FeliCa Approval for Security and Trust (FAST) v2
Overview

FeliCa Networks

Copyright FeliCa Networks, Inc.

Introduction
The security certification scheme called “FeliCa Approval for Security andTrust (FAST)” has been set up to enable the evaluation and certification ofthe mobile FeliCa product security aspects.
The FAST v2 scheme is driven by the independent certification body andthe certificate is issued as ISO/IEC 15408 (Common Criteria) certificate.
The TOE are FeliCa Card product that consists of the security IC and FeliCaOS, and Mobile FeliCa product that consists of the Security IC, theoperating system (such as Java Card OS), and the mobile FeliCa application(such as payment and transit applications) including relevant crypto
libraries for AES and TDES/DES.
The FAST v2 scheme aims to give a high assurance of security level (i.e.,
AVA_VAN.5), in a timely manner, to the service providers who deploy
FeliCa products for their payment and/or transit services.

FeliCa Networks

Copyright FeliCa Networks, Inc.

1

Intent
The intent of the scheme is to provide sufficient assurance for the certified
products to protect the assets against potential threats.
This scheme streamlines the process by focusing on specific threats thatFeliCa products are exposed to.
To maintain a consistent and state-of-the-art level of assurance, while
reducing the time and cost of certification management, a streamlined
certification process is defined.
In this certification process, an ISO/IEC 17065 accredited certification bodyshall assess the evaluation results, and shall then determine whether theproducts provide sufficient assurance to be certified under this scheme.

FeliCa Networks

Copyright FeliCa Networks, Inc.

2FAST v2 roles and responsibilitiesRole

Responsibility

Scheme owner( Accreditation IH-Certification Body'"[[Certificate]

Test plans
ETRl"[ Accreditation IEvaluation Body
HST, Source code((Application)
Samples, etc. )Form-+FeliCa Networks

Developer

Scheme review
Accredit a certification body
Operate certification process
Accept application form
Approve test plan
Approve evaluation report (ETR)
Issue certificate and publishment
Evaluate FeliCa Applet / FeliCa CryptoLib
Submit test plan to certifying lab
Submit ETR to certifying lab
Develop FeliCa Card, FeliCa Applet, or FeliCa CL
Submit ST, samples, source code and the required
developer documents

Copyright FeliCa Networks, Inc.

4

FAST v2 scope and process (FeliCa card)
Certification scope'I

Smart Card... Evaluate under FAST

FeliCa OS-Security IC

....

...

-j

Evaluate under FAST or CC or EMVCo IC evaluation~Composite certification process

Product certification process

Security IC

Security IC

FeliCa OSandSecurity IC

CC or EMVCo“FAST”“FAST”

Java Card OS

FeliCa Networks

Copyright FeliCa Networks, Inc.

4

FAST v2 scope and process (Mobile FeliCa)
Certification scope
Secure Element

FeliCa AppletEvaluate under FAST

FeliCa CryptoLib

Evaluate under FASTJava Card OS

Evaluate under CC or EMVCo Platform evaluation

Security IC

Evaluate under CC or EMVCo IC evaluation

Composite certification process(FeliCa Applet

FeliCa CryptoLib

FeliCa CryptoLib

Java Card OS

Java Card OS

Java Card OS

Security IC

Security IC

Security IC

Security IC

CC or EMVCo

CC or EMVCo“FAST”“FAST”

FeliCa Networksl

Copyright FeliCa Networks, Inc.

5

Requirements (non-exhaustive list)
All requirements for evaluation and certification are defined inthe scheme document “FeliCa Approval for Security and Trustscheme v2.0” provided by the certification body.
Key evaluation aspects:

TOEs are evaluated according to ISO/IEC 15408 (CC) and ISO/IEC
18045 (CEM)■ Penetration test against high attack potential (AVA_VAN.5)■ Site security (EMVCo site audit or the site certification under CC
scheme can be reused)■ AES and TDES/DES crypto protocol■Certification validity

5 years■ Validity can be extended by 5 years through renewal process■FeliCa Networks

Copyright FeliCa Networks, Inc.

6