NFC based payment: how will it develop relative to upcoming alternative approaches?

1. NFC based payment: how will it develop relative to upcoming alternative approaches? Hong Kong | March 2014

2. About UL… Safe products Safe buildings Safe workplaces Safe water, food & health Safe, clean energy Promoting safe living and working environments Certify Validate Test Inspect Audit Advice & Educate We Be the best, and achieve meaningful size in all that we do

3. About UL Transaction Security Working towards a safer world by being the number one independent center in Transaction Security Technology • Unrivalled expertise across industry domains • State-of-the-art services/products portfolio • Recognition in our local markets – Thought Leadership • Scalable offering • Service offering

4. UL supports worldwide many mCommerce initiatives with advisory services Weve ISIS • “UL staff has been extremely valuable to ISIS in supporting the testing and integration of our TSM.” • “.. the UL team always considered any issues beyond just the technical aspects and looked at the wider commercial and customer implications, which was and is invaluable for us.” Customer References • “The effort from the UL team has been crucial for our project. Their competence, attitude and hard work have been inspiring for us all.” • “The strategic workshops hosted by UL TS at the start of our project were crucial to create a common vision and helped us to speed up the project” DNB & Telenor Mobiel Betalen Nederland

5. Agenda Alternative approaches to NFC-based payments Alternative to SE-based NFC implementation Impact and Outlook

6. QR/Bar codes: remotely-based Trigger redirects payment transaction to e-money transfer E-Money Service Internet Lifecycle management Authentication and payment transaction (e-money transfer) Merchant’s physical shop Internet

7. Bluetooth Low Energy: remotely-based Trigger redirects payment transaction to e-money transfer E-Money Service Internet Lifecycle management Authentication and payment transaction (e-money transfer) Merchant’s physical shop Internet

8. BLE: How does it work?User experience perspective The Beacon network at the store is aware that consumer is in the area and “checks him in” after he approves so. Proximity marketing when consumer passes nearby B&M store Consumer is checked in at the store Cashier submits payment from the POS by selecting customer from list of nearby checked-in customers As the consumer enters a micro-region at the store, he receives personalized deals or coupons Consumer approaches cash register to choose payment scheme and give verbal approval for payment Cashier verifies identity of consumer using visual inspection. Customer chooses payment scheme POS detects presence of customer nearby. List of customers nearby is re-sorted The POS is equiped with a beacon as well

9. BLE: Business opportunities Proximity marketing Specific directions Indoor mapping Micro Location-based notification Customized marketing “Contactless payments”

10. BLE versus NFC BLE and NFC are both short range wireless data transfer technologies, even though the range at which BLE operates is much longer. Tens of meters compared to a few centimeters for NFC • Between both technologies there are minor differences in power consumption • Whereas NFC is focused on one-to-one data exchange, BLE allows for multiple simultaneous connections • Both BLE and NFC utilize AES-128 bit data encryption and pairing modes The principle underlying use for both technologies is different

11. “Traditional” NFC Handset Secure Element Host CPU Scope Read / Write mode Peer 2 peer mode Card emulation mode Tag Handset Terminal

12. SE-based NFC: proximity-based SEI-TSM SP-TSM Lifecycle management NFC Merchant’s physical shop

13. Challenge for SE-based NFC Card Emulation: SEI ≠ SP Physical cards: SEI = SP NFC Card emulation: SEI ≠ SP Card vendor Supply contract SEI BPO Supply contract Supply contract Perso bureau Card vendor BPO BPO SP SP SEI TSM SP TSM

14. Android KitKat’s HCE promises to change that

15. Host-based Card Emulation Host CPU Android OS Android device Contactless smartcard reader Select AID “x” NFC Controller Secure Element Select AID “y”

16. HCE takes place in environment that is not secure: the host Host CPU Android has in-built security mechanisms (e.g. sandboxing). These may be over-ruled in case the device is rooted. Android OS Android device Device rooting Select AID “x” Contactless smartcard reader NFC Controller Secure Element

17. HCE & Cloud solutions. • Device Authentication. • Key Management. • Tokenization. • Token storage. • PCI requirements. • Host physical and logical requirements. App 1 App 2 Wallet

18. HCE accelerates the NFC ecosystem • NFC Ecosystem is getting ready to scale up: • Device support • Consumers are used to access services from mobile devices • Infrastructure is growing SE access discussions are however delaying development, while many services do not require top-level security from day one With HCE SPs have the freedom to choose for the HW security or not

19. HCE impact on NFC ecosystem Impact on Explanation SPs • Are given an additional degree of freedom • The role of the SEI is removed (or much lighter) for HCE services SEI (& SEI TSM) TSM • The role of (SP-)TSMs may change from the personalization of an applet to the personalization of an HCE service. App development • Enhancing the security of HCE applications • Existing wallet and payment apps to be updated

20. Example 1: HCE for open-loop high value payments Pro Con • Convenience • Reduced costs • Less players + no SE issuers • Decreased security • High potential losses • Certification unclear (yet) SP’s compromise point-of-view

21. Example 2: HCE for low value payments, closed loop systems, transit, access control Con Pro • Decreased security • Low potential losses • Compatibility • Convenience • Reduced costs • Less players + no SE issuers SP’s compromise point-of-view

22. Summary Alternatives approaches are available, all bring their own challenges. Cash and Physical cards are still the most commonly deployed

23. THANK YOU.