First DESFire implementation on a SIM platform

Mifare emulation has been around for some years. Mifare emulation simply refers to an application running on a chip card operating system. The application emulates the native mifare chip and responds the mifare readers as if it is a mifare chip. Of course there are some considerations when implementing a mifare emulation. First of all, it is not native mifare and the terminal software needs to be updated accordingly to recognise the chip. Secondly, mifare emulation is not as fast as a native mifare chip so some parameters must be updated to transact with the mifare emulation applet.

These have been done since some time, but Gemalto has started a new era by implementing the DESFire application on a SIM/UICC. Even the owner of the technology -NXP, does not officialy have DESFire emulation yet. It’s a huge thing in terms of innovation. However there’s still some time before a DESFire enable transportation system is to accept an NFC handset device with a Gemalto SIM/UICC.

Gemalto has been aggressive on the contactless market almost since its start and this is clearly a result of it. Read the full press release here.

NFC on Mobile World Congress 2010

In my perspective, NFC was the rising star of the Mobile World Congress 2010. In the first day of the event, the agenda of the session was mobile money. A balanced selection of speakers from carriers to technology companies provided a mind opening content.

The first outcome of the day for me was that NFC is something that you can not expect a single task, but there is a need for companions. I mean, a simple mobile wallet application will not be enough for people to make it a killer application. Mobile coupon style add-ons as well as making the content accesible to user through the handset is crucial. People already have credit cards, debit cards, transportation cards, etc for making the payment. Why would the user have switch it to a handset instead of a card?

Secondly, all the parties are ready to jump on the band wagon but it still needs some time for the boom. We’ve already seen many pilots and even a commercial roll out in Japan, but there’s still some more time ahead.

Mobile World Congress 2010 had also an NFC event for platinum pass holders with a Samsung handset.

It was interesting to see that SIM cards are having more and more abilities for mobile payment applications. Gemalto announced a new SIM card which is able to run a DESFire ticketing application. I also had a product presentation of a SIM platform with NFC support from Giesecke&Devrient.

Finally, BarclayCard announced an iPhone application which can accept contact EMV chip cards with the PIN support. Just like the US version running from magnetic stripe interface, Barclay’s one has a contact chip card reader attached to the iPhone and the terminal software runs on the iPhone OS.

A new dual interface smart card from ACS : ACOS7

ACS announced its new dual interface smart card ACOS7. ACS is a Hong Kong based company working on smart cards and readers. Their product portfolio is quite strong, they almost have everything that you can imagine. I especially love the card readers of ACS.

ACOS7 seems an addition to their ACOS family optimised for transportation. It has 8 kb of application memory which is pretty suitable for a transportation applications. ACOS7 has almost every feature you’d expect from a dual interface card product positioned for transportation; from hardware based random number generator to support for ISO7816 Part 4 file structures:  transparent, linear fixed, linear variable, cyclic which are essential for transportation logging mechanisms.

I got the impression that ACOS7 is especially targeting the Chinese market, but I think they could do quite well in Europe, too.

Chinese are coming

China is a huge country. When you have the population of that much, it’s not logical to pay license fees, but better to develop your own standards. They did it on blueray equivalent media and on payment card applications. China has a payment system of its own, called CUP and NFC World’s latest article says that they will do the NFC on their own way too.

There’s also an interesting card manufacturer company in China, Watchdata. I have personally been following the products of Watchdata for a few years and they are really coming. When I first met with Watchdata dual interface cards, they did not had the EMV, so I was unable to use it. In time, they got the EMV certification and much more. I have seen their chip products replacing many competitors around the world. I saw Watchdata presenting their products around Europe in many respectable events.

Sim Pass is especially an interesting product of Watchdata. Instead of waiting for handset manufacturers to release NFC complaint devices, they developed a SIM card with an embedded antenna. This way, people have a handset which is capable of contactless payment transactions regardless of the handset they have. It’s a very innovative product of its kind, but I don’t think it will reach Europe, since it’s not the European way. But it’s quite a successful implementation step for the mobile contactless payments, that’s for sure.

my-d move from Infineon against NXP’s Mifare Ultralight

Contactless chips for limited use have been popular in public transportation for some years. NXP, just like in mifare case, has been leading this market with mifare ultralight. Ultralight chips have limited memory and no crypto support, but have OTP (one time programmable) memory area which is perfect for enabling the restriction the limited use of the ticket. Later on NXP developed a next generation of Ultralight, which is called Ultralight C. Ultralight C supports 3DES in addition to its elder brother Ultralight. Good.

