Use of NFC and QR code Identification in an Electronic Ticket System for Public Transport

Use of NFC and QR code Identification in an Electronic Ticket System for Public Transport Luka Finžgar, Mira Trebar University of Ljubljana, Faculty of Computer and Information Science Ljubljana, Slovenia E-mail:lukafin@gmail.com, mira.trebar@fri.uni-lj.si Abstract: The evolution of modern communication technologies and widespread use of mobile phones enable their common use in numerous everyday applications. This paper describes the implementation of a system, which enables the use of phones for acquiring electronic public transport ticket. QR codes and RFID tags are used for registering passenger at the beginning and at the end of their journeys. The development of mobile applications was done by using two modern technologies, mobile operating system Android and Near Field Communication (NFC). A passenger can see the amounts charged for a ticket and other information, like departures. Moreover, a conductor can use the Android application to check the validity of the tickets. Beside the possibility of getting an electronic ticket, which is stored on the phone, a website was built to enable new users of this system to register. An additional website was designed for administrators to see the data on the journeys of passengers and to analyse statistics results. 1. INTRODUCTION Modern electronic tickets in public transport are more and more put forward to exchange commonly used cash systems of payment and daily or monthly season tickets that needed to be purchased on the station. Very often, every journey starts with the purchase of a ticket at ticket counter or on a machine. This often involvs waiting in a queue, losing some precious time and extends the whole journey. It would be convenient to have an electronic system at our disposal, that could make this task as easier as possible and without additional steps for the passenger. The expanded use of mobile phones, their computational capabilities and their ability to connect to the Internet makes them suitable for solving this problem. Lately, several new technologies have been used for such purposes. The most common solutions for buying a public transport ticket worldwide are: (i) online ticket purchase and printing a ticket at home (e.g. Austrian railways system [1]), (ii) buying it on a ticket machine, (iii) buying it at ticket counter, (iv) paying a ticket with mobile phone or smart card. The well known and widespread system for paying with mobile phone in Slovenia is Moneta, which can be also used to pay for services of Ljubljana's public transport company [2]. A very interesting system is Touch&Travel [3], which is operated by German railways. Very popular choice is the use of stored-value contactless cards which are prepaid, where passengers have to load the card with credit before starting a trip. The balance on a card is checked when passenger enters a bus or subway train. Examples of such system are Slovenian Urbana card [4] and London Oyster card [5]. Travel agency must also install smart card readers on every means of transportation it operates (e.g. bus, train,...). Smart card readers usually use technology named Near Field Communication (NFC). A passenger must position his smart card close to the reader to allow system to verify his card for sufficient credit. Additionally, several studies of different smartcard and NFC based electronic systems were done in the past. An open architecture design [6] for the mass transit and regional rail system in US with portable wireless ticketing solution with the connection to the server was investigated to improve ticket transactions and making sales data available. Already tested mobile ticketing prototype system was improved by introducing NFC solution which was replacing an existing manual insertion of journey starting point [7]. This system still requires manual control of tickets by visual inspection. Another electronic system is using location based ticketing by tracing mobile user during his journey to define check-in and check-out used for the calculation of his fare [8]. Lately, a new approach of using QR code is becoming important in tourism to encode the data by any mobile phone having camera. Mobile tagging, based on QR code is used within a test study in cultural institutions, like museums to increase the usability of mobile services [9]. The use of these modern technologies, named Automated Fare Collection (AFC), enables transit agencies to get useful data on travel patterns and passenger habits. With that data, it is possible to optimize time tables and other parameters of public transport system. Before AFC, transit agencies have relied on traveler surveys or manual passenger counts to get data on travel patterns. These surveys were at best conducted only a few times a year. Electronic tickets and AFC give public transport planners detailed, continuous and accurate data on behavior of passengers and enable sophisticated analysis of travel patterns. Taking into account a transfer of data in electronic systems, a secure communication is one of the important issues that needs to be considered. NFC is allowing transactions in a

