The Market Must be Minded to Use NFC - the article by Mikhail Tatarenkov, the Head of Convergent Projects for “Cards' World” journal - #9, 2013

This article aims to highlight the key aspects of NFC market which is being formed in our country, to give an overview of the already launched projects. We also would like to invite our readers to discuss the first findings and insights garnered by the project participants and the development potential of the Russian NFC market. Such a complex task, obviously, could not limit itself to a few sheets of the text.

Over the past year «NovaCard» has gained the unique experience through the delivery of almost all the NFC projects launched in Russia and the CIS. We sincerely hope that the write-up presented below will help you to shape an objective view on technology which became the leitmotif of the vast majority of the card’s business conferences, exhibitions and events during the past few years.

Sticking to the rule of the early delivery of the top quality innovative products to our partners we started to poise the converged solutions market at the end of 2011 based on our learning derived from manufacturing and personalization of EMV cards for the largest banks, (U)SIM-cards for mobile operators, MIFARE products for transport operators, payments aggregators and retail chains. In each sphere we delivered many successful projects, and combining the upper functionality in the phone could jumpstart the development and roll out of a new product which, without doubt, will receive an accolade from the users.

We appreciate the efforts of our partners to promote NFC in Russia. These products would have never been developed without your expertise. The start for our market was given in May 2012, when the largest payment NFC project on the territory of Europe was launched. Gradually other operators and banks joined with their own projects (this will be set out in detail below). In fact for a year and a half a large amount of information has accumulated. It is worthwhile to study and discuss it.

Pilot NFC projects. Technical aspects.

The idea to create a client-oriented service on a high level has resulted in a series of the pilot NFC projects announced over past eighteen months in different cities of Russia and the CIS: Moscow, Minsk, St. Petersburg, Nizhny Novgorod, Yekaterinburg, Novosibirsk and, of course, Kazan. Geography of projects and their scale are diverse. However, there are many common technical features of these solutions. During the launch of the new projects the business model has been defined and refined. It allows the participants to promptly start the NFC project. The main features are as follows:

• For all NFC pilots (except for iFree and TCS) a SIM-centric model was selected with the UICC card as the Secure Element (SE) and the image of the Bank and/or transport MIFARE card;
  
• Telecom, banking and transport apps are personalized in a traditional way in NovaCard or inhouse. Often instead of complex logistical schemes and physical moving of cards from one inhouse to another, the personalization is performed in the trusted bureau with the high degree of protection, where the whole process of production and personalization takes place within one safety circuit;
• For the transportation projects a User Interface in the form of STK-menu is used. It allows to remotely add funds to the transportation card from the mobile phone account;
• NFC card with the built-in banking application is distributed through the network of bank offices that allows to quickly sign a bank service contract and to replace the SIM card in the bank branch.

These features form a clear scheme of participation for all parties involved. You can introduce to the market NFC project within 3-4 months, considering the time for the arrangements and for the settlement of contract details between the participants.

This model was most effectively tested during the preparation for the large-scale Russian NFC project dedicated to the XXVII World Summer Universiade in Kazan. The key players in their industries participated in this project: “AK Bars” bank - the largest bank in the Tatarstan region, “Transportation card” provides a share of 77% of public transportation ticketing in Kazan, “Big four” mobile operators. Thus, maximum coverage of the potential audience of the NFC services users was ensured.

However, time is required to become a mass service even in such an enabling environment. This became evident in 2 months after the start of the project. Similar scenarios are characteristic for all NFC pilots launched during the past 18 months. It erroneously seems that the consumer only needs to have the phone and the desire to use the NFC. But there are other Russian market intrinsic limitations.

The status of the running NFC projects. Forecasts, realities, prospects.

With all its promise and obvious advantages over alternative forms of payments, NFC was unable to «blow up» the Russian market of payments as well as any market of the other country. Pilot projects are running, but the consumers are not ready to massively deploy the new technology. There are several reasons which in different ways influence the rate of deployment of this technology.

First it is the infrastructure readiness to accept contactless transactions. NFC POS-terminals start to appear in the points of sale. However, the percentage of these enterprises among the total number today is small. The consumer with its buying preferences in certain shops, retail chains, service companies can hardly safely abandon the use of other forms of payment.

Secondly, about 10% of all newly sold phones are NFC-enabled. The percentage is not high, but the rate of growth of sales of NFC-enabled devices has the positive dynamics. However, sales could be even higher if the phone retailers were interested to promote this technology. In fact most of the consultants heard of NFC, some of them can explain properly what this technology is and why it is needed, but only few of them know where NFC cervices are available. Speaking about territories outside Moscow or St. Petersburg, the question «Where can I use NFC?» can hardly be answered. This is not because the consultant is poorly versed in the subject, but because you are probably the first who asked him about it. As a result NFC is not that «technological trick» the consumers would like to possess. It is only an add-on to the more consumer-tangible features like the high performance, the high resolution of the screen, many megapixels of the camera and other valuable parameters of mobile devices.

