A website dedicated to contactless payment systems

Nokia has always been the pioneer handset manufacturer in the NFC environment since the beginning. Nokia released the SDK of handsets with secure elements located in the handset and in the SIM over SWP years ago. So, I had felt disappointment to hear that the long awaited handset supporting NFC Nokia 6212 was canceled.

Fortunately, Nokia announced that all new Nokia smart phones will support NFC starting from 2011. There’s even more; the secure element will be located every location possible on the handset, not only in the SIM. This means that every player in the NFC space will have their chance to play in the game. Near Field Communications World reports that Nokia Executive Vice President for Markets Anssi Vanjoki made the announcement on Mobey Forum‘s 10th year anniversary in Helsinki.

This is a great news, not only for NFC enthusiasts, but for Nokia, too. Nokia has fallen apart from the smart phone wars (in terms of application store-wise) and I think this will be a big step for Nokia in the smart phone market. I think a killer NFC application will help a lot.

Edit : Turns out that it will be a feature of upcoming Symbian 4 platform and only selected handsets will have NFC support. For details please see here.

Contactless cards are penetrating into more and more market segments day by day. The three most common use cases of contactless cards are clearly ticketing, payment and access control. Now let’s skip the access control and compare the ticketing and payment use cases.

Work Flows

Functional requirements of a contactless ticketing application are generally store a balance, contract, expire date and a log space. Typical work flow of a contactless ticketing transaction is as follows:

• Identify the card in the field
• Authenticate the card and the ticketing terminal
• Read the contract from the card
• Read the previous transaction logs -if necessary
• Compute the fare
• Debit the card with the fare
• Write the transaction log

When it comes to payment, the work flow of a contactless EMV payment is as follows:

• Identify the card in the field
• Authenticate the card and the terminal
• Debit the card
• Store the transaction log

As you can see, the main difference of the payment and the ticketing work flow is the fare calculation based on some variables like contract type of the card and the previous transactions performed and stored in the application. This is something EMV is still uncapable of. Both Visa and MasterCard are already working on ticketing extensions of payWave and PayPass, however they will still have many barriers ahead even if the specification are completed and first samples are out for testing.

Authentication and cryptography

EMV relies on RSA and Triple DES, while ticketing applications use mainly DES variants and AES. Contactless EMV transactions are quite secure with DDA (Dynamic Data Authentication) and it is a perfect solution for an interoperable environment of different banks.

Almost all ticketing systems are proprietary and each transport operator or provider has its own application. Every system has its own infrastructure and interoperability between ticketing systems are quite rare. So each system has its own authentication alghoritm and of course key types and lengths.

Main differences

EMV is designed for securing the transaction between card and terminal, terminal and host systems, host system and the card. It’s the underlying standard of Visa, MasterCard and JCB. Each organization has its own application of EMV but  essentially they are mostly identical. Contactless ticketing application depend heavily on the chip platform and operating system they are using. Every transport authority, system integrator or solution provider has its own ticketing application. There are efforts in Europe to standardize the ticketing applications but they are not mature enough yet. So basically ticketing is proprietary for now.

Some time in the near future, payment and ticketing is supposed to meet on the NFC platform, but it seems it’s still a long way there.

3rd Cardist Card & Smart Technologies Exhibition & Summit is held in Istanbul between 12-14 May 2010 with the main sponsorships of BKM, Visa and MasterCard.

Here are my highlights from the exhibition:

Garanti & Avea announced a mobile payment product based on mobile phones. Payment is processed by the application running on SIM card and the SIM card has an external antenna attached. This way, there’s no need for an NFC based handset, all handsets can be used with. it. Garanti Bank already has more than 1 million contactless credit cards issued and clearly the market leader in contactless payments in Turkey.

BKM, the national switch of Turkey announced the pilot project to run on NFC handsets in which BKM acts as the TSM. 6 banks are attending the pilot project.

Oytek demonstrated their NFC solutions running on Nokia 6212. The application has a paid balance, ticketing and couponing extensions. There’s also a kiosque with a contactless reader and an NFC poster application to complete the NFC picture.

Banksoft was awarded with the contactless pre-paid card program which was developed for Halk Bank’s Bank 24 Visa contactless card. Smartsoft is also awarded with their pre-paid platform as well.

Payment Cards&Mobile, which I think the best magazine on contactless systems was also present in the exhibition as they were in the last two ones.

Belbim, the technology provider of Istanbul Municipality -including the electronic ticketing for public transport- exhibited their validators and surrounding devices. Belbim has developed a DesFire application for Istanbul public transport but somehow it’s still not been released for public use.

KentKart was also present and demonstrated contactless only validators and vehicle tracking systems.

Gemalto announced that Gemalto joined the Open Handset Alliance. I  find this a very good news for the NFC world.

Android platform was an initiative by the Open Handset Alliance. Almost all of the researches point out that Android will be one of the most popular mobile operating systems of (very near) future. Android runs not only on mobile phones but a range of mobile devices varying from netbooks to internet tablets. I believe Android will penetrate into more devices like running on  embedded systems.

So what does Gemalto’s joining to Open Handset Alliance mean in terms of contactless systems? First of all, Gemalto is the first and only company on secure payment and identification technology in the alliance. Gemalto is clearly the biggest company that has the expertise on the application level security for payment/identification chips, which I believe will boost the NFC implementation on Android OS. Gemalto has all the necessary know how and sources for developing a generic NFC API for Android which will encourage handset manufacturers for more handsets supporting NFC. On the application level, this will lead the huge Android developer community to implement many NFC applications – and not only payment.

Since it’s now widely believed that next generation iPhone will have some kind of contactless interface, now almost all major mobile platforms (Symbian- of course, iPhone and now Android) will have native support for NFC.

In my perspective, NFC was the rising star of the Mobile World Congress 2010. In the first day of the event, the agenda of the session was mobile money. A balanced selection of speakers from carriers to technology companies provided a mind opening content.

The first outcome of the day for me was that NFC is something that you can not expect a single task, but there is a need for companions. I mean, a simple mobile wallet application will not be enough for people to make it a killer application. Mobile coupon style add-ons as well as making the content accesible to user through the handset is crucial. People already have credit cards, debit cards, transportation cards, etc for making the payment. Why would the user have switch it to a handset instead of a card?

Secondly, all the parties are ready to jump on the band wagon but it still needs some time for the boom. We’ve already seen many pilots and even a commercial roll out in Japan, but there’s still some more time ahead.

Mobile World Congress 2010 had also an NFC event for platinum pass holders with a Samsung handset.

It was interesting to see that SIM cards are having more and more abilities for mobile payment applications. Gemalto announced a new SIM card which is able to run a DESFire ticketing application. I also had a product presentation of a SIM platform with NFC support from Giesecke&Devrient.

Finally, BarclayCard announced an iPhone application which can accept contact EMV chip cards with the PIN support. Just like the US version running from magnetic stripe interface, Barclay’s one has a contact chip card reader attached to the iPhone and the terminal software runs on the iPhone OS.