password.

While entering the master password on the 4x4 keypad, note that the '*' key serves as a backspace.

And remember that you can't change the master password without losing the ability to decrypt all user data stored in the Google Firebase!

KhadashPay won't be able to decrypt the user data without the master password because the keys for the encryption algorithms are partially derived from it. Perhaps, it won't even unlock without the correct master password.

When you're done entering the master password, press either the '#" or 'C' key on the keypad to finish the input and set the master password.

After you've unlocked the KhadashPay and got to the menu:

• Press the "0" key on the 4x4 keypad to go down the menu;
• Press the "8" key on the 4x4 keypad to go up the menu;
• Press the "#" key on the 4x4 keypad to perform the selected action;
• Press the '.' key on the 4x4 keypad to show the random lock screen. After that, press any key to return to the menu.

Technically, the length of the master password is unlimited, but practically, I wouldn't be setting a master password longer than 300 characters. If you enter the master password using the PS/2 keyboard, you can use all characters available on the keyboard.

Aside from the master password, you must also set an operator password.

Ok, let's start with the facts about the KhadashPay account.

• Each account is bound to the RFID card and PIN;
• The PIN can have a length from 1 to 8 characters;
• The PIN can have the following characters: '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '.', 'B', 'D';
• A client can create several accounts using the same card as long as the pins are different;
• The maximum amount of money stored in the account is only limited by the double variable type (don't worry about that, the KhadashPay can still store a 15-digit number without any problems).

To create an account on KhadashPay:

Operator:

• Select the "New Account" line in the menu;
• Press the '#' key on the 4x4 keypad;
• Enter the operator password;
• Press the '#' key on the 4x4 keypad;
• Press the '#' key on the 4x4 keypad and give the device to the client.

Client:

• Tap your RFID card on the RFID reader;
• Set your PIN;
• Press the '#' key on the 4x4 keypad;
• Enter the PIN that you've set again;
• Press the '#' key on the 4x4 keypad.

To put money into the account:

Operator:

• Select the "Put Money In" line in the menu;
• Press the '#' key on the 4x4 keypad;
• Enter the operator password;
• Press the '#' key on the 4x4 keypad;
• Enter the amount of money to be put into the client's account;
• Press the '#' key on the 4x4 keypad;
• Press the '#' key on the 4x4 keypad and give the device to the client.

Client:

• Tap your RFID card on the RFID reader;
• Enter your PIN;
• Press the '#' key on the 4x4 keypad.

To make a sale:

Operator:

• Select the "Make A Sale" line in the menu;
• Press the '#' key on the 4x4 keypad;
• Enter the operator password;
• Press the '#' key on the 4x4 keypad;
• Enter the sale amount;
• Press the '#' key on the 4x4 keypad;
• Press the '#' key on the 4x4 keypad and give the device to the client.

Client:

• Tap your RFID card on the RFID reader;
• Enter your PIN;
• Press the '#' key on the 4x4 keypad.

To view balance:

Operator:

• Select the "View Balance" line in the menu;
• Press the '#' key on the 4x4 keypad;
• Enter the operator password;
• Press the '#' key on the 4x4 keypad;
• Press the '#' key on the 4x4 keypad and give the device to the client.

Client:

• Tap your RFID card on the RFID reader;
• Enter your PIN;
• Press the '#' key on the 4x4 keypad.

The payment terminal also allows you to interact with it using the PS/2 keyboard. just make sure that the PS/2 keyboard and the Arduino Nano aren't connected to the ESP32 at the same time.

In addition to being a payment terminal, this version of KhadashPay incorporates the vault capabilities of the DIY IoT Data Vault With Google Firebase (Midbar Firebase Edition V1.0), enabling you to securely store your login credentials, credit card information, notes, and phone number in the cloud.

I'll leave it for you to explore.

*All credentials demonstrated here are entirely fictitious. Any similarity to actual credentials is purely coincidental.

Finally, after more than a year of development, I made a functional payment system that allows you to deploy and operate multiple payment terminals quickly and efficiently.

And since the payment terminals of that version of KhadashPay share the same database that's stored in the cloud, the clients who use that particular version of KhadashPay can benefit from its capabilities even if the terminals are connected to different networks and located in different countries.

I think it's also worth mentioning that KhadashPay's source code is distributed under the MIT license. That grants you the freedom to customize, adapt, and modify KhadashPay according to your needs and preferences. In other words, you can create your own version of KhadashPay or use it as a starting point for building new projects without the need for external permission.

If you found this tutorial to be useful, please consider sharing it.

Thank you for reading this tutorial.