It seems EMVCo is ahead of Visa and MasterCard this time, they released requirements for contactless payments by handsets. There are already implementations of Visa and MasterCard’s applications on handsets, but all of them have been dropped before launch -after pilot phase.

Basically, a mobile application is a user interface for accessing the EMV compliant payment application running on the secure element of the handset. Secure element can reside on the NFC controller of the handset or on the SIM card.

What EMVCo requires for these applications are;

• Application should have a soft/hard key for easy access. If it’s a soft key, it must be accessible from the main/home screen.
• Application should inform the handset/card holder when a contactless transaction is in place.
• Application should be secured by a password and it should be configurable to enable/disable the application.
• There should be an indication of contactless capability, just like the bluetooth icon.
• Handset shall provide a mechanism to notify the application when it is powered off.

It is a good effort to draw the boundaries of the environment and will lead the players in the industry to have a single user experience. It seems we will see more mobile payment applications on the market -hopefully in the commercial level rather than pilots.

Original document can be found here.

This has been possible by a company -Laks, whose vision is beyond most of the people in both card payments and watch industry. Laks is a Vienna based company developing very cool watches that have a dual interface chip slot and the watch has an antenna inside the watch. The antenna plugs into a specific type of SIM sized dual interface chip produced specifically to fit in this environment. There is the possibility of running many applications on the chip. Actually there is the possibility of requesting any kind of chip in this form, which means that sky is the limit for implementing a chip application inside a watch. Laks also has native mifare chip embedded into the watch. Although I’ve never asked, I am sure that they can fit any kind of chip inside a watch.

Watches come with the antenna, while the dual interface chips do not necessarily. If so, personalization process must be processed while the chip is in the watch, which is something hard to do when personalizing huge volumes.

In Turkey, Garanti Bank launched a product based on Laks watches a few years ago. It was a little bit early, however it was still a very innovative product. In Turkey, there were efforts to develop a payment product based on Laks’ watches, which some of them had already passed the proof of concept phase, unfortunately they were never launched.

Maybe, the commercialization did not happen due to the fact that watch is a personal thing (like a mobile phone in the NFC case) and a payment product bundled in a personal stuff might not sound good to people. But I am sure there will be some contactless projects based on watches and Laks will definitely have a big role in this picture. There are more interesting watches other than having a contactless capability in Laks’ web site, worth to visit.

Work Flows

Functional requirements of a contactless ticketing application are generally store a balance, contract, expire date and a log space. Typical work flow of a contactless ticketing transaction is as follows:

• Identify the card in the field
• Authenticate the card and the ticketing terminal
• Read the contract from the card
• Read the previous transaction logs -if necessary
• Compute the fare
• Debit the card with the fare
• Write the transaction log

When it comes to payment, the work flow of a contactless EMV payment is as follows:

• Identify the card in the field
• Authenticate the card and the terminal
• Debit the card
• Store the transaction log

As you can see, the main difference of the payment and the ticketing work flow is the fare calculation based on some variables like contract type of the card and the previous transactions performed and stored in the application. This is something EMV is still uncapable of. Both Visa and MasterCard are already working on ticketing extensions of payWave and PayPass, however they will still have many barriers ahead even if the specification are completed and first samples are out for testing.

Authentication and cryptography

EMV relies on RSA and Triple DES, while ticketing applications use mainly DES variants and AES. Contactless EMV transactions are quite secure with DDA (Dynamic Data Authentication) and it is a perfect solution for an interoperable environment of different banks.

Almost all ticketing systems are proprietary and each transport operator or provider has its own application. Every system has its own infrastructure and interoperability between ticketing systems are quite rare. So each system has its own authentication alghoritm and of course key types and lengths.

