Page 2 - NFC Experience; NFC at FHNW; NFC was included in a removable cover
NFC Experience NFC at FHNW > 2005/06 First NFC demonstrator (with Siemens CX70 Emoty) – NFC was included in a removable cover > 2009/10 Mobile Payment project (Nokia 6131 NFC, S40 Phone) – touch'n'pay Self Service Shop – Supported by the Hasler foundation – NFC Forum competition: First price i...
Page 3 - AGENDA
3 AGENDA > What is NFC > NFC with Android: Reading & Writing NDEF Messages > NFC with Android: Beyond NDEF > NFC with Android: Applications > NFC Secure Element > NFC Use Case: Self Service Shopping
Page 4 - What is NFC; Communication roles:
What is NFC NFC (Near Field Communication) > Communication technology based on radio waves at 13.56 MHz frequency > Short range (<= 10 cm theoretical, 1-4 cm typical) > Low speed (106 / 216 / 414 kbps) > Low friction setup (no discovery, no pairing) – Setup-time < 0.1 Sec > Comm...
Page 5 - NFC Device Operating Modes; No need to launch an application
NFC Device Operating Modes Reader-Writer Mode > Mobile Device is able to read external tags/smartcards, Device becomes RFID reader/writer (and can launch applications) – Tag content: Text, URI (WebLink, Phone Number), SmartPoster > Like QR-Codes, but faster – No need to launch an application –...
Page 6 - Bidirectional P2P connection to exchange data between devices
NFC Device Operating Modes Peer-To-Peer Mode > Bidirectional P2P connection to exchange data between devices – Proximity triggered interactions – Nexus S: Devices have to be placed back-to-back > Applications – Exchange of vCards – Hand-over of Tickets & P2P Payment – Web-page sharing, You...
Page 7 - Tag Emulation
NFC Device Operating Modes Tag Emulation > Device emulates a passive tag (typically a smart card) – Device can emulate (contain) multiple smartcards – Reader can’t distinguish between smartcard & tag emulation – Android: Emulated tag can be read only if screen is on > Examples – Access to ...
Page 8 - Android and NFC; Android Gingerbread; Nexus S
Android and NFC Android Gingerbread > Tag reading (2.3.2) > Tag writing (2.3.3) > Limited P2P (NDEF push only, 2.3.3) Android NFC Devices > Nexus S contains PN544 NFC Controller from NXP + SecureMX – Embedded Secure Element – Support of SE on SIM (Single Wire Protocol) > Samsung Galax...
Page 10 - NDEF; Container format to store NFC data in NFC tags
NFC Data Exchange Format (NDEF) NDEF > Container format to store NFC data in NFC tags – Independent from tag type > Defines a number of specific types – URI, TextRecord, SmartPoster > Standardized by the NFC Forum (http://www.nfcforum.org) – Specs are public – Specs are free 10
Page 11 - NdefMessage; Represents an NDEF (NFC Data Exchange Format) data message; NdefRecord; Represents a NDEF record and always contains
NFC Data Exchange Format (NDEF) NdefMessage > Represents an NDEF (NFC Data Exchange Format) data message > Contains one or more NdefRecords that represent different sets of data NdefRecord > Represents a NDEF record and always contains – 3-bit TNF (Type Name Format) field (indicates how to ...
Page 12 - TNF Types
NFC Data Exchange Format (NDEF) TNF Types > EMPTY (0) Empty record (without type / id / payload) > WELL_KNOWN (1) Record contains a well-known type according to the RTD definition (Text, URI, SmartPoster, …) > MIME_MEDIA (2) Type of this record is defined with a MIME-type, > ABSOLUTE_URI...
Page 15 - NDEF Record Layout; CF = initial or middle chunk of a chunked record
NFC Data Exchange Format (NDEF) NDEF Record Layout > MB = Message begin > ME = Message end > CF = initial or middle chunk of a chunked record > SR = Short record (payload length = 1 byte) > IL = ID_Length (and ID) are present 15
Page 16 - Mifare Tag with NDEF message
NFC Data Exchange Format (NDEF) Mifare Tag with NDEF message > 03 = NDEF content > 0F = Length of NDEF message (15 bytes) > D1 = Status = 1101 0001 – Short record, no ID – TNF = WELL-Known > 01 = Type length > 0B = Payload Length > 55 = Type ("U" => URL) > 03 = Prefix...
