Apple Pay and Android payment eco-systems

It is important to understand what tokenization means in the context of the introduction by Apple on Tuesday.  The word "tokenization" can sound very general, complex, and unknown the way it is being used in payments today.  I think many use the term without really understanding the important details of the concept.  I sort of relate it to when i pick up my 4 year old daughter from sunday school class, I will ask her what she learned, and she knows that if she answers "God", that she is right.

So the point of this blog is to try to understand what tokens are, and how they are used to solve something in payments.  The mis-understood rule of tokens is that people think they change from transaction to transaction, but in reality the cryptogram changes but the token properties (tPAN and tUDK) don't:

• A token may be created once for the life of a credential (card).  

This is easiest to understand with the Apple Pay use case.  The secure element on the phone is programmed at the factory when the iPhone is built to support many different card standards.  At the time when the token data needs to get programmed into the device, Apple requests a token for that device from the card networks.  The networks need to keep track of the token because they need to know how to translate that token into iTunes identity for processing the iTunes selected card during transactions with the payment acceptor.

But the important piece is that this token is a static identifier for the life of the card that was programmed.

A diagram describing this process for iPhone is here:   

Because Android is not a vertically owned stack similar to apple, it is really hard to distinguish who owns the SIM, or SE, or UICC that is on the particular phone.  Because of the ownership argument over the last few years, the idea of HCE was launched to push the ownership of the SE to the cloud so that it could be leveraged on any Android phone from the cloud.  But the important concept that has gotten lost with the Apple announcement is that the concept of "tokenization"  as Apple Pay uses is still the exact plan for tokenization in the android space.  With HCE enabled, however, the equivalent of the one time token "Apple ID" that lives in the iPhone SE, is actually located virtually in the cloud with a bank, or third party vendor like SimplyTapp:

======================AND STOP===================

THE TOKEN HAS NOW BEEN CREATED!!
THE TOKEN REQUESTER CAN USE THIS TOKEN FOR
ALL TRANSACTIONS ON THAT CARD GOING FORWARD
WITHOUT REQUESTING ANOTHER TOKEN FROM THE SERVICE
AGAIN FOR THE LIFE OF THAT CARD IT REPRESENTS

THIS CAN BE TREATED ON PAR WITH TYPICAL PLASTIC CARD
PERSONALIZATION SERVICES TODAY

ONLY WHEN THE TOKEN IS ACQUIRED BY THE MERCHANT
DOES THE NETWORK NEED TO VERIFY THE TOKEN AND ALSO
TRANSLATE THE TOKEN BACK TO THE CARD IT REPRESENTS
SO THAT THE BANK CAN PROCESS IT FOR APPROVAL AS
USUAL

SO ONE TOKEN AND RELATED DATA CAN BE USED FOR
MULTIPLE TRANSACTIONS

==================================================
ok, i think i'm done hammering that characteristic of a token. :)

Another very important thing to understand about transactions using tokens is to understand that the data format of a tokenized transaction is EXACTLY the same as the data format of a non-tokenized transaction from the Point of Sale perspective.  The same basic elements exist and are exchanged from the phone to the POS:
non-tokenized:
1) Personal Account Number
2)  Expiration Date
3)  Service Code
4)  Issuer Discretionary Data
5)  Cryptogram

tokenized:
1) Tokenized Personal Account Number
2)  Expiration Date
3)  Service Code
4)  Issuer Discretionary Data
5)  Cryptogram

because the data format that is exchanged between the phone and the POS is identical in both cases, the tokenized version still has the ability to include dynamic transactional data by using a Cryptogram to do so (adding the "one time number for each transaction" that Tim Cook preached about)

Keep in mind for cryptogram creation and cryptogram validation, there does not need to be a run-time link between the validator and the tokenized card (this is obvious by the apple deployment of a hardened secure element on the phone).

So understanding how tokenized or non-tokenized cryptograms are created and validated is important.  By the way,  the algorithm is identical for tokenized or non-tokenized.  The "tokenized" part of the features is actually out of the scope of cryptogram calculation / validation.