Main differences

EMV is designed for securing the transaction between card and terminal, terminal and host systems, host system and the card. It’s the underlying standard of Visa, MasterCard and JCB. Each organization has its own application of EMV but  essentially they are mostly identical. Contactless ticketing application depend heavily on the chip platform and operating system they are using. Every transport authority, system integrator or solution provider has its own ticketing application. There are efforts in Europe to standardize the ticketing applications but they are not mature enough yet. So basically ticketing is proprietary for now.

Some time in the near future, payment and ticketing is supposed to meet on the NFC platform, but it seems it’s still a long way there.

Around 2 years ago, the biggest mobile network operator Safaricom started a mobile money transfer system called M-Pesa which now became the most innovative mobile payment system throughout the world. It was created for responding the underbanked population for their basic money transfer needs. There was no legal infrastructure to regulate the system, government could do it after 6 months of the launch. Now it’s projected that almost one third of every Kenyan has an active M-Pesa account.

So, what is M-Pesa, how do people use it? M-Pesa is a money transfer program managed via cell phones. All the cell phones are compatible since the application was developed on the SIM card. All Safaricom SIM cards have the M-Pesa application pre-installed, so all you need to do is to register the service. Even I was -as a foreigner- able to register it within hours by using my passport only.

What really great is that there are no hardware terminals installed, both users and distribution network use the same SIM-centric approach. For registering, you simply need to apply to an M-Pesa agent. Agent keys in the typical personal information to his/her cell phone and you receive the notification in hours. The application is protected by a PIN, which is created during the registration, so it is secure enough.

With an M-Pesa account, you can send and receive money, withdraw cash from ATMs, shop at certain points and now the latest news is that you can even link your account to a bank account. What would an average Kenyan want more from a mobile network operator?

I personally consider M-Pesa as one of the most creative product based on a smart card platform. The SIM application alone enables the whole service as the heart of the system. Safaricom manages a pool account for all the money loaded in to M-Pesa accounts. Safaricom is not a bank, but now with the introduction of M-Kesho, people can open a bank account at Equity Bank and use the basic banking instruments through the M-Pesa application just by linking the M-Pesa account with the Equity Bank account. Another innovative step!

M-Pesa was a huge success, so Vodafone, the owner of Safaricom launched the same product in Tanzania, Afghanistan and is planning in India, Eygpt and South Africa.

It’s a true success of a smart card/SIM technology, yet I can consider as a contactless system since everything happens out of the contact interface!

Here are my highlights from the exhibition:

Garanti & Avea announced a mobile payment product based on mobile phones. Payment is processed by the application running on SIM card and the SIM card has an external antenna attached. This way, there’s no need for an NFC based handset, all handsets can be used with. it. Garanti Bank already has more than 1 million contactless credit cards issued and clearly the market leader in contactless payments in Turkey.

BKM, the national switch of Turkey announced the pilot project to run on NFC handsets in which BKM acts as the TSM. 6 banks are attending the pilot project.

Oytek demonstrated their NFC solutions running on Nokia 6212. The application has a paid balance, ticketing and couponing extensions. There’s also a kiosque with a contactless reader and an NFC poster application to complete the NFC picture.

Banksoft was awarded with the contactless pre-paid card program which was developed for Halk Bank’s Bank 24 Visa contactless card. Smartsoft is also awarded with their pre-paid platform as well.

Payment Cards&Mobile, which I think the best magazine on contactless systems was also present in the exhibition as they were in the last two ones.

Belbim, the technology provider of Istanbul Municipality -including the electronic ticketing for public transport- exhibited their validators and surrounding devices. Belbim has developed a DesFire application for Istanbul public transport but somehow it’s still not been released for public use.

KentKart was also present and demonstrated contactless only validators and vehicle tracking systems.

So, what is Calypso?

Calypso is a ticketing application developed and maintained by Calypso Association. Calypso Association, based in Brussels, Belgium, was established by RATP and technology provider Innovatron in 1993. Later on, group of European transport operators from Belgium, Germany, France, Italy and Portugal joined the association. Calypso ticketing application is currently being used by various European public transport systems.

