Activating New Mobile Services
and Business Models
with smartSD Memory cards
White Paper | November 2014 - enhanced from September 2013www.sdcard.org | ©2014 SD Association. All rights reserved

Table of Contents
Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3
Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Introducing the smart microSD memory card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
Security Certifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
smartSD issuance and acquisition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Host implementation and integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
Roles of smartSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
The smartSD ecosystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Mobilization of services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Go to market . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12

SD Association
2400 Camino Ramon, Suite 375
San Ramon, CA 94583 USA
Telephone: +1 (925) 275-6615,
Fax: +1 (925) 886-4870
E-mail: help@sdcard.org

Evolution of services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Benefits Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
For the service providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
For the card issuers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
For end users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
smartSD Business Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
HCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Payment card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Transit pass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Dematerialized Loyalty card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Express check out for Retailers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Parking meter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Ticketing / VIP event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Machine to machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Hotel room card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Campus card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Government / Secure communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
TSM operator & MNO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Handset bundle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Self-service kiosks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Secure services for multimedia in consumer devices . . . . . . . . . . . . . . . . . . . . . .19
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20

Activating New Mobile Services and Business models with smartSD Memory Cards

2

www.sdcard.org | ©2014 SD Association. All rights reserved

1Definitions
App An application running on the mobile
handsetOTA Over the Air
PPSE Proximity Payment System Environment
defined by EMVco that specifies thedefault payment card.

Applet A Java Card application running on the NFC
SE; also called a cardlet
APDU Command for Java Card applet(Application Protocol Data Unit)

PVR Personal Video Recorder.
SDA SD Association manages standard related
to SD, miniSD and microSD memory cards

ASSD Advance Security SD is SDA transport
protocol for APDUSE Secure Element chip that provides asecure run time environment approvedfor banking Applet

BOM Bill of Material, i.e. cost of the finished good
Dematerialized Many virtual cards sharing the samecard physical microSD memory card

A tamper resistant component used toprovide the security, confidentiality, andmultiple application environments
required to support various businessmodels.

EMVCo Standard body that defined the Contactless
Mobile Payment, Application Activation
User Interface
FIPS Federal Information Processing standard
that defines security certification profile

SIM The Subscriber Identification Module used
to authenticate a subscriber on the mobile
network

HCE Host Card Emulation. A function for NFC
device to route Applet calls/commands toa mobile App

smartSD smartSD is the general term defined by
SDA for memory card that embeds a SE

microSD a memory card format defined by the SD
Association

SWP Single Wire Protocol that allows interfacingwith NFC front end as defined by ETSI SCP(TS102 613)

MNO Mobile Network Operator
NFC Near Field Communication, a contactlesscommunication, as defined by ISO18092
standard 18092

TAM Total Available Market
TSM The Trusted Service Manager provides asecure gateway to remotely administrate
the NFC SE

Contactless Self-contained microSD card with SE andsmart microSD contactless interface. The contactlessinterface (i.e. NFC card emulation) is notdefined by SDA

UICC Universal Integrated Circuit Card contains
the SIM applets and can store otherpersonal data.

Activating New Mobile Services and Business models with smartSD Memory Cards

3

www.sdcard.org | ©2014 SD Association. All rights reserved

1smartSD Memory Card Application Ecosystem

Activating New Mobile Services and Business models with smartSD Memory Cards

4

www.sdcard.org | ©2014 SD Association. All rights reserved

1Executive Summary
Smartphones are everywhere and rarely outside consumers’
reach, giving service providers unprecedented reach into theircustomers’ daily lives. Mobile phones have created a newchannel to deliver exciting new services to consumers andmobilization of services is becoming a strategic imperative tobuild and extend your brand. This white paper presents thecompelling benefits of smartSD™ memory cards as not only
the best, but also the easiest solution to enable Near Field
Communications card emulation and deploy mobile security
tokens on mobile devices.

However, smartSD memory cards are more than just anotheroption for contactless communication or smartcard andsecurity features. The removability and cross-compatibility ofsmartSD enables many business models and provides great
flexibility for providers and customers. With access to morethan 78 percent of the mobile phones in the world and themarket weight of the SD standard, smartSD gives service
providers unequal access to consumer devices.
The smartSD memory card also supports a consumer-centricbusiness model envisioned by GlobalPlatform™ that sets inmotion a virtuous ecosystem and ultimately creates value forall parties.