Cryptogram creation requirements:
1) card creation time, the token issuer authority (card network) contains an issuer master key for a "tokenized" BIN.  The master key for the "tokenized" bin is used to create a "tokenized" Unique Derived Key (tUDK) and "tokenized" Personal Account Number (tPAN) for each "tokenized" card when a Token Requestor requests a token on behalf of a card issuer.

2) Also at card creation time, this new "tokenized" UDK and "tokenized" PAN are delivered back to the Token Requestor

3) Now from a token requestor perspective, it is business as usual for tokenized card personalization.  This data is injected to the tokenized card just like a non-tokenized card.

4) A LUK is created PRIOR to transaction time:
   a)  Tokenized UDK in the card + ATC used to create the tokenized LUK (AKA Session Key, or one time use key)
   b) this LUK can be exposed to the mobile device (in apple case, the calculation of the LUK or similar key can be created inside the SE of the mobile device)

5) At transaction time, the cryptogram is created:
   a)  Tokenized LUK + terminal UN (POS data) used to create final cryptogram returned to the POS for processing

Have a look at how the Apple Pay system works during payment time:

And obviously, the mirror transactional sequence for the Android environment:

You will notice that the net result from the reader perspective is identical in both cases; "Tokenized Data" as described above.  The Android app and cloud based secure element, however, must work together throughout the life of the app on the phone to produce this result.


What tokens solve!:

Legacy Processing:  The main thing, in my eyes, that tokenization solves is the backend processing changes.  The HCE side of the equation requires, for some card networks, new Cryptogram calculation specifications to be processed because the cryptogram calculation process is forced to be changed.  i.e. intro to CVN 43!

Believe it or not, this is probably the biggest driver for tokenization because it is faster to build the tokenization engine and allow it to validate and convert the new cryptogram to an older version than it is to go into the old old old old (say it one more time...old) processing houses that are running Commodor 64, pascal, and big tape drives and get them to update the cryptographic algorithms on the HSM.  So, both VISA and mastercard can just as easy validate the CVN 43 CBP cryptogram just before the service de-tokenizes it.

Firewalling Transactions:  When a token is created, it is implied that the tokenization engine will always have to de-tokenize prior to processing the transaction,  with that, obviously coves verification of the token.  This is a perfect opportunity to build in transaction processing rules for that token such as:
1)  Card present only transactions (this token must ALWAYS contain a cryptogram with it)
2)  Use this token at ONLY these particular merchant IDs
3)  This token is ONLY valid for transactions within a 90 day period!

Translating to Card On File:  Major wins for Apple, Google, Amazon, and anyone else who has scores of cards on file buried in their datacenter.  Not only does tokenization allow you to translate to an existing bank account.  As displayed by Apple, it also allows you to translate a token to an account that may then represent one of many Cards On File for a particular google, amazon, or apple account.  Potentially this allows lower than Card Not Present rates for internet based transactions.

Host Card Emulation Series: HCE Virtual Card Life Cycle Management

HCE has introduced a new and powerful way to create, issue and manage virtual cards stored in the cloud. The value of HCE is clear but with that recognition comes a great deal of other questions. One of the most common questions is that surrounding virtual card life cycle management. This blog post will discuss one tools made available by SimplyTapp to manage your virtual card in the cloud in the SimplyTapp system.

SimplyTapp offers STBridge as tool to manage card life cycle. STBridge allows an issuer to connect to a virtual card instance in the SimplyTapp cloud.

STBridge is used to communicate APDUs, and other GP commands, to a specific virtual card residing in the cloud platform. STBridge supports standard GPJ shell commands.

STBridge packaged as an executable jar (STBridge) and can be executed in the following format:

java -jar STBridge.jar -ck consumer_key -cs consumer_secret -at access_token_to_card -ts access_token_secret [-s jcsh_script_to_run

STBridge Paramater list:

-ck the issuer consumer key

-cs the issuer consumer secret

-at the card access token

-ts the card access token secret

There are various ways for obtaining the parameters from a virtual card in cloud needed to execute STBridge.
This example we are we are working with a previously create virtual card.