Of course, Ultralight is not the only product in the market. Infineon, as one of the strongest players in the semi-conductor manufacturers have a great product as a competitor to NXP’s Ultralight family called my-d move. my-d move is a member of my-d family of Infineon and has 128 bytes of memory for application and supports 32 bit password for authentication. It also supports password re-try counter feature against brute force attacks. Unlike Ultralight C, my-d move does not have any keys stored in the chip, but has a secure code which is written at the time of issuing the chip. Secure code is authenticated at the time of using the chip along with the password.

One great future of my-d move is, just like Mifare Ultralight, the support for NFC Type 2 Tag Operations. This practically means that my-d move can interact with NFC devices like handsets or other contactless readers. This opens a whole new world for these products. Infineon positions the product as a limited use media like single trip ticket for transportation or event ticketing. Imagine tickets for a rock music event being formatted by a cell phone on an over-the-air service. my-d move and Ultralight opens a gate for enabling projects like this. You can create the ticket with a mobile phone and then send the ticket data to central host over GPRS/3G connection of the mobile handset. You can also validate/invalidate tickets via NFC handsets. Great opportunity. One great addition to this would be the usage of the ticket for buying a drink inside the event. Or think of voting for polls displayed on kiosks with contactless readers and people voting and identifying themselves with the contactless ticket.

Basicly, my point is that these chips are great for any type of ticketing, not limited to limited use for transportation.

Apple’s implementation of NFC

My previous post on Apple’s NFC support on iPhone got the most hits among all the content here. Luckily, it turns out that next generation iPhone will have the NFC support. Near Field Communications World.com’s post was linking the Apple Insider’s post, which has all the details of the patent application of Apple on sharing data between NFC enabled devices. Apple’s understanding of NFC is to syncronise devices over a contactless interface. Sounds logical.

In every NFC promo video, you can see people exchanging contacts and some other information by touching their phones to each other. It seems iPhone will be the first commercially available device to actually do this. I can imagine the ads of the next generation iPhone; how people will be touching their shiny iPhones to other iPhones, Mac Books, iPod Touchs and Apple TVs. This is a very good news for the NFC world.Think of people sending each other files between their iPhones. Banks, fast food restaurants, online stores, almost all types of businesses already have their own iPhone applications. I can imagine how the NFC chip will extend their applications into contactless loyalty schemes or secure identification media. My forecast is that payment will come later, possibly after people are convenient with their iPhone’s contactless ability. Of course the TSM context needs to be stabilised in the minds of decision makers of the payments industry. I hope this happens before the iPhone’s “possible” NFC boom.

On the other hand, just like touch screens, I think this move will lead to many handset manufacturers to follow the lead and integrate NFC chips into their products. Eventually this will lead MNOs to create their value added services on NFC hardware. Banks, transport operators, loyalty schemes, etc will have much more creative products. I think, and strongly believe that current NFC hardware and software developers will be securing their future -hopefully not in a long time.

A possible huge step for NFC

A recent post on Near Field Communications Group on Linkedin states that Apple is working on some prototype iPhones which have contactless reader. Here’s the full post:

Had to share this news. A highly reliable source has informed me that Apple has built some prototypes of the next gen iPhone with an RFID reader built in and they have seen it in action. So its not full NFC but its a start for real service discovery and I’m told that the reaction was very positive that we can expect this in the next gen iPhone. If Apple does it, expect every phone manufacturer and their sister to begin pumping out NFC enabled phones, at least for service discovery and sync. This just reinforces what we knew based on the two seperate patents Apple submited that had the iPhone enabled to read RFID tags. I’m told that the touch project video and the BT SIG’s specs were all driving forces to push this forward as well as other factors. Guess I’ll be touching my iPhone to my Mac to link them together to sync iTunes by next year.
Nokia has been the leader of NFC innovations in the handset world, but if this happens to be true Apple may go far ahead. And at the same time it will lead to a boom in NFC applications.