Using smartSD memory cards as the Secure Element formobile payment and identity enables value-added services tobe interoperable across millions of devices, thousands ofconsumer products and hundreds of global brands. New
opportunities in mobile commerce, advertising, location
based services, access control, rewards programs andtransportation emerge.

smartSD memory cards offer service providers and card
issuers a superior approach to deploy services to the total
available market using existing business processes andexisting hardware. smartSD memory cards help service
providers and card issuers reach the largest audience, retain
business independence, launch faster and with lower costs,
and differentiate their services.

At a minimum, smartSD memory cards can achieve the same
security certification as smartcards and security tokens and,
therefore, can be used to bridge existing services with various
mobile devices, including mobile phones.

The smartSD memory card also supports a consumer-centric businessmodel envisioned by GlobalPlatform that sets in motion a virtuous
ecosystem and ultimately creates value for all parties.

Activating New Mobile Services and Business models with smartSD Memory Cards

5

www.sdcard.org | ©2014 SD Association. All rights reserved

1Introducing the smart microSD memory card
A smart card secure element can be packaged into various
form factors including all SD memory card formats such as
full-sized SD and microSD memory cards of any storage
capacity or speed. The smartSD memory card comes with anembedded Secure Element (SE) that features the exact samelevel of security as other smart card form factors. smartSD isaccessible to the host appliation and through contactless(when applicable) therefore it is ideal for mobilizing both theworld of digital security and the world of contactless cards,
bringing innovative new services to mobile devices. The
smart SD card is available in two flavors: a smartSD thatfeatures Java Card technology and complies with
GlobalPlatform™ specifications and a contactless smartSD that
additionally features a contactless antenna. Fully compatible
with each other, both are compliant with legacy microSD
specifications thus maintaining portability and universal
storage capabilities.

smartSD covers business needs such as User Identification,
Remote Authentication, Non-Repudiation and Confidentiality.
It enables new business models for service providers andprotects end users.
Most importantly, smartSD provides a SE independent fromboth the OEM and MNO.
smartSD combines the advantages of memory cards withthose of security tokens while it benefits from the hostcapabilities such as display and 24/7 connection.
As such smartSD could be distributed, initialized, and prepersonalized with a service or mailed personalized to the end
user like regular banking cards. Services can also be issued in
the field, allowing end users to purchase smartSD cards andconfigure them to fit their unique needs.

Figure 1: Types of smartSD

Typical target usages are:
The smartSD card isn’t specific to a particular SE chip, Java
Card and GlobalPlatform versions: the card can be custommade to meet security requirements and certification ofparticular use cases . smartSD cards can protect all cipher,authentication and signature keys, validate PIN andbiometrics, and run cardlets of different types includingtransit, payment, ticketing, loyalty, and many more.

• Security token: The embedded SE is typically used toprotect credentials used for authentication, digital
signature, data encryption, etc.
• Secure Element: The smartSD is the secure element for thehost device NFC• NFC card emulation enabler: Contactless smartSD brings
NFC card emulation and SE to the host device independentof the host device being present or NFC capabilities missing.

Activating New Mobile Services and Business models with smartSD Memory Cards

6

www.sdcard.org | ©2014 SD Association. All rights reserved1Security Certifications
Security certifications are typical of target services and assuch are not covered by SDA. SDA also doesn’t define thecontactless interface of smartSD which is driven by NFC
standards and ISO14443.

smartSD can be configured and distributed as typical smart
card and security tokens.
The configuration of the SE can be done using standard
smart card software as PC/SC drivers are typically available
for microSD as well. Only the physical interface to the card
is different. Initialization and personalization of the SE canbe done on anything from desktop solutions using a simple
USB reader up to mass personalization solutions with
automated machines that can handle many microSD at one
time.

Security certifications are attached to the SE in a microSD
package and are therefore dependent on the security levelof the selected smartcard chips. User storage has no impact
on the certification and a certification is typically valid for
multiple storage capacities. Certification is product specificand obtaining certification is a business decision.
There are already multiple certification programs and labsthat can certify a smartSD card: Visa®, MasterCard®,
American Express®,EMVCo, FIPS 140-2 for government andenterprise applications and more. SmartSD could also be
used in transit applications when the chip features MIFARE™
or can be loaded with the adequate transit App such as
Calypso™ or Cipurse™.

