ARCHITECTURE & DEVELOPMENT OF NFC APPLICATIONS MOBILE JAVA DEVELOPMENT, JAVA CARD, USIM AND TOUCH-BASED SERVICES

Thomas de LazzariSmart-University 2009

Presentation

• Project Managerat the University of Nicewith Serge Miranda▫ Ticket TAP▫ Campus Nova▫ NFC Container

• NFC Forum competition (WIMA, Monaco)

• R&D Team in Morocco (mobile money transfer)

• Blog: http://tdelazzari.blogspot.com

Campus Nova NFC trial with Credit Agricole and mobile

payment at the student cafeteria in Sophia-Antipolis

Come & see us:Get 10% off ladies bags

until tomorrow

Ticket TAP

50% reduction for girl students at the star light

Dance Club

?Read and seek valuable offers

Receive personalized

offers VS.

mobile is digital, targeted and personal

Present Future

Partners

Introduction to NFC, its Ecosystem Radio Frequency Identification Contactless cards Standardization bodies Roles and Actors NFC tags

NFC on a SIM card Smart Cards

NFC services use cases Pilots and business aspect Available devices

Objectives

Objectives (2) NFC for developers

Dev kits Reading/Writing tags APDU JSR 257 & 177 Java Card PC/SC readers JSR-268 Midlet SCWS

Demo and Examples Conclusion

Mobiquity

MOBIlitY (Mobile) UbiQUITous (Internet)

One of the major added value for NFC is the security of third party applications provided by the SIM card.

Google Android

ATAWAD Google is going from web to mobile. This means you can

now create a contact or an entry in your calendar from your mobile and data is automatically replicated not on the SIM but on Google servers (trust and private life is another debate). 

ATAWAD = Any Time, Any Where, Any Device They start from the needs without necessarily innovate. They did not create the search engine, they just

improved it.

In 5 years we’ll probably say: "they didn’t create the mobile, they’ve just improved it."

Needs of NFC ? NFC is not like GPS

The value chain and the different roles are complex.

NFC strenghts Smart poster. Configuration shortcut.

NFC in SIM card Digital signature. Secure payment.

Handset manufacturersNokia, Apple, ...must agreewith MNOs Orange, SFR, ...

PART 1

Introduction to NFC, its Ecosystem

RFID RFID : Radio Frequency Identification

RFID Tags: Store and retrieve data (with a distant reader)

History : radar technology, cow identification (year 1970).

Use case examples: road taxes, trace books in libraires, access card, shops (Wall-Mart).

RFID tags types Active Passive (without battery)

RFIDFrequencies

125-135KHz Round corners Through most

things No radiation

problem No reflection

problem Cheaper

electronics

13.56MHz 1m max range Doesn’t work

through metal and fluids

UHF Long range (up to

10m without battery)

GHz Long range High data rate Smallest

Best compromise

for most cards and

tickets

ANIMALS, BEER BERRELS, GAS CYLINDERS, SHOES OF MARATHON RUNNERS

CONVEYANCES, VEHICLES, LIBRARY, LAUNDRY, ITEM LEVEL TAGGING, BANKNOTES, ERROR PREVENTION, SECURE ACCESS, AIRPORT BAGGAGE

From RFID to NFC

Can communicate with objects Magnetic field induction Contactless technology based on RFID

13,56MHz NFC is standardized ECMA-340 and ISO/IEC

18092 Backward compatibility with ISO14443 and

SmartCard Millions of readers Easy to use

Contactless Cards FELICA (sony) encryption key

generated dynamicaly at each auth.

Topaz Tag Innovision

MIFARE Standard: 512bits UL (no security) used for tickets Other formats : 1K (768 Bytes data), 4K The 16bits random of MIFARE has been hacked

NXP announced MIFAREplus

MIFARE DESFirepreprogrammed cardExample: Oyster Card in London

Gemalto: Mifare 4 Mobile

Contactless Java Card

85%+ of the access control / TicketingISO14443 market is Mifare®

NFC NFC allows a device to read and write a contactless card, act

like a contactless card and even connects to another NFC device to exchange data.

3 modes : Card reading (MIFARE …) Peer to peer (initiator & target) Card emulating

Distance : 0 - 20 centimeters

Bandwidth to 424 kbits/s

NFC Forum : NDEF specs

N-Mark: http://www.nfc-forum.org/resources/N-Mark

NFC FORUMhttp://www.nfc-forum.org

Standardization bodies

ETSI / SCP (Smart Card Platform) to specify the interface between the SIM card and the NFC chipset.