short range and is used to transfer a small amount of data from identification point to NFC device [10]. Thus a contactless smartcard and an NFC enabled phone can be used as a secure token. A special attention should also be payed to the privacy issues when designing a public system over mobile or internet connections. More concerns are related to security of the ticketing distribution from a ticket server to a mobile phone. The related work was developed as a computer engineering diploma thesis and provides the laboratory prototype implementation to explore the possibility of using two different tagging technologies: (i) RFID (Radio Frequency Identification) tags, and (ii) QR (Quick Response) codes along with mobile phones in an electronic ticketing system. The paper provides information on basic functionalities to show a proof of concept that could be used in electronic ticketing system and is organized as follows. In section 2, the design of our electronic ticket solution is presented by describing NFC and QR tagging technologies, and supported mobile devices with applications. Server programming and webpage design for users and company administration of the system are outlined in section 3. Section 4 describes the use case scenario of working system, and is followed by conclusion in section 5. 2. ELECTRONIC TICKET SOLUTION In the proposed electronic ticket system, passengers are required to check-in at the beginning of their journey and check-out at the end of the journey with the application on their mobile phone. In this way, a payment is based on the actual trip and the process only takes few seconds which is faster than buying ticket on a ticket machine. For the identification of stations we used RFID tags and QR codes which can be placed on input/output gate of the station or even on the mean of transportation. RFID tags are read with application on mobile phone Nokia 6212, which is a NFC enabled mobile phone with the feasibility of reading and writing RFID tags. There are currently very few NFC enabled mobile phones on the market, which lead us to also use QR code to be read by an application for mobile operating system Android. On this type of mobile phone, the passenger receives his ticket in the form of QR code. Since Nokia 6212 doesn t support autofocus, which is required for the use of Zxing library, that is capable of decoding QR codes, we couldn t use it to demonstrate both tagging methods with one phone. Applications were developed in programming language Java. We used open source integrated development enviroment Eclipse with some plugins, that made the process of compiling, debugging and testing faster and easier. We continue with the description of technologies to be used for important parts of developed applications. 2.1 NFC and QR tagging technologies Identification or tagging a check-in or check-out location depends on the mobile phone that is used in the electronic ticketing. Today, two of the well known technologies are available. For NFC enabled mobile phones, RFID tags are usually the best choice and for any other mobile phone with camera, QR code can be used. NFC is a radio frequency based technology allowing transactions in short-range communications designed to exchange the data between NFC devices and smart cards with a touch [11]. This contactless technology is already enabling many current solutions in acess control, payment and transport. NFC devices operate under the 13.56MHz frequency and rely on the smartcard standard ISO/IEC 14443. The technology provides a range of benefits, such as: suitability for many industries, standard based, enables secure transmissions of data, and has capabilities to support secure applications on mobile phones. QR is a specific 2D barcode which carries information in the vertical direction as well as in the horizontal which enables the several hundred times the amount of data carried by ordinary barcodes [12]. The code consistes of black modules arranged in a square pattern on a white background to encode a text, URLs (Uniform Resource Locator) to access webpages, or any other data. It can be defined in a small printout size and easily read with dedicated QR readers or with modern mobile, named smart phones with camera and application for them. 2.2 Application for Android operating system Android is a mobile device platform and operating system for smartphones, based on Linux kernel [13]. It is developed by Google and other companies in Open Handset Alliance (OHA), which strive to develope open standards for mobile devices. In the beginning, Android was developed for use in mobile phones, but today it can be found running on tablet PCs and TV set-top-boxes (STB). Google released most of the Android code under the Apache License, a free software and open source license. That leads to a conclusion that more and more phones will be supported by Android. This was one of the reasons that we decided to choose this platform. Everyone who wants to develop applications for Android must install Android SDK [14], which includes a comprehensive set of development tools (debugger, libraries, a handset emulator, documentation, sample code, and tutorials). Mostly, developers write in the Java programming language, and sometimes programming language C can be used for time critical code with Android NDK. A very important characteristic of OS Android is that it enables

developers to replace even basic system applications, like calling application, and Short Message Service (SMS) application with their owns. If we encounter any problems during development, a large online Android community can be very helpful. An Android mechanism, that was used extensively in our application is Intent. It is similiar to Inter-Process Communication (IPC) with a data structure, holding the description of action, that needs to be performed. The primary pieces of information in an intent are action (e.g. display of some information with 'ACTION_VIEW') and the data to operate on (e.g. phone number 'tel 041922674'). Intents are usually used to launch an activity (a single, focused thing that the user can do) or to launch a service. The activity we launch with intent can be a part of our application or a part of some other application installed on our mobile phone. This way, a few lines of code allowed us to launch an application, which read the QR code and returned the result to our application. It can be used in two different ways. A window, shown in Figure 1, is presented to regular user at the launch of the application. The user is not allowed to check-in or check-out, if he didn't finish previous action. In the second case, when the user enters administrator usename