Smart microSD can be distributed to the consumer indifferent ways: retail purchase, from the service provider,kiosk, received by mail, on-site issuance, bundled with thephone, etc. The secure element in the smartSD can beinitialized with a specific security configuration or be readyfor a service or personalized in the field.
smartSD is also compatible with TSMs that cancommunicate to the card through mobile apps or services.
Typically a compatible service would check in at the TSM
and look for specific job(s) to perform.

smartSD issuance and acquisition
The smartSD memory card has a similar life cycle as legacy
smartcards, SIM cards, contactless cards and other security
tokens. Despite a different physical communicationinterface, the manufacturing is very similar to the otherform factors as many components are shared, including theembedded secure chip that meets the security andfunctional requirements mandated by the different markets(e.g. banking, identity, transport).

The GlobalPlatform Consumer Centric Model will ensurethat post-issuance of cardlets would be the same as getting
a new App on a mobile phone. GlobalPlatform Consumer
centric specifications provide the security mechanisms andthe user control to ensure such a user experience can be
implemented.

The following table illustrates the similarities anddifferences for these different form factors:
SiliconOperang System

Packaging

Init and perso

conttacttl ess
contactless
smart microSD●S
Security
e curi ty ssensor
e n s ordetectors● Secure memory
management● Secure run !me smart microSD
with
SWP
w
i th S
WP
environment
e nvi ronme nt● ISO7816-3,4
ISO781
816
6-3
3,4
4
Security token
compliance● ISO 14443
compliance and ISO Contactless card
18092
SIM card with SWP
Embedded SE● Electrical
El e ctri cal
ini!aliza!onandi nii !ali
liza!
li
!on a
nd
d
personaliza!on● Physicalpersonaliza!onMobileHost Devices

Distribuon● Retail● Banks● Service
Se rvi ce provider
provi de r
● MNOs
MNOs
Os● Handset bundle● Mailing● MNO
Handset bundle

MostM
ostt microSD
mii croS
SD hosthostt
devices
Phones with SWP tomicroSDmi croSD
N/A

TSM
T
SM & ot
otherther(oponal)l
Instant gra!ﬁca!on TSM & other((op!onal)
op!onal )oror
TSM iissuance
ssu
ss
uance whenw he nTSM
PC solu!on only
applicable

N/A
Only NFC phones
from partner MNOs
Phone model speciﬁc

RemoteManagement

Service accessNA
A$er issuancethrough TSM

TSM
OTA
TSM

Figure 2: smartSD life cycle
Activating New Mobile Services and Business models with smartSD Memory Cards

7

www.sdcard.org | ©2014 SD Association. All rights reserved

1

The implementation of a smartSD App is quite simple. It
only requires standard mobile App development and takes

Host implementation and integration
smartSD defines a memory card that embeds a SE. The
typical SE features JavaCard and Global Platform andadvantage of a few APIs to exchange APDUs.

communicates with APDU.

Most smartSD and contactless smartSD will work without
an App however the value-add typically results from theinclusion of an app that takes advantage of the host/phonecapabilities.

Therefore SDA has defined a transport for APDU: ASSD is a
software protocol to send APDUs using a standard microSD
interface (no extra or dedicated pin for APDU is needed).
ASSD is available on Blackberry and the source code isavailable for Android SEEK.

The smartSD could be implemented as a security token
where it protects credentials and could be used to secure
email, messaging, digital signatures, transaction approval,
identification, VPN access and many more. In that case thesmartSD would be implemented into different apps where

Many smartSD cards typically feature the capability totransport APDU using files, which has the advantage ofworking over a standard file system and can address
devices where ASSD hasn’t been implemented. These file
I/O solutions are however proprietary and not defined by
SDA.

the card services and security features would be madeavailable to the end user.
The smartSD can be implemented for NFC card emulationuse cases. NFC card emulation covers many applications
and multiple target markets. The smartSD would typicallyrun the cardlet required for the service and take advantageof the App to provide additional value to the end user. This
could also apply to MIFARE when the smartSD SE features
such capabilities. For these implementations the mobile
and its App typically adds value on top of what acontactless card could do.