By the way, most of the users believe that NFC is a technology to transfer media files (Peer2Peer mode) because it's the only available operation for them now with the use of this function.

Thirdly, the consumer needs to come to the bank branch. This need to go somewhere and take further steps cut off about 45% of the potential audience. People simply do not want to do extra work.

This environment is not supportive in terms of the introduction of the technology: banks are not in a hurry to replace the POS-terminals for the modern contactless payments-ready equipment referring to their higher costs and the small number of NFC devices sold (about 3 million in Q2 2013 in Russia); and users are not in a hurry to give preferences to NFC-capable phones due to the underdeveloped infrastructure. Luckily in the second half of 2013 Banks Issuers made the installation of NFC POS-terminals more affordable for the merchants. Thus, hopefully within 3-5 years (average equipment life-cycle in retail) a broad network of contactless POS-terminals will be installed.

Additionally, business arrangements play the essential role. Financial institutions and mobile operators spend a substantial period of time, 2-3 months, to agree on a business model. According to the current practice, this process is complex, but quite surmountable if there is a good will. Many banks have already proven the viability of the idea of partnership with mobile operators, thereby driving NFC business in Russia. And we believe that soon they will be joined by other banks, making it possible for the consumer to use the NFC services in the Bank, as an option to the already opened card account.

Certainly, today’s NFC format in Russia is the very initial phase of the NFC ecosystem introduction. But this stage is extremely important, as it is essential to build the qualitatively new models with the use of the Trusted Service Management (TSM) platform. It is the service that reveals the full range of the NFC features.

Trusted Service Manager

As NFC ecosystem grows the SE Issuer enters into contractual relationships with the new Service Providers (SP): Banks, Transportation companies, etc. But still the question is how to deliver a new service on the already released SE is vital. A scenario used in the pilot projects, when the application is personalized at the factory, is irrational. Imagine that every time you need to add/remove a service, activate and lock an application and etc., the UICC card will have to be re-issued and delivered to the subscriber. This is unacceptable for all including the end user.

TSM aims to solve the problem of the remote administration of the SE. TSM is a hardware&software complex providing encrypted OTA data channel on the SE of the end user (UICC card) while providing NFC services. Thus, the SE Issuer can quickly and easily connect a new SP, remotely personalize the SE application and arrange its lifecycle management.

The term «NFC ecosystem» usually implies the presence of two or more TSMs. As a rule, one TSM belongs to the Issuer (TSM Secure Element Issuer), and the other to the Vendor/Service Provider (TSM Service Provider). Business procedures are defined in the GlobalPlatform System Spec. 2.2 and AFSCM specifications.

Let’s consider a scenario of the NFC service connection in such an ecosystem with two TSMs. The end user gets in touch with the SP to connect the NFC service. The Provider asks for verification of compliance.

The Service Provider directs a TSM SEI request for the verification of the requirements compliance through the TSM SP. TSM SEI automatically runs a series of tests “Operator-Service Provider» and «Operator-Subscriber»:

If a positive answer is received for each question, then TSM SEI will provide TSM SP with a compliance report. If no, the Provider will be given the reason for the refusal. This operation takes a few seconds and runs online. In case of a positive result the Provider moves to the next stage and asks the TSM SEI to create an additional security service domain (SSD).

TSM SEI creates the new SSD on the end-user’s SE via OTA. Right after creation SSD contains a set of default keys SCP 02. In future, these keys will be replaced so that they would be unknown to the Operator. The Trustee is involved in the procedure of the keys replacement, it also manages the Controlling Authority Security Domain (CASD). Thus the Provider’s confidentiality is guaranteed when working with SSD.

Personalization of contactless applications and activating via OTA comply with the selected scenario of the Card Content Management (CCM): Simple mode, Delegated management, Authorized management.

In simple mode the Operator takes actions with SE on behalf of the SP. After the SSD on the SE was bound to a specific Provider, a contactless application of the Service Provider can be downloaded and installed on the SSD.

When using delegated mode to access the Operator’s SE, the SP must obtain a permission (digital signature) from the TSM SEI for the manipulations with SSD. This usually happens automatically according to the terms agreed by the parties.

When using an authorized mode, the SE Issuer authorizes the SP to carry out any operations with SSD, without notice to the Issuer.