and password in the settings, another button appears that allows the launch of ticket verification. The ticket is also saved to the phone's memory card, usually SD card, so that it can be shown to the conductor during the ticket inspection. After the user obtained his ticket, he can display the information of next three arrivals of the transportation means for his station by pressing a button. In order to do that, a HTTP GET request is executed with two parameters, origin of journey and command type. If the user has alredy completed his check-in and he chooses 'Information' in the menu, his current ticket gets displayed and his amounts charged (monthly, total), otherwise he sees only his amounts charged which is received from the server with the help of HTTP GET request with parameters username, password and command type. Figure 2 shows a QR code generated at the server to substitute a train ticket with an electronic version. Figure 2 - Screenshot of received ticket Figure 1 - The main menu of Android application Activity 'Check-in' connects a mobile phone to the server and requests a ticket. This is done with HTTP GET request. The following parameters are sent to the server with request: username, password, origin of journey read from QR barcode, command type defined by the application on the server. This request is executed in a new thread to allow the user interface to remain responsive. During the request, a dialog box is displayed to the user to inform him about the current action. After a successful request, a ticket is displayed in application. A ticket is a picture in PNG format, less than 1KB of size, which is very suitable for transfer over mobile network and status bar notification is set. This way, the user is reminded to not to forget to make a check-out at the end of his journey. Activity 'Check-out' is used by a passenger at his final station to finish a journey. This is done with HTTP GET request with the following parameters: username, password, destination of journey (read from QR code), command type and type of check-out. The parameter 'type of check-out' tells application on the server how much time had passed between check-in and check-out. This kind of a solution gives the user a possibility to change his mind and leave common carrier soon after the check-in and not to be charged with anything. After the successful check-out, he receives the fare in the response from the server. It is then also displayed on the mobile phone's screen. Besides that, the notification is removed from the status bar of phone and the user is allowed to make another check-in. Administrator can launch the verification of tickets from the main menu. This is accomplished by reading QR barcode, a ticket from the mobile phone screen of the passenger. The application gets username, time of check-in and security code from the QR barcode and then sends them as parameters of HTTP GET request to the appropriate method on the server. Afterwards, the validity of the ticket is displayed on the screen. This way, passengers who would want to cheat and

show fake ticket to the conductor in their own applications that look similiar to ours would have almost impossible job. 2.3 Application for NFC enabled phone Nokia 6212 We developed MIDlet for mobile phone Nokia 6212 which are applications that run on top of CLDC (the Connected Limited Device) configuration inside Java ME. Java ME configuration describes a set of libraries and type of Java virtual machine that must be present in an implementation. CLDC describes a small subset of Java SE libraries (no collections and advanced data structures) and is aimed at devices with limited working memory and/or limited computing power. It is a Java platform designed for mobile devices and embedded systems. Series 40 Nokia 6212 NFC SDK [15] is required for development of applications for Nokia 6212. SDK contains Nokia 6212 emulator, Application Programming Interface (API), source code samples and help files. If we want to communicate and exchange data with contactless cards, we also need to install JSR-257, the Contactless Communication API. NFC Manager software enables simulation of RFID tags to simplify programming of a phone. For our applications, we also have a possibility of monthly flat rate subscribers. Figure 3 shows the ticket information received by the passenger from the server after check-in operation. It can be stored to memory card and displayed during a control. Figure 3 - Screenshot of Nokia 6212 application The functionality of NFC application is very similiar to the one of Android. The main difference is that the checkin/check-out station is read from the RFID tag. The name is saved on a RFID tag in the form of NFC Data Exchange Format (NDEF) record defined as text/plain type. It is a binary format, that allows encapsulation of application data of custom type and custom length which is limited only by the size of user memory on RFID tag into the structure called NDEF message. It consists of one or several NDEF records and is conceptually very close to MIME types. URL adresses of HTTP GET requests sent to the server are the same as those in Android application. Since Zxing library for reading QR codes requires autofocus feature, which is not present in Nokia 6212, we couldn t use a phone to read a ticket during control. Consequently, it is not possible to verify tickets with application for Nokia 6212. 3. SERVER PROGRAMMING There are two web applications on the server: (i) one to register new users, and (ii) one for the administrators, who can check the statistics about passengers and past travels. There is also a 'servlet' which responds to requests coming from mobile phones. 