Page 18 - Reading NDEF Messages; Permission to access the NFC hardware
Reading NDEF Messages AndroidManifest.xml > Permission to access the NFC hardware > Specify minimum SDK version (2.3.3) > Indication for the market > Intent Filter 18 <uses-permission android:name="android.permission.NFC" /> <uses-sdk android:minSdkVersion="10"/&...
Page 19 - Intent Filter and Data Field; Scheme mandatory
Reading NDEF Messages Intent Filter and Data Field > TNF_WELL_KNOWN / RTD_TEXT > TNF_WELL_KNOWN / RTD_URI or RTD_SMART_POSTER – Scheme mandatory – Host may be omitted (if present, then exact match necessary, no wildcards) – Path may be omitted (if present, then exact match necessary, no wildca...
Page 21 - Writing NDEF Messages
Writing NDEF Messages 21 void writeUrlToTag(Intent intent, String url) throws IOException, FormatException { String action = intent.getAction(); if (NfcAdapter.ACTION_NDEF_DISCOVERED.equals(action)) { Tag tag = intent.getParcelableExtra(NfcAdapter.EXTRA_TAG); Ndef ndefTag = Ndef.get(tag); NdefRecord...
Page 22 - Prerequisites; Pushing activity must be in the foreground; Remarks
Peer-To-Peer NDEF Messages Prerequisites > Pushing activity must be in the foreground > Data to be send must be encoded as NdefMessage > Both devices must support the NDEF push protocol Remarks > While pushing data, the standard intent dispatch system is disabled > Pushing is enabled ...
Page 25 - Beyond NDEF; Specifications; Classes to expose technology specific functionality (
Beyond NDEF Specifications > Protocol Level: 14443-3A / B, JIS6319-4 (Felica), ISO-15693 (Vincinity) > Application Level: 14443-4 (Transmission protocol) > Proprietary: Mifare Classic/Plus, Mifare Ultralight [C], Mifare DESFire Tag Technologies > Classes to expose technology specific fun...
Page 27 - Tag Technology Access
Beyond NDEF Tag Technology Access > Method Tag.getTechList() returns a list of supported technologies, as fully qualified class names > Example: IsoDep: provides access to ISO-DEP (ISO 14443-4) Tags 27 class IsoDep implements TagTechnology { static IsoDep get(Tag tag); Tag getTag(); void conne...
Page 29 - Tag Technology Dispatching
Beyond NDEF Tag Technology Dispatching > Intent-Filter can also be specified for particular tag technologies 29 <activity android:name="..." android:label="..."> <intent-filter> <action android:name="android.nfc.action.TECH_DISCOVERED"/> </intent-filte...
Page 31 - Tag Dispatching
Beyond NDEF Tag Dispatching 31 ACTION_NDEF_DISCOVERED ACTION_TECH_DISCOVERED ACTION_TAG_DISCOVERED enableForegroundDispatch()
Page 33 - Applications; NFC Tag Info; Displays card information
Applications NFC Tag Info > Displays card information > Displays the sectors of a tag (hex / ascii) > Displays NDEF content 33
Page 34 - NXP Tag Writer; Supports Reading & Viewing content of a tag
Applications NXP Tag Writer > Supports Reading & Viewing content of a tag > Supports Creating / Erasing / Protecting content 34
Page 35 - WiFiTap
Applications WiFiTap Allows to store & load the WiFi configuration on a tag (i.e. Name & WPA/WEP password) NFC TaskLauncher Use NFC tags to automate tasks (e.g. set volumes, set alarms, etc) EnableTable Restaurant couponing & loyalty system Tag is embedded in the check billfold NFC Secur...
Page 37 - Secure Element; Secure Storage in NFC device
Secure Element Secure Storage in NFC device > Tamper-proof storage for sensible data (money, tickets, keys) > Cryptographic operations > Secure environment for the execution of program code (sandbox model) Platforms > SmartCard (Global Platform) – JavaCard system – APDU commands 37 Host-...