SDA has also defined a pin for Single Wire Protocol (SWP)
that is used to connect to the host NFC and provide asecure element for NFC card emulation. In some cases,
where supported by the SE and the host NFC, this SWP pin
could also be used to transport APDU.

smartSD could also perfectly combine with HCE (host cardemulation) and TEE (Trusted Execution Environment) where
it would bring the necessary certified security to reduce theoperation cost inherent to HCE while keeping all the value
propositions of HCE unchanged. The integrated SE in asmartSD card allows for a more secure HCE implementation
without a major overhaul of the existing solution.
Overall the smartSD implementation ensures that theservice provider can decide on the role of the card, the typeof user interface and the business model. Furthermore thecard provides complete independence from the phonemodel and from the mobile operator.
It also makes it very easy for today’s card issuer as smartSD
can be distributed as current cards and prepared using thesame software solutions.
Activating New Mobile Services and Business models with smartSD Memory Cards

8

www.sdcard.org | ©2014 SD Association. All rights reserved1Roles of smartSD

smartSD can be used for both contactless services and forthe security of App and services.

App and services could take advantage of smartSD security
to ensure specific business requirements such as privacy,
confidentiality, non-repudiation, user
identification/authentication, and more.

Contactless services would rely on contactless smart
microSD or on a smartSD implemented within an HCE
capable host.

For this usage the smartSD provides a known level of
security that meets business requirements and ensurestamper resistance.

Therefore smartSD could be used to mobilize existing
contactless card services and solutions and take advantageof the mobile host display and connection capabilities toenable value-add services. This would be applicable totransit, access control, ticketing, payment, loyalty, and many
more applications.

In this world, smartSD is typically used to protect cipher
keys, perform strong authentication and perform user
identification using PIN or biometrics. The card ensures thatkeys cannot be copied and that user information remains
protected.

smartSD would run the needed cardlet that would beaccessible from the contactless side and from the App thatprovides a UI and facilitates a connection to a backend.

SmartSD is typically integrated into crypto libraries such as
PKCS#11 or CSP that are used by an App for secure email,privacy and confidentiality, backend authentication,
document authenticity or approval cycles.

This would also permit the development of new innovative
services taking advantage of the contactless interface tocommunicate with a cardlet in the smartSD thatmaintains the required security to protect theend user and to enable business models while
an App provides a nice user interface.

Activating New Mobile Services and Business models with smartSD Memory Cards

9

www.sdcard.org | ©2014 SD Association. All rights reserved

1Therefore smartSD presents more benefits for stakeholders
than any other mobile security solution. And businessindependence is key for the service providers as mobile is anecessary strategic move.

The smartSD ecosystem
The smartSD enables an ecosystem that creates value for allparties. It is not like other approaches where a single party
is perceived to extract all the value at a disproportionate

This ecosystem becomes virtuous as more parties, users,
services and applications, take advantage of smartSD,
creating greater value for all.

cost to all other parties.
First, smartSD provides freedom to the end user as it isavailable to most users independently from their phonemodel or mobile operator. This means that in addition to
extra storage always valued to the end user, changing
phone and mobile network operator doesn’t come at theexpense of losing credentials and benefits of associatedservices.

GlobalPlatform Consumer Centric Model allows consumers,
rather than issuers, to control multiple services on a single
smartSD as they do with apps on a mobile phone.
Driven by the SD Association and with the support of
GlobalPlatform, the smartSD memory card ecosystem willcontinually evolve to meet new industry needs, evengaining the ability for consumers to add third-party serviceson their smartSD memory card.

It also means the service providers can address most of
their customers (including iPhone 4/5 owners through aspecific case adaptor1).

The smartSD is not a transitional technology simply waiting

smartSD can be issued by service providers or purchased
directly by consumers, as well as distributed by traditional
operator controlled smartcard channels.

for NFC handsets to become available to the masses or until
another SE takes over; rather, smartSD offers the market acompelling value for today and tomorrow.

In particular, smartSD memory cards allow service providers
to differentiate and determine a specific business modelthat does not have to involve a third party.

1 iPhone 6 TBC

Figure 3: A virtuous ecosystem
Activating New Mobile Services and Business models with smartSD Memory Cards

10

www.sdcard.org | ©2014 SD Association. All rights reserved

1

Mobilization of services
With smartphones and super phones becoming widely
available and various app stores making it very easy todownload new applications to any device, consumers now
want all services on a single device which they always carry withthem.

smartSD would typically secure the connection to the server
and provide strong identification. It can also increase thesecurity of the received tokens and associated rules. As such thesmartSD brings a known level of security into the solution andincrease the security on critical parts. As such the HCE App andclient-server relationship does not need a constant update tostay ahead of hackers. Therefore for these types of services
smartSD is ideal as it doesn’t change the value propositions ofbusiness independence and differentiation provided by HCE
while adding a smart card level of security into the solution.

