Welcome!

News Feed Item

Consult Hyperion and the GSMA Publish Report Contrasting HCE and SIM Secure Element Approaches to NFC Payments

Digital payments experts Consult Hyperion, in conjunction with the GSMA, today published a guide to help banks and mobile operators understand the Host Card Emulation (HCE) and SIM Secure Element approaches for NFC payments. The guide, “HCE and SIM Secure Element: It’s not Black and White”, follows the recent introduction of HCE into Android 4.4 (KitKat) and concludes that the SIM Secure Element and HCE approaches to NFC payments each offer important benefits for financial institutions. Further, they should not be viewed as mutually exclusive and a combination of the approaches may be appropriate for differing applications and markets.

“This paper provides a balanced analysis for financial institutions of HCE as an alternative proposition for NFC payments, alongside the existing SIM approach,” said Alex Sinclair, Chief Technology Officer, GSMA. “The recent inclusion of HCE into Android opens up the possibility of performing NFC payments without using a SIM Secure Element and HCE could also potentially remove complexity associated with SIM-based NFC payments. At the same time, SIM-based NFC offers a proven secure solution that is being commercially deployed today. The challenge for the mobile operator community is to simplify the provisioning process, further accelerating deployments of SIM-based NFC on a global basis.”

“MasterCard has been technology agnostic, enabling mobile payments in a way that allows current card accounts to be used seamlessly and securely from consumers’ favorite electronic devices,” said James Anderson, senior vice president of emerging payments, MasterCard. “We have deployed SIM and Secure Element-based solutions through partnerships with mobile network operators, OS providers and handset manufacturers, while recently adding support for cloud-based payments. This paper will help both the mobile and payments industries understand the strengths of each approach and allow them to choose the options that align with their business strategies.”

Report co-author Steve Pannifer, Head of Delivery at Consult Hyperion said: “The inclusion of HCE into Android has generated a lot of excitement that can only be good for NFC payments. This, combined with the efforts to streamline SIM Secure Element based NFC evident in many markets, will enable NFC payment products to be rolled out with renewed vigour. We hope that this paper will encourage banks and mobile operators to collaborate further in bringing NFC payments to the market. We believe the mobile operators have an important role to play, particularly in providing mobile security and authentication services that are paramount in any payments service.”

The guide shows that whilst HCE does indeed simplify some aspects of the NFC ecosystem by allowing mobile NFC payments to be performed without using a SIM Secure Element, this is only part of the landscape. HCE requires a new approach to security in terms of ecosystem integration, risk management and certification processes. In contrast, SIM Secure Element processes are well defined and mobile operators are actively working with the ecosystem to simplify them further.

The report examines the heritage of SIM-based NFC, the lessons learnt from the first deployments and the actions that have been taken to allow service providers to deploy secure, stable and proven mobile payment services at scale. The guide finds that whilst there is significant interest around HCE, the SIM Secure Element approach for mobile payments still has many complimentary advantages and it will be down to the banks to carefully review their needs in each of their operating markets.

“Both the People’s Bank of China (PBOC) and China UnionPay have released mobile payment specifications, which require a Secure Element to support NFC mobile payments, in order to provide a secure and reliable payment service. China UnionPay has worked very closely with Chinese operators on large-scale commercial NFC services based on the SIM as Secure Element. In conjunction, China UnionPay is working actively on a feasibility study of new technologies including HCE,” said Jiang Haijian, Deputy General Manager, Mobile Payment Dept., China UnionPay.

Consult Hyperion suggests that there are a number of key points for banks to consider as they plan mobile NFC payments:

  • Understand your local environment: The local conditions will play a big role in determining the best approach
  • Understand your target transactions: It is possible that HCE will be less suited to certain transaction types (e.g. offline, high value) than SIM Secure Element.
  • SIM Secure Element and HCE are not mutually exclusive: The most effective solutions over the medium term may be hybrid models where, for example, the SIM is used to address the security and authentication gaps in HCE.
  • Build flexibility into your strategy: There is likely to be considerable overlap between SIM Secure Element and HCE in terms of the systems and capabilities that are required
  • Collaborate with the industry: Until there is a level of standardisation around HCE, there remains the risk that banks could adopt solutions that are insufficiently flexible or lock the banks in.

David Baker, Head of the Card Innovation Payments Unit at the UK Card Association notes: “While Host Card Emulation has been hailed as a potential game changer for card-based NFC proximity payments, this report gives valuable advice and guidance on the issues the industry must address -- and highlights the real need for collaboration between ecosystem partners to ensure greater adoption of mobile payment services.”

The full report can be seen here

Note to Editors:

HCE is a recent feature of Android that allows an Android application to emulate a contactless card via the NFC interface of the handset; previously, this was reserved to applications stored in a secure chip or Secure Element, typically the SIM card, with similar security features as chip-and-PIN plastic cards. HCE opens the way to payment applications without a secure element, but such applications need to reach a satisfactory level of security. In order to achieve this, card schemes are developing a “tokenisation” approach, whereby the payment card identifier is replaced by a single use or limited use “token”. This reduces the impact of data breaches significantly: if a “token” is compromised it will have limited and possibly no value.

