Architecture and Development of NFC Applications


Published on

Sept 2009: this is an updated presentation of the Near Field Communication (NFC) technology. I tried to explain how NFC works on a SIM card, what are the standardization bodies, roles and actors in the ecosystem.
This presentation is for developers and describes technical architecture to implement a NFC application on a SIM card using Java and APDU commands (JSR-177, 257 and 268).
These slides will be presented during the Smart University 2009 in Nice, Sophia-Antipolis.

Published in: Technology
  • Njce! Thanks for sharing.
    Are you sure you want to  Yes  No
    Your message goes here
  • More than 5000 IT Certified ( SAP,Oracle,Mainframe,Microsoft and IBM Technologies etc...)Consultants registered. Register for IT courses at Most of our companies will help you in processing H1B Visa, Work Permit and Job Placements
    Are you sure you want to  Yes  No
    Your message goes here
  • what is the future of NFC in 2012, when android and blackberry apps are having the Leon role ?
    Where J2Me apps will go, while we have now Java/Android and more.
    Are you sure you want to  Yes  No
    Your message goes here
  • @Identive_Group

    I have requested my software development Engg to review and contact you via email.
    Are you sure you want to  Yes  No
    Your message goes here
  • Vijay, thanks for reaching back out. We'd love to talk with you. Have you had a chance to take a look at our NFC Software Development Kit? If not, this may be of some assistance:

    In the interim, please reach out to our NFC team via email: Send them a quick message and they'll get right back to you!
    Are you sure you want to  Yes  No
    Your message goes here
No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Architecture and Development of NFC Applications

  2. 2. Presentation <ul><li>Project Manager at the University of Nice with Serge Miranda </li></ul><ul><ul><li>Ticket TAP </li></ul></ul><ul><ul><li>Campus Nova </li></ul></ul><ul><ul><li>NFC Container </li></ul></ul><ul><li>NFC Forum competition (WIMA, Monaco) </li></ul><ul><li>R&D Team in Morocco (mobile money transfer) </li></ul><ul><li>Blog: </li></ul>
  3. 3. Campus Nova <ul><li>NFC trial with Credit Agricole and mobile payment at the student cafeteria in Sophia-Antipolis </li></ul>
  4. 4. Ticket TAP mobile is digital, targeted and personal Present Future Come & see us: Get 10% off ladies bags until tomorrow 50% reduction for girl students at the star light Dance Club ? VS.
  5. 5. Partners
  6. 6. <ul><li>Introduction to NFC, its Ecosystem </li></ul><ul><ul><li>Radio Frequency Identification </li></ul></ul><ul><ul><li>Contactless cards </li></ul></ul><ul><ul><li>Standardization bodies </li></ul></ul><ul><ul><li>Roles and Actors </li></ul></ul><ul><ul><li>NFC tags </li></ul></ul><ul><li>NFC on a SIM card </li></ul><ul><ul><li>Smart Cards </li></ul></ul><ul><li>NFC services </li></ul><ul><ul><li>use cases </li></ul></ul><ul><ul><li>Pilots and business aspect </li></ul></ul><ul><ul><li>Available devices </li></ul></ul>Objectives
  7. 7. Objectives (2) <ul><li>NFC for developers </li></ul><ul><ul><li>Dev kits </li></ul></ul><ul><ul><li>Reading/Writing tags </li></ul></ul><ul><ul><li>APDU </li></ul></ul><ul><ul><li>JSR 257 & 177 </li></ul></ul><ul><ul><li>Java Card </li></ul></ul><ul><ul><li>PC/SC readers JSR-268 </li></ul></ul><ul><ul><li>Midlet </li></ul></ul><ul><ul><li>SCWS </li></ul></ul><ul><li>Demo and Examples </li></ul><ul><li>Conclusion </li></ul>
  8. 8. Mobiquity <ul><li>MOBI lit Y (Mobile) </li></ul><ul><li>Ubi QUIT ous (Internet) </li></ul>One of the major added value for NFC is the security of third party applications provided by the SIM card.
  9. 9. Google Android
  10. 10. ATAWAD <ul><li>Google is going from web to mobile. This means you can now create a contact or an entry in your calendar from your mobile and data is automatically replicated not on the SIM but on Google servers (trust and private life is another debate).  </li></ul><ul><li>ATAWAD = Any Time, Any Where, Any Device </li></ul><ul><li>They start from the needs without necessarily innovate. </li></ul><ul><li>They did not create the search engine, they just improved it. </li></ul><ul><li>In 5 years we’ll probably say: &quot;they didn’t create the mobile, they’ve just improved it.&quot; </li></ul>
  11. 11. Needs of NFC ? <ul><li>NFC is not like GPS </li></ul><ul><ul><li>The value chain and the different roles are complex. </li></ul></ul><ul><li>NFC strenghts </li></ul><ul><ul><li>Smart poster. </li></ul></ul><ul><ul><li>Configuration shortcut. </li></ul></ul><ul><li>NFC in SIM card </li></ul><ul><ul><li>Digital signature. </li></ul></ul><ul><ul><li>Secure payment. </li></ul></ul><ul><li>Handset manufacturers Nokia, Apple, ... must agree with MNOs Orange, SFR, ... </li></ul>
  12. 12. PART 1 Introduction to NFC, its Ecosystem
  13. 13. RFID <ul><li>RFID : Radio Frequency Identification </li></ul><ul><li>RFID Tags: Store and retrieve data (with a distant reader) </li></ul><ul><li>History : radar technology, cow identification (year 1970). </li></ul><ul><li>Use case examples: road taxes, trace books in libraires, access card, shops (Wall-Mart). </li></ul><ul><li>RFID tags types </li></ul><ul><ul><li>Active </li></ul></ul><ul><ul><li>Passive (without battery) </li></ul></ul>
  14. 14. RFID Frequencies <ul><li>125-135KHz </li></ul><ul><li>Round corners </li></ul><ul><li>Through most things </li></ul><ul><li>No radiation problem </li></ul><ul><li>No reflection problem </li></ul><ul><li>Cheaper electronics </li></ul><ul><li>13.56MHz </li></ul><ul><li>1m max range </li></ul><ul><li>Doesn’t work through metal and fluids </li></ul><ul><li>UHF </li></ul><ul><li>Long range (up to 10m without battery) </li></ul><ul><li>GHz </li></ul><ul><li>Long range </li></ul><ul><li>High data rate </li></ul><ul><li>Smallest </li></ul>Best compromise for most cards and tickets ANIMALS, BEER BERRELS, GAS CYLINDERS, SHOES OF MARATHON RUNNERS CONVEYANCES, VEHICLES, LIBRARY, LAUNDRY, ITEM LEVEL TAGGING, BANKNOTES, ERROR PREVENTION, SECURE ACCESS, AIRPORT BAGGAGE