A recent post on Near Field Communications Group on Linkedin states that Apple is working on some prototype iPhones which have contactless reader. Here’s the full post:

Had to share this news. A highly reliable source has informed me that Apple has built some prototypes of the next gen iPhone with an RFID reader built in and they have seen it in action. So its not full NFC but its a start for real service discovery and I’m told that the reaction was very positive that we can expect this in the next gen iPhone. If Apple does it, expect every phone manufacturer and their sister to begin pumping out NFC enabled phones, at least for service discovery and sync. This just reinforces what we knew based on the two seperate patents Apple submited that had the iPhone enabled to read RFID tags. I’m told that the touch project video and the BT SIG’s specs were all driving forces to push this forward as well as other factors. Guess I’ll be touching my iPhone to my Mac to link them together to sync iTunes by next year.

Nokia has been the leader of NFC innovations in the handset world, but if this happens to be true Apple may go far ahead. And at the same time, it will definitely lead to a boom in NFC applications.

Mifare classic the legend

It’s quite common nowadays to talk about security leaks of mifare classic chips. It’s easy to “hack” the chip, clone it, read the contents of it without knowing the keys, and so on; the list goes on like this. Even the license holder NXP is recommending to migrate to mifare plus. Well not good for any product!

These words definitely don’t sound good, however there’s the fact that a huge number of mifare chips (more than one billion, according to unofficial sources of mine) are already being used for systems mainly transportation and access control. Many of these applications do not require anything more than reading a unique id. When it’s transportation or e-purse, it’s authenticating a few sectors and updating the purse balance.

Mifare was developed by an Austrian company called Micron. It was specifically designed for transportation and the name was chosen accordingly: Micron Fare Collection, which was Mi-Fare. The chip was very fast and providing a good level of security required for access control and transport ticketing environment. The memory structure is not flexible enough for today’s complex mechanisms but back then, I think it was more than enough.

Basically, mifare operating system has 16 sectors of secure memory protected by two 48 bit keys stored in the chip. Each sector has 4 blocks for storing data. Each block has 16 bytes of data storage. Each sector has one block reserved for keys and access conditions. Although not recommended, you can even use the keys as data storage.

I think the strength of mifare platform comes mainly from off-the-shelf readers and components widely available on the market. Today, designing a mifare application, developing it on readers and formatting the cards is quite a standardized process. You can find virtually unlimited number of products and companies providing mifare based application and systems. The “security” rules are also very well defined and documented.

Well, there’s been many projects that it was planned that mifare will be phased out. Or mifare is specifically blacklisted as a prerequisite. However, I strongly believe that mifare is quite a successful product and it has made a very good job for deploying contactless systems. If mifare did not exist, I think contactless systems would not be popular as it is today. Of course there are very strong competitors of mifare such as Legic, Calypso and Felica, but mifare is the most popular one among all. I will try to cover the competitors of mifare, which are all stronger than mifare in the security level, but not as much as deployed worldwide as mifare. This is actually the point that I’d like to point out with this post.