3.1 Servlet A Servlet is a Java class in Java EE that conforms to the Java Servlet API, a protocol by which a Java class may respond to HTTP requests. We used Apache Tomcat as servlet container. This is the component of a Web server that interacts with servlets. The most important code inside the servlet is the one that takes care of check-ins by generating and sending tickets, check-outs, ticket verifications, sending information about train departures and calculating users' monthly consumption and sending them receipts. The servlet knows which of these actions to take from the parameter 'command', that is part of the received HTTP GET request. If a request is made from registered user, a servlet generates ticket in the form of QR barcode with Zxing library. The following string of characters is stored inside QR barcode: 'Username/TimeOfCheckIn/SecurityCode'. The security code is added to the ticket as a protection against forgery. The system also stores this code to the database, so it is possible to compare the value on a ticket with the value in a database and see if the ticket is valid. Only administrators can launch the application for calculating consumption an sending the receipts. This is done with HTTP GET request. The ticket expense is written to the PDF file and sent to e-mail addresses of all users. We used Java library itext for creating PDF files and JavaMail API for sending e-mails. 3.2 Web application for registring new users and web application for administrators Web applications were created with Google Web Toolkit (GWT). GWT is an open source set of tools that allows web developers to create and maintain complex AJAX front-end web applications in Java. Java source code is compiled to JavaScript, which is then inserted inside HTML document. All our applications needed to store data into database. We

used relational database management system MySQL to create tables for registred users, journeys, connections betweens cities, ticket prices and a table with fares. Both web applications sometimes need to communicate with the web server (e.g. when reading data from database to display it on a website). GWT uses mechanism called GWT RPC for the purpose of communicating with server via HTTP. The implementation of server side code calls is based on servlet technology. GWT RPC allows us to send Java objects between client and server, and all low-level details like object serialization are done automatically. Although the terminology is very similar, GWT's concept of 'serializable' is slightly different than serialization based on the standard Java interface Serializable. All GWT RPC calls are asynchronous (non-blocking), which allows applications to stay responsive even after the call to server method. In the application for administrators, all the charts were created with Google Visualization API. Using this powerful API, it is possible to choose from many different chart types (bar chart, area chart, line chart,...) and to customize their look (titles, colors, shape,...). Results of performed tests were also analysed on administration webpage. We also checked if registred users received their ticket expense recorded during the test on their e-mail addresses. 4. USE CASE SCENARIO OF THE SYSTEM Every passenger who wants to use the proposed system must register himself on a website. He enters his personal information and needs to choose how he wants to pay for our services (monthly flat rate or pay-per-travel). In the next step, he defines the type of a mobile phone which would be used for the electronic ticket. After successful registration, every new user receives login information and the application for mobile phone on his e-mail. He installs the application on the phone, enters his login data, defines settings and is ready to start using it when travelling. Figure 4 shows the working system by using mobile phones as a substitute of electronic ticket, RFID tags and QR code prints as identification of check-in and check-out points at the station. 3.3 Test results For the testing purposes of applications, we decided to implement an electronic ticketing system in the laboratory for a train transportation scenario. For tagging check-in and check-out stations we used an RFID tag, a contactless smart card MIFARE MF1ICS50 according to ISO/IEC 14443 standard which is used in public e-ticketing solution. The protection of a system against attacts is supported by mutual challenge and response authentication, data chiphering and message authentication. Data was written to the tag by a simple application developed for Nokia 6212. We also used web applications that can generate QR codes with custom content to be printed out representing check-in and check-out stations. For three train station defined in our tests, both tagging solutions were used. After that, we registered few users via our registration website, entered received login data to mobile applications and successfully made several check-ins and checkouts at different stations. A valid ticket in the form of QR code received from the server was defined with random generated string to prevent forgery. Additionally, to check if we can spot fake tickets in Android applications, we created fake ticket in the form of QR code without random generated string. With the help of Android application used in administrator node that contacted our server, we correctly identified fake ticket. The server application checked the database and found that the ticket with that kind of QR code with random string was not generated. Figure 4 - Typical use of the system. Description of passenger s journey is defined with four specification methods of a system: Start of the journey 1-Passenger places his mobile phone near RFID tag or reads QR barcode at the check-in point on a station. 2-Application on mobile phone gets the name of the station. 3-Application sends request for issuing a ticket to the server. 4-Application on the server authorizes the user and sends back ticket in the form of QR code or confirmation of valid pre-payed ticket. End of the journey 5-Name of the check-out station is read from RFID tag or QR code and sent to the server. 6-Server finalizes the journey.