  15. 15. From RFID to NFC <ul><li>Can communicate with objects </li></ul><ul><li>Magnetic field induction </li></ul><ul><li>Contactless technology based on RFID 13,56MHz </li></ul><ul><li>NFC is standardized ECMA-340 and ISO/IEC 18092 </li></ul><ul><li>Backward compatibility with ISO14443 and SmartCard </li></ul><ul><ul><li>Millions of readers </li></ul></ul><ul><ul><li>Easy to use </li></ul></ul>
  16. 16. Contactless Cards <ul><li>FELICA (sony) encryption key generated dynamicaly at each auth. </li></ul><ul><li>Topaz Tag Innovision </li></ul><ul><li>MIFARE Standard: </li></ul><ul><ul><li>512bits UL (no security) used for tickets </li></ul></ul><ul><ul><li>Other formats : 1K (768 Bytes data), 4K </li></ul></ul><ul><ul><li>The 16bits random of MIFARE has been hacked </li></ul></ul><ul><ul><ul><li>NXP announced MIFAREplus </li></ul></ul></ul><ul><li>MIFARE DESFire preprogrammed card Example: Oyster Card in London </li></ul><ul><li>Gemalto: Mifare 4 Mobile </li></ul><ul><li>Contactless Java Card </li></ul>85%+ of the access control / Ticketing ISO14443 market is Mifare®
  17. 17. NFC <ul><li>NFC allows a device to read and write a contactless card, act like a contactless card and even connects to another NFC device to exchange data. </li></ul><ul><li>3 modes : </li></ul><ul><ul><li>Card reading (MIFARE …) </li></ul></ul><ul><ul><li>Peer to peer (initiator & target) </li></ul></ul><ul><ul><li>Card emulating </li></ul></ul><ul><li>Distance : 0 - 20 centimeters </li></ul><ul><li>Bandwidth to 424 kbits/s </li></ul><ul><li>NFC Forum : NDEF specs </li></ul><ul><li>N-Mark: </li></ul>NFC FORUM
  18. 18. Standardization bodies <ul><li>ETSI / SCP (Smart Card Platform) to specify the interface between the SIM card and the NFC chipset. </li></ul><ul><li>EMVCo for the impacts on the EMV payment applications. </li></ul><ul><li>GSM Association </li></ul><ul><li>Mobey Forum for mobile financial services </li></ul><ul><li>AFSCM is French association for mobile contactless </li></ul><ul><ul><li>Download specifications here: </li></ul></ul><ul><li>Global Platform to specify a multi-application architecture of the secure element. </li></ul><ul><li>Etc. </li></ul>
  19. 19. NFC FORUM SPECS Applications LLCP (Logical Link Control Protocol) RTD (Record Type Definition) & NDEF (Data Exchange Format) Card Emulation (Smart Card Capability for Mobile Devices) RF Layer ISO 18092 + ISO 14443 Type A, Type B + FeliCa Peer to peer mode Read/Write mode Card emulation mode
  20. 20. Smart Poster <ul><li>Location based services </li></ul><ul><li>List of proximity services depending on Points of Interest </li></ul><ul><li>Trailers </li></ul><ul><li>Tickets booking </li></ul><ul><li>Specifications </li></ul><ul><ul><li>NFC Forum releases specification for NDEF . </li></ul></ul><ul><ul><li>NFC Data Exchange Format which is a way to « format » RFID tags to be compatible with NFC applications. </li></ul></ul><ul><ul><li>Works with MIME type. </li></ul></ul>From SMS push to Smart Poster « pull »
  21. 21. Smart Poster RTD MAY SHALL For example, the Smart Poster record defines a URI plus some added metadata about that URI. Action record values Value Action 0 Do the action (send the SMS, launch the browser, make the telephone call) 1 Save for later (store the SMS in INBOX, put the URI in a bookmark, save the telephone number in contacts) 3 Open for editing (open an SMS in the SMS editor, open the URI in an URI editor, open the telephone number for editing).
  22. 22. NFC Forum tag types <ul><li>Interoperability between tag providers and NFC device manufacturers </li></ul><ul><li>Type 1 , based on ISO14443A. Tags are read and re-write capable; users can configure the tag to become read-only. Memory availability is 96 bytes and expandable to 2 Kbytes. Communication speed is 106 Kbit/s. </li></ul><ul><li>Type 2 , same as Type 1 except that memory availability is 48 bytes and expandable to 2 Kbytes. </li></ul><ul><li>Type 3 is based on FeliCa. Tags are pre-configured at manufacture to be either read and re-writable, or read-only. Memory limit is 1Mbyte per service. Communication speed is 212 Kbit/s or 424 Kbit/s. </li></ul><ul><li>Type 4 , fully compatible with ISO14443A and B standards. Tags are pre-configured. Up to 32 Kbytes per service. Communication speed is up to 424 Kbit/s. </li></ul>
  23. 23. NFC Roles and actors Service provider Trusted Service Manager (MNO or TTP) Application owner SIM Card Manufacturer (Smart Card provider) Card Issuer MNO (SIM Card management system) Contactless service management platform OTA NFC Service Management POS SIM NFC Mobile station holder
  24. 24. NFC service provider Mobile domain Mobile operator NFC applications repository Webapp NFC service operator SIM management system SIM card Application Customers management database cardlets Service profile platform Profile data KS FS Final user Customers management database Life cycle management system for mobile NFC applications KS FS Application data GUI SDD management system KS SSD Card management system KS ISD Network access Customer service Subscribe a service Subscribe a service Subscribe a service Interfaces 3 1 Customer Operator information system Customers data 2
  25. 25. Use case: phone is lost Service provider TSM Mobile operator Customer <ul><li>Ask for token (delegated management) </li></ul><ul><li>Ask applet installation via ISD (MNO centric model) </li></ul><ul><li>Tells phone has been lost </li></ul><ul><li>Tells customer has new SIM card </li></ul><ul><li>Service installation request after customer registration </li></ul><ul><li>Tells phone has been lost </li></ul><ul><li>Tells customer has new SIM card </li></ul><ul><li>Services management & referral for SP </li></ul><ul><li>Install NFC services </li></ul>
  26. 26. Global Platform - security domains By Gemalto Low TRUST High Mandated DAP (applications integrity at plaform level) DAP Verification (application integrity by SSD) Issuer Centric (only ISD management) Delegated Management (token management) Authorized Management (dual management) High CONTROL Low
  27. 27. NFC on a Mobile Phone one thing among all Contactless Screen with a user interface Security GPS Loudspeaker and Microphone Keyboard Camera Network TV etc.
