CIPURSE

Last updated

CIPURSE is an open security standard for transit fare collection systems. It makes use of smart card technologies and additional security measures.

Contents

History

The CIPURSE open security standard [1] was established by the Open Standard for Public Transportation Alliance [2] to address the needs of local and regional transit authorities for automatic fare collection systems based on smart card technologies and advanced security measures.

Products developed in conformance with the CIPURSE standard [3] are intended to:

The open CIPURSE standard is intended to:

All of these factors are intended to reduce operating costs and increase flexibility for transport system operators.

Background

In the past, public transport systems were often implemented using standalone, proprietary fare collection systems. In such cases, each fare collection system employed unique fare media (such as its own style of ticket printed on card) and data management systems. Because fare collection systems did not interoperate with each other, payment schemes and tokens varied widely between local and regional systems, and new systems were often costly to develop and maintain.

Transport systems are migrating to microcontroller-based fare collection systems. These are converging with similar applications and technologies, such as branded credit-debit payment cards, micropayments, multi-application cards, and Near Field Communication (NFC) mobile phones and devices. These schemes will enable passengers to use transit tokens seamlessly across multiple transit systems. These new applications demand higher levels of security than most existing schemes that they will replace.

The OSPT Alliance defined the CIPURSE standard to provide an open platform for securing both new and legacy transit fare collection [4] applications. Systems using the CIPURSE open security standard address public transport services, collection of transport fares, and transactions related to micropayments.

The transition to an open standard platform creates opportunities to adopt open standards for important parts of the fare collection system, including data management, the media interface and security. An open standard for developing secure transit fare collection solutions could make systems more cost-effective, secure, flexible, scalable and extensible.

Specification

In December 2010, the OSPT Alliance introduced the first draft of the CIPURSE standard. It employs existing, proven open standards, including the ISO/IEC 7816 smart card standard, as well as the 128-bit Advanced Encryption Standard and the ISO/IEC 14443 protocol layer. Designed for low-cost silicon implementations,[ citation needed ] the CIPURSE security concept uses an authentication scheme that is resistant to most of today’s electronic attacks.

Its security mechanisms include a unique cryptographic protocol for fast and efficient implementations with robust, inherent protection against differential power analysis (DPA) and Differential fault analysis attacks. Because the protocol is inherently resistant to these kinds of attacks and does not require dedicated hardware measures, it should be both more secure and less costly. It is intended to guard against counterfeiting, cloning, eavesdropping, man-in-the-middle attacks and other security threats.

The CIPURSE standard also:

OSPT Alliance technology providers are allowed to add functionality outside the common core (which is defined in the standard) to differentiate their products, so long as they do not jeopardize interoperability of the core functions. [5]

Introduced in late 2012, Version 2.0 of the CIPURSE Specification is the latest version. Designed as a layered, modular architecture with application-specific profiles, the open and secure CIPURSE V2 standard comprises a single, consistent set of specifications for all security, personalization, administration and life-cycle management functions needed to create a broad range of interoperable transit applications – from inexpensive single-ride or daily paper tickets to rechargeable fixed-count or weekly plastic tickets to longer-term smart card- or smart phone-based commuter tickets that can also support loyalty and other applications.

Three application-specific profiles – subsets of the CIPURSE V2 standard tailored for different use cases – have been defined, with which vendors are required to comply when creating products targeting these applications:

Products based on different profiles can be added to fare collection systems at any time and can be used in parallel to provide transit operators the greatest flexibility in offering riders a range of transit fare options. Because they are derived from the same set of specifications, all the profiles are interoperable, reflect the same design criteria and have the same appearance, enabling developers to create products according to a family concept. With its modular “onion-layered” design, the CIPURSE standard can be easily enhanced in the future with additional functionality and new profiles created to address changes in technology and business. The CIPURSE V2 specification enables technology suppliers to develop and deliver innovative, more secure and interoperable transit fare collection solutions for cards, stickers, fobs, mobile phones and other consumer devices, as well as infrastructure components.

In early 2013, the OSPT introduced the CIPURSE V2 Mobile Guidelines, a comprehensive set of requirements and use cases for developing and deploying CIPURSE-secured transit fare mobile apps for near field communication (NFC)-enabled smartphones, tablets and other smart devices. Providing everything developers need to implement and use the CIPURSE V2 open security standard when embedded in an NFC mobile device, the new guidelines enable transit operators to enhance their systems to support mobile ticketing with these new form factors.

Organization

Founded by smart card manufacturers Giesecke & Devrient GmbH (G&D) and Oberthur Technologies and chip suppliers Infineon Technologies AG, and INSIDE Secure S.A. (formerly INSIDE Contactless) in January 2010, the OSPT Alliance [6] collectively defined the CIPURSE standard.

The Alliance partners test their products for conformance with CIPURSE to demonstrate interoperability, [7] and have engaged an independent test authority to test compliance with the standard, interoperability, and performance. [8]

The OSPT Alliance

The OSPT Alliance [9] is a nonprofit industry organization open to technology vendors, transit operators, government agencies, systems integrators, mobile device manufacturers, trusted service operators, consultants, industry associations and others wishing to participate in the organization’s education, marketing and technology development activities.

Members

As of February 2019, Full members of the alliance are: [10]

The alliance is open to companies on the component supply and system integration side, as well as transport agencies and other standards bodies, to contribute their experience and knowledge to the development of the CIPURSE open standard.

See also

Resources

Related Research Articles

<span class="mw-page-title-main">Smart card</span> Pocket-sized card with embedded integrated circuits for identification or payment functions

A smart card (SC), chip card, or integrated circuit card is a physical electronic authentication device, used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit (IC) chip. Many smart cards include a pattern of metal contacts to electrically connect to the internal chip. Others are contactless, and some are both. Smart cards can provide personal identification, authentication, data storage, and application processing. Applications include identification, financial, public transit, computer security, schools, and healthcare. Smart cards may provide strong security authentication for single sign-on (SSO) within organizations. Numerous nations have deployed smart cards throughout their populations.

ISO/IEC 14443Identification cards -- Contactless integrated circuit cards -- Proximity cards is an international standard that defines proximity cards used for identification, and the transmission protocols for communicating with it.

<span class="mw-page-title-main">Mobile payment</span> Payment services via a mobile device

A mobile payment, also referred to as mobile money, mobile money transfer and mobile wallet, is any of various payment processing services operated under financial regulations and performed from or via a mobile device, as the cardinal class of digital wallet. Instead of paying with cash, cheque, or credit cards, a consumer can use a payment app on a mobile device to pay for a wide range of services and digital or hard goods. Although the concept of using non-coin-based currency systems has a long history, it is only in the 21st century that the technology to support such systems has become widely available.

<span class="mw-page-title-main">Near-field communication</span> Radio communication established between devices by bringing them into proximity

Near-field communication (NFC) is a set of communication protocols that enables communication between two electronic devices over a distance of 4 cm (1.57 in) or less. NFC offers a low-speed connection through a simple setup that can be used to bootstrap more capable wireless connections. Like other "proximity card" technologies, NFC is based on inductive coupling between two antennas present on NFC-enabled devices—for example a smartphone and a printer—communicating in one or both directions, using a frequency of 13.56 MHz in the globally available unlicensed radio frequency ISM band using the ISO/IEC 18000-3 air interface standard at data rates ranging from 106 to 848 kbit/s.

<span class="mw-page-title-main">EZ-Link</span> Contactless smart card used in Singapore

The EZ-Link card is a rechargeable contactless smart card and electronic money system that is primarily used as a payment method for public transport such as bus and rail lines in Singapore. A standard EZ-Link card is a credit-card-sized stored-value contact-less smart-card that comes in a variety of colours, as well as limited edition designs. It is sold by TransitLink Pte Ltd, a subsidiary of the Land Transport Authority (LTA), and can be used on travel modes across Singapore, including the Mass Rapid Transit (MRT), the Light Rail Transit (LRT), public buses which are operated by SBS Transit, SMRT Buses, Tower Transit Singapore and Go-Ahead Singapore, as well as the Sentosa Express.

<span class="mw-page-title-main">MIFARE</span> Brand of smart and proximity cards

MIFARE is a series of integrated circuit (IC) chips used in contactless smart cards and proximity cards.

OMA SpecWorks, previously the Open Mobile Alliance (OMA) is a standards organization which develops open, international technical standards for the mobile phone industry. It is a nonprofit Non-governmental organization (NGO), not a formal government-sponsored standards organization as is the International Telecommunication Union (ITU): a forum for industry stakeholders to agree on common specifications for products and services.

FeliCa is a contactless RFID smart card system from Sony in Japan, primarily used in electronic money cards. The name stands for Felicity Card. First utilized in the Octopus card system in Hong Kong, the technology is used in a variety of cards also in countries such as Singapore, Japan, Indonesia, Macau, the Philippines and the United States.

Java Card is a software technology that allows Java-based applications (applets) to be run securely on smart cards and more generally on similar secure small memory footprint devices which are called "secure elements" (SE). Today, a Secure Element is not limited to its smart cards and other removable cryptographic tokens form factors; embedded SEs soldered onto a device board and new security designs embedded into general purpose chips are also widely used. Java Card addresses this hardware fragmentation and specificities while retaining code portability brought forward by Java.

Java Card OpenPlatform (JCOP) is a smart card operating system for the Java Card platform developed by IBM Zürich Research Laboratory. On 31 January 2006 the development and support responsibilities transferred to the IBM Smart Card Technology team in Böblingen, Germany. Since July 2007 support and development activities for the JCOP operating system on NXP / Philips silicon are serviced by NXP Semiconductors.

<span class="mw-page-title-main">Z-Wave</span> Wireless standard for intelligent building networks

Z-Wave is a wireless communications protocol used primarily for residential and commercial building automation. It is a mesh network using low-energy radio waves to communicate from device to device, allowing for wireless control of smart home devices, such as smart lights, security systems, thermostats, sensors, smart door locks, and garage door openers. The Z-Wave brand and technology are owned by Silicon Labs. Over 300 companies involved in this technology are gathered within the Z-Wave Alliance.

The OpenAjax Alliance is an industry group dedicated to the set of technologies and web programming techniques known as Ajax.


A contactless smart card is a contactless credential whose dimensions are credit card size. Its embedded integrated circuits can store data and communicate with a terminal via NFC. Commonplace uses include transit tickets, bank cards and passports.

<span class="mw-page-title-main">Contactless payment</span> Technology enabling payment without physical contact

Contactless payment systems are credit cards and debit cards, key fobs, smart cards, or other devices, including smartphones and other mobile devices, that use radio-frequency identification (RFID) or near-field communication for making secure payments. The embedded integrated circuit chip and antenna enable consumers to wave their card, fob, or handheld device over a reader at the Point-of-sale terminal. Contactless payments are made in close physical proximity, unlike other types of mobile payments which use broad-area cellular or WiFi networks and do not involve close physical proximity.

Calypso is an international electronic ticketing standard for microprocessor contactless smart cards, originally designed by a group of transit operators from 11 countries including Belgium, Canada, France, Germany, Italy, Latvia, México, Portugal and others. It ensures multi-sources of compatible products, and allows for interoperability between several transport operators in the same area.

<span class="mw-page-title-main">UniPro</span>

UniPro is a high-speed interface technology for interconnecting integrated circuits in mobile and mobile-influenced electronics. The various versions of the UniPro protocol are created within the MIPI Alliance, an organization that defines specifications targeting mobile and mobile-influenced applications.

MIFARE4Mobile is a technical specification published by NXP Semiconductors in December 2008 to manage MIFARE-based applications in mobile devices. The specification provides mobile network operators and service providers with a single, interoperable programming interface, easing the use of the contactless MIFARE technology in future mobile Near Field Communication (NFC) devices.

Cubic Corporation is a global private transportation and defense corporation. It operates two business segments: Cubic Transportation Systems (CTS) and Cubic Mission and Performance Solutions (CMPS).

<span class="mw-page-title-main">Automated fare collection</span>

An automated fare collection (AFC) system is the collection of components that automate the ticketing system of a public transportation network – an automated version of manual fare collection. An AFC system is usually the basis for integrated ticketing.

Host card emulation (HCE) is the software architecture that provides exact virtual representation of various electronic identity cards using only software. Prior to the HCE architecture, near field communication (NFC) transactions were mainly carried out using hardware-based secure elements.

References

  1. ↑ Sayer, Peter (7 December 2010). "Card makers hope to shake security status quo". CSO Online. IDG News Service.
  2. ↑ "The open standard for public transport alliance makes its debut". EETimes Group. Archived from the original on 22 December 2013. Retrieved 16 July 2013.
  3. ↑ McLean, Heather (9 September 2011). "OSPT Alliance publishes open standard for contactless transit payments". NFC World . Retrieved 16 November 2011.
  4. ↑ "OSPT Alliance debuts at CARTES, announces open standard for fare collection". NFC News. 9 December 2010. Retrieved 16 November 2011.
  5. ↑ "An Open Standard for Next Generation Transit Fare Collection" (PDF). OSPT Alliance. Retrieved 16 November 2011.
  6. ↑ Clark, Sarah (16 December 2010). "Transport ticketing alliance debuts 'Cipurse' open alternative to Mifare". NFC World. NFC World. Retrieved 10 December 2011.
  7. ↑ "CIPURSE-Certified devices". OSPT Alliance. Retrieved 4 June 2014.
  8. ↑ "CIPURSE Product Certification". OSPT Alliance. Retrieved 4 June 2014.
  9. ↑ "About us". OSPT Alliance. Archived from the original on 3 November 2011. Retrieved 16 November 2011.
  10. ↑ "OSPT Alliance Members". OSPT Alliance. Retrieved 28 February 2019.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.