Ticket verification 7-A conductor uses application on his Android mobile phone to read the ticket from the screen of passenger's phone and verifies it. Calculating the fare 8-Based on the known check-in and check-out station, application on the server calculates the fare. 9-Users receive receipts for their past journeys on the e-mail addresses. Administrators can login to the website and check the following data: 1-Number of passengers on certain routes (with chart); 2-Number of passengers on certain routes at certain times; 3-Ratio of passengers paying flat rate to those paying per travel; 4-Number of new registered users for the last defined period. Besides visualizing statistics data, it is also possible for the administrator to insert new train departure times and new prices for monthly flat rate. 5. CONCLUSION The proposed solution of an electronic ticket system shows an idea of eliminating a complete infrastructure of many electronic devices in public transport. There is no need of having smart cards, which benefits the passenger and no need for transport companies to install smartcard readers, or to support personnel with mobile ticketing system. Lately, many new technologies offer a very appropriate and cheap functionallity for the identification of stations and also defining electronic ticket in a form of QR code, stored on a phone. All operations, including identification of each checkin or check-out point and even verification of tickets can be done by any mobile phone. The use of camera on any mobile/smart phone to read QR codes or NFC facilities to read RFID tags is very suitable for transferring small amount of data from the enviroment or so called physical world to electronic devices. Mobile phones with camera are nowadays very common even in the low end segment of the market. QR barcodes can be created for free with special applications and printed at every home printer. The prices of RFID tags are in steady decline and are therefore used in many areas. At the moment, the only problem with our approach is in a low number of NFC enabled mobile phones that can read RFID tags on the market. But this is about to change soon, with anouncements of new NFC enabled mobile phones for Android (Nexus S), Apple ios (iphone OS) and Nokia coming every day. Some of them are already available, but the price is still very high. Developed applications allow simple and fast registration of passengers with the central ticketing system of a company which can be done by using mobile or wireless connections. We presented one of many possible solutions of future electronic systems and we are aware, that there would be some additional problems to solve. By now, we haven t explored any concerns about having Very Large DataBase (VLDB), a support of server operations in case of many simultaneous requests for check-in/check-out, how to deal with data security and integrity checks, etc. REFERENCES [1] Austrian railways web portal for buying tickets, http: //www.oebb.at/de/fahrkarten/online-ticket/index.jsp, 2010. [2] System for mobile payments Moneta, http://www.moneta. si/predstavitev/postopek_placevanja/lpp, 2010. [3] System of German railways for paying train rides with Mobile phones, http://www.touchandtravel.de/site/touchand travel/ de/start.html, 2010. [4] City card Urbana, http://www.jhl.si/holding/urbana, 2010. [5] Contactless smart card Oyster for London public Transport, https://oyster.tfl.gov.uk/oyster/entry.do, 2010. [6] Li Bay, Gerald Kane, Patrick Lyons: ''Open Architecture for Contactless Smartcard based Portable Electronic Payment Systems'', 4 th IEEE Conference on Authomation Science and Engineering, Washington, USA, August 2008, p.p. 715-719. [7] Florian Resatch: ''Working Prototype, An NFC- based Mobile Phone Ticketing System'', Ubiquitous Computing, 2010, p.p. 155-196. [8] Andreas Bohm, Bernard Murtz, Karsten Sommer and Manfred Wermuth: ''Location based ticketing in public Transport'', Digital Excelence 2008, p.p. 68-76. [9] Michael Canadi, Wolfram Hopken, Matthias Fuchs, ''Application of QR Codes in Online Travel Distribution'', Information and Communication Technologies in Tourism Vol. 4, p.p. 138-148, 2010. [10] Gerald Madlmayr, Peter Kleebauer, Josef Langer and Josef Scharinger, ''Secure Communication between Web Browsers and NFC Targets by the Example of an e-ticketing System'', E-Commerce and Web Technologies, Lecture Notes in Computer Science, Vol. 5183/2008, p.p. 1-10, 2008. [11] Forum NFC, http://www.nfc-forum.org, 2011. [12] QR code, http://www.denso-wave.com/qrcode/aboutqre.html, 2011. [13] OS Android, http://developer.android.com/guide/basics /what-is-android.html, 2010. [14] Android SDK, http://developer.android.com/sdk/index. html, 2010. [15] Nokia, http://www.forum.nokia.com/library/tools_and_ downloads/other/series_40_nokia_6212_nfc_sdk/, 2010.