  28. 28. NFC Architecture
  29. 29. PART 2 NFC in a SIM Card
  30. 30. Smart Card <ul><li>Piece of plastic the size of a credit card hosting an electronic circuit that can store and process information. </li></ul><ul><li>The integrated circuit (chip) may contain a microprocessor capable of processing this information, or it can only contain non-volatile memory with a security component (memory card). </li></ul><ul><li>Smart cards are mainly used as means of personal identification (identity card, access badge to buildings, health insurance card, SIM card) or payment (credit card, electronic purse) or proof of subscription to prepaid services (calling card, ticket). </li></ul><ul><li>Contact or Contactless smart card readers are used as a communications medium between the smart card and a host (point of sale). </li></ul>
  31. 31. Smart Card used in France for healthcare refunds (Carte Vitale)
  32. 32. Smart Card history <ul><li>The automated chip card was invented by German rocket scientist  Helmut Gröttrup  and his colleague Jürgen Dethloff . </li></ul><ul><li>French inventor  Roland Moreno  actually patented his first concept of the memory card. </li></ul><ul><li>Michel Ugon  from Honeywell Bull invented the first microprocessor smart card. </li></ul><ul><li>Bull patented the SPOM (Self Programmable One-chip Microcomputer) that defines the necessary architecture to auto-program the chip. </li></ul>1968 1974 1977 1978
  33. 33. Smart Card until today <ul><li>The first mass use of the cards was for payment in French pay phones (Bull CP8). </li></ul><ul><li>Smart Card is standardized ISO 7816. </li></ul><ul><li>The second use was with the integration of microchips into all French debit cards. </li></ul><ul><li>First Java Cards. </li></ul><ul><li>Axalto and Gemplus, at the time the world's no.2 and no.1 smart card manufacturers, merged and became Gemalto . </li></ul>1983 1987 1992 1997 2006
  34. 34. Smart Card categories Microprocessor card Memory card Contact card Contactless card
  35. 35. The memory card <ul><li>EEPROM read/write memory (4K max) </li></ul><ul><ul><li>Ex: Mifare </li></ul></ul><ul><li>Advantages </li></ul><ul><ul><li>Simple </li></ul></ul><ul><ul><li>Cheap </li></ul></ul><ul><li>Drawbacks </li></ul><ul><ul><li>Security (easy to duplicate) </li></ul></ul>
  36. 36. Microprocessor card <ul><li>Microprocessor used by the application running on card to calculate operations. </li></ul><ul><li>Each card can be personalized and updated after manufacture (for banks with more than 500 000 customers).  </li></ul><ul><ul><li>Credentials can be updated while the card is inserted in a bank automat for example. </li></ul></ul>Very secure for a reasonable cost
  37. 37. Smart Card security <ul><li>Information stored can be protected by a PIN code </li></ul><ul><li>Cryptographic operations </li></ul><ul><li>Circuit is shielded </li></ul><ul><li>Unique serial number </li></ul><ul><li>Software security </li></ul><ul><ul><li>Access control to data </li></ul></ul><ul><ul><li>Data integrity </li></ul></ul><ul><ul><li>IN/OUT firewall </li></ul></ul>
  38. 38. Smart Card anatomy <ul><li>CPU: Control Processing Unit </li></ul><ul><li>SRAM: Static Random Access Memory </li></ul><ul><li>ROM: Read Only Memory </li></ul><ul><ul><li>Static </li></ul></ul><ul><ul><li>Store the Operating System </li></ul></ul><ul><li>EEPROM: Electrically Erasable and Programmable Read Only Memory </li></ul><ul><ul><li>Persistent </li></ul></ul><ul><li>CRYPTO:  Cryptographic processor </li></ul><ul><li>RNG:  Random Number Generator </li></ul><ul><ul><li>Used to generate keys </li></ul></ul>
  39. 39. Smart Card connectors <ul><li>A Smart Card has 8 connectors : (ISO7816-2) </li></ul><ul><li>C1 Vcc </li></ul><ul><li>C2 RST </li></ul><ul><li>C3 CLK </li></ul><ul><li>C4 RFU ( Reserved for future use) </li></ul><ul><li>C5 GND </li></ul><ul><li>C6 Vpp (old EEPROM) </li></ul><ul><li>C7 I/O (bi-directional, in half-duplex mode) </li></ul><ul><li>C8 RFU ( Reserved for future use) </li></ul>
  40. 40. Contactless Card <ul><li>ISO 14443 defines the standard for Contactless Card. </li></ul>
  41. 41. Smart Card applications <ul><li>Secure a computer </li></ul><ul><ul><li>Store internet security certificate </li></ul></ul><ul><ul><li>Hard drives can be encrypted using and attached Smart Card </li></ul></ul><ul><ul><li>Used to authenticate a user on the computer (at login screen) </li></ul></ul>
  42. 42. Smart card applications <ul><li>Payment </li></ul><ul><ul><li>Credit card, SIM card, TV Channel card, Access card </li></ul></ul><ul><ul><li>Transports </li></ul></ul><ul><ul><li>Electronic purse (coffee machine) </li></ul></ul><ul><li>Identification </li></ul><ul><ul><li>PKI </li></ul></ul><ul><ul><li>Digital signature </li></ul></ul><ul><ul><li>Can store biometric data </li></ul></ul><ul><ul><li>2009 in Spain and Belgium: eID card </li></ul></ul><ul><ul><ul><li>2 certificates: one used to authenticate and one to apply the digital signature (real legal value) </li></ul></ul></ul>
  43. 43. Pyramid of Authentication Technologies Higher level of security offered for highly valued information User private key is kept in a device such as a smart card. Biometrics are also used to protect key. User’s private key is stored on a portable computer device such as a disk. User name and password authenticates User – PGP encrypts data. SSL encrypts data.
