Android Host Card Emulation(HCE) in 4.4 ?

 FAQ

Q> What is HCE?

A> Host-Based Card Emulation

Er... whats that??

Before we talk about HCE (Host-Based Card Emulation) we must understand what is CE (Card Emulation)

Card Emulation is as it says emulation of a card (CreditCard/ ID Card/ Loyalty Card / any card) over NFC interface of a mobile phone.

In this mode a mobile NFC can exchange APDU (Data) with the a POS (Payment Terminals) or any other Terminal (eg. Security Machine on Doors or a Time punching machine for your office )

Alright!! I understand NFC but whats Card Emulation?

A card in this refers to a an environment which is created with the help of secure element, and applets.

Woaahhh 2 NEW TERMS!!!

Secure Element:  In simplest words.. Its a memory + processor + Mini OS which is out of phone OS, is highly restricted for access and is believed to be non-hackable!

Applets: Nothing more than small Java Programs which can run on this Mini OS of Secure Element. Which communicates based on Hexadecimal Commands also known as APDU.

So when you use your credit card or even a sim card remember "YOU GOT THE POWER" of secure element in your hands. Yeah that a freaking complete Operating system which is super secure in your hand.

Ok.. so??

So Card Emulation basically says that in order to communicate with this Card (Secure Element + Applets) the Phone NFC will accept the commands, will send these commands to Card residing somewhere in the phone and then will forward the responses generated from this Card over NFC interface back to the terminal.(See Dig.2)

Now to ease things up Card can be present in 3 of these location

1. Embedded Secure Element

2. SDCard based Secure Element

3. UICC (SIM Card)

Kool!! then why do we need HCE?

The biggest advantage is also the biggest disadvantage for Secure Element, being highly restricted, any addition of deletion of data needs heck of approvals from the provider of these.

For example: In case of UICC based Secure Element, only the MNO (mobile Network Operator) who owns a SIM card is authorised to put your CreditCard data inside the secure element, BUT, the CreditCard belongs to a Issuer (Bank) therefore in-order to put one simple CreditCard inside a secure element you need Bank and MNO to come together and work together. No wonder you don't see many application which uses any of these technologies.

Now with HCE, there is no need for Secure Element, I mean you can work even without them.

Now the data can directly be sent and received by an application, your own phone application.(See Dig.3)

Overview on Host Card Emulation (HCE)

HCE is an open architecture that allows mobile applications to emulate a contactless smartcard. Unlike traditional NFC transactions that rely an embedded or SIM card Secure Element (SE), HCE is a purely software-based solution. This new approach is significant for the industry because: 1) it takes control away from mobile network operators (MNOs) who control access to a mobile device’s SE and, 2) it creates new possibilities for using a phone’s NFC feature.

Host Card Emulation (HCE) as an exciting development for the NFC market because it provides an additional means by which to perform NFC transactions. With HCE, transactions take place using credentials stored in the cloud or on the host processor of the NFC-enabled mobile device rather than a tamper resistant Secure Element, such as an embedded security chip, SIM, or microSD card.

HCE works by storing payment credentials on a remote cloud rather than the SE (see Figure 1). Conceptually, a mobile application could be programed to send requests to allow access to these credentials via a secure token. This token would then be passed via the phone’s NFC antennae to another contactless reader to complete a payment transaction. A key requirement is ensuring that the token is recognized by the reader as a valid payment credential.

Dig.1

This development may prove troubling to some mobile wallets, like the Mobile Network Operator-led Isis, which relies on the SE approach.Isis currently requires card issuers to integrate with a Trusted Service Manager (TSM) to facilitate access to a device’s SE.HCE provides an alternative to TSM integration, which can be expensive and time consuming. To date, only a few European banks have explored HCE deployment, but there are service providers that are prepared to enable similar solutions in the U.S. market. Visa and MasterCard have also independently announced their intentions to provide software development kits (SDKs) that would allow issuers and other potential wallet providers to write HCE applications that conform to the existing contactless payment specifications.

Host Card Emulation (HCE) as an exciting development for the NFC market because it provides an additional means by which to perform NFC transactions. With HCE, transactions take place using credentials stored in the cloud or on the host processor of the NFC-enabled mobile device rather than a tamper resistant Secure Element, such as an embedded security chip, SIM, or microSD card.As the definition suggests, it is an emulation of a contactless smart card. What is the capability of a contactless smart card? Mainly payment, identification and transportation. What happens when one of these cards, say your id card, which you use for entering your office building is just an app on your mobile phone? Or your contactless credit/debit card? Sounds intriguing.

Before HCE, contactless smart card was being emulated by a hardware chip and software (mobile app) was needed for the hardware to be activated. Hardware component was either a chip embedded on the phone or the SIM card. Either way, a few more parties other than the owner of the handset itself was involved in the game and it was quite complicated to activate and use the NFC app. Now with the HCE, smart card is still being emulated but this time it is software rather than the hardware.

In the hardware mode, contactless (NFC) reader was working with the secure element.

 Dig.2

Now with the HCE, hardware component -SE or the embedded chip is not needed. Android itself emulates the hardware. Apps will use the interface provided by the operating system again but this time there is no hardware below the API.

Dig.3