Therefore mobilization of a service is not only a must havecapability but also a strategic move. It is a real opportunity tocreate new revenue streams and strengthen customer
relationships while differentiating your offering with a better
user experience and value added services. Mobilization istypically a real success when taking advantage of the display
and the connectivity of the phone. This is when the end user
value-add shines on top of what contactless card or security
tokens already provide.

The development of new features and the release of value
added apps that can reach all customers without any MNO or
handset model limitation is perhaps the biggest value ofsmartSD.

As such, mobilization should be carefully
considered and more particularly for services
that involve security such as smartcard,
contactless services and security tokens. The
choice of SE or no SE could be critical.
Some service requirements would dictate the need for a specific
type of SE. Such mobilization should be thought throughcarefully and the choice of form factor for the secure element
could be critical to keep control of the business model, easily
differentiate from competition, and facilitate go-to-market.

The smartSD is the best approach to mobilize security
services by:• Delivering the largest market reach as more than 78 percent
of mobile phones and thousands of other devices have a
microSD memory card slot

There are services using card and security tokens where thecontinuity of existing operation process is critical. In that case,smartSD is a perfect fit as it can use the same distributed
process and channels already in place. smartSD also brings thevalue of being a hardware token providing strict control on theissuing process.

• Working on most users’ current phones independent fromthe mobile subscription and operator• Offering unsurpassed portability and easy transfer by the
consumer to a device of choice• Allowing familiar issuance processes that fit contactless cardand security token operation and business processes

Other services rely on implementation in the app such as HCE.
smartSD is also very relevant for this type of implementation as
it brings increased security to reduce the financial risk andminimize operation costs. HCE services such as for payment
typically rely on transaction tokens delivered by a server. The• Providing an open choice of business models• Simplifying the launch of services, reducing time to market
and eliminating the need for third parties and for upfront
TSM deployment

Activating New Mobile Services and Business models with smartSD Memory Cards

11

www.sdcard.org | ©2014 SD Association. All rights reserved1

Go to market

Evolution of services

The smartSD memory card makes mobilization easier forservice providers/operators who focus on delivering value

App stores make it easy to inform users about updates and todeliver and install these updates. Updated apps can havepropositions.

additional features and value propositions on the smartSD
device. This makes improving the user experience anddifferentiating the service easy.

Once the type of smartSD implementation has been chosen,
launching is very easy as it fits existing business processes
and does not require any agreement with third parties.

Existing cardlets on the SE can be configured or personalizedwith a simple data connection to the mobile device (Cell, WiFi or tethered), through contactless communication, or using
onsite issuance.

Driving market adoption, however, requires understanding
what it takes for consumers to change their habits. Thismeans understanding their perceived value of the services aswell as knowing what value would inspire them to buy theservice or the smartSD memory card.

Adding new applets on the SE may require the use of a TSM.
However, most TSM vendors support smartSD with their TSM
supporting data connection. This is typically the same ascommunicating with other SEs over a data connection, butsome TSMs might be set for a specific SE and would require
an additional module to handle a second SE such as smartSD

Millions of microSD cards are sold every day and a(contactless) smartSD would be an inexpensive add-on to
the standard card consumers buy today. Demonstrating andpromoting consumer benefits is important to facilitate
adoption and potentially transfer the entire cost of the card
to the consumer. In short creating awareness at key locations
drives adoption of the service

Overall, GlobalPlatform’s consumer centric approach specifies
all the information and the processes needed to facilitatesuch updates or service evolution and work seamlessly withsmartSD.

Here are some examples of real life end-user value
proposition applicable to various markets:Type

Tag line

Implementation

Cash back

2% cash back for every purchase

Using interchange rate
Annual membership could pay for the card

Cost saving$Save - Up to 50% off

Promotion to smartSD holder for purchase at
specific target stores

VIP

VIP yourself! Skip the queue

Special line for smartSD contactless check inPack lighter

Downsize your wallet
Travel lighter

Leverage dematerialized loyalty and payment
cards and security tokens for badge and VPN

SafetyProtect your money

PIN protection and consumer control RF

Control

Get back in control of your financeTakes full advantage of mobile UI and alerts

A smartSD consumer centric approach can provide formultiple services thus making the smartSD cards an evenmore valuable investment for the end user. Also, smartSD
memory cards include all of the current benefits from being
the world’s leading memory card form factor: extra portablestorage for end-user content and data.
Activating New Mobile Services and Business models with smartSD Memory Cards

12

www.sdcard.org | ©2014 SD Association. All rights reserved1Benefits Summary
For the service providers
Largest reach:User’s current and future mobile devices,
any mobile operator and mobile plan,
phones with and without NFC

Business independence:

No dependence on any 3rd party,
including MNO’s or handset
manufacturers.