EMVCo for the impacts on the EMV payment applications.

GSM Association Mobey Forum for mobile financial services AFSCM is French association for mobile

contactless Download specifications here: http://afscm.org

Global Platform to specify a multi-application architecture of the secure element.

Etc.

NFC FORUM SPECS

Applications

LLCP(Logical Link

Control Protocol)

RTD(Record Type Definition)

&NDEF

(Data Exchange Format)

Card Emulation

(Smart Card Capability for Mobile Devices)

RF Layer ISO 18092 + ISO 14443 Type A, Type B + FeliCa

Peer to peer mode

Read/Write mode

Card emulation mode

Smart Poster

Location based services List of proximity services

dependingon Points of Interest

Trailers Tickets booking

SpecificationsNFC Forum releases specification for NDEF.NFC Data Exchange Format which is a way to

« format » RFID tags to be compatible with NFC applications.

Works with MIME type.

From SMS push to Smart Poster « pull »

Smart Poster RTD

MAY SHALL

For example, the Smart Poster record defines a URI plus some added metadata about that URI.

Value Action0 Do the action (send the SMS, launch the browser, make the

telephone call)

1 Save for later (store the SMS in INBOX, put the URI in a bookmark, save the telephone number in contacts)

3 Open for editing (open an SMS in the SMS editor, open the URI in an URI editor, open the telephone number for editing).

Action record values

NFC Forum tag typeshttp://www.nfc-forum.org/specs/

Interoperability between tag providers and NFC device manufacturers

Type 1, based on ISO14443A. Tags are read and re-write capable; users can configure the tag to become read-only. Memory availability is 96 bytes and expandable to 2 Kbytes. Communication speed is 106 Kbit/s.

Type 2, same as Type 1 except that memory availability is 48 bytes and expandable to 2 Kbytes.

Type 3 is based on FeliCa. Tags are pre-configured at manufacture to be either read and re-writable, or read-only. Memory limit is 1Mbyte per service. Communication speed is 212 Kbit/s or 424 Kbit/s.

Type 4, fully compatible with ISO14443A and B standards. Tags are pre-configured. Up to 32 Kbytes per service.Communication speed is up to 424 Kbit/s.

NFC Roles and actors

Serviceprovider

Trusted ServiceManager (MNO or TTP)

Application owner

SIM Card Manufacturer(Smart Card provider)

Card Issuer MNO(SIM Card management system)

Contactless service management platform

OTA NFC Service Management

POS

SIMNFC

Mobile station holder

NFC service provider

TS

M

Mobile dom

ainMobile operator

NFC applications repository

Webapp

NFC service operator

SIMmanagementsystem

SIM card

Application

Customers management

database

cardlets

Service profile platform

Profile data

KS FS

Finaluser

Custom

ers m

anagement

database

Life cycle management system

for mobile NFC applications

3

KS FS

1

Customer

Application data

GUI

SDD management systemKS

SSD

Card management system KS ISD

Network access

Customer service

Subs

crib

e a

serv

ice

Subscribe a service

Operator information

system

Customers data

Subscribea service

2

Interfaces

Service provider

TSMMobile

operator

Customer

• Ask for token (delegated management)• Ask applet installation via ISD (MNO centric model)

• Tells phone has been lost• Tells customer has new SIM card

• Service installation request after customer registration

• Tells phone has been lost• Tells customer has new SIM card• Services management & referral for SP

• Install NFC services

Use case: phone is lost

Global Platform - security domains

By Gemalto

Low TRUST High

Mandated DAP(applications integrity at plaform level)

DAP Verification(application integrity by SSD)

Issuer Centric(only ISD management)

Delegated Management(token management)

Authorized Management(dual management)

High CONTROLLow

NFC on a Mobile Phoneone thing among all

Contactless

Screen with a user interface

Security

GPS

Loudspeaker and Microphone

Keyboard

CameraNetwork

TV

etc.

NFC Architecture

PART 2

NFC in a SIM Card

Smart Card Piece of plastic the size of a credit card hosting an

electronic circuit that can store and process information.

The integrated circuit (chip) may contain a microprocessor capable of processing this information, or it can only contain non-volatile memory with a security component (memory card).