  44. 44. Part 3 NFC potential, services and devices
  45. 45. NFC on iPhone NFC already on iPhone: Stickers, 30-pin RFID readers, SIM add-on…
  46. 46. <ul><li>Exchange data, P2P </li></ul><ul><li>Configuration (bluetooth pairing) </li></ul><ul><li>Vending machines, service maintenance </li></ul><ul><li>Loyalty, couponing </li></ul><ul><li>NFC poster, get information </li></ul><ul><li>Ticketing </li></ul><ul><li>Medical, home care </li></ul><ul><li>Web applications </li></ul><ul><li>Payment solution </li></ul><ul><li>Access control </li></ul><ul><li>Mobile signature </li></ul><ul><li>Etc. </li></ul>Added value services
  47. 47. NFC Use cases by Nokia
  48. 48. Mobile Ticketing <ul><li>A customer books two tickets for a concert. </li></ul><ul><li>He pays and downloads his tickets on his mobile phone with a simple touch. </li></ul><ul><li>He meets with his girlfriend and transfers the ticket on her mobile. </li></ul><ul><li>They arrives and unlock security gates thanks to their NFC mobile phone. </li></ul>14 millions RFID tickets were produced by ASK for Olympic Games in China - <ul><li>Mo bile ticketing will become more popular over the next few years, with 2.6 billion tickets worth $87 billion, delivered by 2011 </li></ul><ul><li>Juniper Research (April 2008) </li></ul>
  49. 49. NFC in the World (2009) <ul><li>Japan with Sony FeliCa, NTT DoCoMo NTT Docomo reports 10 million mobile credit card customers </li></ul><ul><li>StoLPaN « Store Logistics and Payment with NFC » is a pan-European consortium supported by the European Commission’s Information Society Technologies program: </li></ul><ul><li>Akbank and Turkcell test NFC in Istanbul </li></ul><ul><li>Visa launches NFC trial in Brazil </li></ul><ul><li>Citi launches NFC trial in India </li></ul><ul><li>Telefónica launches O2 Money, says it is ready to deploy NFC </li></ul><ul><li>Nokia Money </li></ul><ul><li>41 NFC-related trials and launches in the Asia-Pacific region so far… </li></ul><ul><li>etc. </li></ul>
  50. 50. NFC in France (2009) <ul><li>Disneyland Paris to test NFC and contactless cards from October 2009, with Crédit Mutuel and CIC banks . </li></ul><ul><li>Smart-Park with VINCI Park and Monext . </li></ul><ul><li>Paris Metro: Paris transport operators to launch NFC ticketing from the end of 2010. STIF will coordinate the Paris transport operators ( Optile , RATP and SNCF Transilien ) and the participating telecoms operators ( Orange , Bouygues Telecom and SFR ). </li></ul><ul><li>Pegasus workgroup: multi-operator (Orange, Bouygues Telecom, SFR), multi-bank (BNP Paribas, Groupe Crédit Mutuel-CIC, Crédit Agricole, Société Générale) with MasterCard, Visa Europe and Gemalto for mobile payment in two cities: Caen and Strasbourg </li></ul><ul><li>Nice NFC city </li></ul>
  51. 51. NFC gives sense to touch based services Object Tag + URL Mobile device Reader Display Wireless service provider Information on Objects Components of an object hyperlinking scheme <ul><li>NFC is not a Bluetooth replacement. NFC is not made to transfer objects. </li></ul><ul><li>One of the key argument for NFC is to pair a Bluetooth device. </li></ul><ul><li>More than wireless. </li></ul><ul><li>Proximity and contact. </li></ul><ul><li>Secure payment. </li></ul>
  52. 52. NFC tomorrow <ul><li>Hard beginning Three years ago, ABI Research predicted half of mobile phones in the world will be NFC ready in 2009. </li></ul><ul><li>Juniper research, september 2009 : </li></ul><ul><ul><li>NFC Mobile Payments to Exceed $30bn by 2012, Supported by Revenues from Mobile Coupons and Smart Posters </li></ul></ul><ul><li>June 2009: Top handset manufacturers begin sampling NXP’s PN544 NFC chip The PN544 NFC controller is the first fully industry standard NFC handset chip, offering compliance with the Single Wire Protocol and with Mifare . </li></ul>
  53. 53. In a recent presentation, Sony Ericsson says mobile NFC will take more than 5 years to become mass market. NFC tomorrow
  54. 54. NFC keys of success <ul><li>Reach and availability </li></ul><ul><ul><li>The availability of NFC phones and SIM card </li></ul></ul><ul><li>Variety of use </li></ul><ul><li>Ease of use </li></ul><ul><ul><li>See iphone </li></ul></ul><ul><li>Security </li></ul><ul><ul><li>Be able to lock payment card </li></ul></ul><ul><li>Added value services </li></ul><ul><ul><li>Advantage for customer ? </li></ul></ul><ul><li>Infrastructure </li></ul><ul><ul><li>NFC access points in shops </li></ul></ul>Complex value chain + Mobile OTA B2C battle
  55. 55. NFC Devices <ul><li>NFC Phones using single wire Protocol and UICC (08/2008) </li></ul><ul><li>The Sagem my700X </li></ul><ul><li>The LG L600V </li></ul><ul><li>The Nokia 6131 SWP </li></ul><ul><li>The Motorola SLVR L7 </li></ul><ul><li>All devices are more or less concept devices and come with an InsideContactless NFC Chip. </li></ul><ul><li>In order to develop applications with these devices a Dev Kit (like the Gemalto Developer Suite ) and a SWP UICC is required. All four devices are already capable of using SCWS . </li></ul>