Page 38 - removable
Secure Element 38 Secure Element non- removable removable Embedded Hardware (Secure IC) MicroSD- Card (Secure MC) UICC over SWP (Secure SIM) Bluetooth Stickers Micro-USB Stickers
Page 40 - Self Service Shopping
Page 41 - Facts; Mobile Payment Solution Provider
Self Service Shopping Facts > Location: Mini-market, Uf-Stocken, Kilchberg > Pilot start: 12.2009 – 12.2010 > No. of user: 80 consumers > Devices: Nokia 6131 NFC/ Nokia 6212 Classic Partners > e24 Mobile Payment Solution Provider http://www.e-24.ch > NEXPERTS NFC Solution Provider ...
Page 42 - Self Service Shopping: Secure Payment
Self Service Shopping: Secure Payment JVM NFC Chip SE Payment Server 1. Reading Tags and collecting data 3. Send Request 2. Computing Hash 4. Request for PIN 5. Read & Send PIN 6. Confirmation 7. Store purchase Applet Midlet 42
Page 43 - Communication with the Applet with APDU commands
ISO 14443-4 compliant Card Access Communication with the Applet with APDU commands byte[] SELECT = { (byte) 0x00, // CLA Class (byte) 0xA4, // INS Instruction (byte) 0x04, // P1 Parameter 1 (byte) 0x00, // P2 Parameter 2 (byte) 0x0A, // Length 0x63,0x64,0x63,0x00,0x00,0x00,0x00,0x32,0x32,0x31 // AID...
Page 45 - JavaCard TX Signing Applet; Applet implements APDU commands
JavaCard TX Signing Applet Applet implements APDU commands public class TXSigningApplet extends Applet { private final static byte INS_INIT = 0x01; private final static byte INS_SIGN = 0x02; private final static byte INS_MSISDN = 0x04; private byte[] msisdn; private byte[] key; private boolean initi...
Page 47 - OTA Loader
OTA Loader JVM NFC Chip SE Payment Server Applet Midlet 47 TSM
Page 48 - Proxy between Server and SE; Proxy may be started by a push SMS; OTAProxy; APDU
OTA Loader Proxy between Server and SE > Proxy reads requests from server and forwards them to secure element > Proxy may be started by a push SMS > On server, we use GlobalPlatform (sourceforge project GPShell 1.4.2) which contains a library to convert readable commands to APDUs > SSL n...
Page 49 - OTA Loader: Proxy main loop
OTA Loader: Proxy main loop void seCommand() throws IOException, ContactlessException{ short b0 = (short)( is.read() & 0xFF ); short b1 = (short)( is.read() & 0xFF ); short apduLength = (short)((b0 << 8) + b1); int n = 0; byte[] apdu = new byte[apduLength]; while(n < apduLength){ in...
Page 50 - Google Wallet; Mobile Payment System
Google Wallet Mobile Payment System > Checkout at MasterCard PayPass-enabled terminals > Supported Credit Cards – Citi MasterCard – Google Prepayed > Partners – Citi: Credit Card Issuer – FirstData: Accounting / Backend – Sprint: Telco Provider > Android 2.3.4 – New classes (@hidden) hav...
Page 51 - Open Questions
Open Questions Secure Element > Who controls the keys of the secure element, i.e. which party can enable "card emulation"? > Will there be a development key to access the SE? > How are the SE (JavaCard) applets distributed? > How to revoke applications from a SE? – In case that d...
Page 52 - Security
Open Questions Security > SmartPoster Spoofing Attack Source: Collin Mulliner, http://www.mulliner.org/nfc/ 52
Page 53 - NFC Next Steps; Buy Nexus S and upgrade to Android 2.3.4
NFC Next Steps Projects & Trials > Buy Nexus S and upgrade to Android 2.3.4 > Buy NFC Reader & Tags (=> Starter Kits) > Install NFC Tag Info / NXP Tag Writer Apps > Read Documentation – http://developer.android.com/reference/android/nfc/package-summary.html > Look at Sample...
Page 54 - Steinackerstrasse 5
Dominik Gruntz www.imvs.ch University of Applied Sciences [email protected] Fachhochschule Nordwestschweiz Institut für Mobile und Verteilte Systeme Steinackerstrasse 5 5210 Windisch / Switzerland