Managing An Active Card

Appending scripts to the STBridge.jar executable file allows one to manage card life cycle. The following are examples of how to manage card life cycle.

Card is personalized by running a personalization (perso) script.

After perso script is executed, the card is in activated state.

Post card personalization, you can connect to card and  run any various card management scripts. Activating an activated card does nothing and deactivating a deactivated card does not change the state of the card, but scripts will execute.

The following are examples of executing card management scripts on a  active virtual card in the cloud.

Deactivate Card.

vcbp_deactivate_card.jcsh is script to deactivate the card. 

After running the script, the card agent is disabled from performing contact-less transactions.  

Activate card

vcbp_activate_card.jcsh is script to activate the card again. 

After running the script, the card agent is enabled to perform contact-less transactions. 

Terminate card

vcbp_terminate_card.jcsh is script to terminate the card.

 After running the script, the card agent is disabled from performing contact-less transaction. The card agent does not load anymore after refreshing/restarting the wallet. This is like a kill switch, the state cannot be changed from terminated.  

Running vcbp_terminate_card script updates the card state in the database to "dead". 

Once a card is terminated it is marked as dead and can not be recovered to active state from  the data base.

The complete STBridge tutorial can be found at:  http://wiki.simplytapp.com/utilities-resources/stbridge/stbridge-guide

Host Card Emulation Series: Google Cloud Messaging

Notifications can be an integral part of securing cloud based payment transactions.  Most mobile OS platforms support notification resources that can be leveraged by the platform developers for different reasons.  In the case of cloud based payments, notifications can be used to help secure and enforce authentic transactions at the POS.

The only relevant mobile OS platform at the time of this publication that supports payments that are accepted by existing mainstream acquirers is the AOSP or Android.  HCE (Host Card Emulation) was released inside Android 4.4 last October, so this blog post will focus on using Google Cloud Messaging or GCM.

An overview of the GCM architecture:

As you can see above the GCM and mobile device form an independent channel from the application itself.  This is done because Android OS manages registration of any particular application and therefore managing the communication with that registration which includes OS and device level security precautions.  

For a third party system to send a notification using GCM, the system follows step (a) above and that notification message is expected to be delivered using GCM channels, that is it.

This architecture can be used as a security measure to protect data that is ultimately relayed to a POS from a mobile application.  This simple diagram can indicate how payment transactional data can be protected using 2 different delivery channels

As you see above, the message that is to be delivered to the mobile application is split and actually delivered over 2 different channels.  So now with contactless or EMV (Cloud Based) credentials, payment information can be protected by these means:

1)  Dynamic Transaction Data:  each transaction data delivered to the POS is dynamic or changing from transaction to transaction so that a single transaction data can't be used more than one time

2)  2 Channel Delivery:  each dynamic transaction data above is split and delivered to the mobile device using SSL as one channel and GCM as a separate channel

Using GCM with SimplyTapp Platform

The example below provides a hands-on approach to accomplishing these tasks on the SimplyTapp platform.  The platform has Notification messaging built into it so that you do not have to concern yourself with the technical details of delivering messages over the network.  The interface abstracts the complexity and simply offers a "send to agent" api taking a single message as a string from the card applet service api framework.  This message has a known destination of the matching card agent for the card applet service.  The SimplyTapp platform handles all the routing and delivery to the proper place.

First things first, After downloading the IssuerSdk, unpack it, and go into IssuerSdkBundle and edit CardAgentTesterApp/build.gradle directory and make sure the agentToTest flag is uncommented for "CardAgent-GCM":

//

//  Swap the line below if you wish to test CardAgent-PayPass or

//  CardAgent-VisaMSD-SwipeYours instead of the CardAgent directory's code

// 

//def agentToTest = "CardAgent"

//def agentToTest = "CardAgent-PayPass"

//def agentToTest = "CardAgent-VisaMSD-SwipeYours"

def agentToTest = "CardAgent-GCM"

then build for eclipse:

> gradle eclipse

CardApplet service:

Import CardApplet-GCM into eclipse as a java project.  In the CardApplet.java file look at the code:

private short ATC = 0;

public void process(APDU apdu) {

  // Good practice: Return 9000 on SELECT

  if (selectingApplet()) {

    //no perso required for this card, so enable on first select

    Calendar exp = Calendar.getInstance();

    exp.set(Calendar.YEAR, 2014);

    exp.set(Calendar.MONTH, 4);

    try {

      setStatePersonalized("5413123456784800", exp, "", "");

    } catch (IOException e) {

    }

    return;

  }

  byte[] buf = apdu.getBuffer();

  switch (buf[ISO7816.OFFSET_INS]) {

  case (byte) 0x01:  //command to send a message via GCM

    short len = apdu.setIncomingAndReceive();

    //convert bytes to ASCII

    byte[] bytes = new byte[len];

    Util.arrayCopy(apdu.getBuffer(), (short)5, bytes, (short)0, len);

    String msg = "";

    try {

      msg = new String(bytes, "UTF-8");

      //echo back the Google Cloud Messaging Notification

      this.sendToAgent("Applet Message No.: "+ATC+"\nData: " + msg);

      ATC++;

    } catch (IOException e) {

    }

    break;

  default:

    // good practice: If you don't know the INStruction, say so:

    ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);

  }

}

The code above in the applet is pretty simple.  upon select, it switches the state of the card to personalized if it isn't personalized already.  Also it supports only one command (0x01) that is a simple echo of an incoming data message to the GCM service.  The key method to send a message via GCM is :

sentToAgent("this is a string destined to my agent over GCM");

An IOException() may be thrown in the event that the card agent has not yet been loaded by the mobile application.


CardAgent:

Import the CardAgent-GCM into eclipse as a java project.  In the CardAgent.java file look at the code:

@Override

public void messageFromRemoteCard(String msg)

{

  try {

    //post the message to the app, get the response back to message approval

    postMessage("GCM message from applet:\n"+msg+"\n\nTry Again?", true, null);

  } catch (IOException e) {

  }

}

when the card agent receives a message from the GCM server, this method posts the message to the mobile application.

the next code effectively collects a message from the application user and relays that message to the remote card applet service :

public void post()

{

  //post a message to the app, get a response back to message approval with approval data

  //the message must be less than 32 bytes as defined by the 32

  ApprovalData.StringData stringData = new ApprovalData.StringData((short)0,(short)32);

  ApprovalData approvalData = new ApprovalData(stringData);

  try {

    postMessage("Enter A GCM Message", false, approvalData);

  } catch (IOException e) {

  }

}

@Override

public void messageApproval(boolean approval, ApprovalData approvalData)

{

  if(approvalData!=null && approvalData.getApprovalData()!=null)

  {

    ApprovalData.StringData data = (ApprovalData.StringData)approvalData.getApprovalData();

    if(data!=null && data.getAnswer()!=null)

    {

      byte[] msg = data.getAnswer().getBytes();

      try {

        connect();

      } catch (IOException e) {

      }

      try {

        TransceiveData batchCommands = new TransceiveData(TransceiveData.NFC_CHANNEL);

        batchCommands.setTimeout((short) 5000);

        // In this example we just pack a single APDU command to send a message after card reset

        // and select of applet

        batchCommands.packCardReset(false);

        // select applet

        byte[] apduData = new byte[10];

        apduData[0] = 0x00;

        apduData[1] = (byte)0xa4;

        apduData[2] = 0x04;

        apduData[3] = 0x00;

        apduData[4] = 0x05;

        apduData[5] = 0x00;

        apduData[6] = 0x01;

        apduData[7] = 0x02;

        apduData[8] = 0x03;

        apduData[9] = 0x04;

        batchCommands.packApdu(apduData, false);

        //send message to applet to relay over GCM

        short len = (short)msg.length;

        apduData = new byte[5+len];

        apduData[0] = 0x00;

        apduData[1] = 0x01;

        apduData[2] = 0x00;

        apduData[3] = 0x00;

        apduData[4] = (byte)len;