  56. 56. NOKIA 6212 <ul><li>Java MIDP 2.0 </li></ul><ul><li>Bluetooth 2.0 </li></ul><ul><li>2 megapixel camera </li></ul><ul><li>3G connection </li></ul><ul><li>Share business cards, bookmarks, calendar notes, images, profiles, and more. </li></ul><ul><li>Contactless payment and ticketing capabilities. </li></ul><ul><li>Access to mobile services and information with a simple touch. </li></ul><ul><li>Uses Java specification requirement 257 (JSR 257) for third-party NFC applications. </li></ul><ul><li> </li></ul>Jeremy Belostock on the future of NFC
  57. 57. Nokia 6216 <ul><li>First SIM-based NFC handset by Nokia </li></ul><ul><ul><li>Capable of storing credit card, user account and other security details on the SIM card, </li></ul></ul> normal availability appr. Q1/2010 See video, Jeremy Belostock, NFC, and operators
  58. 58. Security and memory for RFID tags vs cost National ID card Aircraft part tag Passport label / page Secure access or credit card Transit card Transit ticket Library book label Item drug label Retail pallet / case label Specification typically ISO 14443 or 15693 (r ead distance to 50 cm) 7cents Chip cost 3dollars Security and/or memory size
  59. 59. NFC requirements
  60. 60. Part 4 NFC for developers
  61. 61. Developing on a Mobile Phone is Different operating systems, browsers, etc. What are the solutions to develop a 3rd party application on a mobile phone except on iPhone 
  62. 62. UICC SIM NFC antenna External env. Applications CPU OS J2ME NFC Chip OTA OS Apps NFC Phone Architecture <ul><li>Single Wire Protocol (SWP) architecture: SIM & SE is same Java Card. </li></ul><ul><li>MIFARE is a storage which enables the phone to act like a MIFARE card. </li></ul>F rom a developer's point of view it does not matter at all where the SE is located. You will still code against the GlobalPlatform specs. The only difference comes with the distribution/lifecycle model; and since in most cases, the operators control both the SIM card and the phone, the difference is largely academical anyway. Of course, business people may think differently, but that's their problem. Jalkanen, Nokia discussion boards
  63. 63. NFC and C (with Java Native Interface) <ul><li>JNI allows to call C code and DLL in Java. </li></ul><ul><li>  To use JNI, you must follow the following steps: </li></ul><ul><ul><li>Create a Native method in Java </li></ul></ul><ul><ul><li>Once the Java class is compiled, you must generate a header file with the tool javah –h . </li></ul></ul><ul><ul><li>Compile the native code using the interface generated at step 2. Change the methods headers and params. </li></ul></ul><ul><ul><ul><li>For example: a String becomes a Jstring . </li></ul></ul></ul>
  64. 64. NFC and Java <ul><li>Java / NFC Java is the key. It allows technologies to work together : Bluetooth, Video, Music, GPRS, … </li></ul><ul><li>Problems of JSR not implemented on a mobile phone </li></ul><ul><li>Graphical user Interface are not always compatible : screen size, different JVM. </li></ul><ul><li>Solution: Mobile Distillery ? SVG ? Flash lite ? SIM Toolkit ? SCWS ? HTML5 ? </li></ul><ul><li>Native application : security problem, no API, manufacturer lock… Symbian development is heavy. </li></ul>
  65. 65. <ul><li>Java IDE such as Eclipse or Netbeans </li></ul><ul><li>SDK from manufacturers (Nokia) </li></ul><ul><li>Dev Kit from card issuers (Gemalto, Oberthur) </li></ul><ul><li>Dev Kit from MNO (Orange) </li></ul>Development Kits
  66. 66. JCOP Tools <ul><li>String uri = System.getProperty(&quot;;); </li></ul><ul><li>ISO14443Connection iseConn = (ISO14443Connection); </li></ul><ul><li>Applet extends javacard.framework.Applet </li></ul><ul><li>MIDlet </li></ul><ul><li>JCOP tools need </li></ul><ul><ul><li>activation key: [email_address] </li></ul></ul><ul><ul><li>compatible PC/SC reader </li></ul></ul><ul><li>Configure SE keyset to 42 ENC, MAC and KEY are all &quot;404142434445464748494A4B4C4D4E4F” </li></ul>public void process(APDU apdu){ byte[] buf = apdu.getBuffer(); // Ignore Select instruction. if (buf[ISO7816.OFFSET_CLA] == 0x00 && buf[ISO7816.OFFSET_INS] == (byte)0xA4) { return; }
  67. 67. Gemalto Developer suite
  68. 68. Gemalto Developer suite
  69. 69. Nokia 6212 SDK Compatible with Netbeans and Eclipse
  70. 70. JSR-257 Contactless communication API <ul><li>For NFC and Infrared </li></ul><ul><li>Optional package for J2ME </li></ul><ul><li>DiscoveryManager Target listener (no matter the type) </li></ul><ul><li>Connection NDEF & ISO14443 </li></ul>
  71. 71. MIFARE <ul><li>Card is composed of 16 sectors with 4 blocks of 16 bytes each. </li></ul><ul><li>In each sector a block is reserved to define access bits . Ex : block 7. </li></ul><ul><li>A key is initialized to read and write data blocks. </li></ul>Security in a MIFARE 1K CARD
  72. 72. MIFARE Anti-collision <ul><li>An anti-collision system allows to operate with many cards in the same magnetic field. </li></ul><ul><li>The algorithm selects each card one by one and ensures that the transaction takes place on the selected card without data corruption. </li></ul><ul><li>MAD (MIFARE Application Directory) is a table written in first sector and used to identify which sector is dedicated to a specific application. </li></ul>Request Anti-collision Read/Write Authentication Select card Card id ? Transaction time GSMA tech guide: NFC mobile device and reader shall be less than or equal to 250ms to meet Service Provider requirements.
