{'fraction_non_alphanumeric': 0.027853838164479276, 'fraction_numerical': 0.005098668680955528, 'mean_word_length': 4.91731843575419, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Simplified Hybrid Secure Algorithm for Mobile Banking Application

M-banking is one of the main divisions of m-commerce. It provides daily banking operations to the customer using his mobile with the supported application. But the current applications are facing security challenges due to the limitations of mobile resources. There are two major schemes. First, the public key infrastructure (PKI) but, suffers the scalability and certificate management problems. Second, the identity-based public key cryptography (IBPKC) but has key escrow problem. In this paper a modified algorithm to solve these problems by combining elliptic curve Signcryption with certificateless cryptography and enhance the security with lower computational time. From the results, the proposed algorithm has superior performance compared with earlier schemes. Also, it supports multiple types of messages (such as document and multimedia).


Introduction
Mobile banking is a way for a bank's customer to access banking services using his cell phone to provide functions like balance query, debit application, payment transaction, electronic bill payments, and, etc. It reduces time and effort costs at the different bank branches. Understanding the mobile banking and payments market and ecosystem is critical in addressing the security challenges. The security in M-banking applications is important both at the administrative level and from the user perspective. So, the Cryptography is used to prevent the third parties from reading private messages. Usually, banks enable customers to access their banking accounts through one of these technologies the interactive voice response (IVR), the short messaging service (SMS) or the web-based mobile applications [1]. Cryptography techniques are used for secure communications by constructing protocols that prevent third parties from reading the private messages.
In a traditional public key cryptography (PKC), to be able to communicate with others, a public key should be associated with the owner by a certificate which is a signature issued by the trusted Certificate Authority (CA). That technique brings a large amount of computation, communication cost and certificate management problems. To solve those problems, identity-based cryptography is used. By using information related to the user identity, publicly known and unique in the whole system, as his public key. The advantage of identity-based cryptography is that only user's identity is required to communicate. However, the user must completely trust KGC, which introduce as key escrow problem [2], [3].

Literature Review
Most of the existing security framework proposals using PKI but due to its associated problems a various software implementation is used to overcome resource limitation issues. This is the case of [4], which use RSA and PKI but the scheme has a large overheads in terms of memory, processing, and SMS usage both for digital signatures and public key validation. Another workaround for PKI that sacrifice usability is given in [5], which proposes users register themselves on a website before they start exchanging secure SMS. Another common strategy is the adoption of an auxiliary device with better computational capabilities, like a SIM card empowered by a co-processor and extra storage space for private keys [6], [7]. A few researchers introduced solutions to the mobile banking security problems using the identity-based cryptography. For example, Zhao and Aggarwal [8].
The Certificateless cryptography remove the need for certificates also solve the key escrow problem in ID-PKC. However, certificateless cryptography schemes have not appeared in the literature in association with applications. In certificateless cryptography the KGC server is involved only in generating a user's partial key without knowing the value of user's secret key [2], [9] but they depend on the bilinear map which needs costly operations so it's inefficient. This includes the uses of certificateless encryption [10], certificateless signatures and certificateless signcryption [11]. Recently, in [12] the authors introduced a secure mobile banking scheme based on certificateless cryptography, but it depends on the bilinear map which needs costly operations so it's inefficient.
The proposed scheme applies the Hypred technique on mobile banking transactions without using the bilinear map or limited by text messages like in [2]. The proposed scheme enhances the security and reduces the computational time compared to the existing Hypred techniques like wireless networks [13] or IOT [2], [14] or Instant Message [3].

Cryptography Basic Assumptions
In this section, a brief introduction for several computational assumptions relevant to our proposal.

Elliptic curve cryptography
Let denotes the finite field of modulo of a large prime p. An elliptic curve E over the finite field is defined via Where a and b satisfy. A base point P of the elliptic curve E with order n should satisfy N*P=O, where N is the order of the base point P and O is a point at infinity of E. The points of elliptic curve Ep (a, b) together with a point O at infinity from an addition cyclic group with order p.

Elliptic Curve Discrete Logarithm Problem (ECDL).
Finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible.