        System.arraycopy(msg, 0, apduData, 5, msg.length);

        batchCommands.packApdu(apduData, true);  //make sure this completes before disconnecting

        transceive(batchCommands);

      } catch (IOException e) {

      }

      try {

        disconnect();

      } catch (IOException e) {

      }

    }

  }

  else if(approval)

    post();

}

@Override

public void create() {

  post();

}

the transceive function sends apdu commands to the card applet service for processing and the payload of the second APDU indicates the message to send in ascii format from  data.getAnswer().getBytes();


Running a test:

Now, let's try it out.  Import CardAgentTesterApp into eclipse as an android project.  After import is completed, browse to the com.simplytapp.config.Constants.java file and adjust the contents to match your PC settings that are running the CardApplet simulator when you start the card applet:

package com.simplytapp.config;

public class Constants {

    /*setup to communicate to the remoteSE simulator

     * make sure that you have the IsserSdk simulator 

     * running in order for the cardAgent to connect to it.

     * It is important that if you are using the same eclipse

     * client to run the SESDK as this card agent project that

     * you run the SESDK NOT in debug mode as it can tend to

     * slow the response from the SESDK down to non-realistic

     * latencies.  anyway, adjust the ipaddress and port 

     * for the running SESDK below accordingly for your environment

     */

  //address of a running SE simulator

  final public static String ip="192.168.1.66"; 

  //port address of a running SE simulator

  final public static int port=3000;            

}

Also, make sure your mobile device has WIFI on and is connected to your internal network so that it can reach the simulator config as defined above.

Next, you start the CardApplet project inside eclipse which will prompt you to enter commands in the command window.  First highlight the project "CardApplet-GCM" and click the debug button.  You may have to select the main class for the project.  if so select "com.simplytapp.cardwrapper.CardWrapper".  You should see this in the command window:

# SimplyTapp simulator running on port 3000

# gpjNG connected on port 3000

# Connected to card NFC interface

# using gpjNG!

# type: help

# to get started

#

Found card in terminal: SimplyTapp

ATR: 3B 00 

>

at the command prompt enter:

>/card

ATR: 3B 00 

Command  APDU: 00 A4 04 00 07 A0 00 00 01 51 00 00 

Response APDU: 6F 0F 84 08 A0 00 00 01 51 00 00 A5 04 9F 65 01 FF 90 00 

(16 ms)

Successfully selected Security Domain GP211 A0 00 00 01 51 00 00 

>auth

Command  APDU: 80 50 00 00 08 F4 AA A8 1A ED CB 4C 84 

Response APDU: 00 00 00 00 00 00 00 00 00 00 FF 02 00 00 6C 55 44 79 7A 91 94 AC C7 A2 F3 8D E7 1B 90 00 

(27 ms)

Command  APDU: 84 82 00 00 10 10 2F AA 11 12 B3 0C 93 52 3C 41 C3 46 65 5C 92 

Response APDU: 90 00 

(6 ms)

>install -i 0001020304 |com.st |CardApplet

Command  APDU: 80 E6 0C 00 1E 06 63 6F 6D 2E 73 74 0A 43 61 72 64 41 70 70 6C 65 74 05 00 01 02 03 04 01 00 02 C9 00 00 

Response APDU: 00 90 00 

(17 ms)

>exit-shell

exiting shell, leaving port open

this installs the new applet as AID 0001020304 which is the proper AID for this demo.  after installation you will see that we exit-shell which will leave the simulator running and ready to connect up to the card on the port 3000 as shown above in this configuration.

after the simulator is running the card applet service, you can then run the card applet tester app on your device.  

Once the app starts, you should get a prompt like this:  

After clicking the "Ok" button, the text will go to the card agent which will connect to the remote card applet and send the message to the remote card applet.  The card applet will then, in turn, add the message counter information setup in the example code to the message and send the message to GCM for delivery back to the card agent in the mobile application.  So you should end up seeing a full circle message delivery and notification from your mobile device that looks like this:

This test can be repeated as long as you like and it's only purpose is to demonstrate how to use GCM to transport information from the remote card applet service to its card agent.