  73. 73. Receive read-only data from NDEF tag NDEF push The MIDlet can see that it was launched by touching a tag, by reading the DiscoveryManager property LaunchType.
  74. 74. Java Card <ul><li>Java Card MIFARE ProX & SmartMX are cards with microprocessor and OS (for example JCOP). </li></ul><ul><li>An Applet is a JAVA CARD application stored inside the Secure Element. </li></ul><ul><li>APDU COMMANDS is a way to communicate with Applet </li></ul><ul><li>ISO14443Connection and 7816-4 APDUS </li></ul><ul><li>Security : Crypto Processor </li></ul>
  75. 75. Java Card description <ul><li>At the beginning, applications on Smart Card were all developed proprietary and native . </li></ul><ul><li>There was a need to find a generic way to develop an application that could run on 2 Smart Cards issued by different companies. </li></ul><ul><li>The Java Card technology allows developers to gather around one way of programming using Java. And it openned the path to third party applications. </li></ul><ul><li>This technology can also be used to develop on a SIM card. A SIM card has more memory than other types of Smart Cards like Credit Card. </li></ul><ul><li>Java Card includes: </li></ul><ul><ul><li>An API (application programming interface) to define Java libraries that can be used </li></ul></ul><ul><ul><li>A virtual machine </li></ul></ul><ul><ul><li>Runtime (JCRE) : memory and security management </li></ul></ul><ul><li>Java Card 2.1.1 SDK provides an environment to test applets, a tool to upload applets into the Java Card, and code examples. </li></ul>
  76. 76. Smart Card protocols <ul><li>PTS : Protocol Type Sélection </li></ul><ul><li>ATR : Answer To Reset </li></ul>T=0 Byte-level transmission protocol, defined in ISO/IEC 7816-3 T=1 Block-level transmission protocol, defined in ISO/IEC 7816-3 APDU transmission via contactless interface, defined in ISO/IEC 14443-4
  77. 77. ISO 7816-4: APDU <ul><li>APDU Command ( C-APDU ), sent by reader to the card </li></ul><ul><li>Header, 4 Bytes </li></ul><ul><li>Class instruction ( CLA ) </li></ul><ul><li>Code instruction ( INS ) </li></ul><ul><li>Parameters : P1 et P2 </li></ul><ul><li>Optional body (random size) </li></ul><ul><li>Lc = length of body (data) in Bytes </li></ul><ul><li>Le = length of response to the command (Bytes) </li></ul><ul><li>The data field contains data to be sent to the card, to process instructions specified in header. </li></ul>
  78. 78. APDU command types <ul><li>4 APDUs commands are possible depending on whether it expects a response back or if it contains data. </li></ul><ul><ul><li>No data, no required answer </li></ul></ul><ul><ul><ul><li>CLA INS P1 P2 </li></ul></ul></ul><ul><ul><li>Data, no required answer </li></ul></ul><ul><ul><ul><li>CLA INS P1 P2 Lc Data </li></ul></ul></ul><ul><ul><li>No data, required answer </li></ul></ul><ul><ul><ul><li>CLA INS P1 P2 Le </li></ul></ul></ul><ul><ul><li>Data, required answer </li></ul></ul><ul><ul><ul><li>CLA INS P1 P2 Lc Data Le </li></ul></ul></ul>
  79. 79. AID <ul><li>AID = unique identifier for an application or a certain type of files </li></ul><ul><ul><li>First 5 bytes are RID (resource identifier) </li></ul></ul><ul><ul><li>Following bytes are PIX (proprietary identifier extension) </li></ul></ul>
  80. 80. Java Card <ul><li>Select </li></ul>
  81. 81. Java Card: CAP A smart  card  is inserted into a  Card Acceptance Device  (CAD) to power on the integrated circuit.
  82. 82. Java Card features <ul><li>Threads </li></ul><ul><ul><li>CPU on JavaCard does not support multiple tasks and you can’t use « synchronized » or « volatile ». </li></ul></ul><ul><li>Garbage collector </li></ul><ul><ul><li>Finalize() not supported </li></ul></ul><ul><li>Non-supported types: Long, Char, Float, Double </li></ul><ul><li>Supported types: </li></ul>
  83. 83. Java Card features <ul><li>Java Card support atomic transaction </li></ul><ul><ul><li>System.beginTransaction() </li></ul></ul><ul><ul><li>System.commitTransaction() </li></ul></ul><ul><ul><ul><li>System.abortTransaction() </li></ul></ul></ul>
  84. 84. Java Card security <ul><li>« Sandbox »: In Java, code and application data (resources) are protected by a sandbox and can’t interfere with other applications. </li></ul>
  85. 85. Java Card applet <ul><li>Let’s take the example of a Wallet to see how to code an applet. </li></ul><ul><li>This applet allows the SIM card to act as a real eletronic purse. </li></ul><ul><li>Use cases </li></ul><ul><ul><li>The applet can add and substract money to a balance </li></ul></ul><ul><ul><li>Shows the actual balance of the purse </li></ul></ul><ul><ul><li>It includes a mechanism to ask for a PIN code for security purposes </li></ul></ul>See articles on Sun website
  86. 86.