Certificateless Public Key Cryptography
The certificateless public key cryptography system, uses a key generating centre (KGC) to generate a partial private key and delivers it securely to the correct entities. The entity uses the partial private key with a secret key (not known to the KGC) to generate a full private key.

Security Requirements for the scheme
The proposed scheme should have the following security features.
• Confidentiality. The text should be set to single line the encrypted message must be correctly decrypted only by the specified recipient.
The recipient should be able to know that the message has not been tampered with. The recipient should be able to verify the received message sender. • Unforgeability.
The scheme must be resistance to Type Ⅰ attack which is the public key substitution attack and Type Ⅱ attack which is the malicious KGC attack.
A judge can authenticate that the signcrypted text is valid or not, without using the private keys.
The sender cannot deny sending the received message. • Forward Secrecy.
The secrecy of the messages is ensured, even if the sender's private key is compromised. • Denial of Replay Attack.
The recipient must be able to eliminate the duplicate message.

Certificateless Cryptography
Certificateless cryptography has three phases as shown in Figure 2{Setup phase, Authentication phase and partial private key generation phase}. The phases operations will be discussed in details.

Client Registration phase.
• The client must apply for the service by meeting the bank's employee Figure 1 to check his Identity and his account, then the client provides: mobile station international subscriber directory number (MSISDN), which will be used as his ID (

Elliptic curve Signcryption Cryptography
A client checks for changes in public parameters before performing The Signcryption process, if there is a change the client must repeat the KGC server authentication phase and the partial key generation phase. The Signcryption and Un-Signcryption process as follow.

Encryption / decryption algorithm.
The proposed scheme uses AES 128-bit GCM mode to encrypt the message between the Client and KGC server, it provides both authentication and encryption. The key is the Client password with applying the Key derivation function (KDF) with unique initialization vector for every encryption.

Security analysis
Theorem 1: The key agreement process is secure under the ECDLP 1 assumption.
Proof: Assume that KGC has generated private keys for a client C and the bank B, and the adversary is denoted as A. We can prove the security as follows: a) client C chooses a number randomly and calculates and Then, obtain the current timestamp T and calculates S, R client's private key and send the organized message to the bank B. b) When the bank B has received the message, he will retrieve the session key.

➔
(1) c) The Bank B will verify T, ACC and R ➔ Adversary A can only obtain S, R, and the public parameters. In this case, obtaining K1 without and should solve the ECDL problem. In addition, client C and bank B can detect forgery and replay attacks by verify if received and T.

Theorem 2:
The scheme resistance to Type Ⅰ attack (the public key substitution attack). Proof: Adversary A has access to the system public parameters but not client secret key a) Adversary A chooses a random number gets client partial private key so the full private key is and replace the public keys to be instead of . b) Adversary A generates the K1, then calculates c) The Bank B retrieve they key then gets T, ACC then verify them and calculates ➔ (4) Finally, it's clear that received . Hence, the type Ⅰ attack is unsuccessful.

Theorem 3:
The scheme resistance to Type Ⅱ attack (malicious KGC attack). Proof: Adversary A has access to KGC master key and can't replace the client C partial private key.   [3] [12] Systems Figure 3. Computational time In [3] they used only the KGC Server to generate the private key for all entities using it's master key and the user Identity which is unique in the whole system . However, the user must completely trust KGC, which can impersonate any user to sign or decrypt any message. This issue is known as key escrow problem [15]. But the proposed paper overcomes it by allowing the KGC server to generate only the partial private key not the full private key. Also, the proposed scheme has less Computational time Figure 3. The comparison shows that the proposed scheme achieves a less computational cost compared with Hassouna [12] and Li [14] Figure 3. The proposed scheme has more computational time than Omala [13], but offers more essential security features like public verifiability Table 3.
Our scheme offers the resistance to key escrow problem compared to Nguyen [2], furthermore other features shown in Table 3.

Conclusion
The paper discusses the advantage of the proposed Simplified Hybrid Secure Algorithm for Mobile Banking Application, the benefits of using Elliptic curve certificateless (CL) cryptography which overcomes many problems presented in the other schemes like PKI scheme and ID-PKC and enhancing the security with low computational time. Also, the flexibility to be used in mobile banking