Smart cards are mainly used as means of personal identification (identity card, access badge to buildings, health insurance card, SIM card) or payment (credit card, electronic purse) or proof of subscription to prepaid services (calling card, ticket).

Contact or Contactless smart card readers are used as a communications medium between the smart card and ahost (point of sale).

Smart Card used in France for healthcare refunds (Carte Vitale)

Smart Card history The automated chip card was invented

by German rocket scientist Helmut Gröttrup and his colleague Jürgen Dethloff.

French inventor Roland Moreno actually patented his first concept of the memory card.

Michel Ugon from Honeywell Bull invented the first microprocessor smart card.

Bull patented the SPOM (Self Programmable One-chip Microcomputer) that defines the necessary architecture to auto-program the chip.

1968197419771978

Smart Card until today

The first mass use of the cards was for payment in French pay phones (Bull CP8).

Smart Card is standardized ISO 7816.

The second use was with the integration of microchips into all French debit cards.

First Java Cards.

Axalto and Gemplus, at the time the world's no.2 and no.1 smart card manufacturers, merged and became Gemalto.

19831987199219972006

Smart Card categories

Microprocessor cardMemory card

Contact card Contactless card

The memory card EEPROM read/write memory (4K max)

Ex: Mifare

Advantages Simple Cheap

Drawbacks Security (easy to duplicate)

Microprocessor card Microprocessor used by the application running

on card to calculate operations. Each card can be personalized and updated after

manufacture (for banks with more than 500 000 customers).  Credentials can be updated while the card is inserted

in a bank automat for example.

Very secure for a reasonable cost

Smart Card security

Information stored can be protected by a PIN code

Cryptographic operations Circuit is shielded Unique serial number Software security

Access control to data Data integrity IN/OUT firewall

Smart Card anatomy CPU: Control Processing Unit

SRAM: Static Random Access Memory

ROM: Read Only Memory Static Store the Operating System

EEPROM: Electrically Erasable andProgrammable Read Only Memory Persistent

CRYPTO:  Cryptographic processor

RNG:  Random NumberGenerator Used to generate keys

Smart Card connectors• A Smart Card has 8 connectors : (ISO7816-2)• C1 Vcc• C2 RST• C3 CLK• C4 RFU (Reserved for future use)• C5 GND• C6 Vpp (old EEPROM)• C7 I/O (bi-directional, in half-duplex mode)• C8 RFU (Reserved for future use)

Contactless Card

ISO 14443 defines the standard for Contactless Card.

Smart Card applications

Secure a computer Store internet security certificate Hard drives can be encrypted using and

attached Smart Card Used to authenticate a user on the

computer (at login screen)

Smart card applications

Payment Credit card, SIM card, TV Channel card, Access card Transports Electronic purse (coffee machine)

Identification PKI Digital signature Can store biometric data 2009 in Spain and Belgium: eID card

2 certificates: one used to authenticate and one toapply the digital signature (real legal value)

Pyramid of Authentication Technologies

Digital Signature Certificate - PKI

Digital Signature Certificate – PGP

Password + SSL

Password/Tokens(without encryptions)

Higher level of security offered for highly valued information

User private key is kept in a device such as a smart card. Biometrics are also used to

protect key.

User’s private key is stored on a portable computer device such as a

disk.

User name and password authenticates

User – PGP encrypts data.

SSL encrypts data.

Part 3

NFC potential, servicesand devices

NFC on iPhone

http://www.nearfield.org/NFC already on iPhone:Stickers, 30-pin RFID readers, SIM add-on…

Exchange data, P2P Configuration (bluetooth pairing) Vending machines, service

maintenance Loyalty, couponing NFC poster, get information Ticketing Medical, home care Web applications Payment solution Access control Mobile signature Etc.

Added value services

NFC Use cases

by Nokia

Mobile Ticketing

A customer books two tickets for a concert.

He pays and downloads his tickets on his mobile phone with a simple touch.

He meets with his girlfriend and transfers the ticket on her mobile.

They arrives and unlock security gates thanks to their NFC mobile phone.