Host Card Emulation Series: Card Agents and APDUs

In Android 4.4 to support HCE, HostApduService declares processCommandApdu() method that the developer needs to implement. The method processCommandApdu() is called when the service receives an Application Protocol Data Unit (APDU) sent by contactless/NFC reader. The developer needs to implement how to process APDUs specific to the card application(s) the service supports. The implementation can become complex if the service supports multiple card applications.

SimplyTapp SDK provides a robust architecture where each card application is implemented in a "card agent". Using SimplyTapp SDK, there is no need for the developer to implement a complex processCommandApdu() method for a service that supports multiple card applications. Instead the developer implements process() method in the card agent for each card application. A mobile application can support multiple card agents and card agents can be remotely deployed to the mobile application, similar to remotely deploying Java Card applet (aka cardlet) to the Secure Element. Essentially SimplyTapp SDK provides an architecture that is familiar to Java Card developers.

I will describe how the card agent processes different APDU cases as defined in ISO/IEC 7816-4 specification.

ISO 7816-4 Case 1	No Lc No Le Example: 80100000
ISO 7816-4 Case 2	No Lc 1-byte Le (1 to 256, Le=0x00 represents 256) Example: 8012000000
ISO 7816-4 Case 3	1-byte Lc (1 to 255) No Le Example: 80140000081112131415161718
ISO 7816-4 Case 4	1-byte Lc (1 to 255) 1-byte Le (1 to 256, Le=0x00 represents 256) Example: 8016000008212223242526272800

Here is sample code for card agent implementation that demonstrates how to process the example APDUs. The class extends com.simplytapp.virtualcard.Agent.

 import javacard.framework.APDU;  
 import javacard.framework.ISO7816;  
 import javacard.framework.ISOException;  
   
 import com.simplytapp.virtualcard.Agent;  
   
 public class CardAgent extends Agent {  
   
   public void process(APDU apdu) throws ISOException {  
     byte[] apduBuffer = apdu.getBuffer();  
     byte claByte = apduBuffer[ISO7816.OFFSET_CLA];  
     byte insByte = apduBuffer[ISO7816.OFFSET_INS];  
   
     if (claByte == (byte) 0x80) {  
       if (insByte == (byte) 0x10) {  
         // Process case 1 command APDU.  
         processCase1Apdu();  
   
         // Return SW=0x9000.  
       }  
       else if (insByte == (byte) 0x12) {  
         // Process case 2 command APDU.  
   
         // Copy response data to APDU buffer.  
         System.arraycopy(responseData, 0,   
             apduBuffer, 0, responseData.length);  
   
         short le = apdu.setOutgoing();  
         if (responseData.length > le) {  
           le = (short) responseData.length;  
         }  
         apdu.setOutgoingLength(le);  
         apdu.sendBytes((short) 0, le);  
         // Return response data with SW=0x9000.  
       }  
       else if (insByte == (byte) 0x14) {  
         // Process case 3 command APDU.  
         short lc = apdu.setIncomingAndReceive();  
   
         // Save command data from APDU buffer.  
         System.arraycopy(apduBuffer, ISO7816.OFFSET_CDATA,   
             commandData, 0, lc);  
   
         // Return SW=0x9000.  
       }  
       else if (insByte == (byte) 0x16) {  
         // Process case 4 command APDU.  
         short lc = apdu.setIncomingAndReceive();  
   
         // Save command data from APDU buffer.  
         System.arraycopy(apduBuffer, ISO7816.OFFSET_CDATA,   
             commandData, 0, lc);  
   
         // Copy response data to APDU buffer.  
         System.arraycopy(responseData, 0,   
             apduBuffer, 0, responseData.length);  
   
         short le = apdu.setOutgoing();  
         if (responseData.length > le) {  
           le = (short) responseData.length;  
         }  
         apdu.setOutgoingLength(le);  
         apdu.sendBytes((short) 0, le);  
         // Return response data with SW=0x9000.  
       }  
     }  
   }  
   
 }  

The card agent can also process extended length APDUs as defined in ISO/IEC 7816-4 specification. The maximum supported length using extended length is 32767 to be consistent with Java Card API.