The contactless application connection completes with a successful activation. After that TSM SEI provides SP with a report about the performed operations with the SE and the results obtained. TSM SP checks this report and updates the status of the services provided to the Subscriber.

Information exchange between TSM and the external systems is conducted through a cryptographically secure Protocol with mutual authentication of the parties and ensured confidentiality and integrity of traffic. All operations associated with remote management of SE and services activated on these SE are recorded and can be accessed by the TSM administrators. Card Content Management (CCM) is performed by TSM administrators via a web interface remotely. TSM administrators have an access to TSM via https or other secure protocols.

Solution role management complies with the model of Role Based Access Control (RBAC) and supports the following functional roles: Administrator, Operator, Auditor. Functional roles can be modified within the RBAC model.

TSM also allows you to make records of all transactions for backup and recovery.

This solution allows the user to become an administrator of all services connected: to choose only the selected features, to connect them by simple clicking, to control the lifecycle of installed applications. This is the key feature planned for a launch.

TSM Models: Inhouse и Hosted

TSM Platform is a rather expensive solution. In Russia, as in Europe, the purchase of hardware&software of such complexity requires a balanced approach. The majority of market participants to date have no specific drivers to purchase inhouse solutions. Therefore it is worthwhile to host services in the trusted bureaus. Before the decision to purchase a platform is made the SPs and Operators can use TSM located in the NovaCard’s Center of Data Processing (CDP). Geographically, the datacenter is located on the territory of Russia, in Nizhny Novgorod.

Hosting in the NovaCard’s CDP allows to reduce the overall budget of the project, as Operators and SPs do not have to purchase hardware. Instead the NFC ecosystem participants agree on the number of Active User licenses and pay fees only for users who passed the procedure of activation of service. The leading Russian banks have put their trust in NovaCard for over 7 years delegating us the manufacturing and personalization of EMV-compliant payment cards of the total volume of more than 30 mln. cards. Among our partners are: MTS-Bank, Home Credit & Finance Bank, non-Bank credit institution «Golden crown», Rusfinance, OTP Bank, BNP Paribas, HSBC, Ak Bars Bank, BelGazProm Bank, CA Sberbank, Volgo-Vyatsky head office of Sberbank of Russia.

When after a certain period of time an Operator or a SP will decide to move the hosted solution inhouse – the Provider will provide all necessary support. This model has a number of advantages for our partners they will appreciate duly.

User interface

As NFC services in Russia are undergoing the phase of trials, the players mainly bet on performance. At this stage the user interface lacks focus. Partly it's the right decision. The service should primarily operate stably without causing customers’ complaints. If this is achieved, then the next step will be a roll out of a functional application that gives the user not only the visualization of the Bank or Transport card, the image of which is in the phone, but also a wide range of extra options: menu for card management, card balance, transactions history, the list of available cards, the option to enter the PIN on the phone when conducting 2tap transactions, links to useful information and more. One of the most interesting options is the link to the mobile Bank.

A Mobile application provides a user-friendly and familiar to Smartphone users interface and also the opportunity to install the additional protection. For example, it allows to set a requirement to confirm every transaction with entering a PIN online eliminating the possibility of unauthorized use of customer's account, if the phone is stolen or lost. In addition, there is a list of possible options and recommendations developed by payment systems. Today NovaCard can offer customization and branding of the interface in line with the wishes of the customer. The solution is based on the demo-application created in accordance with the MasterCard SDK (Software Development Kit). User interface is of big interest to the Banks participating in the NFC projects, because it is important to the Bank that the user can quickly and easily obtain the necessary information. Soon the first applications will be released.

Conclusions

Today it is clear that the penetration rates of contactless payments, both in Russia and worldwide, are significantly lower than it was predicted by NFC experts. However, there's nothing wrong that forecasts do not come true. What is important is that the dynamics of development is positive. Therefore, we can expect successful commercial launches.

There is a considerable number of skeptics who doubt the NFC technology introduction. But if many of us could agree 15 years ago that every Russian citizen would have a banking card? I think, that even those who were driving the card business in our country, did not know from the outset how the industry will develop: they hardly could predict a wide range of banking products, which are currently being actively used by consumers: debit, credit, prepaid cards; loyalty programs in the form of bonuses and cash-backs; online shopping, online banking and more. And, hopefully, NFC also has serious chances for the wide implementation.

NFC is neither a panacea nor a “space-shuttle”. This is just a convenient way to pay for what you need. It is a real alternative to cash – but it needs time to market. The consumers did not either adopt payment cards right after they appeared. But consumers’ preferences are changing, new technologies are required to make our life (at least that part of our life which deals with shopping, or other payments and settlements with vendors and SPs) easier, safer, and more comfortable. And in the meantime the initial, but very important steps are made.