14 millions RFID tickets were produced by ASK for Olympic Games in China - http://www.ask-rfid.com

Mobile ticketing will become more popular over the next few years, with 2.6 billion tickets worth $87 billion, delivered by 2011

Juniper Research (April 2008)

NFC in the World (2009)http://www.nearfieldcommunicationsworld.com

Japan with Sony FeliCa, NTT DoCoMoNTT Docomo reports 10 million mobile credit card customers

StoLPaN « Store Logistics and Payment with NFC » is a pan-European consortium supported by the European Commission’s Information Society Technologies program: http://www.stolpan.com

Akbank and Turkcell test NFC in Istanbul Visa launches NFC trial in Brazil Citi launches NFC trial in India Telefónica launches O2 Money, says it is ready

to deploy NFC Nokia Money 41 NFC-related trials and launches in the Asia-

Pacific region so far… etc.

NFC in France(2009)

Disneyland Paris to test NFC and contactless cards from October 2009, with Crédit Mutuel and CIC banks.

Smart-Park with VINCI Park and Monext. Paris Metro: Paris transport operators to launch

NFC ticketing from the end of 2010. STIF will coordinate the Paris transport operators (Optile, RATP and SNCF Transilien) and the participating telecoms operators (Orange, Bouygues Telecom and SFR).

Pegasus workgroup: multi-operator (Orange, Bouygues Telecom, SFR), multi-bank (BNP Paribas, Groupe Crédit Mutuel-CIC, Crédit Agricole, Société Générale) with MasterCard, Visa Europe and Gemalto for mobile payment in two cities: Caen and Strasbourg

Nice NFC cityhttp://www.afscm.org/entreprises/nice-ville-nfc

NFC gives sense to touch based services

Object

Tag+ URL

Mobile deviceReader

Display

Wireless service provider

Information on ObjectsNFC is not a Bluetooth replacement. NFC is not made to transfer

objects.One of the key argument for NFC is to pair a Bluetooth device. More than wireless. Proximity and contact. Secure payment.

Components of an object hyperlinking scheme

NFC tomorrow Hard beginning

Three years ago, ABI Research predicted half of mobile phones in the world will be NFC ready in 2009.

Juniper research, september 2009: NFC Mobile Payments to Exceed $30bn by

2012, Supported by Revenues from Mobile Coupons and Smart Posters

June 2009: Top handset manufacturers begin sampling NXP’s PN544 NFC chipThe PN544 NFC controller is the first fully industry standard NFC handset chip, offering compliance with the Single Wire Protocoland with Mifare.

In a recent presentation, Sony Ericsson says mobile NFC will takemore than 5 years to become mass market.

NFC tomorrow

NFC keys of success Reach and availability

The availability of NFC phones and SIM card Variety of use Ease of use

See iphone Security

Be able to lock payment card Added value services

Advantage for customer ? Infrastructure

NFC access points in shops

Complex value chain +

Mobile OTA B2C battle

NFC DevicesNFC Phones using single wire Protocol and UICC (08/2008) The Sagem my700X The LG L600V The Nokia 6131 SWP The Motorola SLVR L7

All devices are more or less concept devices and come with an InsideContactless NFC Chip.

In order to develop applications with these devices a Dev Kit (like the Gemalto Developer Suite) and a SWP UICC is required. All four devices are already capable of using SCWS.

NOKIA 6212

Java MIDP 2.0 Bluetooth 2.0 2 megapixel camera 3G connection Share business cards,

bookmarks, calendar notes, images, profiles, and more.

Contactless payment and ticketing capabilities.

Access to mobile services and information with a simple touch.

Uses Java specification requirement 257 (JSR 257) for third-party NFC applications.

http://europe.nokia.com/A4991363

Jeremy Belostock on the future of NFChttp://fr.youtube.com/watch?v=BoOH7AtCT_E

Nokia 6216 First SIM-based NFC handset by Nokia

Capable of storing credit card, user account and other security details on the SIM card,http://toptunniste.fi/topshop/product_catalog.php?c=72

normal availability appr. Q1/2010

See video,Jeremy Belostock, NFC, and operatorshttp://www.youtube.com/watch?v=53dhyDPXmH8

National ID card

Aircraft part tag

Passport label / page

Secure access or

credit cardTransit cardTransit

ticketLibrar

y book labelItem

drug label

Retail pallet/ case label

Specification typically ISO 14443

or 15693 (read distance to 50 cm)

7cents Chip cost 3dollars

Security and memory for RFID tags vs cost

Security and/or memory size

NFC requirements Integration at a POS level:

define an application protocol Certification and Mobile signature

(Wireless PKI) Backward compatibility:

MIFARE type A / type B Service Providers need interfaces

(SOA) with MNO and TSM OTA customization for Service Profiles See AFSCM specifications

Interoperability with different phone OS & manufacturers

Allow different secure chip or flash memory ?

