Introducing MIFARE DESFire EV2

Transcription

1 Z Introducing MIFARE DESFire EV2 Q Rainer Lutz, Joo Ming Chua ID Customer Day

2 Agenda Introduction to the world of NXP MIFARE MIFARE DESFire IHS analysis of the transport ticketing market An invitation to explore new business opportunites enabled by MIFARE DESFire EV2 innovations Key innovative features explained Conclusions & possible next steps for you

3 We bring Security & Convenience NXP is #1 with over 8B units shipped Source: NXP

4 And is now a platform available across form factors including banking cards and in mobile devices. NXP is the Identification Industry s #1 Semiconductor Supplier egovernment Bank Cards Smart Mobility & Access Management Cards Tags & Authentication Smart Readers Mobile Devices MIFARE DESFire was designed for smart mobility and access

5 MIFARE the application platform

6 Media Value NXP s MIFARE Product Portfolio multi-interface CPU card and mobile ICs contactless CPU card ICs PN65T P60D040 J3A041 / J3C081 limited-use ticket ICs MIFARE Ultralight C MIFARE Ultralight EV1 MIFARE Ultralight contactless memory card ICs MIFARE Classic 4k MIFARE Classic 1K MIFARE Plus S/X 4K MIFARE Plus S/X 2K MIFARE DESFire EV2 4K MIFARE DESFire EV2 8K MIFARE DESFire EV2 2K JTA021 P5CD0XX SmartMX Products Functionality 6

7 MIFARE DESFire by Numbers >300Mpcs shipped >65% annual growth in average for the last 10 years Proven in >30 applications Powering eticketing in >60 cities >10 regional & countrywide schemes Managing access to >250 companies and institutions Supported by leading system integrators Available as implementation on SmartMX >5 Licensees NFC Forum Type 4 Tag compliant #1 rank by ABI research secure microcontroller for transport ticketing category Compliant to >10 standards and industry best practices

8 Some MIFARE DESFire reference projects Contactless Betalen Open Cash finle Kesko Loyalty Vancouver Seattle San Francisco Monterrey Rosario GM University of Arizona Mexico DF University of Michigan Car2Go St. Louis Toronto University of Pennsylvania Miami Costa Rica ITSO Reims Toulouse London Oyster Madrid Bilbao Istanbul Theme park Orange Cairo & Egypt Railways Nairobi Google Beba Mpumalanga province Berlin Library Hamburg University 1FC Köln Nile University Dubai Abu Dhabi German blood donor card Prague Lubljana Tap&Go Parking Mumbai Velocity Loyalty EU commission Ankara Helsinki Nestlé Daimler Benz Bangalore Vietin Melbourne Kolkata New Delhi Wladiwostok Nanjing Citizen card Bangkok E-money Loyalty BKK Transdev Studios Sydney DoD New Zealand countrywide Road Tolling Public transport Access Management Micro payment Other applications

9 MIFARE DESFire EV2 speaking the language of the world s leading system integrators

10 Smart Cards in Transportation World Market 2013 Edition IHS Electronics & Media

11 IHS Key Global Market Findings It is estimated that 995 million smart cards were sold into transportation applications in This number is forecast to grow at a CAGR of 14.6%, reaching 2.3 billion shipments in IHS Electronics & Media

12 IHS Global Card Shipments IHS Smart Cards in Transportation World 2013 Report Analyst: Global Smart Credentials Shipped - By Technology Format (Not Including Limited Use) Thousands of Cards Shipped By 2018, MIFARE DESFire is projected to reach 111 million which is only 11 million fewer than MIFARE Classic, making it the fastest growing microcontroller card in the market, over the forecast period. 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% MIFARE DESFire MIFARE Classic MIFARE Plus Calypso FeliCa CiPurse S/ CiPurse T MOC Other - Chip Card Source: IHS Aug-13 IHS Electronics & Media

13 The value of MIFARE DESFire EV2 innovations

14 To elevate the value for our key applications we have innovated along 3 strategic axes Contactless Performance Convenient touch n go experience through improved operating distance Fast and reliable transactions Design freedom for smaller form factors on the credential and reader side. Security & Privacy Next level certification Security self healing mechanism with rolling keys Assuring authentication in multi operator schemes Anticipating future need for privacy protection Multi-application Enabling new business models through seamless integration of additional services in the field Cross system interoperability Easy migration through backwards compatibility with MIFARE DESFire and MIFARE Classic infrastructure

15 Key innovation features explained

16 MIFARE DESFire EV2 Key Features Performance Security & Privacy Multi Application Functional backwards compatible to DESFire EV1 Drop-In Replacement MIsmartApp supporting post-issuance applications Multi-Application Multiple file access conditions Enhances Key Management File sharing between applications Common Purse Multiple Rolling Keysets per application Update Keys in the Field Transaction MAC Fraudulent Transaction Claim Protection Proximity Check Relay Attack Protection Virtual Card Architecture Privacy Protection Improved transaction speed (vs DESFire EV1) Faster Transactions Improved RF performance (vs DESFire EV1) More Operating Range

17 Transaction MAC (Message Authentication Code) Contactless systems with multiple operators / merchants merchants might not be fully trusted by the clearing instance Making the transaction trusted in MIFARE DESFire EV2: MAC computed over all transaction data by the card Using an AES key that is only known by the card and the backend system Transaction MAC allows the backend system to detect: Forged transactions Replay of valid transactions Unreported transactions (e.g. important for Credit operations)

