1. © ZigBee Alliance. All rights reserved. 1 Natural Security Initiative Loic Berton - Benoit Courouble - Dominique Pierre MWG, July 2012

2. CONFIDENTIAL © ZigBee Alliance. All rights reserved. 2 Natural Security provides the first efficient and really easy-to- use three-factor authentication solution by enabling a consumer to conduct a transaction without manipulating its personal device or card The transaction is executed using a mid-range distance contactless interface combined with biometric authentication of the consumer The solution provides a unique user experience to authenticate for a wide range of services: – Physical or logical access control – Payment, Cash withdrawal – Secure access to Internet services Biometrics are securely stored in a secure element embedded in the consumer device providing increased privacy (no biometrics data stored remotely in data base, no PIN entering) Natural Security key features

3. CONFIDENTIAL © ZigBee Alliance. All rights reserved. 3 How does it work ? Acceptance devicesConsumer devices Wireless network range: 3 to 9 feet Fob Card all-in-one Mobile handset

4. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Pilot implementation being launched in 2 locations in France Secured payment transaction using chip and PIN technologies – payment transaction executed in a few seconds – no card to manipulate, no PIN to enter First pilot in the world using 2 different biometric technologies (fingervein and fingerprint) in a real payment environment Pilot implementation: payment 4

5. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Real life transaction execution 5

6. CONFIDENTIAL © ZigBee Alliance. All rights reserved. 6 Natural Security innovation brings to the ZigBee Alliance the fast growing strong authentication market Corporate Healthcare Government & Administration Transportation School campus Retail Financial institution Market Verticals Targeted

7. CONFIDENTIAL © ZigBee Alliance. All rights reserved. 7 Services targeted & Market size Physical & Logical access> 1 billion badges* Secure access to web server> 2 billions PC* Payment2.5 billions cards** 37 millions POS** Cash withdrawal2.2 millions ATM** Market Segments Targeted * estimate ** source Eurosmart

8. CONFIDENTIAL © ZigBee Alliance. All rights reserved. 2006 – Project started by banks and retailers 2008 – Company creation 2010 – General availability of the first version of the specs, first proofs of concept 2011-2012 – Launch of the commercial phase – Several pilots planned in 2012: payment (open and close loop), access control (physical and logical), mobile payment – Development of industrial "off-the-shelf” NS products Timeline 8

9. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Our Partners 9 Shareholders First vendors Memberships Technical partners Other vendors coming soon naccu.org

10. © ZigBee Alliance. All rights reserved. 10 WPAN Components 10

11. CONFIDENTIAL © ZigBee Alliance. All rights reserved. NFC (not adopted) – Require the consumer to handle the device to execute a transaction which takes beyond the 3 sec. maximum transaction time – Does not provide a unique user experience for all types of transactions – Strong concern on the security and the confidentiality of the solution (data transmitted in clear between the merchant and the consumer devices) Bluetooth Smart (a.k.a. BTLE) (not adopted) – Modulation scheme susceptible to interference – NS-WPAN architecture challenging to implement – Latency variability too large for requirements IEEE 802.15.4 (adopted) – Native support for NS-WPAN architecture – Acceptable, predictable latency Technologies evaluated 11

12. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Our WPAN implementation must respect several key requirements defined by government agencies such as : – Anonymous – No traceable protocol – Star topology (mesh topology cannot be used, introduces risk factors) – Fully reconfigurable, no coordinator And we add : – Dynamic and mobility – Mid range (between 1m to 3m) – High density of device – And low cost … Why do we need a « new » stack ? 12

13. CONFIDENTIAL © ZigBee Alliance. All rights reserved. matrix of market requirements against network features 13

14. CONFIDENTIAL © ZigBee Alliance. All rights reserved. AspectNFCBluetoothBluetooth Low Energy RFID compatibleISO 18000-3activeActive StandardisationbodyISO/IECBluetooth SIG Network StandardISO 13157 etc.IEEE 802.15.1 Network TypePoint-to-pointWPAN Cryptographynot with RFIDavailable Range< 0.2 m~100 m (class 1)~50 m Frequency13.56 MHz2.4–2.5 GHz Bit rate424 kbit/s2.1 Mbit/s~1.0 Mbit/s Set-up time< 0.1 s< 6 s< 0.006 s Power consumption< 15mA (read)varies with classe< 15 mA (transmit or receive) Comparaison NFC / Bluetooth 14

15. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Natural security Network Topology 13 WAD WPD POS1 Retail A POS2 POS1 Retail B Retail C

16. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Our stack will be implemented by several vendors Large organizations such as payment schemes will adopt this protocol only if it is owned and supported by an open association We conducted research to use other stacks or protocols (ZigBee pro, RF4CE, Dash7, Bluetooth) They don't meet our key business, technical and security requirements BLE could also be a potential good candidate however, 802.15.4 is considered as the best option at present Why do we need a « ZigBee » stack ? 16

17. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Technical specification developed by natural security Test plan developed by UL (RFI Global) The stack has been implemented on several chips used by multiple vendors: Atmel TI ST (being currently tested) Strong, active support of large retailers and financial institutions Current situation 17

18. CONFIDENTIAL © ZigBee Alliance. All rights reserved. Creation of a WG Natural Security proposes to act as technical editor and chair of the WG Natural Security will provide for free The specification The test plan Next steps … 18

19. © ZigBee Alliance. All rights reserved. 19 Thank you 19

20. © ZigBee Alliance. All rights reserved.www.zigbee.org