$\text{UPI}\rho$: An Envisioned Policy-Based UPI Architecture for Secure Transactions

Unified Payment Interface (UPI) is a popular platform in India that is used for digital payments. The ease of transactions and lack of IT Security knowledge in the general community at large are attracting cyber fraudsters to use UPI as a new platform to carry out cyber frauds to steal money from user accounts over UPI. In this paper, we present a novel idea of employing the attribute-based access control (ABAC) model to improve the security of UPI architecture. The ABAC policy model grants the subject access to objects based on assigned attributes of the subject, assigned attributes of the object, environment conditions, and a set of policies specified in terms of those attributes and conditions. We propose a modified architecture with an access control sublayer and necessary primitives that can allow users to specify custom transaction control policies to avoid the majority of UPI attacks over their accounts. We believe that the proposed architecture will help the digital payment ecosystem as well as the industry and academia involved in UPI directly or indirectly to look at it with a new vision and perspective on UPI transaction processing architecture.