Android and Symbian NFC mobile development questions and answers (FAQ)

Question

Let’s share on a common place ideas about the NFC development, technology… I warmly welcome any comments you might have – either about the Android or Symbian SDK or about the NFC in general.

From my point of view the general question is what we can develop, i.e. what kinds of applications can we bring to the market with the NFC technology? And how can we, developers, earn money and benefit from the NFC?

I think there is an expectation the NFC will open the door for numerous services and possibilities for developers – but is that true? The difference between the NFC and other wireless technologies (BT, WiFi) is that it already comes with major use cases – payment, transportation tickets and keys (building access). But for all these use cases you need a secure element, which is

• either controlled by the phone manufacturer, e.g. Google – see Google Wallet which uses exclusively the built-in NXP SecureMX on Nexus S (and this is something which can be very hardly changed if we do not want to compromise the security),
• or accessible via UICC on SIM card (on Android and Symbian /and MeeGO/ phone as well); here the deal has to be made with operators.

But having 3 or 4 operators in a country, how probable it will be for a middle-sized company that they will allow running their applets on SIM cards? And what about more worldwide solutions? All above mentioned services/use cases need a lot of coordination of all the players and a well established ecosystem (banks, MNO, NFC chip producers, phone manufacturers, TSM…).

They are still options for p2p applications, tags reading – but many functionality will be already built-in in the phone, so this does not look like goldmine…

I think the chances can be bigger if the phone will include the NFC-WI(S2C) – having this interface (specified by ECMA) and micro SD cards with the NFC-WI support (already specified by the SD card association) will possibly allow purchasing the SD cards with secure elements for an arbitrary company… But it is not on the market and it does not look anything will appear soon.

What is your vision and experience with NFC and mobile phone development?

Husbandman

Answer 1

In order to be a little bit more practical, and not only theoretical, I have posted some patches on xda-developers to enable card emulation mode on the currently unique android phone supporting NFC (the Nexus S). You and others might be interested in playing around with card emulation mode by yourselves. Take into consideration that this is only for experimental purposes.

They apply to gingerbread versión 2.3.4_r1 of the AOSP sources. They allow:

• Enabling NFC card emulation mode on the Nexus S. This mode is always enabled.
• Disabling reader mode, letting the card emulation being the only one working.
• Selecting an external secure element (in UICC) instead of the embedded one (in SmartMX chip).
• Although not related, removing time-limit to bluetooth discoverability option.

---

What I have found out about NFC card emulation on Android so far:

• Card emulation is disabled by default on stock images and require a firmware modification. Alteration of Nfc system application and libnfc-nxp system library are the places to look at.
• Embedded SmartMX chip inside Nexus S presents itself as a dual smartcard. A programable one (allowing installing of cardlets on it) based and a 4K Mifare one.
• The 4K Mifare card has default keys, so it can be written/read from an external reader.
• The programable card is supposed to be GP compatible, but no one except Google can fiddle with it since access keys are not public.
• Nexus S does support SWP and allows to operate with a secure element located inside an UICC.
• Applications can not access directly to any contents of secure elements. On one hand the embedded SE is unaccessible because we do not know the keys. On the other hand the external element is accesible externally by means of SWP (that connects to NFC controller) but not internally because AFAIK the SIM slot is not connected by other means to the NFC controller. This leaves us with only one path, the baseband processor. However BB firmware is propietary and controlled by manufacturers. Samsung has not implemented the 3GPP TS 27.007 Technical Specification to interact with it in its BB firmware.
• OTA access to external SE should be possible, this lies in hands of MNOs. Some of the might offer TSM services to allow 3rd party access to SE inside UICC.

By the way the technology you mention (NFC-WI) is already used in the Nexus S to interconnect the NFC controller with the embedded secure element.

Upate

To summarize I answer Sten's questions:

Since the Mifare 4K area has default keys, anybody with the external NFC reader can change the keys and securely store values there – is that correct? Did you try it? Does this come with any difficulties?

Short answer yes, I did access Mifare 4K from an external reader. I was able to modify default keys too. The difficulties come from modifying system sources and building a custom firmware yourself.