Customer understanding between different applications such as paypass, electronic purse, credit card emulation

NFC services such as access control must also work if Mobile is OFF See, battery levels and thresholds of

mobile phones What is the added value if service

already exists Mesure social impact before Tickets or direct payments

Part 4

NFC for developers

Developing on a Mobile Phone is J2ME

OS

NFC Chip & SIM

Different operating systems, browsers, etc.

What are the solutions to develop a 3rd partyapplication on a mobile phone

except on iPhone

UICC SIM

NFC antenna

Externalenv.

Applications

CPU

OS

J2ME

NFC Chip

OTA

OS

Apps

NFC Phone Architecture

Single Wire Protocol (SWP) architecture: SIM & SE is same Java Card.

MIFARE is a storage which enables the phone to act like a MIFARE card.

From a developer's point of view it does not matter at all where the SE is located. You will still code against the GlobalPlatform specs. The only difference comes with the distribution/lifecycle model; and since in most cases, the operators control both the SIM card and the phone, the difference is largely academical anyway.Of course, business people may think differently, but that's their problem.

Jalkanen, Nokia discussion boards

NFC and C (with Java Native Interface)

JNI allows to call C code and DLL in Java.  To use JNI, you must follow the following

steps: Create a Native method in Java Once the Java class is compiled, you must generate

a header file with the tool javah –h. Compile the native code using the interface

generated at step 2. Change the methods headers and params. For example: a String becomes a Jstring.

NFC and Java Java / NFC

Java is the key. It allows technologies to work together : Bluetooth, Video, Music, GPRS, …

Problems of JSR not implemented on a mobile phone

Graphical user Interface are not always compatible : screen size, different JVM.

Solution: Mobile Distillery ? SVG ? Flash lite ? SIM Toolkit ? SCWS ? HTML5 ?

Native application : security problem, no API, manufacturer lock… Symbian development is heavy.

Java IDE such as Eclipse or Netbeans

SDK from manufacturers (Nokia)

Dev Kit from card issuers (Gemalto, Oberthur)

Dev Kit from MNO (Orange)

Development Kits

JCOP Tools

String uri = System.getProperty("internal.se.url");

ISO14443Connection iseConn = (ISO14443Connection) Connector.open(uri);

Applet extends javacard.framework.Applet MIDlet

JCOP tools need activation key: tools.jcop@nxp.com compatible PC/SC reader

Configure SE keyset to 42ENC, MAC and KEY are all "404142434445464748494A4B4C4D4E4F”

public void process(APDU apdu){ byte[] buf = apdu.getBuffer(); // Ignore Select instruction. if (buf[ISO7816.OFFSET_CLA] == 0x00 && buf[ISO7816.OFFSET_INS] == (byte)0xA4) { return; }

Gemalto Developer suite

Gemalto Developer suite

Nokia 6212 SDKCompatible with Netbeans and Eclipsehttp://www.forum.nokia.com/main/resources/tools_and_sdks/nokia_6212_nfc_sdk/

JSR-257 Contactlesscommunication API

For NFC andInfrared

Optional packagefor J2ME

DiscoveryManagerTarget listener (nomatter the type)

Connection NDEF& ISO14443

MIFARE

Card is composed of 16 sectors with 4 blocks of 16 bytes each.

In each sector a block is reserved to define access bits. Ex : block 7.

A key is initialized to read and write data blocks.

Security in a MIFARE 1K CARD

MIFARE Anti-collision An anti-collision system allows to

operate with many cards in the same magnetic field.

The algorithm selects each card one by one and ensures that the transaction takes place on the selected card without data corruption.

MAD (MIFARE Application Directory) is a table written in first sector and used to identify which sector is dedicated to a specific application.

Request

Anti-collision Identification 3ms+ 1ms / collision

Read/Write

Authentication

Select card

Card id ?

Authentication 2ms

Read block 2.5 msWrite block 6ms

Transaction time

GSMA tech guide: NFC mobile device and reader shall be less than or equal to 250ms to meet Service Provider requirements.

Receive read-only data from NDEF tag

NDEF pushThe MIDlet can see that it was launched by touching a tag, by reading the DiscoveryManager property LaunchType.

