Security Requirements in the Era of Mobile communication The case of the financial industry

Transcription

1 Security Requirements in the Era of Mobile communication The case of the financial industry 7th February 2012 Dr. Kai Grassie, CTO

2 Agenda Development and status of Mobile Payment Technology-Trends in Mobile Payment: Secure Elements: SIM, Embedded, MicroSD Wallet The value chain Trusted Execution Environment (TEE) with Mobicore

3 Cards with contactless interface will account for 25% - 30% of chip market within five years Chip Card Market Volumes by Interface [in mio pcs] Contactless and Dual-Interface Market Volumes [in mio pcs] 17% % contactless dual-interface contact tokens Cards with contactless interface to gain ~1/4th of the market within five years USA, China, and South America (ex-brazil) pure contactless, rest primarily dualinterface N-America Lat-America Europe MEA North Asia South Asia

4 Contactless payment cards and terminals are now deployed in high volumes in many countries, NFC will benefit from this 2010: Visa contactless cards in UK to reach 12 million by year end 2008: Barclaycard issued over a million MasterCard PayPass-branded Barclaycard credit cards in UK 2009: Interac introduces contactless capability in Canada. 2011: Starbucks introduces Mobile Payment 2010: US Bank introduces contactless payments 2006: MasterCard s PayPass contactless cards for Banamex Financial Group in Mexico 2009: MasterCard & RBS WorldPay introduce Contactless Payments in UK 2010: RBC goes contactless for Vancouver Olympics 2011: Telefonica and Mastercard set up JV in the 12 Latin American countries 2005: 7-Eleven to Accept Visa Contactless Payments 2010: Discover begins roll out of contactless cards and stickers 2010: MBNA and Virgin Money roll out UK contactless card 2010: Intesa Sanpaolo moves to contactless in Italy 2010: Over 1 million contactless Visa payment cards have been issued in Turkey since spring. 2009: Citibank launches contactless payment Citi Tap and Pay in India. 2010: PayPal and Barclaycard have released statistics demonstrating the rise of mobile and contactless payment methods in the UK. 2010: PKO Bank Polski S.A. started mass deployment of Visa PayWave 2010: The OTP Bank of Hungary announced rollout of MasterCard PayPass contactless cards 2010: Burger King Singapore goes contactless 2006: Japan and South Korea are leading the word in contactless payment adoption 2009: NETS Introduces Singapore's Most Innovative Contactless Debit Card 2010: Commonwealth Bank contactless drive gathers momentum Sources: Finextra, MasterCard, contactless news 2010: McDonald's and 7-Eleven go contactless in Australia

5 NFC: Exploring New Revenue Opportunities Approximately US$113 billion will be made in NFC transactions worldwide in 2016 (Juniper Research): North America $47 billion Far East and China $31 billion Western Europe $23 billion Rest of the world $12 billion 1 in 4 Smartphones sold in 2014 will have NFC 400 mio NFC-Smartphones in worldwide forecast by 2015

6 Global signs from the market on NFC in mobile devices the focus is on smartphones Galaxy S II Bold 9900 C7 T530 U8650 MC75A HF Nexus S Wave 578 Bold 9930 N5 Optimus Net S5230 Curve S5260 Curve E320 Axia A206 iphone 3/4/4S only with attachments Wave M SHW- A170K Curve N9 XP1301 Vega Racer DT-X8 Wave Y 603 NFC Cosyphone HTC Ruby Updated list: Sky Vega LTE IT-800

7 Agenda Development and status of Mobile Payment Technology-Trends in Mobile Payment: Secure Elements: SIM, Embedded, MicroSD Wallet The value chain Trusted Execution Environment (TEE) with Mobicore

8 Customer s requirements on a system level, and G&D s components and services, integrate into a complete solution Secure components Certified Secure Element types, embedded, SIM/UICC, removable Software applications for major payment schemes, including wallets Operating systems for SE s based on latest standards Services and provisioning Consultancy for customer specific solutions, roll-out support Remote personalization (OTA) Life-cycle management of devices and applications System integration Customer project management System integration of components 3 rd party components integration Secure Elements Wallet, UI Handset models - MNOs - Banks - Payment schemes - System integrator Your individual mobile payment solution - Handset vendors - TSMs System integration Unattended Self-service Attended In-branch Manual fab Applications, brand OTA PPSE Provisioning