In the Calypso world, you can define various players into a single card (now the term “portable object” is used though, rather than “the card”) and they can share the same balance. The technical design of the application supports multi-application by nature. Different contracts can be installed on to a single card which are protected by different key sets. Each Calypso chip has a set of derived keys from master keys. DES and DESX (an implementation of DES against brute force attacks) can be used for authentication. Calypso requires its own SAM card for authentication which is a pre-requisite of modifying the data in the chip.

Unlike typical mifare designs, you are restricted by the boundaries and transaction flow developed by Calypso, but it covers almost anything that can be expected in a transport ticketing environment. Calypso applet runs on micro processor chips, so authentication is quite strong (and fast)

Calypso Association plays an innovative role towards the NFC era and they seem to be ready for the NFC evolution. (I wish I could say revolution, by the way) Calypso applet runs on various card operating systems varying from Infineon to Watchdata chips, including NXP’s JCOP family. Of course this includes any secure element in the NFC world.

Based on my personal experience, I can say that Calypso is an equivalent of EMV in the banking payment world. Both of the applications are quite well designed, already running on millions of chips and getting ready for the future.

These have been done since some time, but Gemalto has started a new era by implementing the DESFire application on a SIM/UICC. Even the owner of the technology -NXP, does not officialy have DESFire emulation yet. It’s a huge thing in terms of innovation. However there’s still some time before a DESFire enable transportation system is to accept an NFC handset device with a Gemalto SIM/UICC.

Gemalto has been aggressive on the contactless market almost since its start and this is clearly a result of it. Read the full press release here.

The first outcome of the day for me was that NFC is something that you can not expect a single task, but there is a need for companions. I mean, a simple mobile wallet application will not be enough for people to make it a killer application. Mobile coupon style add-ons as well as making the content accesible to user through the handset is crucial. People already have credit cards, debit cards, transportation cards, etc for making the payment. Why would the user have switch it to a handset instead of a card?

Secondly, all the parties are ready to jump on the band wagon but it still needs some time for the boom. We’ve already seen many pilots and even a commercial roll out in Japan, but there’s still some more time ahead.

Mobile World Congress 2010 had also an NFC event for platinum pass holders with a Samsung handset.

It was interesting to see that SIM cards are having more and more abilities for mobile payment applications. Gemalto announced a new SIM card which is able to run a DESFire ticketing application. I also had a product presentation of a SIM platform with NFC support from Giesecke&Devrient.

Finally, BarclayCard announced an iPhone application which can accept contact EMV chip cards with the PIN support. Just like the US version running from magnetic stripe interface, Barclay’s one has a contact chip card reader attached to the iPhone and the terminal software runs on the iPhone OS.

ACOS7 seems an addition to their ACOS family optimised for transportation. It has 8 kb of application memory which is pretty suitable for a transportation applications. ACOS7 has almost every feature you’d expect from a dual interface card product positioned for transportation; from hardware based random number generator to support for ISO7816 Part 4 file structures:  transparent, linear fixed, linear variable, cyclic which are essential for transportation logging mechanisms.

I got the impression that ACOS7 is especially targeting the Chinese market, but I think they could do quite well in Europe, too.

There’s also an interesting card manufacturer company in China, Watchdata. I have personally been following the products of Watchdata for a few years and they are really coming. When I first met with Watchdata dual interface cards, they did not had the EMV, so I was unable to use it. In time, they got the EMV certification and much more. I have seen their chip products replacing many competitors around the world. I saw Watchdata presenting their products around Europe in many respectable events.

Sim Pass is especially an interesting product of Watchdata. Instead of waiting for handset manufacturers to release NFC complaint devices, they developed a SIM card with an embedded antenna. This way, people have a handset which is capable of contactless payment transactions regardless of the handset they have. It’s a very innovative product of its kind, but I don’t think it will reach Europe, since it’s not the European way. But it’s quite a successful implementation step for the mobile contactless payments, that’s for sure.