Is use of the external NFC reader the only way how to access the Mifare space?

Theoretically no. The other alternative would be sending APDUs to the SIM, containing the Mifare commands to execute on the Mifare card.

Can e.g. application installed on the Android phone read/write some data to Mifare 4K using some API (over NFC controller and NFC-WI path)? Can e.g. seek-for-android help there?

For the time being no. Though you modify the AOSP sources with seek-for-android patches (I did it myself) your application will just crash with stock phones. The reason is that they have not implemented the 3GPP TS 27.007 Technical Specification, that allows the application processor to send APDUs directly to the SIM (UICC).

However there could be some light ahead of the tunnel, since citizy project in France are already using secure element mode of NFC technology with Android phones, taking the UICC secure element approach. In fact there is a modified Samsung Galaxy SII model in use and the new Acer Liquid Express will also be soon available to integrate into citizy. Those phones are bound to have the required TS 27.007 specification implemented in their baseband processor firmware. When it comes to application processor I do not know if they took the SEEK-for-android from G&D path or the OpenNFC from Insecure. Being french I would bet all-in for the last one.

Hermitage

Hi, NICE contribution: So in short – one cannot access the Mifare 4K unless the Google will share the keys with the respective company or rent a space via TSM – this I think can be theoretically possible for some companies, since there should be still a lot of free sectors available (unless the Goolge Wallet occupies all 3440 bytes). But I am not sure how in such case (i.e. even with Google permission) cardlets can be installed on the phone built-in SmartMX – is it possible via OTA? To be continued – Husbandman

The other option is SIM card – there is the way to access it over NFC via SWP or directly (BB) over USB or similar – but to upload the program on the SIM card there are same restrictions as for built-in secure element… This left us with micro SD cards I think. – Husbandman

Well, you cannot access Mifare 4K from the phone, but you can from an external RFID reader (keys have default values). If you mean OTA normal MNO OTA I don't think it can be accessed that way since OTA is meant to access SIM not Phone internals itself. – Lindyline

As far as I have realized experimenting with Nexus S, SWP is only used to connect UICC<->NFC Controller in radio communication. That channel (I haven't found how) is not accesible from application processor. The only "path" to access a SE from application processor via NFC Controller is NFC-WI interface, which is used exclusively for embedded SE communication. The only supposed way to access UICC from application processor is via baseband processor (which is connected to UICC), which must implement appropiated AT commands to export that functionality. – Lindyline

If you enable card emulation mode via the modification mentioned above you won't be able to use the card emulation from the UICC/SmartMX at the same time. Problem: How do you tell the UICC to disable Card emulation without altering the program? This is a dead end imho. – Renita

You can work with card emulation using embedded SmartMX SE or using the external SE inside UICC. Not at the same time, but with the patches provided you can specify if you prefer external over embedded if available or not. – Lindyline

Answer 2

So to continue the discussion I will just summary it: The NXP SmartMX microcontroller consists of two separate secure elements. The first one is programmable, runs some operating system (e.g. MULTOS or Sm@rtCafe or other) and a JavaCard VM, but it is locked and the production access keys there are in Google or TSM hands only. There is no way to install JavaCard application for testing purposes here, since it is not possible to unlock the secure element for test purposes.

Also there is no way how to utilize the SIM card, because even if this can be technically possible, for the commercial application deal with MNO is necessary. Let’s stop for a while with the Mifare 4K, which seems to be the most promissing:

Since the Mifare 4K area has default keys, anybody with the external NFC reader can change the keys and securely store values there – is that correct? Did you try it? Does this come with any difficulties?

Is use of the external NFC reader the only way how to access the Mifare space? Can e.g. application installed on the Android phone read/write some data to Mifare 4K using some API (over NFC controller and NFC-WI path)? Can e.g. seek-for-android help there?

Thanks STeN

Husbandman

I doubt this is a format we like, on a Q&A site. (Not being a discussion forum!) – Wallah

The Mifare4K is a dead end because no NFC controller beside the NXP family support this tag. It's not required by the NFC standard and NXP wants license for their broken Crypto-1 algorithm. Therefore all upcomming NFC-Chips that I know off don't support Mifare classic tags. – Renita