9 A Secure Element is a tamper-proof hardware and operating system, certified for the secure payment application and data Embedded Secure Element Built-in integrated NFC device Removable Secure Element Built-on attached NFC support SIM/UICC-based Secure Element NFC Attachments with Secure Element

10 Deployment concepts for mobile payment with MicroSD Card with Single Wire Protocol (MSC SWP) MSC SWP with keyset of bank n tio a liz na set o d s er han ion p rd ta, mat a C da for in SP TSM (SEI TSM) MSC distribution to consumer (optionally including personalization) OTA personalization, wallet provisioning Electronic retail Bank customer New µsd SWP NFC phone Mobile network operator

11 Agenda Development and status of Mobile Payment Technology-Trends in Mobile Payment: Secure Elements: SIM, Embedded, MicroSD Wallet The value chain Trusted Execution Environment (TEE) with Mobicore

12 NFC Ecosystem: Service Provider and SEI To deploy and manage NFC applications without compromising user s sensitive data... SE issuers manage and issue Secure Elements capable of hosting smart card applications... Service providers, such as banks or transportation companies, manage credit cards and transportation passes Manages Security Domains on SIM, manages applications, implements OTA & secure element lifecycle management SEI-TSM* Deployed As TSM GP Messaging Interface Deployed As SP-TSM Interfaces to SP to support service deployment, personalization of service & service lifecycle management G&D s NFC Enabler G&D s NFC Service Manager *SEI-TSM is often referred to as MNO-TSM due to its typically deployed within an MNO environment

13 Agenda Development and status of Mobile Payment Technology-Trends in Mobile Payment: Secure Elements: SIM, Embedded, MicroSD Wallet The value chain Trusted Execution Environment (TEE) with Mobicore

14 The need for a Trusted Execution Environment (TEE) Embedded SE Removable SE TEE: TrustZone & MobiCore SIM-based SE SE = Secure Element 14

15 TEE Use Case Examples Device Security Strong User Authentication Root Management Support second (corporate) identity on phone based on secure PIN, secured VPN, etc.) Payment Services / Banking Strengthening mobile wallet by achieving card-holder-present status based on secured PIN entry Strong authentication for payments and account access and transactions-based mobile OTP Enable NFC phone to become a POS-like reader Operator Media Distribution such as Payper-View based on secured clock Support end-to-end secure content stream for e.g. HD video content to connected screen Enterprise Anti Malware Single sign on & VPN Data security and storage Identity Management Commerce Secure activation (e.g. time/location based) of vouchers/coupons Identity Management for one-click mobile shopping

16 MobiCore enables new Payment Methods Enabling of Peer-2-Peer Payment between mobile devices Support of ewallets with different identities for different payment providers User convenience by managing in the mobile different passwords and PINs for the authorization of a transaction Cardholder presence can be verified with the secure keypad Secure Money Transfer Internet

17 G&D MobiCore The Mobicore System Mobicore Features is a Trusted Execution Environment (TEE) for ARM TrustZone Mobicore & Backend Containers for developer community Secure Element Enabler TSM TSM Servive Provider Service Provider Service Provider Service Provider is based on approved G&D microkernel technology executes securely downloaded native code grants MMU based process isolation supports pre-emptive scheduling of system services supports round robin scheduling of user services (Trustlets) provides a JavaCard alike API for Trustlet (Service) development integrates a G&D crypto library is designed to block never the Rich OS

18 The Eco-System behind a TEE Implementation Applications need to be developed to enable Service Providers making use of TEE The user wants easy access to services TSM required for secure OTA service activation and up-dates MNOs ideally endorse TEE in MNO distributed devices The secure OS need to interact with the open OS, e.g. Google Android Device manufacturer (OEM) to choose TEE enabled silicon/soc and a secure OS Normal World Secure World Silicon Provider to integrate and manufacture TEE in processor and SoC, e.g. Software part of TEE the secure OS from G&D Silicon design architecture plan (IP) for TEE from

19 Thank You