Easier launch:

Fits existing business process. No need to
involve a 3rd party.

Lower cost:

Upfront TSM integration optional. Simplify
service delivery

Differentiation:

No constraints to differentiate fromcompetition with your own user
experience, set of features and businessmodel.

For the card issuers
Service Providers:

In some cases the service provider is also the smartSD
issuer. In that approach, the smartSD could be sold as partof the service and advertised as consumer centriccompliant and thus usable and compatible with multiple
services. Such service provider contributes to theecosystem by making these cards available for otherservices and can take advantage of cards sold by otherservice providers.

Retailers:Millions of microSD are sold every day abd smartSD could
be sold in retail alongside or instead of regular SD cards.
smartSD could come with a service pre-installed to add
upfront value and the GP consumer centric model
facilitates the issuance of additional applets post-sale.

Mobile network operators: smartSD lowers the upfront cost of NFC as it could betargeted to specific users. SmartSD has a larger reach andcould assist in acquiring subscribers from competition.
TSM operators:

smartSD provides new TSM opportunities, a larger reachand business independence

Activating New Mobile Services and Business models with smartSD Memory Cards

13

www.sdcard.org | ©2014 SD Association. All rights reserved1For end users
Instant Gratification:

smartSD works with existing phones and can potentially require only a software upgrade to integratewith users existing applications, providing immediate value to the user upon purchase.

More choice:smartSD provides a choice of suppliers and more products to choose from.

Greater freedom:

smartSD provides the freedom to choose phones and mobile plans independently from services.

Extra storage:

smartSD provides the same benefits of millions of microSD sold every day for extra storage which
supports the growing need for music, photos, videos and games.

Ease of Upgrade:consumers can upgrade their phone or change their MNO without losing their existing services.

Application Control:

users can choose the applications can services they want and make changes easily.

Instant
Graficaon

Easy toupgradeGreater
FreedomMorechoiceControl Apps
and Applets

Extra storage
for PC, phones
tablets, etc.

Activating New Mobile Services and Business models with smartSD Memory Cards

14

www.sdcard.org | ©2014 SD Association. All rights reserved

1smartSD Business Cases
In some implementations non repudiation is a must-haveand proper user identification is required. Once again this
could damage the user experience if the user is asked to be
identified too often.

While the consumer could purchase a smartSD memory card
directly in any of the following scenarios, these business cases
focus on the examples where the smartSD memory card is
subsidized or provided at no-cost to the consumer. They
demonstrate how the cost of issuing the smart microSD
memory card can be recovered even when provided free tothe customer.

Ideally the connection to the backend should betransparent to the end user and if possible done atconvenient times, e.g. not at transaction time. Howevercaching information to maintain a good user experience
requires adequate security. Caching is not optimal when
the number of transactions is unpredictable such as fortransportation or fare-collection systems.

This focus does not detract from the consumer ability orinterest in buying the smartSD memory card directly to accessvalue-added services on their mobile phones. Other businesscases can include selling the smartSD to the end user
providing an immediate return on invest, but they are notconsidered in this section.

The token server is a great target for hackers and forimpersonation as tokens are personal.

HCE

Tokens are also delivered to the device and only protectedin software. This would be another target for hackers who
can get free transactions either by changing the expiration
rules (when applicable) or by using the renewal mechanism
to get more tokens.

HCE allows for software emulation of contactless JavaCard
and is typical of contactless use cases. It is unrelated tosecurity tokens for mobile application and online services. It
is also specific to JavaCard and may not apply to contactlesssolutions with proprietary features such as MIFARE andDESFire.

In both cases the App is the weakest link because it
contains the information to authenticate to the backend
and the information to access to local tokens. To stay aheadof hackers, the App must be continuously updated alongwith the server side. This represents a large cost as the App
would have to be continuously tested for all supported
phone models. Furthermore the financial risk remains
unknown because software hack could be unpredictable.
Additional software layers such as TEE might help on the
security side but could also increase the cost for a financial
risk that remains unknown as TEE does not have security
certification at the moment.