The guide was commissioned by the GSMA, 5 New Street Square, London, EC4A 3BF, United Kingdom. Any opinions, findings, and conclusions or recommendations expressed in the material are those of the author(s) and do not necessarily reflect those of the GSMA or its members.

About Consult Hyperion

Consult Hyperion is an independent information technology consultancy that has spent over two decades advising leading organisations around the world. Consult Hyperion helps these organisations to reap real benefits from technological change in the field of secure electronic transactions ranging from retail payments to mobile wallets to contactless transit ticketing. Consult Hyperion is uniquely qualified to advise on turning great business ideas into working systems that can help customers, and to evaluate new business concepts, develop new products and services from specification to customer roll-out, and to test and certify complex systems.

The four main sectors the company operates in are; financial services, with card schemes, banks, retailers and others; telecommunications and media, advising world leading companies; technology, to support some of the largest IT companies, and in the public sector and transit where projects include transit operators, government and law enforcement.

For more information visit Consult Hyperion, follow on Twitter @chyppings and keep up to date with the latest debate at Tomorrow’s Transactions Blog.

About the GSMA

The GSMA represents the interests of mobile operators worldwide. Spanning more than 220 countries, the GSMA unites nearly 800 of the world’s mobile operators with more than 250 companies in the broader mobile ecosystem, including handset makers, software companies, equipment providers and Internet companies, as well as organisations in industry sectors such as financial services, healthcare, media, transport and utilities. The GSMA also produces industry-leading events such as the Mobile World Congress and Mobile Asia Expo.

For more information, please visit the GSMA corporate website at www.gsma.com. Follow the GSMA on Twitter: @GSMA.

More Stories By Business Wire

Copyright © 2009 Business Wire. All rights reserved. Republication or redistribution of Business Wire content is expressly prohibited without the prior written consent of Business Wire. Business Wire shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Latest Stories
It is one thing to build single industrial IoT applications, but what will it take to build the Smart Cities and truly society changing applications of the future? The technology won’t be the problem, it will be the number of parties that need to work together and be aligned in their motivation to succeed. In his Day 2 Keynote at @ThingsExpo, Henrik Kenani Dahlgren, Portfolio Marketing Manager at Ericsson, discussed how to plan to cooperate, partner, and form lasting all-star teams to change the...
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
"delaPlex is a software development company. We do team-based outsourcing development," explained Mark Rivers, COO and Co-founder of delaPlex Software, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
In his session at 20th Cloud Expo, Mike Johnston, an infrastructure engineer at Supergiant.io, will discuss how to use Kubernetes to setup a SaaS infrastructure for your business. Mike Johnston is an infrastructure engineer at Supergiant.io with over 12 years of experience designing, deploying, and maintaining server and workstation infrastructure at all scales. He has experience with brick and mortar data centers as well as cloud providers like Digital Ocean, Amazon Web Services, and Rackspace....
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From ...
"I think that everyone recognizes that for IoT to really realize its full potential and value that it is about creating ecosystems and marketplaces and that no single vendor is able to support what is required," explained Esmeralda Swartz, VP, Marketing Enterprise and Cloud at Ericsson, in this SYS-CON.tv interview at @ThingsExpo, held June 7-9, 2016, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Fusion, a leading provider of cloud services, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Fusion, a leading provider of integrated cloud solutions to small, medium and large businesses, is the industry’s single source for the cloud. Fusion’s advanced, proprietary cloud service platform enables the integration of leading edge solutions in the cloud, including cloud...
The buzz continues for cloud, data analytics and the Internet of Things (IoT) and their collective impact across all industries. But a new conversation is emerging - how do companies use industry disruption and technology enablers to lead in markets undergoing change, uncertainty and ambiguity? Organizations of all sizes need to evolve and transform, often under massive pressure, as industry lines blur and merge and traditional business models are assaulted and turned upside down. In this new da...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settle...
SYS-CON Events announced today that Cloud Academy will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloud Academy is the industry’s most innovative, vendor-neutral cloud technology training platform. Cloud Academy provides continuous learning solutions for individuals and enterprise teams for Amazon Web Services, Microsoft Azure, Google Cloud Platform, and the most popular cloud computing technologies. Ge...
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
Cloud Expo, Inc. has announced today that Andi Mann and Aruna Ravichandran have been named Co-Chairs of @DevOpsSummit at Cloud Expo 2017. The @DevOpsSummit at Cloud Expo New York will take place on June 6-8, 2017, at the Javits Center in New York City, New York, and @DevOpsSummit at Cloud Expo Silicon Valley will take place Oct. 31-Nov. 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that Outlyer, a monitoring service for DevOps and operations teams, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outlyer is a monitoring service for DevOps and Operations teams running Cloud, SaaS, Microservices and IoT deployments. Designed for today's dynamic environments that need beyond cloud-scale monitoring, we make monitoring effortless so you...
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain.
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.