Working with a Startup, Google Cuts the Ties Between NFC And the Secure Element

For two years, Google Inc. and Verizon Wireless have been at odds, with Verizon blocking the online search giant’s access to SIM cards on Verizon devices for Google Wallet. But on Thursday Google released a new version of its Android mobile operating system that not only slices through that Gordian Knot for Google Wallet, it also frees up other players, including small banks and merchants, to offer mobile payments via the potentially powerful near-field communication technology.

The implications for Google Wallet and its competitors, including the carrier-backed Isis mobile-payments venture, could be far-reaching. Verizon’s blockade against Google Wallet helped stymie the application at the point of sale, leading to Google’s recent moves to focus the wallet on e-commerce and person-to-person payments.

Access to the secure element, such as a SIM card, is crucial because this is where users’ payment credentials are housed in conventional NFC transactions. Hence, Isis has enjoyed a key advantage as a joint venture of AT&T Mobility and T-Mobile USA as well as Verizon. Now all that could change radically.

Android 4.4 KitKat, the new OS, includes a feature called host card emulation, which allows NFC transactions to take place without a secure element in the mobile device, either as a SIM card or an embedded chip. This capability comes from an Austin, Texas-based startup called SimplyTapp Inc., which has been working on it since its founding in the fall of 2011.

The startup’s phones have been ringing off the hook since KitKat’s release, Doug Yeager, founder and chief executive of SimplyTapp, tells Digital Transactions News. The release is “fairly liberating to most card issuers,” he says. “SimplyTapp is built around the idea of not having a local secure element on the phone to store card data. Google has extended that right to those that do not have a secure element on the phone.”

Google did not respond to a request for comment for this story, so it remains unclear what the company’s plans are for Wallet in the wake of KitKat’s launch. Nor is it known whether updates to the product might be required to work with KitKat.

Up to now, NFC has relied on a configuration called card emulation, so called because it makes the mobile device appear to the point-of-sale reader as if it were a contactless card. In this configuration, inquiries from the reader are routed to the secure element via the NFC chipset, bypassing the operating system.

With SimplyTapp’s host card emulation technology, the NFC chipset still receives data from the POS reader but routes them instead to an NFC service manager, which is part of the Android OS. This lets any application on the phone act on the instructions. Payment credentials, meanwhile, reside on a remote server.

Without the dependence on a secure element in the phone, more issuers, merchants, and developers can create NFC-based payments products, experts say. Not only Google, but a host of other players could jump into NFC without having to pay tolls for access to the secure element, breathing new life into the technology, they say. “Any app can play without having to pay the piper,” says Cherian Abraham, mobile commerce and payments lead at Experian Global Consulting. “They can build on that [KitKat] stack. That’s the story.”

But Abraham and other experts also point out that host card emulation has downsides. They say the card networks have not yet certified the cloud-based configuration for managing card credentials. And they say the configuration can be slow, making it hard for NFC to penetrate key markets like mass transit.

Still, while conceding the secure element is the safest way to house payment data, Yeager says bypassing the secure element will unleash innovation as more companies can afford to adopt NFC. “The audience [for NFC] is a lot bigger now,” he notes.