GlobalPlatform
Annual Report2023

GlobalPlatform
Annual Report 2023

Contents
Reflecting on progress…

02

Looking ahead…		

03

GlobalPlatform in numbers

04

Why GlobalPlatform?

06

In Focus: eID Wallets, SESIP and Automotive

07

Who is GlobalPlatform?

08

Our technologies

10

Collaborating on technical priorities

14

GlobalPlatform services

24

Technical training

27

STAR Awards

29

Industry partnerships

30

The value of membership

33

Member testimonials

34

01

Reflecting on progress…
It has been another year of opportunity for our organization. GlobalPlatform continues todeliver technical expertise and critical support to create collaborative and open ecosystems
that further empower our members.
We have proactively responded to industry developments – evolving our Task Forces topromote cross-industry discussion to identify market requirements, and launching crucial
specifications that develop confidence and inspire trust in secure technologies andcertifications.

Key Achievements• GlobalPlatform formed the Cybersecurity
Vehicle Forum, hosting events in
Munich and Detroit that brought the
automotive value chain together to specify
requirements and enable cross-industry
engagement on cybersecurity.
• The second Standardization Executive
Roundtable welcomed full members todefine their short and long-term priorities.
This insightful discussion proved to be thecatalyst to enable us to address the topics
and trends through our technical roadmap.
• New specifications have been publishedcovering SESIP governance, Cryptography
recommendations for TEE internalmechanisms and Root of Trust definitions
and requirements.
• We launched the GP Women Initiative – aGroup committed to championing womenin the cybersecurity ecosystem. We also
welcomed Nicola Palmer, Chief Technology
Ambassador at Verizon, to officially launch
the Group in March 2023. Empowering
females in the industry remains a key
priority for our organization,
here is why.

• Experts from government and industry,including BSI, Deutsche Telekom Security,
GSMA, ENISA, EU Commission, NXP
Semiconductors, Orange and Thales,joined us in Brussels for the GlobalPlatformeID Wallet Seminar to discuss and debate
the future of the European Digital Identity(EUDI) Wallet.
• With a focus on delivering morecertifications, we renewed our ISO 17065
accreditation – ensuring we continue todeliver the highest value for our industry
partners and participants – and announced
that GlobalPlatform would be thequalification authority for the OSIA global
qualification program – read more on
page 26.
While the last year has proved to betransformative in how we support ourmembership and deliver standardized
technologies and certifications that matter,
there is so much more to do. Throughindustry-driven collaboration, innovation andcritical knowledge-sharing, we can continue
to make a difference in how we truly connect
the digital world.

Stéphanie El Rhomri
Chair of the Board

02

GlobalPlatform
Annual Report 2023

Looking ahead…
As the world becomes increasingly connected, there has never been a more important timeto ensure devices remain secure and interoperable. GlobalPlatform has been building thefoundations of security for over 20 years and remains committed to driving new initiatives that
increase trust and security in devices, enabling stakeholders to efficiently – and effectively –deliver innovative digital services.
Through collaboration with our members and industry partners we have been able to identify key
roadmap and organizational priorities for GlobalPlatform. Some of this work has already begun –as you will see in this report – but there is still a long way to go if we are to standardize and certify
technologies that address specific business security and scalability needs. Below is an overview
of our focus areas and the progress we are making.

Strategic Initiatives• Following the release of GSMA’s
Secured Applications for Mobile (SAM)
requirements, GlobalPlatform is helping
impacted industries to navigate how secure
applications will be deployed, managed andaccessed within the eUICC of a device.

• SESIP will be the cornerstone of a secureconnected future. GlobalPlatform is building
the future ecosystem, as well as rolling out adedicated SESIP training program, seminars
and educative resources to support thecreation of IoT vertical-specific schemes.

• As EU member states get set to pilot
their EU Digital Identity (EUDI) Walletapps, GlobalPlatform has been building
the foundations to foster trust in digital
identity and enable secure EUDI wallet
implementations.

• Ensuring the cybersecurity of vehicles
is another key focus for GlobalPlatform.
Alongside launching a specialist Automotive
Task Force and Cybersecurity Vehicle
Forum, we are working on a mature andinteroperable cybersecurity standard
and certification program to comply withregulations that foster industry growth with
innovation and product differentiation,
and Post-Quantum Cryptography (PQC)
migration.

• We have also launched a dedicated eID
Wallet Task Force to identify wallet use
cases and propose deployment models
focusing initially on supporting Europe, andnow expanding our scope to encompass theglobal market.
• As part of this effort, GlobalPlatform will also
work to standardize a Cryptographic Service
Provider (CSP) Application Programming
Interface (API) to help ease the certificationof digital ID applets by promoting reuse andreducing fragmentation.

As always, GlobalPlatform cannot do this work
alone. The active participation of our members
is invaluable if we are to effectively develop,
deploy and manage trusted digital services
and devices that encourage a more connectedworld. Get in touch to offer your vital expertise:ana.lattibeaudiere@globalplatform.org

Ana Tavares Lattibeaudiere
Executive Director

03

GlobalPlatform in numbers
Collaboration→

2,280+

representatives from89 member companies

6market-specific
Task Forces

3 Sub-Task
Forces3

Technical
Committees

supported by 15 Working Groups

36
3

Industry
Partnerships

certified with moretrainers coming soon!

Adoption→

100%of SIMs and eSIMs produced
after 2001 rely on
GlobalPlatform technology
Tens of billions of
GlobalPlatform-certified
SEs and TEEs are used indevices across market sectors,
including identity, automotive,
IoT, payments, mobile
connectivity and more.

04

62bn+

GlobalPlatform-compliant SEs
shipped worldwide

200

specifications and technicaldocuments available

GlobalPlatform
Annual Report 2023

Certification→

560

48

7

products
certifiedtest suites
available

GlobalPlatform-accredited labs
in China, France, Spain, UK,
and Netherlands.

Over the course of 2022-23
7bn+

13

168

46

GlobalPlatform-certified SEs
shippedTechnical Committee andWorking Group meetings, alongwith 90 virtual Task Force and
Sub-Task force sessions

Launched

the eID Wallet Task Force& held seminar in Brussels

3

SESIP seminars
held in Austin, Barcelona& Taiwan

new specifications
publishedproducts certified

5

new industry partners
welcomed

Launched

Cybersecurity Vehicle
Forum with events in
Munich & Detroit05

Why GlobalPlatform?
A Legacy of Building Standards That Benefit Everyone
For over 20 years, GlobalPlatform has worked to develop frameworks and technologies that
support the isolation of an execution environment in a device to deliver secure services andtrusted storage for diverse industries and stakeholders.
At the core of our work is the standardization of Secure
Element (SE) and Trusted Execution Environment(TEE) technologies. Having been the body responsible
for standardizing SE technologies since 2000 and
TEE technologies since 2010, GlobalPlatform securecomponents are an industry-recognized benchmark forsecurity, interoperability, and privacy.
GlobalPlatform also creates device specifications, withassociated open-source program code, that define auniversal language to access secure services provided
by GlobalPlatform SEs and TEEs through Trusted
Platform Services (TPS) APIs. The aim is to make iteasier for service providers and application developers,
in different market sectors, to link together the strong
security technology offered by secure components intheir products.

Most SIM cards,
credit cards, identity
cards, ePassports
and smartphones
today rely on
GlobalPlatform’s
technologies.

New Initiatives, Grounded in Proven Security
Banking and identity were the first industries to adopt GlobalPlatform standards. This wasquickly followed by the mobile industry and has since expanded to encapsulate numerous
other connected industries.
With the digitalization of our world continuing to introduce new requirements, GlobalPlatform
is working with its members and industry partners to improve understanding of how securecomponents can be used to address specific markets and use cases.

Financial Services

Smart City

Identity

Automotive

MobileUtilities

Consumer Electronics

Logistics

Healthcare

06→ Bring us your requirements!

GlobalPlatform
Annual Report 2023

In Focus: eID Wallets, SESIP
and AutomotiveeID Wallets
The development of eID Wallets globally led to the establishment of the GlobalPlatformeID Wallet Task Force to analyze, identify and address digital identity wallet use cases,
propose secure and frictionless deployment models and support the long-term needs ofEuropean governments that are engaged in large-scale ID and eID deployments.
→ Learn more on page 18.

SESIP
The Security Evaluation Standard for IoT Platforms (SESIP) has rapidly grown into aninternationally recognized standard for IoT security evaluation.
GlobalPlatform continues to evolve the SESIP methodology to map with additional
regulations and standards requirements. We are also creating specific security profiles
to address new markets such as healthcare and automotive.
→ Learn more on page 20.

Automotive
GlobalPlatform has launched a broad-reaching initiative to drive engagement acrosssecurity experts in the full automotive value chain and adjacent digital services. The
objective is to optimize and accelerate the deployment of secure components, trusted
digital architecture, security APIs, and security lifecycle management within theautomotive sector. This initiative is being led by a dedicated Automotive Task Force tofoster the alignment of GlobalPlatform technologies with automotive use cases andrequirements.
→ Learn more on page 13 & 17.

07

Who is GlobalPlatform?
Our Executive Team is responsible for the development andadoption of GlobalPlatform’s technical specifications, driving
awareness and understanding of our work and managing
day to day operations.

Ana Tavares Lattibeaudiere

Gil Bernabeau

Executive Director

Chief Technology Officer

08

Tono Aspinall
Alliances Management
Operations DirectorGlobalPlatform
Annual Report 2023

Our Board of Directors is comprised of 11 representatives
from GlobalPlatform Full Member companies, who work
together to develop and drive the organizational strategy.

Stéphanie El Rhomri

Olivier Van Nieuwenhuyze

Claus Dietze

GlobalPlatform Chair,
FIME

Vice Chair,
STMicroelectronics

GlobalPlatform Treasurer andSecretary, Giesecke + Devrient
Mobile Security

Rob Coombs

Eikazu Niwano

Sebastian Hans

Jeremy O’Donoghue

ARM

NTT Corporation

OracleQualcomm

Guillaume Phan

Scott Migaldi

Richard Hayton

Marc Kekicheff

Thales

T-Mobile USA

Trustonic

Visa Inc.

09

Our Technologies
Trusted Innovation: Build, Certify, Deploy & Manage
As digital transformation continues to drive change across ourindustries, GlobalPlatform technologies enable device makers andservice providers to focus on their business models and innovation,safe in the knowledge that standardized security will continue towork for them as new risks and opportunities arise.

Build• GlobalPlatform secure components provide a secure
platform to build customizable, innovative products thatanswer security, regulatory and market requirements.
• GlobalPlatform TPS APIs provide a standardized way toaccess secure services in the device and help to create anattestable Chain of Trust (from the Root of Trust (RoT) to
the application or the cloud). These APIs are optimized forthe IoT and built with an attestation-by-design mindset.

GlobalPlatform is supporting
new designs and architecture
to enable the managementof Roots of Trust on
Microcontroller Units (MCUs)
from design to certificationand market adoption.

• This standardized approach to security and attestation brings confidence and simplifies
set-up processes to reduce the burden on manufacturers who rarely have the time, andconsumers who rarely have the expertise, to securely onboard devices to networks, cloud
platforms and digital services.

Test & Certify• Product testing and certification helps manufacturers demonstrate the quality and securityof their solutions, propagate trust among service providers and accelerate the adoption ofvalue-added services.
• Companies can verify product adherence to GlobalPlatform technical specifications,market-specific configurations and security levels through GlobalPlatform’s functional andsecurity certification schemes.
• GlobalPlatform also collaborates with the IoT ecosystem to simplify security evaluation
through the SESIP methodology, which is now an EN 17927 Standard. By enabling reuseand composition of certified components, SESIP optimizes the effort of vendors andlaboratories to adhere with worldwide regulations and standards, reducing the cost and timeof evaluation.

10

GlobalPlatform
Annual Report 2023

Deploy & Manage• Industry, service provider, device maker and end-user requirements change rapidly, making
the ability to securely update devices and applications essential.
• GlobalPlatform develops frameworks and secure protocols for managing software updates
and downloading secure applications, as well as mechanisms to switch underlying
cryptography to protect against quantum threats.
• The organization’s focus on ensuring that the firmware in devices is updateable andprotected against attacks, provides the assurance that solutions will function as intended
when deployed in the field and can be remotely managed to ensure cyber resilience.

SecureBy Design

SecureComponent

SE

TEE

Build

Certify

Deploy& Manage

GlobalPlatform®

Certified
Device Trust
Architecture

GlobalPlatform®

Training

MCU

Pre-Integration

Certified Secure
Component

Secure Lifecycle
Management

11

“Business, security and privacy regulations are demanding moreof the technical community. Yet across all industries, we are seeing
the same fundamental needs. Device makers and service providers
need technologies that provide the flexibility to build to their specificrequirements. They need tools that simplify compliance with evolving
regulations and make security understandable for non-experts. The ability
to deploy secure services anywhere and at any time based on state-ofthe-art cryptography is also crucial. In today’s digital society, we must
be confident that once a solution is live in the field, it can be remotely
managed and securely updated throughout its lifecycle to protect against
future threats and risks posed by quantum computers.”

Gil Bernabeu
Chief Technology Officer

12

GlobalPlatform
Annual Report 2023

Addressing Emerging Automotive Requirements

Evolving cybersecurity requirements and new connectivity
and service-oriented trends are having a major impact on
the future of automotive security. These changes requirerobust, trusted service solutions to create agility indeveloping and deploying new services, but also flexibility
in updating services in the field. Additionally, the global
semiconductor chip shortage emphasized the need forstandardized, secure technology in vehicles, supported bymultiple providers, to deliver everything from entertainment
systems to power steering.
As a leader in delivering specifications andcertifications for secure digital services,
GlobalPlatform has existing technologies tosupport the evolving requirements in trust
management for automotive, and members
are already providing solutions. Therefore, in
2022, GlobalPlatform launched a dedicatedautomotive initiative to address theseissues. Through the Automotive Task Force,
GlobalPlatform has partnered with automotive
standards organizations to better define
and answer to the needs of this market. We
recognize that GlobalPlatform technology will
not solve all requirements and that a common
platform to discuss and align the industry
will become mandatory. This is why the
Cybersecurity Vehicle Forum was created - tounite the automotive ecosystem in optimizing
cybersecurity for vehicles.
By establishing cooperative agreementswith key automotive industry organizations,GlobalPlatform aims to develop a standard
reference framework and map GlobalPlatform
specifications to existing requirements andregulations. The Car Connectivity Consortium
was the first automotive standard to use
GlobalPlatform-SEs to define the digital car
key technology that is publicly available today.
Currently, we have started to coordinate with
the Society of Automotive Engineers (SAE)
to work on the harmonization of hardwarebased secure execution environments in
automotive (J3101). We have also partneredwith AUTOSAR to coordinate the alignmentof secure component standards andspecifications for automotive. In addition,
GlobalPlatform has joined the Auto-ISAC
community. These alliances will ensure
coordination and alignment on common
requirements with key automotive andcybersecurity organizations. GlobalPlatform
is focused on working with the full automotive
value chain to develop interoperable, securecomponents that meet emerging vehicle
standards.

13Collaborating on technicalpriorities
When developing standards that enable convenient andtrusted digital services across market sectors, industry
collaboration is key.
GlobalPlatform members make their voices heard and alignthe organization’s technical priorities with business goals,
by participating in our technical committees, working groups
and task forces.

14

GlobalPlatform
Annual Report 2023

Secure Element (SE)Committee

Key Initiative:

GSMA Secured Application for
Mobile (SAM)
Objective:
Finalize the SAM configuration for
GlobalPlatform SE specifications, theassociated compliance test suite andProtection Profile. This initiative is being
driven in collaboration with GSMA.

Chair:
Karl Eglof Hartel, G+D Mobile Security
Mission:Define industry and technology neutral specifications
for the secure and interoperable deployment andmanagement of multiple embedded applications on SE
technology. This includes embedded and integrated SEs,
SIM/UICC, as well as smart cards.

Learn more →Key Initiative:

Support eID and Automotive
Requirements
Objective:
Develop specific configurations foraddressing requirements from automotive
and eID Wallet use cases.

Key Initiative:

Enhancing Low Level Protocols
for SE Integration
Objective:
Develop a Next Gen APDU Transport
specification, and publish a new Secure
Channel Protocol enabling remoteapplication and file management on
constrained IoT devices and low-power
networks.

15

Key Initiative:

Address TEE Evolution

Trusted Execution Environment(TEE) Committee

Objective:
Update the Core APIs to reflect the newcapabilities in the TEE Architecture 1.3
which adds capabilities around hypervisors
and new processor types.

Key Initiative:

Support Automotive
Requirements
Objective:
Chair:
Richard Hayton, Trustonic
Mission:Define an open security architecture for consumer
and connected devices and enable the development
and deployment of secure services from multiple
service providers.

Learn more →Trusted Platform Services(TPS) Committee

Develop a specific configuration foraddressing requirements from automotive
use cases.

Key Initiative:

TEE Compliance and Security
Documentation
Objective:
Update the TEE compliance programand maintenance of the TEE security
documentation including the attack
methodology.

Key Initiative:

Enabling Access to SecureServices
Objective:
Finalize TPS Keystore, TPS Client API,and TPS Entity Attestation Protocol
Specifications as the first APIs to accessthe secure services provided by the RoT indevices, including SEs, TEEs and MCUs.
Chair:
Jeremy O’Donoghue, Qualcomm
Mission:Make it easier for service providers and application
developers in different market sectors to link together thestrong security technology offered by secure components
in their products.

Learn more →16

Key Initiative:

Open Source
Objective:
Organize a DevFest to promote the open
source reference implementation for thesoftware developer community.

GlobalPlatform
Annual Report 2023

Automotive Task ForceKey Initiative:

Aligning GlobalPlatform
Specifications to the J3101
Automotive Standard
Objective:

Chair:
Richard Hayton, Trustonic
Mission:Securing software defined vehicle services.

Learn more →Enable GlobalPlatform-certified
components to be in compliance with
the Society of Automotive Engineer’s(SAE) Hardware Protected Security
Environments J3101 automotive standard,
and to demonstrate compliance throughGlobalPlatform’s test suites.

Key Initiative:

Alignment with AUTOSAR’s
adaptive platform
Objective:
Align GlobalPlatform’s automotive
configuration with the AUTOSAR adaptive
platform, thus enabling compliance withthe de facto standard.

17

eID Wallet Task ForceKey Initiative:

Enabling New SE Technologies to
Securely Host Digital IDs
Objective:
Support the deployment of digital ID
applications on SEs with different form
factors – such as embedded SE or
embedded UICC – with a certifiable highsecurity level of assurance.
Key priorities:

Chair:
Jean-Daniel Aussel, Thales
Mission:Enable the deployment of digital identity wallets that meetthe highest levels of security, while also being convenient
to use and inclusive for citizens.

Learn more →• Define eID requirements for the SAM
specification, to enable ID applets to be
securely deployed on existing eUICCs(embedded SIMs / eSIMs), independently
and in complete isolation of the operator
profiles.
• Drive the development of a
Cryptographic Service Provider(CSP) specification that will ease thecertification of digital ID applets bydelegating sensitive cryptographic
operations to a certified library,embedded in the SE.

Spotlight:
How GlobalPlatform supports eID
implementation
With eIDAS 2.0 regulation now officially in place,
European Digital Identity (EUDI) wallet deployments
are expected in early 2025 after a phase of largescale pilots. It is the responsibility of each of the 27
member states to develop and issue an eID Wallet witha scheme that is recognized and accepted by all othermember states.
Having successfully developed several interoperable
and reliable technologies for trustworthy devices
and digital services, GlobalPlatform is in a strong
position to provide the foundations for fostering trustin the EUDI Wallet, regardless of the underlying wallet
attributes or data model.

18

The compliance program ensures the interoperabilityof GlobalPlatform secure components, which are
deployed on a range of form factors that can fit
different needs of EUDI Wallet implementations.
As such, GlobalPlatform technology will enable
EUDI Wallet implementations to support the highest
assurance security requirements when the ENISA
certification scheme for the EUDI Wallet is defined.

GlobalPlatform
Annual Report 2023

Security Task ForceKey Initiative:

Cybersecurity Certification
Objective:
Engage the European Union Agency for
Cybersecurity (ENISA) on the alignmentof security levels and cybersecurity
certification frameworks to address
fragmentation.

Chair:
Olivier Van Nieuwenhuyze, STMicroelectronics

Key Initiative:

Mission:Objective:

Define GlobalPlatform’s security philosophy and its
contribution to the security landscape in collaboration
with the Crypto Sub-Task Force and SESIP Sub-Task
Force.

Learn more →Addressing Market Requirements
Define requirements for use cases
and market sectors and contribute to
GlobalPlatform’s Technical Committees
to shape the development and evolutionof technologies and certifications that
address them.
Priorities include:• Obfuscation method evaluation• Cryptographic Service Provider
requirements• Finalizing the requirements for the
Operating System (OS) update ofGovernment IDs.

19

SESIP Sub-Task ForceKey Initiative:

SESIP Methodology
Objective:
Drive adoption and recognition of SESIP
certificates by:• Educating on the security, cost, andtime-to-market benefits.
• Mapping the methodology to otherstandards and regulations.
Chair:
Eve Atallah, NXP Semiconductors• Issuing or reviewing SESIP profiles for
specific types of IoT components.

Mission:Develop and drive global adoption and recognition of the
SESIP methodology across markets.

• Providing access to SESIP training,
qualified evaluation laboratories andcertification bodies.

Learn more →Spotlight:
The Security Evaluation Standard for
IoT Platforms (SESIP)
An optimized security evaluation methodology, designed for IoT devices

GlobalPlatform recognizes that many IoT products are comprised of more components
than traditional security evaluation approaches were designed to address.
This is why the organization supports IoT device makers, labs and certification
bodies to adopt the Security Evaluation Standard for IoT Platforms (SESIP) – a
common security evaluation methodology – to establish their own IoT device security
certification schemes and adopt trusted components that have already been SESIPevaluated.
Why SESIP?

SESIP delivers greater efficiency, cost-savings andensures defined assurance levels across a broad
range of regulatory and security frameworks including
ETSI, ISO/IEC and NIST, as well as specific, verticalregulations.
CEN CENELEC has publicly cited its intention to adopt
SESIP as a European Standard (prEN 17927).

20

Supporting IoT device makers andcertification bodies

GlobalPlatform can provide existing SESIP documents,
Protection Profiles and approaches on establishing
schemes that support the methodology. Certification
bodies can also onboard an existing GlobalPlatform
laboratory or GlobalPlatform can assist them intraining and certifying new labs.

GlobalPlatform
Annual Report 2023

Crypto Sub-Task ForceKey Initiative:

Post Quantum Cryptography(PQC) Migration
Objective:

Chair:
Beatrice Peirani, Thales

Provide guidance for members on
migration, transition, hybridization,and crypto agility standards, as well as
validate the PQC migration strategy andupdate crypto recommendations for the
integration of PQC algorithms publishedby security standards bodies including
the National Institute of Standards andTechnology (NIST).

Mission:Evaluate and provide recommendations on thecryptographic mechanisms used in GlobalPlatform
technology, to ensure high levels of security as
cryptography trends and technologies evolve.

Learn more →Spotlight:
Post-Quantum Cryptography
GlobalPlatform is supporting the migration to Post-Quantum Cryptography (PCQ)
and actively engages with its members, and external security organizations, to ensurethat security requirements from a broad range of use cases and market sectors are
addressed for each phase:• Secure Channel Protocol (SCP04) – based onsymmetric cryptography and designed with crypto
agility in mind, the new protocol enables the transfer
of data with authentication, integrity, data origin andconfidentiality.

• Specifications – to provide security frameworks
that help device manufacturers protect theirproducts and associated content across many use
cases, from payments to smart homes and cities,
government and enterprise ID.

• Specialist recommendations – GlobalPlatform
maintains a classification table of cryptographic
algorithms and key lengths based on therecommendations of several national agencies– including NIST and the SOG-IS – that iscontinuously updated as new threats are
anticipated.

• Supporting the automotive industry – bringing
industry players together to collaborate on thedevelopment of a winning PQC migration strategy
for automotive.

21

SBOM Task ForceKey Initiative:

Guidance on SBOM
Objective:
Publish a whitepaper that analyzes
the impact of the SBOM and provides
guidance relating to its deployment,
including a consistent means to produce,
consume and exchange, softwaretransparency and assurance information.
Chair:
Gonda Lamberink, Fortress Information Security
Mission:Analyze the impact of and provide guidance on the
deployment of the Software Bill of Materials (SBOM).

Learn more →China Task ForceKey Initiative:

Addressing Regional
Requirements
Objective:
Identify regional requirements and expand
GlobalPlatform technology adoption
and the certification program to address
specific needs.
Priorities include:
Chair:
Xinmiao Chang, Huawei• Collaborating with members to identify
market requirements for new initiatives,
including automotive and SESIP.

Mission:• Promoting the TEE and SE successstories of regional members.

Provide a platform for members with business interests
in China to identify and agree on requirements fromthe region. The group also works directly with Chinese
industry and standardization associations.

Learn more →22• Increasing the number of online and inperson task force meetings with support
from members and event partners.

GlobalPlatform
Annual Report 2023

Japan Task ForceKey Initiative:

Expand GlobalPlatform Adoption
Objective:

Chair:
Eikazu Niwano, NTT Corporation

Expand GlobalPlatform technology
adoption and the certification program
across the smart cities market, as well as
critical infrastructure and consumer device
industries in Japan. This is in addition
to a focus on automotive and driving
engagement with local associations andother relevant entities.

Mission:

Provide a dedicated platform for members with businessinterests in Japan to gather and discuss business andfunctional requirements of specific market sectors within
the region.

Learn more →23

GlobalPlatform services
Supporting the adoption and launch of standardized secureservices

GlobalPlatform workshops, training sessions andpublications provide a deep-dive into specific technologies,
demonstrate their real-world application, and provide
information on the latest market trends, opportunities, andchallenges.

24

GlobalPlatform
Annual Report 2023

Functional and Security Certification

GlobalPlatform’s independent and industry-driven evaluationand certification schemes are ISO/IEC 17065-accredited
and enable product vendors to demonstrate productadherence to GlobalPlatform’s specifications, market-specificconfigurations, and protection profiles.
• Functional - evaluate the functional behaviorof a product against the requirements
outlined by GlobalPlatform configurations
and associated specifications to achievemarket interoperability. Independent testing
provides confirmation that a digital service
will perform as intended in the field on any
certified product, regardless of the productprovider.

Learn more →Laboratories and test tool suppliers
can also work with GlobalPlatform tobecome accredited and offer their own
GlobalPlatform-certified test services.

An ISO 17065 accredited
certification body
GlobalPlatform has renewed its ISO/IEC 17065 accreditation, ensuring theorganization continues to deliver thehighest levels of value to participants andpartners of its state-of-the-art functionaland security certification programs (suchas SE and TEE).

• Security - validate conformance of asecure component to a Common Criteriarecognized protection profile throughindependent security evaluation. To assist
the market in managing varying security
requirements, GlobalPlatform has structured
the program under three security levels:
Basic, Enhanced (TEE products) and High(SE products). This enables device makers
to select the most appropriate accredited
component for meeting their particularrequirements, and service providers to
confidently and effectively manage risk andcomply with industry requirements.

Learn more →ISO/IEC 17065 (number 5486.01) setsout requirements for the impartiality,competence, confidentiality, consistent
operation and openness of product,
process and service certification
bodies. The accreditation confirms thatthe operation of the GlobalPlatform
certification body answers all process
requirements and maintains a quality
management system supporting
continuous improvement processes.

Learn more →25

Managed Certification and Qualification Services Supporting
EMVCo, GSMA and Secure Identity Alliance (SIA)

GlobalPlatform’s functional and security certification
schemes are recognized across industries. The organization
uses its expertise and infrastructure to support a numberof other organizations with managed certification andqualification services.
Get in touch →Spotlight:
OSIA qualification program
GlobalPlatform is the qualification
authority of SIA’s OSIA global
qualification program and issues
an ‘OSIA-qualified’ mark tovendors following the successful
assessment of their products/
solutions against the OSIA
test plan.

In focus: Supporting openness andinteroperability in identity with OSIA
Launched by SIA, OSIA is an open standard
set of interfaces (APIs) that enables seamlessconnectivity between building blocks of theidentity management ecosystem – independentof technology, solution architecture or vendor.
The qualification program works to enhance
the interoperability of identity management
systems, support identity solution development
and address government requirements for OSIA
compliance.
It also aims to support the growing number ofgovernment bodies that want to introduce an
OSIA qualification as a solution pre-requisite
during their tendering process. It is doing this byenabling the government-industry collaborationneeded to build open, innovative and futureproofed national identity systems.

Discover more →26

GlobalPlatform
Annual Report 2023

Technical training
Secure Element (SE)A two-day training course supporting product developers,
system integrators, chip manufacturers and service
providers to implement the GlobalPlatform Card
Specifications into their own business models and productofferings – saving them significant cost and time-to-market.
This technical, instructor-led and engaging
training program demonstrates how
GlobalPlatform Card Specifications canbe used to support the delivery of digital
services in different markets for industrial andconsumer use cases.

There is also the option of a third ‘marketspecific’ training day, focusing on payments/
mobile contactless, mobile identity or SE
for IoT.

Sign up →Trusted Execution
Environment (TEE)

These two-day interactive and instructor-led courses cover
the technologies, support systems and architectures of the
TEE:•

Program/Product Managers – for thosedeveloping applications within the TEE or
device manufacturers integrating a TEE
into their device. Become proficient in the
TEE’s security mechanisms and methods,
architecture, security and functional
certification and trusted application
management.

Sign up →•Developers – taught in partnershipwith a TEE Open-Source development
environment. Learn how to effectively
implement a TEE environment and enable
the development and deployment of
secure applications from multiple service
providers.

Sign up →27

Security Evaluation Standard for IoT Platforms (SESIP)

GlobalPlatform has enhanced its training program to
improve industry knowledge of the SESIP methodology
including levels of security, the key concepts ofcomposition and re-use and GlobalPlatform’s
governance model.
Two-day in-person training or four half-day virtual sessions
available for:•

Product vendors, regulators,
and scheme owners – growyour understanding of the SESIP
methodology, its objectives,
applicability to other standards andGlobalPlatform Governance rules. This
includes our SESIP security profile
requirements and how to become a
GlobalPlatform SESIP Laboratory or
Certification Body licensee.

Sign up →28•

Labs – learn how to implement theevaluation methodology to support
your SESIP projects and provide an
efficient and swift solution for IoT
device certification. GlobalPlatform
member companies can also
participate in GlobalPlatform’scommittees and task forces toimprove the SESIP methodology andassociated supporting documents.

GlobalPlatform
Annual Report 2023

STAR Awards
Recognizing and rewarding GlobalPlatform members
Launched in 2004, the STAR Awards program recognizes individuals who
have demonstrated exemplary member participation throughout the year.
The annual awards celebrate individuals who have made a significant
contribution toward GlobalPlatform’s vision of creating a fully
collaborative and open ecosystem in which all stakeholders can efficiently
deliver innovative digital services, while providing greater security, privacy,
simplicity and convenience to users.
The latest winners – announced at GlobalPlatform’s Annual All Member
Meeting in November 2022 – were:★ Sandeep Tamrakar
Huawei Device (Dongguan) Co., Ltd
Collaboration and teamwork★ Martin Strauch
Huawei Device (Dongguan) Co., Ltd
Collaboration and teamwork

Recognizing Sandeep’s continued work to support
and assist in chairing of the TEE Specification
Working Group, alongside helping to ensure
processes are followed.

Awarded for Martin’s contributions to GlobalPlatform
Card Specification Amendment K (SCP04) as wellas his work on a new Controlling Authority Security
Domain scenario ‘04’ to Amendment A.

★ John Hillan
Qualcomm Technologies Inc.
Making it happen★ Arto Niemi
Huawei Device (Dongguan) Co., Ltd
Making it happen

Following the hard work with the TPS Committee,
John’s expertise helped drive the Entity Attestation
Protocol Specification – a key technology for devices
in today’s connected world when building trust.

Arto’s efforts to improve the ability for a Trusted
Application to securely communicate with services
outside the TEE have helped enable simple, securecommunication to trusted cloud services and otherremote backends.

★ Gaël Gérard
OrangeMaking it happen★ Pekka Laitinen
Huawei Device (Dongguan) Co., Ltd
Innovative thinking

Driving different documents forward across
GlobalPlatform’s SE and TPS communities have beenhugely valuable contributions from Gaël. In particular,
the delivery of a complete solution for SAM, making
this technology a reality.

This award celebrates the work Pekka put intodeveloping the TPS Keystore Specification. The
Keystore API forms the baseline of any RoT service,and this specification is now the basis of theassociated open-source project.

For all previous STAR winners view →29

Industry partnerships
Developing standards that foster adoption of new technology for secure digital
services and devices requires innovative thinking, grounded in knowledge andexperience. GlobalPlatform standardized technologies and certifications aredeveloped through energetic and effective cross-industry collaboration, led bydiverse member companies working in partnership with more than 36 industry
and regulatory bodies and other interested parties from around the world.
Become an industry partner →GlobalPlatform’s Longstanding Collaborative Partners

New partnerships

30

GlobalPlatform
Annual Report 2023

Industry Partner Testimonials
CEN and CENELEC“CEN and CENELEC, as two of the officially recognised European
Standardization Organisations (ESOs), have a strong commitment to making
the digital transition in Europe a reality, working together with all relevant
stakeholders to ensure that new technologies are safe, trustworthy andbeneficial for all. In this context, our collaboration with GlobalPlatform is key.
The work on the European standard based on their SESIP methodology is agood example of what can be achieved in working together for an inclusive
and safe digital society for Europe.”— Cinzia Missiroli, Director, Standardization and Digital Solution

GSMA“Over the past decade, GlobalPlatform has assisted GSMA through theprovision of the functional certification scheme required for eUICC products
and, last year, GSMA started to collaborate with GlobalPlatform on thetechnical implementation required for GSMA’s Secured Application for Mobile(SAM). Through this collaboration, we believe that GlobalPlatform and GSMA
provide the best solution for the SAM ecosystem, allowing any device toinstall a wide range of secure applications for financial services, ticketing, andpersonal identity within an eUICC.”— Ian Pannell, GSMA Chief Engineer

ioXt“ioXt looks forward to working with GlobalPlatform to help harmonize
standards and reduce fragmentation across the cybersecurity industry.
Together, the two will ensure connected products are protected all the way
from silicon-level through to end products and services, as comprehensive
security should be implemented from the ground up.”
— Grace Burkard, Director of Operations

31

32

GlobalPlatform
Annual Report 2023

The Value of Membership
Members get involved in the evolution of existing,established standards, the evaluation of newtechnologies and the definition of new use cases thatneed to be supported. They can also monitor new
trends in cryptography, assess tiered baseline levelsof product security that answer to multiple market
requirements and network with a community of experts
from different industries.

Interested in joining
GlobalPlatform?

GlobalPlatform has 3 distinct levels of membership– Full, Participating, Observer – and 2 separate
categories for Public Entities and Consultants– to serve the needs of every business andorganization type and size. You can learn more
about becoming a member here.
Click here to apply or request more information →33

Member
testimonials
BactechBactech is glad to have joined GlobalPlatform earlier this year.
By becoming a member, we’ve gained access to a vibrant global
community of industry experts and innovators who share invaluable
insights and foster an environment of collaboration. Throughparticipation in working groups, events, and conferences, we’ve not
only stayed at the forefront of emerging technologies and trends but
have also established meaningful connections that have furthered our
corporate growth in digital security. Expertise and training capabilities
in Secure Element technology, automotive security and SESIP
certification scheme are key assets for our company.
— Claude Barral, CEO & Founder

GoodixGoodix provides complete secure solutions from secure elements tosecure embedded operating systems across different market segments
such as mobile devices and IoT. GlobalPlatform specifications lay thefoundations for best-in-class secure technologies and has standardized
them for different segments, from IC to operating systems, as well as
providing security certification. As a member of the organization, we
will be able to provide GlobalPlatform-based secure solutions not onlyin China but also to the global market and we can contribute with ourown innovative ideas for new standards to make GlobalPlatform evenmore comprehensive.
— Yuyang Wang, Director of Product Marketing , Security BU

NXP
NXP is developing technology to enable secure connections for asmarter world, building on the technical standards as well as thecompliance and certification programs provided by GlobalPlatform.
We actively collaborate with our industry partners at GlobalPlatform todevelop open, scalable and secure standards to shape the ecosystems
and allow new services for our customers. GlobalPlatform has become
the standardization organization for secure digital services and NXP iscommitted to further contribute to create a more secure and smarter
world of the future.
— Andreas Lessiak, Head of Secure Element SW, Senior Director

34

GlobalPlatform
Annual Report 2023

Quarkslab
Quarkslab has joined GlobalPlatform to elevate app and dataprotection within the IoT market. Currently, evaluating the effectivenessof protections like obfuscation, white box cryptography, and runtime
app self-protections presents a challenge. This collaboration with
GlobalPlatform provides an optimal way to standardize these cuttingedge technologies, enabling precise assessments of their robustness
and efficacy.
— Michele Sartori, Product Manager, QShield

TrustCB
GlobalPlatform provides strong support of the development of SESIP
and its subsequent adoption and market visibility. The drive towards
standardization via collaboration with industry bodies such as CEN/
CENELEC, and the promotion of SESIP adoption via workshops andother events, has been a great value to TrustCB.
— Wouter Slegers, CEO

Winbond
For Winbond, being a member of GlobalPlatform is a great way tocontribute to the growth of the digital security market, to the growthof awareness about security certifications, as well as an excellent
opportunity to learn from other companies about modern hardware
vulnerabilities and challenges. As a member of the association,
Winbond gives its customers that peace of mind that our products aredesigned with “state of the art” security including the most updated
certification schemes and security techniques.
— Ilia Stolov, Center Head of Secure Solutions35

Supporting members toachieve business goals andmeet technical requirements
Shape the future of standards

Amplify your participation and initiatives• Participate in Technical Committee
meetings and contribute to thedevelopment of technical specifications
and standards.

• Gain visibility on GlobalPlatform’s public
website and communicate to yourecosystem your participation as a member.

• Be at the forefront of innovation andparticipate in the development of the future
standardization roadmap.
Knowledge sharing and education• Advance access to working documents
and discussions that take place before
documents are publicly released.
• Participate in Market / Regional task
force discussions where requirements aredeveloped and new topics explored.
Join a community of security experts• Participate in Industry Events on behalf ofGlobalPlatform.
• Visibility on Social media, Webinars,
Seminars and Workshops.
Enjoy cost savings for services and events• Access to discounted GlobalPlatformfunctional and security certification
services, and training.
• Free access to Test Suites for functional
certification (valued at over $6k per
release).
• Discounted / free access to GlobalPlatform
events and industry partner events.

• Meetings and dedicated networking events,
to participate in innovative discussions withpartners about the future of device security
and be exposed to different perspectives.
• Access to a community of experts from thedifferent parts of the device ecosystem andindustry verticals.

Click here to apply or request more information →36

→globalplatform.org