ARM, Gemalto and G&D introduce alternative to NFC secure elements

Trustonic, a joint venture set up by the three companies, will provide TSMs and service providers with the key to their own secure area within a trusted execution environment on an ARM processor, in exchange for a one-off fee, providing an alternative to secure element chips for applications requiring low- to mid-range security.

TRUSTONIC: A one-time payment buys the key to a secure sub-area

ARM, Gemalto and Giesecke & Devrient (G&D) have launched Trustonic, a joint venture company set up to commercialize trusted execution environments (TEEs) on ARM processors.

A trusted execution environment has some similarities — as well as some important differences — with NFC secure elements. Because it is part of the main processor on a mobile phone, a TEE can process instructions much more quickly than a secure element. But because it is not a completely separate and sealed unit, it is also not as secure.

That means TEEs are unlikely to be suitable to store high security credentials like bank cards. But they can be used to provide a short term secure window into which sensitive data such as PIN numbers can be entered and to provide sufficient security for applications like loyalty cards where some security is required in order to prevent fraud but there is ultimately not the same level of liability that there is with a bank card.

Beyond NFC, TEEs are also expected to be used for digital rights management, in the corporate security market and to add security to ecommerce and mcommerce while also reducing the amount of information consumers need to provide to a merchant in order to make a purchase.

The new Trustonic venture will manage the trusted execution environment on a device and offer both trusted service managers and service providers the ability to purchase a key to their own sub-area within the TEE, Ben Cade, the company’s CEO, has told NFC World.

Exactly how much a key will cost has not been decided, but the revenue model has — there will be a one-off fee to obtain a key, with no annual or other forms of recurring costs.

To be able to work with Trustonic, phones need to have both an ARM TrustZone and security software. Currently, says Cade, there are some 50m phones in circulation that can support Trustonic’s service, up from 20m a year ago, and the number is growing fast — 80% of smart connected devices ship with the necessary hardware but only some of today’s devices include the right security software.

Twelve companies from diverse industries have signed up to support Trustonic at launch, including 20th Century Fox Home Entertainment, Cisco, Discretix, Good Technology, Inside Secure, Irdeto, MasterCard, Nvidia, Samsung Electronics, Sprint, Symantec and Wave Systems.

“At MasterCard we are constantly striving to deliver a better payments experience for merchants and consumers alike,” says MasterCard’s James Anderson. “One of the key challenges in mass-market payments is finding the right balance between strong authentication, consumer usability and ease of scaling. As such, we are keen to explore the potential for Trustonic’s technology and services to help us address that challenge in new and creative ways.”

Next: Visit the NFCW Expo to find new suppliers and solutions