It’s quite common nowadays to talk about security leaks of mifare classic chips. It’s easy to “hack” the chip, clone it, read the contents of it without knowing the keys, and so on; the list goes on like this. Even the license holder NXP is recommending to migrate to mifare plus. Well not good for any product!
These words definitely don’t sound good, however there’s the fact that a huge number of mifare chips (more than one billion, according to unofficial sources of mine) are already being used for systems mainly transportation and access control. Many of these applications do not require anything more than reading a unique id. When it’s transportation or e-purse, it’s authenticating a few sectors and updating the purse balance.
Mifare was developed by an Austrian company called Micron. It was specifically designed for transportation and the name was chosen accordingly: Micron Fare Collection, which was Mi-Fare. The chip was very fast and providing a good level of security required for access control and transport ticketing environment. The memory structure is not flexible enough for today’s complex mechanisms but back then, I think it was more than enough.
Basically, mifare operating system has 16 sectors of secure memory protected by two 48 bit keys stored in the chip. Each sector has 4 blocks for storing data. Each block has 16 bytes of data storage. Each sector has one block reserved for keys and access conditions. Although not recommended, you can even use the keys as data storage.
I think the strength of mifare platform comes mainly from off-the-shelf readers and components widely available on the market. Today, designing a mifare application, developing it on readers and formatting the cards is quite a standardized process. You can find virtually unlimited number of products and companies providing mifare based application and systems. The “security” rules are also very well defined and documented.
Well, there’s been many projects that it was planned that mifare will be phased out. Or mifare is specifically blacklisted as a prerequisite. However, I strongly believe that mifare is quite a successful product and it has made a very good job for deploying contactless systems. If mifare did not exist, I think contactless systems would not be popular as it is today. Of course there are very strong competitors of mifare such as Legic, Calypso and Felica, but mifare is the most popular one among all. I will try to cover the competitors of mifare, which are all stronger than mifare in the security level, but not as much as deployed worldwide as mifare. This is actually the point that I’d like to point out with this post.

SIM-Centric or not?

According to the post on NFCNews, Nokia release its first NFC handset which holds the NFC application on the SIM card, rather than the handset itself.

Well, let’s go through the concepts first. We can say that the heart of an NFC system is the secure element. Secure element refers to the IC (integrated circuit) which hosts the application, which stores the data and communicates the NFC reader. The data stored in the secure element can be financial balance, cardholder data, ticket contract details (on a transport ticketing application), etc and it’s protected by at least DES or TDES keys. The physical communication layer is actually an antenna attached to the handset. In the first generation NFC handsets, both the secure element and the antenna was integrated into the handset.

The place of the secure element actually directs us to the party who controls what application to install or what application not to! If you define the secure element as the SIM card, that means that the owner of the SIM card -which is the mobile network operator- decides what applications will be installed for using with the contactless interface. Before the introduction of the Single Wire Protocol (SWP), this was almost impossible. And there was no business model, either. Now it’s quite clear. Thanks to ETSI, now there’s a standard for this and I think that this will eventually lead to a SIM-Centric NFC world.

On an NFC event held in Istanbul, Turkey on May 27-28, product manager from Nokia (I can not remember his name, sorry) told that at least half of the Nokia phones would have NFC capability in 2-3 years. (I can not remember the exact figures either, but it was something around this, maybe even more) This means that a lot of people will have a contactless device in their hands -even if they don’t want to- and there will be a huge battle for installing an NFC application on a phone. I asked him if Nokia would have both SIM-Centric and handset-centric phones or not. He responded in a very politically correct manner that the market will decide on this.

Just imagine what can you do with this power: You can top-up your transportation card, use it with your phone, check the balance any time from your phone. You can display the last 2-3 transactions from your phone, which bus or tram did you take last time and how much did it cost. You can even top-up by using your airtime. It opens a whole new world, things are shining on the bright side. And this is all happening by using OTA services provided by the network operator.

However, there is a dark side of course. Third party application owners and developers need to negotiate with the mobile network operators. They can not do anything that the operator is not happy with. Let’s say you have a distribution channel and you have a project for adding NFC support so that people will have the chance to use their NFC enabled phones for downloading content. Well, you need to deal with the operator(s) and try to find a way to find a business case for the operator. Good luck.

Briefly, it seems we will have a SIM-Centric NFC world coming and need to prepare for this.

Contactless reader device for home use?

According to the post at NFC News, ASK released a contactless reader device for home use. Reader is connected via USB port and is compatible with all popular contactless card types.

Contactless readers attached to PC over USB port has been available in the market for a long time. Aiming the end users who has a contactless card for transportation, it’s a very nice feature for both the user and the operator to top up the card at home. The user is free to top up any time and the operator gets rid of distribution channels cost for top up. Everyone is happy.

On the other side there are very obstacles for this dream to come true: It’s quite hard to distribute the readers and the software to the end users. Who will be in charge of the cost of the reader and the software?  How secure is to give the card holder the ability to trace the transaction at his/her own PC? For the power users things may be easy but for the average people it will be hard to install the driver of the reader, software and the connect to a financial service for top up.

We will see how successful will the reader become…