1. NFC based payment: how will it develop relative to upcoming alternative approaches?
Hong Kong | March 2014

2. Promoting safe living and working environments
Safe products
Safe buildings
Safe workplaces
Safe water, food & health
Safe, clean energy
About UL…
Promoting safe living and working environments
Certify
Validate
Test
Inspect
Audit
Advice & Educate We
Be the best, and achieve
meaningful size in all that we do

3. About UL Transaction Security
Compliance
Security
Working towards a safer world by being the number one independent center in Transaction Security Technology
Unrivalled expertise across industry domains
State-of-the-art services/products portfolio
Recognition in our local markets – Thought Leadership
Scalable offering
Service offering

4. Mobiel Betalen Nederland
UL supports worldwide many mCommerce initiatives with advisory services
Weve
ISIS
“UL staff has been extremely valuable to ISIS in supporting the testing and integration of our TSM.”
“.. the UL team always considered any issues beyond just the technical aspects and looked at the wider commercial and customer implications, which was and is invaluable for us.”
“The strategic workshops hosted by UL TS at the start of our project were crucial to create a common vision and helped us to speed up the project”
“The effort from the UL team has been crucial for our project. Their competence, attitude and hard work have been inspiring for us all.”
Customer References
DNB & Telenor
Mobiel Betalen Nederland

5. Agenda
Alternative approaches to NFC-based payments Alternative to SE-based NFC implementation Impact and Outlook

6. QR/Bar codes: remotely-based
Merchant’s physical shop
Trigger redirects payment
transaction to e-money transfer
Internet
Lifecycle management
E-Money Service
Authentication and payment transaction (e-money transfer)
Internet

7. Bluetooth Low Energy: remotely-based
Merchant’s physical shop
Trigger redirects payment
transaction to e-money transfer
Internet
Lifecycle management
E-Money Service
Authentication and payment transaction (e-money transfer)
Internet

8. BLE: How does it work? User experience perspective
The Beacon network at the store is aware that consumer is in the area and “checks him in” after he approves so.
Proximity marketing when consumer passes nearby B&M store
Consumer is checked in at the store
As the consumer enters a micro-region at the store, he receives personalized deals or coupons
Cashier submits payment from the POS by selecting customer from list of nearby checked-in customers
Consumer approaches cash register to choose payment scheme and give verbal approval for payment
Cashier verifies identity of consumer using visual inspection.
Customer chooses payment scheme
POS detects presence of customer nearby. List of customers nearby is re-sorted
The POS is equiped with a beacon as well

9. BLE: Business opportunities
Proximity marketing
Micro Location-based notification
Customized marketing
Specific directions
Indoor mapping
“Contactless payments”

10. The principle underlying use for both technologies is different
BLE versus NFC
BLE and NFC are both short range wireless data transfer technologies, even though the range at which BLE operates is much longer.
Tens of meters compared to a few centimeters for NFC
Between both technologies there are minor differences in power consumption
Whereas NFC is focused on one-to-one data exchange, BLE allows for multiple simultaneous connections
Both BLE and NFC utilize AES-128 bit data encryption and pairing modes
The principle underlying use for both technologies is different

11. “Traditional” NFC Handset Host CPU Secure Element Read / Write mode
Scope
Read / Write
mode
Peer 2 peer mode
Card emulation
mode
Tag
Handset
Terminal

12. SE-based NFC: proximity-based
SEI-TSM
SP-TSM
Merchant’s physical shop
Lifecycle management
NFC

13. Challenge for SE-based NFC Card Emulation: SEI ≠ SP
High investments
Complex network
Immature business arrangements
...
Low degree of standardisation
High degree of collaboration needed
Physical cards:
SEI = SP
NFC Card emulation:
SEI ≠ SP
Perso bureau
Card vendor
BPO
Supply
contract SP
SP TSM
SEI TSM
BPO
Supply
contract
Card vendor
Supply contract SP
SEI

14. Android KitKat’s HCE promises to change that

15. Host-based Card Emulation
AID
Routing Rule
Default
Host
AID Y
Secure Element
Android device
Host CPU
Android OS
Contactless smartcard reader
Select AID “x”
NFC Controller
Secure Element
NFC controller Registry
Select AID “y”

16. HCE takes place in environment that is not secure: the host
Android has in-built security mechanisms (e.g. sandboxing). These may be over-ruled in case the device is rooted.
Android device
Host CPU
Android OS
Device rooting
Contactless smartcard reader
Select AID “x”
NFC Controller
Secure Element

17. HCE & Cloud solutions. Device Authentication. Key Management.
Date
HCE & Cloud solutions.
App 1
Device Authentication.
Key Management.
Tokenization.
Token storage.
PCI requirements.
Host physical and logical requirements.
App 2
Wallet

18. HCE accelerates the NFC ecosystem
NFC Ecosystem is getting ready to scale up:
Device support
Consumers are used to access services from mobile devices
Infrastructure is growing
SE access discussions are however delaying development, while many services do not require top-level security from day one
With HCE SPs have the freedom to choose for the HW security or not

19. HCE impact on NFC ecosystem
Explanation
SPs
Are given an additional degree of freedom
SEI (& SEI TSM)
The role of the SEI is removed (or much lighter) for HCE services
TSM
The role of (SP-)TSMs may change from the personalization of an applet to the personalization of an HCE service.
App development
Enhancing the security of HCE applications
Existing wallet and payment apps to be updated

20. Example 1: HCE for open-loop high value payments
Pro
Convenience
Reduced costs
Less players + no SE issuers
Con
Decreased security
High potential losses
Certification unclear (yet)
HCE as an NFC driver takes into account the value of HCE services helping to streamline the use of NFC. Since HCE services are ‘easier’ to deploy than current SE based NFC implementations, then it is assumed that wider spread would mean NFC is driven positively (+).
On the other hand, end-users using HCE services would not distinguish between SE and HCE based NFC services. Therefore a security breach encountered in an HCE service could drive perception of NFC being unsafe. Thus, having a negative driver effect (-).
SP’s compromise point-of-view

21. Example 2: HCE for low value payments, closed loop systems, transit, access control
Pro
Convenience
Reduced costs
Less players + no SE issuers
Con
Decreased security
Low potential losses
Compatibility
SP’s compromise point-of-view

22. Summary
Alternatives approaches are available, all bring their own challenges.
Cash and Physical cards are still the most commonly deployed

23. THANK YOU.