Host Card Emulation would not seem to be a target market
for smartSD but once the costs of maintaining HCE services
secure such as for contactless payment are considered,smartSD can be seen to add significant value to these
implementations.
For example there are HCE solutions that rely on client
server architecture and temporary tokens. Such solutions
are designed around temporary credentials to ensure
strong security is not required to protect them. Howeverthese architectures usually involve connecting to a server to
get the tokens. The App typically authenticates to thebackend or uses some other identification means in order
to identify the user and deliver tokens.

This is where smartSD becomes valuable for HCE:
• ensure a great user experience• provide non-repudiation and protection for identity theft• provide a hardware root of trust that could bepreconfigured for the service• be pre-personalized to ensure strong authentication to
the backend token server, for example by using PKI as
suggested by Fido.org

In some implementations protection of those credentials
could cripple the user experience. For example it won’t beconvenient for the end user to have to present his/her PIN
every time new tokens are required. It also will not be
convenient for the end user to enter their credit card
information every time new tokens are required.

Activating New Mobile Services and Business models with smartSD Memory Cards

15

www.sdcard.org | ©2014 SD Association. All rights reserved1• perform strong user identification (protection of PIN,
biometrics match on card, etc), also suggested by
Fido.org• protect the tokens from the end user

would pay for the smartSD memory card. The consumer
can easily accept a minor fee to take advantage of theconvenience and shorter wait times. A regular user would
pay for the card within the first year.

More importantly smartSD reduces the risk to a known
security level as it has already passed adequate security
certification. Therefore smartSD not only helps lower thefinancial risk but also reduces operation cost as hackers
would focus on the card rather than the App.

Transit operators could also consider the additional revenue
opportunity from advertising in the mobile App. As thesmartSD memory card is the sole SE option without
recurring fees, advertising, so revenue stream could recover
the cost of the smartSD before adding to the bottom line.
This example provides real value for local shops and transit
passengers, plus transit traffic numbers would attract
advertisers.

Using smartSD along with HCE gives the best of bothworlds: the flexibility of HCE and great integration in the OSwith all the security of a certified smartcard chip, without
the trouble of implementing a TSM for evolution of theservice or having to sign agreements with all mobile
operators and mobile phone makers.

Dematerialized Loyalty card
Dematerialized loyalty cards not only reduce clutter inusers’ wallets, they mobilize smartcard-based loyalty
services by taking advantage of mobile phone
communication channels and localization capabilities. The
first allows for a direct marketing channel that could be
used to increase sales and strengthen the brand and thesecond makes it easier to locate a nearby store. While
increased sales would recover the costs of the smartSD
memory card, targeted marketing would also affectcustomer retention.

Payment card
The main revenue from a payment card is typically derived
from serving as a deposit account. Nevertheless, there areother revenue streams that could cover the costs of issuinga smartSD memory card:• When interchange fees are applicable, the cost of asmartSD memory card with average use is easily paidback within the first year. Furthermore, interchange fees
revenue could be used to build a cash-back value
proposition to the consumer that could both drive salesof the card and absorb the entire cost.
• The revenue from a referral program with partners canalso easily pay for the card within a few transactions.
Program partner merchants would pay for customers to
be directed to their stores or services.
• A futuristic business case would capture smartSD
memory card benefits in online payment scenarios
where it could be used for card-present transactions andfor 3D Secure using http(s) as an alternative topotentially costly SMS.

For these programs the embedded SE in the smartSD
memory card could play a role to locally and securely
manage some of the rules so the consumer could redeem
benefits even when offline.

Express check out for Retailers
A basic program for a retail shop to issue smart microSD
memory cards is sustained by the use of a retailer specificmobile app to leverage shopping lists, target promotions,and reward loyalty; however, the current programs stillrequire payment from the user via credit card or cashtransaction. A richer approach would also allow shoppers to
use their phone cameras to scan the goods added to theircart (also allowing for instant promotions) to reduce
checkout time. This richer approach would deliver an
improved shopping experience for the user and require
fewer cashiers for the retailer. Plus, this experience could
also motivate shoppers to buy the smart microSD memory
card to obtain this value-added service.