Java Card Java Card MIFARE ProX & SmartMX

are cards with microprocessor and OS (for example JCOP).

An Applet is a JAVA CARD application stored inside the Secure Element.

APDU COMMANDS is a way tocommunicate with Applet

ISO14443Connection and 7816-4APDUS

Security : Crypto Processor

Java Card description

At the beginning, applications on Smart Card were all developed proprietary and native.

There was a need to find a generic way to develop an application that could run on 2 Smart Cards issued by different companies.

The Java Card technology allows developers to gather around one way of programming using Java. And it openned the path to third party applications.

This technology can also be used to develop on a SIM card. A SIM card has more memory than other types of Smart Cards like Credit Card.

Java Card includes: An API (application programming interface) to define Java libraries that

can be used A virtual machine Runtime (JCRE) : memory and security management

Java Card 2.1.1 SDK provides an environment to test applets,a tool to upload applets into the Java Card, and code examples.

Smart Card protocols

PTS : Protocol Type Sélection ATR : Answer To Reset

T=0 Byte-level transmission protocol, defined in ISO/IEC 7816-3

T=1 Block-level transmission protocol, defined in ISO/IEC 7816-3

APDU transmission via contactless interface, defined in ISO/IEC 14443-4

ISO 7816-4: APDU APDU Command (C-APDU), sent by reader to the card Header, 4 Bytes Class instruction (CLA) Code instruction (INS) Parameters : P1 et P2 Optional body (random size) Lc = length of body (data) in Bytes Le = length of response to the command (Bytes) The data field contains data to be sent to the card, to

process instructions specified in header.

APDU command types 4 APDUs commands are possible depending

on whether it expects a response back or if it contains data. No data, no required answer

CLA INS P1 P2 Data, no required answer

CLA INS P1 P2 Lc Data No data, required answer

CLA INS P1 P2 Le Data, required answer

CLA INS P1 P2 Lc Data Le

AID

AID = unique identifier for an application or a certain type of files

First 5 bytes are RID (resource identifier) Following bytes are PIX (proprietary

identifier extension)

Java Card Select

Java Card: CAPA smart card is inserted into a Card Acceptance Device (CAD) to power on the integrated circuit.

Java Card features Threads

CPU on JavaCard does not support multiple tasks and you can’t use « synchronized » or « volatile ».

Garbage collector Finalize() not supported

Non-supported types: Long, Char, Float, Double Supported types:

Java Card features

Java Card support atomic transaction

System.beginTransaction() System.commitTransaction()

System.abortTransaction()

Java Card security « Sandbox »: In Java, code and

application data (resources) are protected by a sandbox and can’t interfere with other applications.

Java Card applet• Let’s take the example of a Wallet to see how to

code an applet.

• This applet allows the SIM card to act as a real eletronic purse.

• Use cases• The applet can add and substract money to a balance• Shows the actual balance of the purse• It includes a mechanism to ask for a PIN code for

security purposesSee articles on Sun websitehttp://developers.sun.com/mobility/javacard/articles/intro/index.html

Wallet.java

Java Card applet Wallet Package declaration Java naming convention

Java Card framework

package com.sun.javacard.samples.wallet;

import javacard.framework.*;

Java Card: applet Wallet The Java class must extend Applet. It defines all the methods to communicate with JCRE.

public class Wallet extends Applet

Java Card 2 modes An applet is unactive until it receives an

APDU command

Card Emulation Reader Emulation

Applet PIN code

In the Wallet source code, the VERIFY method checks the PIN code. The APDU command contains the parameter PIN (stored inside the data field).

If PIN code is the same than the one defined during the installation process, the method returns true.

PIN_TRY_LIMIT = 3

CLA and INS We choose the hexadecimal value 0xB0

to identify our Wallet.

This value identifies all APDU commands that are processed by the applet.

It means that the APDU commands debit and credit all start with the byte CLA 0xB0.