  87. 87. Java Card applet Wallet <ul><li>Package declaration </li></ul><ul><li>Java naming convention </li></ul><ul><li>Java Card framework </li></ul>package com.sun.javacard.samples.wallet; import javacard.framework.*;
  88. 88. Java Card: applet Wallet <ul><li>The Java class must extend Applet. It defines all the methods to communicate with JCRE. </li></ul>public class Wallet extends Applet
  89. 89. Java Card 2 modes <ul><li>An applet is unactive until it receives an APDU command </li></ul><ul><li>Card Emulation </li></ul><ul><li>Reader Emulation </li></ul>
  90. 90. Applet PIN code <ul><li>In the Wallet source code, the VERIFY method checks the PIN code. The APDU command contains the parameter PIN (stored inside the data field). </li></ul><ul><li>If PIN code is the same than the one defined during the installation process, the method returns true. </li></ul><ul><li>PIN_TRY_LIMIT = 3 </li></ul>
  91. 91. CLA and INS <ul><li>We choose the hexadecimal value 0xB0 to identify our Wallet. </li></ul><ul><li>This value identifies all APDU commands that are processed by the applet. </li></ul><ul><li>It means that the APDU commands debit and credit all start with the byte CLA 0xB0. </li></ul>Wallet_CLA =(byte)0xB0;
  92. 92. INS <ul><li>The 2 nd byte of an APDU command identifies the instruction </li></ul>final static byte VERIFY = (byte) 0x20; final static byte CREDIT = (byte) 0x30; final static byte DEBIT = (byte) 0x40; final static byte GET_BALANCE = (byte) 0x50
  93. 93. Other values <ul><li>Other fixed values of our electronic purse </li></ul><ul><li>The variables </li></ul>// maximum balance final static short MAX_BALANCE = 0x7FFF; // maximum transaction amount final static byte MAX_TRANSACTION_AMOUNT = 127; // maximum number of incorrect tries before the // PIN is blocked final static byte PIN_TRY_LIMIT =(byte)0x03; // maximum size PIN final static byte MAX_PIN_SIZE =(byte)0x08; OwnerPIN pin; short balance;
  94. 94. Applet structure <ul><li>Constructor </li></ul><ul><li>Install </li></ul><ul><li>Select </li></ul><ul><li>Process </li></ul><ul><ul><li>Header analysis (CLA and INS) </li></ul></ul>public void process(APDU apdu) {
  95. 95. Send and receive APDUs <ul><li>setIncomingAndReceive(); </li></ul><ul><li>setOutgoingAndSend() </li></ul><ul><ul><li>Transfer mode </li></ul></ul><ul><ul><li>Expected length for the answer </li></ul></ul><ul><ul><li>Send bytes in response </li></ul></ul>byte[] apduBuffer = apdu.getBuffer(); apduBuffer[0] = byte1; apduBuffer[1] = byte2; apduBuffer[2] = byte3; //0-offset, 3-number of bytes to send apdu.setOutgoingAndSend(0, 3); byte[] buffer = apdu.getBuffer(); short bytes_left = (short) buffer[ISO.OFFSET_LC]; short readCount = apdu.setIncomingAndReceive(); while (bytes_left > 0) { //{process received data in buffer} … bytes_left -= readCount; //get more data readCount = apdu.receiveBytes (ISO.OFFSET_CDDATA); }
  96. 96. Get Balance <ul><li>Retrieve current balance of the electronic purse </li></ul><ul><ul><li>CLA: 0xB0 </li></ul></ul><ul><ul><li>INS: 0x50: GET BALANCE </li></ul></ul><ul><ul><li>P1: 0x00: Normal mode </li></ul></ul><ul><ul><li>P2: 0x00 </li></ul></ul><ul><ul><li>Data: </li></ul></ul><ul><ul><ul><li>in: none. </li></ul></ul></ul><ul><ul><ul><li>out: 2 bytes of balance. </li></ul></ul></ul>
  97. 97. Credit <ul><li>Mutual authentication </li></ul><ul><li>To send the APDU command, you must first initialize a secure transaction with the applet (MAC): </li></ul><ul><ul><ul><li>CLA: 0xB0 </li></ul></ul></ul><ul><ul><ul><li>INS: 0x30: CREDIT </li></ul></ul></ul><ul><ul><ul><li>P1: 0x00: Normal mode </li></ul></ul></ul><ul><ul><ul><li>P2: 0x00 </li></ul></ul></ul><ul><ul><ul><li>Data: - in: 2 bytes of value to credit. </li></ul></ul></ul><ul><ul><ul><ul><li>- out: 2 bytes of updated balance. </li></ul></ul></ul></ul><ul><ul><ul><ul><li>- exception: ISOException with reason SW_SECURITY_STATUS_NOT_SATISFIED (0x6982) if authentication failed. </li></ul></ul></ul></ul>
  98. 98. JSR-177 SATSA <ul><li>JSR-177: Security and Trust Services API for J2ME </li></ul><ul><li>Used to communicate with SIM card </li></ul><ul><li>Used to encrypt/decrypt/sign data </li></ul><ul><li>Example with symmetric algorithm here: </li></ul>
  99. 99. Gemalto examples <ul><li>APDU commands of GPPurse applet are stored in the file APDU_Commands.atf that comes with the project. You can open this file with the Jcard Manager and execute each command at a time. </li></ul><ul><li>Or manually thanks to the option Send APDU in the menu bar. </li></ul>
  100. 100. Gemalto developer suite: Instance AID
  101. 103. Nokia 6131 Secure Element <ul><li>Secure Element consists of Java Smart Card area and Mifare 4K area </li></ul><ul><li>A specific API provided for Applets to access Mifare memory </li></ul><ul><li>All access is password protected </li></ul><ul><li>Password is one-way hashed from Mifare KeyA and KeyB </li></ul><ul><li>JCSystem : atomic transaction management </li></ul><ul><li>The Secure Element IS NOT a play ground </li></ul>Protected by Issuer specific secret keys Protected by transport keys
  102. 104. PC/SC readers <ul><li>SCM reader uses PC/SC driver (Windows) </li></ul><ul><ul><li>Other readers: Philips Pegoda, Omnikey Cardman, etc. </li></ul></ul><ul><li>The most commonly used smart-card interface is PC/SC, a middleware layer backed by Microsoft, and part of the Windows operating system. </li></ul><ul><li>JPCSC is a Java-wrapper around the native PC/SC API . JCOP Tools includes JPCSC and uses it on Linux and MacOS X. On Windows, JCOP Tools uses the native PC/SC API directly. </li></ul><ul><li>JCOP Tools also includes the JCOP offcard API, which is a comprehensive smart card API with special support for Java Card and GlobalPlatform. That sits on top of native PC/SC, JPCSC, and some other proprietary card middleware. </li></ul><ul><li>OpenCard Framework (OCF) , s ee (consortium split up). </li></ul>
  103. 105. javax.smartcardio Java 6 introduces Smart Card I/O API defined by JSR 268 .
