tm @globalplatform_ 1 gp confidential ©2013 1 globalplatform’s value proposition for mobile point...
TRANSCRIPT
TM
@GlobalPlatform_ www.linkedin.com/company/globalplatform1
GP Confidential©2013
1
GlobalPlatform’s Value Proposition forMobile Point of Sale (mPOS)
Dongyan Wang
GlobalPlatform Technical Program Manager
Wednesday 19 March
GP Confidential©2013
@GlobalPlatform_ www.linkedin.com/company/globalplatform
TM
GlobalPlatform MembersTM
TM
Introducing GlobalPlatform Standards...
• With GlobalPlatform standards:
• Create once based on: o Stable and interoperable application programming interfaces (APIs)o Stable security requirement
• Deploy ‘everywhere’
3
GlobalPlatform
TM
GlobalPlatform Positioning
Across several market sectors and in converging sectors
GlobalPlatform is the standard for managing applications on secure chip technology
TrustedExecution
Environment
Secure Element
AND
PremiumContent
TM
Mobile as a Center of the New Service Deployment
Trusted Execution Environment
The trusted execution environment (TEE) provides with a unique capability to ensure that a transaction:• Is approved by the right end user • Is on the right and trusted device • Takes place between the application and cloud or back-end service
TM
What is a TEE?
• TEE provides hardware-based isolation from rich operating systems (OS) such as Android
• TEE runs on the main device chipset and relies on hardware roots of trust (crypto keys and secure boot)
• TEE has privileged access to platform and device resources (user interface, memory controller, video / audio hardware, crypto accelerators, biometry…)
• Technology already massively deployed
• Premium content protection is currently a major use case
6
Hardware Platform
Rich OS Application Environment
Rich OS
Trusted Execution Environment
Trusted CoreEnvironment
GlobalPlatformTEEInternalAPI
TrustedFunctions
Payment Corporate
Client Applications
TrustedApplication
DRM
TrustedApplication
Payment
TrustedApplicationCorporate
HW Secure Resources
GlobalPlatformTEE Internal
TEE Kernel
API
GlobalPlatform TEE Client API
Open to malware and rooting / jailbreaking
Isolation of sensitive assets
TM
GlobalPlatform TEE Functions
• Code and data isolation• Secure cryptography• Secure storage• Secure clock• Trusted user interface• Secure element (SE)
interface• Administration scheme
Hardware-based TEE Functions = ToolBox • Device authentication
• User authentication• Protection of any
sensitive software engine
• Digital signature and encryption
• Secure communication to server and / or SE
• Upgradable environment
Value for Secure App Providers includes
TM
Unique Feature for mPOS : Trusted User Interface (UI)
Message to be signed▪ Transaction summary displayed by
TEE▪ Rich OS environment cannot tamper
with the message▪ The user signs exactly what s/he is
seeing
Explicit Validation Means▪ PIN / password entry rich OS
environment cannot have access to entered credential
Security Indicator▪ Text or image
▪ ‘Sign-in seal concept’
▪ Information securely configured by the user and securely controlled by the TEE
▪ Prove to the user that the screen is TRUSTED by seeing this known information
Tools to build ‘what you see is what you sign’, anti-phishing and non repudiation
TM
• Near field communication (NFC) smartphone can be used as card reader
• A trusted channel is opened between the card and the mPOS
Trusted mPOS (1/3)
Secure Channel
Rich OS
My Store
TM
• When needed the end user enters a PIN to confirm a contactless transaction
• A trusted application will use the trusted UI feature to protect the PIN from any rich OS application
Trusted mPOS (2/3)
PIN
TM
• mPOS needs to be integrated with back and front office applications
• TEE protects the credential required to ensure a trusted channel is opened between the mPOS and the server
Trusted mPOS (3/3)
Rich OS
My Store
Secure Channel
TM
• Thanks to the GlobalPlatform open architecture supporting multiple applications, a smartphone with a qualified TEE is able to support different mPOS applications – Such as mPOS APPs world, mobile,
loyalty programs, actionable intelligence, cross-channel and in-store marketing programs.
• But also barcode scanning, LBS, eReceipts, coupons, QR codes, wallets, click & collect, geo-targeted mobile advertising and alternative in-store payments.
TEE Supports Value Added Services on mPOS
Rich OS
My Bank
TM
• Thanks to the GlobalPlatform open architecture supporting multiple applications from multiple actors, a smartphone with a qualified TEE is able to support different POS
• TEE security certification offers a real insurance for the mPOS deployment
• TEE administration will provide a standard language to manage a mPOS application – Load, install, delete– Update
TEE Supports Multiple mPOS Model
Rich OS
My Bank
TM
Support Different Use Cases
14
eCommerce
• mPOS installed in end-user smartphone
• End-user enters his PIN on his mobile
Commerce
• mPOS installed in merchant smartphone
• End-user enters his PIN on merchant mobile
Hybrid
• mPOS installed in merchant smartphone BUT
• End-user enters his PIN onhis mobile
TM
Summary
• Collaboration between TEE and card allows the best of both worlds– High level security of smart card/SEs and usability of smartphone
• The massive deployment of GlobalPlatform SE and TEE generates a standardized infrastructure for: – Enhancing the usability and security of today’s services– Deploying new payment services (peer-to-peer, remote payment)
• Compliancy is needed to deploy a mobile service across different devices from different providers
• Security across different device and suppliers is a must that is central to the GlobalPlatform technology
15
TM
More @ www.globalplatform.org
16