1. Jason Kuo APSCA mrkuo@apsca.org October 29, 2010 Convergence and cross usage of secure elements for mobile PKI and secure mobile contactless services

2. Agenda  Introduction of APSCA  PKI service from Internet to Mobile  Security concern  NFC as a secured device  Mobile PKI service application cases  Summary 2

3. 3 APSCA The Asia Pacific Smart Card Association (APSCA) is a non-profit, independent association for organizations in the smart card industry in the Asia Pacific region. APSCA is the only professional association for smart cards covering the Asia Pacific and has over 60 members in Hong Kong, China, Taiwan, Japan, Korea, Singapore, Malaysia and Thailand.

4. Bank BBank A User Remittance channel FXML message channel FISC TW WebATM Balance Inquiry Fund Transfer WebPKI 4 Internet Banking using PKI with Smart card Bank C BankB,BankC

5. Banking service from Internet to Mobile Phone 5

6. Smart phone is more popular 6

7. 7 Security concern – Internet & Mobile service No idea who you are and is out there! Not sure if private information is compromised No confirmation of information source No assurance of legal protection Too many stories on hackers & cheats! How mobile device have equivalent in security level to the PC ?

8. New component for mobile Phone with RFID and Security component in NFC Phone 8 SIM -Application logic (java) -User credentials -Open Platform enabled NFC chipset Inside contactless - RF layer - Multi-protocol (type A, B, felica, 15693) RF antenna SWP Single Wire Protocol -1.5 Mbit/s -Battery off mode -Open solution (free IP) -Under standardization (ETSI) -Compatible USB Recommended by (OTA)

9. The trend and schedule for NFC Phone 9 0 400 800 1.200 1.600 2.000 million units 2006200720082009201020112012 mobile phonesphones w memory slotNFC phones Sources: ABI Research, Juniper Research, G&D NB2 SIM SD card

10. NFC Core Applications 10

11. Full NFC is Close  Core specifications are completed  NFC Forum certification program will be launched 4Q 2010  Will enable device manufacturers of all kinds to test against specifications Help stabilize the market Get globally interoperable devices to market 11

12. 4 security element options 12 Embedded SE SIM-based SE Removable SE Trusted Base SE = Secure Element

13. 13 Secure Elements to enable secure applications

14. EXTERNAL TSM 14 Service applet provisioning with/without Mobile Operators

15. Security control for Multiple services in one SEs

16. 16 Service application cases Provides best-of-breed for: Electronic identification (mobile eID) Secure mobile payments (mPayment) Mobile commerce (mCommerce) Mobile Banking (mBanking) Mobile Money Transfer (MMT) Document signing Any security ”aware” application

17. Service Application Providing Internet Office to Mobile Office 17

18. 18 e-banking user e-banking solution mobile phone number 123 authentication request signed confirmation login request Sample use cases: e-banking, electronic stock exchange, electronic insurance services, self-care portals, access to payable content (authentication),... Sample use cases: e-banking, electronic stock exchange, electronic insurance services, self-care portals, access to payable content (authentication),... Service Application Transaction authentication

19. 19 e-government / ERP Home Worker stock sell order authentication 123 sell order signature request signed order Service Application Remote signing for work flow Sample use cases: electronic payment instruction confirmation, purchase or sell orders, self-care portals (contracts, annexes), e-government, e-voting,... Sample use cases: electronic payment instruction confirmation, purchase or sell orders, self-care portals (contracts, annexes), e-government, e-voting,...

20. Summary  It’s important to identify yourself with ID card in physical and e-ID in virtual environment.  Smart Phone is pushing internet service to Mobile service  Personal and security information shall be store in a secured device  Visa/MasterCard had done many NFC trials for credit card payment  It’s good for PKI as bank card service from web internet to mobile service. 20