Wallet_CLA =(byte)0xB0;

INS The 2nd byte of an APDU command

identifies the instruction

final static byte VERIFY = (byte) 0x20;final static byte CREDIT = (byte) 0x30;final static byte DEBIT = (byte) 0x40;final static byte GET_BALANCE = (byte) 0x50

Other values Other fixed values of our electronic

purse

The variables

// maximum balancefinal static short MAX_BALANCE = 0x7FFF;// maximum transaction amount final static byte MAX_TRANSACTION_AMOUNT = 127;// maximum number of incorrect tries before the// PIN is blockedfinal static byte PIN_TRY_LIMIT =(byte)0x03;// maximum size PINfinal static byte MAX_PIN_SIZE =(byte)0x08;

OwnerPIN pin;short balance;

Applet structure Constructor Install Select Process

Header analysis (CLA and INS)

public void process(APDU apdu) {

Send and receive APDUs setIncomingAndReceive();

setOutgoingAndSend() Transfer mode Expected length for the answer Send bytes in response

byte[] apduBuffer = apdu.getBuffer();apduBuffer[0] = byte1;apduBuffer[1] = byte2;apduBuffer[2] = byte3;//0-offset, 3-number of bytes to sendapdu.setOutgoingAndSend(0, 3);

byte[] buffer = apdu.getBuffer();short bytes_left = (short) buffer[ISO.OFFSET_LC];short readCount = apdu.setIncomingAndReceive();while (bytes_left > 0) {//{process received data in buffer}…bytes_left -= readCount;//get more datareadCount = apdu.receiveBytes (ISO.OFFSET_CDDATA);}

Get Balance Retrieve current balance of the

electronic purse CLA: 0xB0 INS: 0x50: GET BALANCE P1: 0x00: Normal mode P2: 0x00 Data:

in: none. out: 2 bytes of balance.

Credit Mutual authentication To send the APDU command, you must first initialize a

secure transaction with the applet (MAC): CLA: 0xB0 INS: 0x30: CREDIT P1: 0x00: Normal mode P2: 0x00 Data: - in: 2 bytes of value to credit.

- out: 2 bytes of updated balance. - exception: ISOException with reason

SW_SECURITY_STATUS_NOT_SATISFIED (0x6982) if authentication failed.

JSR-177 SATSA JSR-177: Security and Trust Services API

for J2ME Used to communicate with SIM card Used to encrypt/decrypt/sign data

Example with symmetric algorithm here:http://wiki.forum.nokia.com/index.php/Encryption_of_data_using_JSR-177

Gemalto examples

APDU commands of GPPurse applet are stored in the file APDU_Commands.atf that comes with the project. You can open this file with the Jcard Manager and execute each command at a time.

Or manually thanks to the option Send APDU in the menu bar.

Gemalto developer suite: Instance AID

Nokia 6131 Secure Element

Secure Element consists of Java Smart Card area and Mifare 4K area

A specific API provided for Applets to access Mifare memory

All access is password protected

Password is one-way hashed from Mifare KeyA and KeyB

JCSystem : atomic transaction management

The Secure Element IS NOT a play ground

Global Platform Card OSJava Card Applet

Mifare 4k

Java Card AppletJava Card Applet

Access Mechanism

Protected by Issuer specific secret keys

Protected by transport keys

PC/SC readers SCM reader uses PC/SC driver (Windows)

Other readers: Philips Pegoda, Omnikey Cardman, etc.

The most commonly used smart-card interface is PC/SC, a middleware layer backed by Microsoft, and part of the Windows operating system.

JPCSC is a Java-wrapper around the native PC/SC API. JCOP Tools includes JPCSC and uses it on Linux and MacOS X. On Windows, JCOP Tools uses the native PC/SC API directly.

JCOP Tools also includes the JCOP offcard API, which is a comprehensive smart card API with special support for Java Card and GlobalPlatform. That sits on top of native PC/SC, JPCSC, and some other proprietary card middleware.

OpenCard Framework (OCF), see http://www.opencard.org(consortium split up).

javax.smartcardio

Java 6 introduces Smart Card I/O API defined by JSR 268.

Dev tools and architecture Devices used

- Mobile phone NOKIA 6131- Tags MIFARE 1K- Pegoda Reader / Philips- SCM Contactless Reader

For developers: Netbeans, Eclipse, Visual Studio, etc.

NFC software layers Graphical User Interface (GUI), implemented in J2ME (or

other). Controller / Application logic (as much as possible),

implemented on the Java Card / Secure Element. Memory of the Mifare element used for storing data.

MIDlet proxy

Phone

OTA Server

Secure Element

Mifare AppletMIDlet

OTA provisioning can be done through HTTP / HTTPS or BIP/TCP.