ISO 7816-4 Case 1	Not Applicable
ISO 7816-4 Case 2	No Lc 3-byte Le (1 to 32767, Le=0x000000 represents 32767) Example: 80120000000000
ISO 7816-4 Case 3	3-byte Lc (1 to 32767) No Le Example: 801400000000081112131415161718
ISO 7816-4 Case 4	3-byte Lc (1 to 32767) 2-byte Le (1 to 32767, Le=0x0000 represents 32767) Example: 8016000000000821222324252627280000

Here is sample code for card agent implementation that demonstrates how to process the example extended length APDUs. The class extends com.simplytapp.virtualcard.Agent and implements javacardx.apdu.ExtendedLength.

 import javacard.framework.APDU;  
 import javacard.framework.ISO7816;  
 import javacard.framework.ISOException;  
 import javacardx.apdu.ExtendedLength;  
   
 import com.simplytapp.virtualcard.Agent;  
   
 public class CardAgent extends Agent implements ExtendedLength {  
   
   public void process(APDU apdu) throws ISOException {  
     byte[] apduBuffer = apdu.getBuffer();  
     byte claByte = apduBuffer[ISO7816.OFFSET_CLA];  
     byte insByte = apduBuffer[ISO7816.OFFSET_INS];  
   
     if (claByte == (byte) 0x80) {  
       if (insByte == (byte) 0x12) {  
         // Process case 2 command APDU.  
   
         // Copy response data to APDU buffer.  
         System.arraycopy(responseData, 0,   
             apduBuffer, 0, responseData.length);  
   
         short le = apdu.setOutgoing();  
         if (responseData.length > le) {  
           le = (short) responseData.length;  
         }  
         apdu.setOutgoingLength(le);  
         apdu.sendBytes((short) 0, le);  
         // Return response data with SW=0x9000.  
       }  
       else if (insByte == (byte) 0x14) {  
         // Process case 3 command APDU.  
         short receivedLen = apdu.setIncomingAndReceive();  
   
         // Save command data from APDU buffer.  
         System.arraycopy(apduBuffer, apdu.getOffsetCdata(),   
             commandData, 0, receivedLen);  
   
         short lc = apdu.getIncomingLength();  
         // Check if additional command data not yet received.  
         if (receivedLen != lc) {  
           short commandDataOffset = receivedLen;  
   
           // Receive more command data until no more available.  
           receivedLen = apdu.receiveBytes((short) 0);  
           while (receivedLen != 0) {  
             // Save additional command data from APDU buffer.  
             System.arraycopy(apduBuffer, 0,   
                 commandData, commandDataOffset, receivedLen);  
             commandDataOffset += receivedLen;  
             receivedLen = apdu.receiveBytes((short) 0);  
           }  
         }  
   
         // Return SW=0x9000.  
       }  
       else if (insByte == (byte) 0x16) {  
         // Process case 4 command APDU.  
         short receivedLen = apdu.setIncomingAndReceive();  
   
         // Save command data from APDU buffer.  
         System.arraycopy(apduBuffer, apdu.getOffsetCdata(),   
             commandData, 0, receivedLen);  
   
         short lc = apdu.getIncomingLength();  
         // Check if additional command data not yet received.  
         if (receivedLen != lc) {  
           short commandDataOffset = receivedLen;  
   
           // Receive more command data until no more available.  
           receivedLen = apdu.receiveBytes((short) 0);  
           while (receivedLen != 0) {  
             // Save additional command data from APDU buffer.  
             System.arraycopy(apduBuffer, 0,   
                 commandData, commandDataOffset, receivedLen);  
             commandDataOffset += receivedLen;  
             receivedLen = apdu.receiveBytes((short) 0);  
           }  
         }  
   
         // Copy response data to APDU buffer.  
         System.arraycopy(responseData, 0,   
             apduBuffer, 0, responseData.length);  
   
         short le = apdu.setOutgoing();  
         if (responseData.length > le) {  
           le = (short) responseData.length;  
         }  
         apdu.setOutgoingLength(le);  
         apdu.sendBytes((short) 0, le);  
         // Return response data with SW=0x9000.  
       }  
     }  
   }  
   