  104. 106. Dev tools and architecture <ul><li>Devices used - Mobile phone NOKIA 6131 - Tags MIFARE 1K - Pegoda Reader / Philips - SCM Contactless Reader </li></ul><ul><li>For developers: Netbeans, Eclipse, Visual Studio, etc. </li></ul><ul><li>NFC software layers </li></ul><ul><ul><li>Graphical User Interface (GUI), implemented in J2ME (or other). </li></ul></ul><ul><ul><li>Controller / Application logic (as much as possible), implemented on the Java Card / Secure Element. </li></ul></ul><ul><ul><li>Memory of the Mifare element used for storing data. </li></ul></ul>
  105. 107. MIDlet proxy Phone OTA Server Secure Element Mifare Applet MIDlet OTA provisioning can be done through HTTP / HTTPS or BIP/TCP. BIP is a new generation protocol allowing remote SIM management over the air (remote file management, remote application management).
  106. 108. Physical layer <ul><li>Steps for a standard NFC communication </li></ul><ul><li>Open </li></ul><ul><li>Poll </li></ul><ul><li>Connect </li></ul><ul><li>Exchange </li></ul><ul><li>Disconnect </li></ul><ul><li>Close </li></ul>
  107. 109. J2ME Java Midlet <ul><li>Java Platform Micro Edition Software Development Kit 3.0 </li></ul><ul><ul><li>Lightweight UI Toolkit (LWUIT) integration </li></ul></ul><ul><ul><li> </li></ul></ul><ul><li>ProGuard (obfuscator) </li></ul><ul><ul><li>Limited storage </li></ul></ul><ul><li>A mobile phone application is divided into 2 packages, a descriptor JAD file and a JAR file containing Java classes. </li></ul><ul><li>Thanks to the JAD file, the JAR file is installed on the mobile phone. Developer can set JAD attributes to manage permissions, push registry, etc. </li></ul><ul><li>Use a Controller to listen and launch threaded events: </li></ul><ul><ul><li>Call to NFC chip </li></ul></ul><ul><ul><li>Print new screen </li></ul></ul><ul><ul><li>Save data in Record Store </li></ul></ul>
  108. 110. J2ME Signature and certificate <ul><li>Security exception </li></ul><ul><li>MIDP permissions </li></ul><ul><ul><li> </li></ul></ul><ul><ul><li> </li></ul></ul>
  109. 111. SmartCard Web Server <ul><li>SIM Toolkit successor. </li></ul><ul><li>SCWS technology can be installed on new generation SIM card and allows GUI management thanks to mobile web browser. </li></ul><ul><li>The SIM card is the authorization module for secure electronic transactions but it’s the mobile phone that controls and generates graphical interfaces. With SCWS, a developer can implement the full application in one package and deploy it directly on the SIM card. MMI and Applets are on the same media. Deployment and administration of applications are simplified. For example: if the user changes his mobile phone. </li></ul><ul><li>Moreover, generated interfaces are compatible with most phones but the rendering and user interaction is not necessarily better. </li></ul>
  110. 112. SCWS Demo
  111. 113. Example of applications NFC Applications – My Keys Office Home Car Edit Delete Parking P5 New key received. Open application ? Yes No Writing key 75% Installing key… Key added Exit Yes Access granted. Add a shortcut ? Lock A PAMS Zone 1 PAMS Zone 2 Credential for PAMS Zone 2 can unlock A and B Lock B
  112. 114. <ul><li>See Mobile PKI (ETSI). </li></ul><ul><li>The MSSP platform is a solution to manage digital signatures for a MNO. </li></ul><ul><li>Two processes: </li></ul><ul><ul><li>Registration : to obtain a certificate and a private key </li></ul></ul><ul><ul><li>Signature : to sign data (with private key) </li></ul></ul>Mobile Signature Service Provider MSSP Operator Service Provider Certification authority
  113. 115. Ex: eBanking authentication <ul><li>Customer accesses his bank website thanks to his login/password. </li></ul><ul><li>Bank sends a request for authentication to Operator (WPKI). This request includes the mobile number (IMSI: International Mobile Subscriber Identity) </li></ul><ul><li>Customer enters PIN code </li></ul><ul><li>eBanking service is authorized </li></ul>Enter PIN code Back Ok The application needs to verify your identity Back Ok Secure Application Ok You are now authenticated
  114. 116. DEMO
  115. 117. HelloKiosk
  116. 118. Conclusion <ul><li>NFC in handsets without knowing it really soon </li></ul><ul><li>Industry is now convinced </li></ul><ul><li>SDK standardization </li></ul><ul><li>Easy to use ! Remember iPhone </li></ul>
  117. 119. Conclusion <ul><li>Use J2ME 3.0 </li></ul><ul><li>Use JSR 257 or SCWS </li></ul><ul><li>Optimize your code </li></ul><ul><li>Store your data online </li></ul><ul><li>Never trust a MIDlet </li></ul><ul><li>Sign your application </li></ul><ul><li>Use J2ME Polish or LWUIT to adapt your application to your target platforms (screen size) </li></ul><ul><li>Use web app for cross-platform development </li></ul><ul><li>Use AFSCM specifications for OTA </li></ul><ul><li>NFC is not an exchange protocol but identification </li></ul>For developers
  118. 120. Resources <ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li>Writing a Java Card Applet </li></ul>
  119. 121. Resources <ul><li>Contactless Smart Cards and NFC Peter Harrop, Ning Xiao & Raghu Das </li></ul><ul><li> , thanks for pictures </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> RFID Information </li></ul><ul><li> Mobile payment blog </li></ul><ul><li> Great blog on Java Card development </li></ul>Special thanks to Nicolas Pastorelly w ho helped me on some slides
  120. 122. Contact me <ul><li>Master MBDS , University of Nice Sophia-Antipolis </li></ul><ul><li>[email_address] </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul>