FeliCa Approval for Security and Trust (FAST) v1
Overview

FeliCa Networks

Copyright FeliCa Networks, Inc.

Introduction
The security certification scheme called “FeliCa Approval for Security andTrust (FAST)” has been set up to enable the evaluation and certification ofthe mobile FeliCa product security aspects.
The FAST v1 scheme requires the same level of security vulnerability
analysis and testing as Common Criteria EAL4 + AVA_VAN.5 certification.
Target of Evaluation (TOE) consists of the security IC, the operating system(such as Java Card OS), and the mobile FeliCa applications (such aspayment and transit applications) including relevant crypto libraries for
AES and TDES/DES.
The main purpose of the TOE is to be the Secure Element for the NFCenabled devices. The FAST v1 scheme aims to give a high assurance ofsecurity level (i.e., AVA_VAN.5), in a timely manner, to the service providers
who deploy mobile FeliCa products for their payment and/or transitservices.

FeliCa Networks

Copyright FeliCa Networks, Inc.

1

Intent
The intent of the scheme is to provide sufficient assurance for the certifiedproducts to protect the assets against potential threats.
As an alternative to Common Criteria certification at EAL4 + AVA_VAN.5,
this scheme streamlines the process by focusing on specific threats thatmobile FeliCa products are exposed to, in the context of a standard design
view and, therefore, a largely similar high-level overview.
To maintain a consistent and state-of-the-art level of assurance, while
reducing the time and cost of certification management, a lightweightcertification process is defined.
In this certification process, an accredited certifying lab shall assess theevaluation results, and shall then determine whether the products provide
sufficient assurance to be certified under this scheme.

FeliCa Networks

Copyright FeliCa Networks, Inc.

2

FAST v1 scope and process
Certification scope
Secure Element

FeliCa Applet

Evaluate under FAST

FeliCa CryptoLib

Evaluate under FASTJava Card OS

Evaluate under CC or EMVCo Platform evaluation

Security IC

Evaluate under CC or EMVCo IC evaluation

Composite certification process(FeliCa Applet

FeliCa CryptoLib

FeliCa CryptoLib

Java Card OS

Java Card OS

Java Card OS

Security IC

Security IC

Security IC

Security IC

CC or EMVCo

CC or EMVCo“FAST”“FAST”

FeliCa Networksl

Copyright FeliCa Networks, Inc.

3

Roles and responsibilities
Role

Responsibility

Scheme ownerOverseew[Certificate

Certifying Lab["]"CJ
Evaluation
resultTest plans" Reports]

Evaluating Lab"[-+FeliCa Networks

Source code
SamplesDeveloperl

Manage FAST v1 scheme
Accredit evaluating lab and certifying lab
Publish certified products
Approve test plan
Approve evaluation report
Issue certificate
Evaluate FeliCa Applet / FeliCa CryptoLib
Submit test plan to certifying lab
Submit evaluation report to certifying lab
Develop FeliCa Applet / FeliCa CryptoLib
Submit samples, source code and therequired developer documents

Copyright FeliCa Networks, Inc.

4

Requirements (non-exhaustive list)
All requirements for evaluation and certification are defined in
the scheme document “FeliCa Approval for Security and Trustscheme” provided by FeliCa Networks.
Key evaluation aspects:

Design and source code review■ Penetration test against high attack potential (AVA_VAN.5)■ Site security (EMVCo site audit or the site certification under CCscheme can be reused)■ AES and TDES/DES crypto protocol■

Certification validity

3 years■ Validity can be extended by 1.5 years through renewal process■FeliCa Networks

Copyright FeliCa Networks, Inc.

5