 }  

Host Card Emulation Series: Contactless Debit, A Merchants Advantage

Contactless Debit, A Merchants Advantage

Host Card Emulation (HCE) brings new opportunity for merchants. In a recent trip to Whole Foods, who installed contactless terminals some time ago, I decided to try my debit card using the Tapp mobile test wallet.  After grabbing some lunch I headed to the register, and proceeded to checkout.  I tapped my phone to the contactless terminal and VOILA! The terminal asked me for my pin, I entered it, grabbed my lunch and off I went.

So why is this important?  The answer requires a look back at where the dynamics of the payments industry was just a few years ago.

The “Way back Machine”

In the semi-beginning, circa 2011, NFC mobile wallets meant Google Wallet, ISIS and the MNOs controlled SE model.  The idea was pretty straight forward one device, one SE, maybe one credit card, and POW!!! BAMM!! Goldmine! Right...Wrong! What happened? A back lash by merchants, banks and just about everyone but the MNOs.  In front of the new push for mobile payments stood a number of hurdles that needed to be cleared.  One of the most sizable hurdles being the merchants feeling that Contactless = Higher Transaction Costs.

Merchants viewed NFC as a more expensive transaction form and in the SE model that was largely true. For example, the average cost of a debit transaction tops out at around $0.30 in the US compared to the potentially much higher cost credit transaction, roughly $0.10 + 1.7% or more.  So what happened? Merchants, led by Walmart, huddled together in an attempt to break down mobile payment progress and keep transaction costs down. They called it MCX. Their message could generally be summed up with the following statement “Hell No, We Won’t Go!”  This stance led to a lot of head scratching as how mobile payment adoption would or could progress. But quietly the ground began to soften and HCE took root. 

“Bing, please enter PIN”

Coming back to my experience at Whole Foods and why it is important. 

The goal of any merchant is to sell goods or services to customers in exchange for assets, typically money, that has a greater value to the merchant than the goods and services being sold.  Pretty straight forward, but how that exchange actually takes place is where we will have our conversation. 

When it comes to merchants convincing consumers to part with their money they want to make it as easy as possible. Today there are, generally speaking, a handful of payments options as presented below:

• Cash – used often and easily accepted;
• Check – rarely used anymore and rather hard and slow to use;
• Credit – used often and extremely easy for both cashier and customer;
• Debit – used most often and equal to credit for ease of use;
• GiftCard/Stored Value – used on a regular basis and considered as easy to use as other plastic forms. 

Each payment option has advantages and disadvantages regarding availability, ease of use and cost of managing and accepting.   More importantly all these payment form factors excluding only cash and check can be all accepted over the contactless channel. This means that merchants now have increased opportunity to influence customers when it comes to selecting payment forms like debit and gift/stored value cards over their more expensive siblings.

It means the power of payment is now in the hands of the merchant.  To illustrate a practical example of this is the case study of Spec’s, a merchant that communicates to their customers the importance of selecting the right payment form.

Debit Strategy: Spec’s

Spec’s is a merchant in Texas that manages their transaction cost extremely well.  Every check out register displays the options and cost of the options and every cashier asks the customer if they would like a 5% discount for using Cash or Debit.  Pretty easy to make that decision for me.  I simply present my debit card and save the money up front.  It is not just Spec’s that takes this simplified approach but other merchants as well. 

Conclusion

HCE offers merchants and banks alike new opportunities to influence consumers’ payment behavior like never before.  As Spec’s demonstrates, customer are willing to pay cash or use debit when offered discounts at the register. Speaking from experience I know this is true. However, merchants should understand that offering consumers incentive to select the less expensive debit or gift/stored value card is a window that will not stat open forever as the pace of adoption continues to accelerate. There are already merchants implementing effective transactions cost reducing strategies.  Moving these same strategies into the mobile space only enhance the merchants’ position in a consumers mind at the time of check out.