BIP is a new generation protocol allowing remote SIM management over the air (remote file management, remote application management).

Physical layer

Steps for astandard NFCcommunication

1. Open2. Poll3. Connect4. Exchange5. Disconnect6. Close

J2ME Java Midlet Java Platform Micro Edition Software Development

Kit 3.0 Lightweight UI Toolkit (LWUIT) integration http://java.sun.com/products/sjwtoolkit/

ProGuard (obfuscator) Limited storage

A mobile phone application is divided into 2 packages, a descriptor JAD file and a JAR file containing Java classes.

Thanks to the JAD file, the JAR file is installed on the mobile phone. Developer can set JAD attributes to manage permissions, push registry, etc.

Use a Controller to listen and launch threaded events:1. Call to NFC chip2. Print new screen3. Save data in Record Store

J2ME Signature and certificate Security exception MIDP permissions

javax.microedition.io.file.FileConnection javax.microedition.io.Connector

SmartCard Web Server SIM Toolkit successor.

SCWS technology can be installed on new generation SIM card and allows GUI management thanks to mobile web browser.

The SIM card is the authorization module for secure electronic transactions but it’s the mobile phone that controls and generates graphical interfaces. With SCWS, a developer can implement the full application in one package and deploy it directly on the SIM card. MMI and Applets are on the same media. Deployment and administration of applications are simplified. For example: if the user changes his mobile phone.

Moreover, generated interfaces are compatible with most phones but the rendering and user interaction is not necessarily better.

SCWS Demo

Example of applications

NFC Applications – My Keys

Office

Home

Car

Edit Delete

Parking P5

New keyreceived.

Open application ?

YesNo

Writing key

75%Installing key…

Key added

Exit Yes

Access granted.Add a shortcut ?

Lock A

PAMS Zone 1

PAMS Zone 2

Credential for PAMS Zone 2 can unlock A and B

Lock B

See Mobile PKI (ETSI). The MSSP platform is a solution to

manage digital signatures for a MNO. Two processes:

Registration: to obtain a certificate and a private key

Signature: to sign data (with private key)

Mobile Signature Service Provider

MSSPOperator

Service Provider

Certification authority

Ex: eBanking authentication1. Customer accesses his bank website thanks to his login/password.2. Bank sends a request for authentication to Operator (WPKI). This

request includes the mobile number (IMSI: International Mobile Subscriber Identity)

3. Customer enters PIN code4. eBanking service is authorized

BackOk

Enter PIN code

****

SecureApplication

Ok

You are nowauthenticated

BackOk

The application needs to verify your identity

DEMO Creating a Java

Midlet

Netbeans Mobility pack

Reading a NDEF tag

Uploading an Applet ona Secure Element

Send an APDU command to my applet from the mobile and from a PC/SC reader.

HelloKiosk

Conclusion NFC in handsets without knowing it

really soon Industry is now convinced SDK standardization Easy to use ! Remember iPhone

Conclusion Use J2ME 3.0 Use JSR 257 or SCWS Optimize your code Store your data online Never trust a MIDlet Sign your application Use J2ME Polish or LWUIT to adapt your application to your

target platforms (screen size) Use web app for cross-platform development Use AFSCM specifications for OTA NFC is not an exchange protocol but identification

For developers

Resources http://discussion.forum.nokia.com/forum/forumdisplay.php?f=144 http://wiki.forum.nokia.com/index.php/NFC http://forum.java.sun.com/forum.jspa?forumID=23 http://www.nearfieldcommunicationsworld.com http://www.talknfc.com http://www.blognfc.com http://www.nfcnews.com Writing a Java Card Applet

http://developers.sun.com/mobility/javacard/articles/intro/index.html

Resources Contactless Smart Cards and NFC

Peter Harrop, Ning Xiao & Raghu Das

http://www.nxp.com, thanks for pictures

http://www.nearfield.org http://www.nfc-forum.org http://www.gsmworld.com/docume

nts/

http://www.rfidjournal.com RFID Information

http://mobilepayment.typepad.com

Mobile payment blog http://0x9000.blogspot.com

Great blog on Java Card development

Special thanks to Nicolas Pastorellywho helped me on some slides

Contact meMaster MBDS, University of Nice Sophia-Antipolistdelazzari@gmail.com

http://www.mbds-fr.orghttp://tdelazzari.blogspot.comhttp://twitter.com/tdelazzari