HCE Driving NFC: From Idea to Reality to Ubiquity. Mobey Day October 7/8, 2014

Transcription

1 HCE Driving NFC: From Idea to Reality to Ubiquity Mobey Day October 7/8, 2014

2 M-PAYMENTS & NFC ADOPTION? 2

3 WHY SO SLOW? The trend towards mobile has set in everywhere else Contactless card use and acceptance are making great strides Other forms of mobile commerce are picking up Technical specifications, certification programs and supporting hardware have all been available 3

4 CONSUMERS AREN T BITING Why haven t they taken the bait? 4

5 CONSUMERS NOT TAKING THE BAIT Awareness Ease of adoption User Experience Acceptance Security Incentive/Value 5

6 BANKS / SPs NOT TAKING THE BAIT Don t want to give up control of Business Model Brand & Consumer Experience Technology & Roadmap 6

7 HCE INTRODUCED ALTERNATIVE HOST CARD EMULATION 7

8 HOST CARD EMULATION (HCE) Traditional SIM SE Models: Host Card Emulation (HCE): 8

9 ADDRESSING MARKET NEEDS What HCE Delivered to the market 9

10 HCE IGNITED NFC IN 2014 For Several Reasons Puts Service Providers back in control Independence to act Simpler deployment models More attractive commercial models Keep control over brand and wallet presence Access the full consumer base 10

11 IS HCE SECURE enough? Tokenization Limiting the use of credentials and keys Active and passive authentication of device and cardholder Added layers of security Hybrid: SE + Cloud Trusted Execution Environment (TEE) Biometrics 11

12 WHAT IS TOKENIZATION? Cardholder information is encrypted and converted to a token that is passed to the merchant POS. No card data stored on the phone. No card data vulnerability at merchant MR CARDHOLDER (Cloud or SE) No changes to contactless POS or merchant acceptance 12

13 IMPACT OF APPLE PAY Huge endorsement for Mobile Payments & NFC Removes longstanding doubt: Uses existing NFC technology & POS terminals Works with schemes: MasterCard/Visa/Amex Brings mass consumer exposure Tokenization + Biometrics 13

14 MULTIPLE SECURITY STANDARDS Cloud/ Issuer Owned SE OEM SE Scheme Service Apple Pay uses tokenization + embedded hardware SE Multiple security models (cloud & SE) will co-exist Credentials managed by Apple (SE owner) or Issuer (Cloud SE owner) Crypto validation & other tokenization is effectively the same 14

15 WHAT TO LOOK FOR MOVING FORWARD HCE, UICC, Embedded SE all of the above? Multiple Security Models will co-exist Hybrid Solutions that combine hardware SE or Trusted Execution Environment (TEE) will add additional security to Cloud Payments / HCE Biometrics for added authentication Tokenization will be standard Mobile Commerce = Remote + Proximity Scheme services & standards playing an increasing role in ecosystem 15

16 TOKENIZATION REQUIREMENTS New processing functions related to tokenization messaging (below in blue) according to EMVco specifications. Cloud Optional Data exchange via the cloud Response Token PAN Product ID Last 4 digits of PAN Token Assurance Level Response Token PAN Product ID Last 4 digits of PAN Token Assurance Level Token Service Provider Response PAN De-Tokenize NFC Device Merchant Terminal Acquirer Payment Network Issuer NFC Data Token Token Exp. Date Token Requestor ID POS Entry Mode Token Cryptogram Request Token Token Exp. Date Token Requestor ID POS Entry Mode Token Cryptogram Request Token Token Exp. Date Token Requestor ID POS Entry Mode Token Cryptogram Request PAN PAN Exp. Date POS Entry Mode Token Token Exp. Date Token Requestor ID Token Assurance Level 16

17 ISSUER CONSIDERATIONS Remote / Proximity PIN / Biometrics Integrated? Stand-alone? Mobile Payment Application In-house / outsource? Multi-platform SE & Cloud Security TEE Hybrid / TEE? In-house / outsource? Scheme service? Token Service / Crypto Validation Credential Management Multi-scheme In-house / outsource? Software changes? Authorization Issuer Card Management Hardware changes? 17

18 WHAT STILL NEEDS TO BE DONE To make mass-market adoption a reality? Clear standards from all schemes for cloud based payments & HCE Clear certification process for all schemes Cross platform consistency Additional use cases : transit, access control, ID etc. Value Added Services Loyatly, coupons etc. 18

19 TECHNOLOGY + USER EXPERIENCE Easy to adopt Intuitive User Experience Accepted everywhere Rewarding user experience Local / Targeted 19

20 CARTA : Carta provides Digital Credential Management & Tokenization Services for Cloud and NFC mobile payment deployments 20

21 ABOUT CARTA A Global Payment Technology Partner CANADA TORONTO UK SCOTLAND LONDON EUROPE SAN FRANSISCO UNITED STATES CASABLANCA UAE CARIBBEAN / LAC CARTA OFFICES CARTA DATA CENTERS MARKET OPERATIONS AUSTRALIA / NZ 14 Founded: 2007 HQ: Toronto, Canada Privately Held. Private & Institutional Investors $50MM+ Invested in Next-Gen Processing Platform Marquee client HCE deployments across 4 continents 21

22 THANK YOU. Contact: Giles Sutherland, VP Strategic Alliances: 22