18 Transaction MAC System level illustration A TMAC is calculated over the transaction data and is returned by the card Transaction is only accepted for reimbursement with a valid TMAC Backend Clearing House K TMAC Merchant Terminal K Transaction Transaction K Transaction Transaction data + TMAC Submit claims TMAC K TMAC TMAC check OK $ Reimburse

19 Multiple Rolling Keysets Secure and Reliable updating keys in the field Increase system security with key renewal policy A self-healing mechanism in the event of keys being compromised Application 1 Application 2 Application Keys Application n Active Keyset RollKey command Keyset 2 Keyset 16 Up to 16 keysets per application Std. Data File BackUp Data File Cyclic Record File Linear Record File Value File

20 Key Updating Reader New Cards Multiple Rolling Keysets per Application Increase system security with key renewal policies Limit the lifespan of each keyset version and its exposure in the field A self-healing mechanism after a keyset has been compromised The next higher keyset version stored on the card can be activated quickly and securely on any terminals in the field New Cards Keyset 1 Keyset 2 Keyset 3 Keyset 4 Keyset 5 Infrastructure support KS1 KS1 KS2 KS1 KS2 KS3 KS2 KS3 KS4 KS3 KS4 KS5 Key rolling during transaction KS1 KS2 KS1 KS3 KS2 KS3 KS1 revoke* KS2 KS4 KS3 KS4 KS1 revoke* KS2 revoke* KS3 KS5 KS4 KS5

21 Multiple Rolling Keysets per Application Security upgrade with key type migration Migrate applications to higher security For existing MIFARE DESFire installations using 3DES crypto to migrate to AES or 3K3DES crypto progressively. 3DES 3K3DES 3DES AES Application x Roll Keyset Application x 3DES AES AES

22 MIsmartApp Allowing secure application creation in already deployed cards facilitating sharing of a card for multi-application. App. keys App. keys Card Issuer/Owner Service providers / Application owners Card Owner has only access to his applications but not to third party applications EV2 Service provider has entire access to his application

23 MIsmartApp Card Issuer/Owner can generate a MIsmartApp token for anyone who wants to put their applications on his deployed cards. The MIsmartApp token allows only an agreed application to be created on the cards. PICC keys Request MIsmartApp Token & K MIsmartApp Service providers / Application owners Card Issuer/Owner

24 MIsmartApp Illustrating an App Store concept with a City card where the card holders can install new applications available for his card at his convenience. CARD ISSUER APP PROVIDERS MIsmartApp Token delivery 1 Master key never shared!!! CARD HOLDER Commercial agreement Upload APP in STORE 2 Card holders install APPs 3 APP STORE

25 MIsmartApp Interoperability with one card in two separate system environments DMRC (PTO) Request Send MIsmartApp Token & Key Delhi Metro Travel Card MIFARE DESFire EV1 4KB Delhi Metro Travel Card MIFARE DESFire EV2 8KB New Delhi Bangalore BMRCL (PTO) Namma Metro Travel Card MIFARE DESFire EV1 4KB

26 Feature comparison MIFARE DESFire, EV1, EV2 MIFARE DESFire MIFARE DESFire EV1 MIFARE DESFire EV2 ISO/IEC A 1-4 ISO/IEC commands and file structure support basic extended extended EEPROM data memory 4KB 2/4/8KB 2/4/8KB Flexible file structure NFC Forum Tag Type 4 V2.0 compliant Secure, high-speed command set Unique ID 7BUID 7BUID or 4B random ID 7BUID or 4B random ID Number of applications unlimited Number of files High data rates according to ISO/IEC up to 424 Kbit/s up to 848 Kbit/s up to 848 Kbit/s Crypto algorithm DES/2K3DES DES/2K3DES/3K3DES/AES DES/2K3DES/3K3DES/AES Unique 7-byte serial number (ISO cascade level 2) Common Criteria certification (HW + SW) EAL 4+ EAL 5+ or higher (in progress) MIsmartApp feature for post-issuance of applications Transaction MAC to authenticate transactions Multiple keysets per application for key rolling Multiple access right settings per file Files sharing between 2 applications Virtual Card architecture for privacy protection Proximity Check against relay attacks Up to 16 keysets per app Up to 8 keys per access Delivery types wafer & MOA4 wafer, MOA4 & MOA8 wafer & MOA4

27 MIFARE DESFire implementations

28

29 MIFARE DESFire implementations by NXP and our licensees NXP MIFARE DESFire EV1 is available on the SmartMX and SmartMX 2 platforms from NXP and will be part of NXP s mobile offering. MIFARE DESFire EV2 is available on future SmartMX platform releases. MIFARE Licensees MIFARE DESFire EV1 is available on IC solutions from STM as well as on UICC SIM solutions form Gemalto, G&D and Oberthur. Key functionality of MIFARE DESFire EV2 has been shared with our licensees. Our MIFARE licensees are required to support the latest version in a defined window after the release of the original NXP product. The actual product availability depends on the individual licensee.

30 MIFARE DESFire EV2 for you

31 MIFARE DESFire EV2 for system design ins Documents & Tools Leaflet & Data Sheet Available NXPReaderLib, MIFAREdiscover SW, Application Notes In progress Pricing MIFARE DESFire EV2 offers a wealth of innovations and is positioned at the same price level as MIFARE DESFire EV1 Updated:

32 Conclusions & next steps Speaking the language of leading system integrators, MIFARE DESFire EV2 brings a rich heritage to the next level. You can immediately enjoy the improved operating distance and speed in existing MIFARE DESFire installations. System operators are enabled to launch new business models offering additional revenue streams. System integrators will enjoy the functional backwards compatibility and smart feature extensions.

33 Thank you Please visit us on MIFARE.net