Transit pass
The ease and convenience delivered by smartSD memory
cards should compel consumers to purchase the smartSD
memory cards. However, some transit services may want topromote mobile phone usage to save on kiosk costs and tokeep workforce costs low. In that case, a reloading fee

Activating New Mobile Services and Business models with smartSD Memory Cards

16

www.sdcard.org | ©2014 SD Association. All rights reserved1Parking meter

Hotel room card

Contactless communication clearly reduces costs forparking meter service and maintenance. It facilitates money
collection, reduces vandalism and dramatically lowers
maintenance costs. The mobile app opens a new world ofpremium services for users. For example, a typical premium
service uses the mobile app to secure a parking spot.
Additionally, like the transit pass business case, the parking
meter app could be used for highly targeted advertisingbased on the user’s parking spot location.

Hotels will definitively benefit from the dematerialized
loyalty card business case taking advantage of local
advertising from partnering restaurants, bars and otherlocal events. It would provide benefit to both service
providers and users.
Additionally, the smartSD memory card with NFC reduces costs
as it decreases staffing required for a good user experience atcheck-in and checkout. The user could take advantage of thehotel booking app to reserve a room and receive thecredentials to access such room directly on its smartSD. Taking
advantage of the smartSD contactless capabilities, thecustomer could go direct to his/her room while the booking
system can benefit from strong authentication.

Ticketing / VIP event
This business case is partially supported by reducing time at
event checkpoints. Contactless technology presents many
advantages over other technologies: it works even when it
is dark and does not require a lens to focus, its built-in anticloning/ anti-pass back security enables offline validation,and the use of contactless communication reduces the riskof failure as no mechanical parts are involved. Overall, thisnew method helps reduce operation costs and, moresignificantly, reduces the number of people needed at thegates to ensure a good user experience.

The value add for the consumer could justify the consumerpurchase of a smartSD memory card, yet the cost savingsand the optional revenue opportunities from referring local
partners and advertising also provides a hotel operator with
ROI on the smartSD memory card.

Campus card
The cost of a campus smartSD memory card could easily be
included in the students’ tuition fees since it supports manyuse cases such as physical access control to campus premises,
library and other campus assets, remote access to the school
network and online courses, and payment of services andfees. It could also serve as a payment card for parents
interested in managing their child’s spending, allowing themto remotely add funds when needed to provide additional
functionality over typical credit/debit card setting.

Users would also gain the option to make purchases fromwithin the mobile app. The app creates new revenue
generating premium services such as paying extra for VIP
access and paying the issuer a percentage on resold
genuine tickets.
Since the smartSD memory card typically does not presenta reason for recurring fees, a card can be issued once andused for multiple events by the consumer.

Some campus usage may generate revenue from thisprogram. For example, payment could leverage an e-purse
or pre-paid MasterCard or Visa that would generate intereston the pool of funds, which could help subsidize the cost of
the card. This might be complemented as well by customer
acquisition fees from partner banks.

Machine to machine
The smartSD memory card presents the perfectcombination to leverage mass secure storage and a secure
run time environment. One consideration for this businesscase is the communication cost savings yielded by using
the smartSD memory card to securely store data for latertransmission during lower cost, low-traffic times.

Universities can also use smartSD cards in the managementof textbooks and related class materials. The smart SD card
can securely load and store required materials for a class ina format that can be easily accessed by students on themobile phones, tablets or laptops. Rental options, where
the materials are only available during the class, are easily
added to this model.

Another consideration for the business case is in the costsavings realized on a design that could have lower BOM
costs and the option to adapt the storage capacity to need,thus optimizing inventory costs.

Activating New Mobile Services and Business models with smartSD Memory Cards

17

www.sdcard.org | ©2014 SD Association. All rights reserved

1

provider’s business model. Also, additional revenue sources
are created from managing the applet store and proposing
additional services to the consumer.

Enterprise
The smartSD memory card in the enterprise is a perfect
example of mobilization of services. The smartSD memory
card with NFC can actually address multiple use cases suchas physical access control and IT security, including secure
email on mobile devices, secure data storage and VPN
access. smartSD memory card storage can also be used toeasily move files around the enterprise in a controlledmanner. As such, in the context of mobilization of theenterprise, the smart microSD memory card with NFC has aclear business case based on cost savings. First, it does nothave recurring costs unlike many other SEs. Then, it allows
the enterprise to reduce the total cost of ownership byreducing the number of devices per employee and allowing
use of the employees’ own mobile devices. This move cuts
the cost of VPN tokens, sophisticated contactless badges,
CDs and USB memory sticks, to name a few. Finally, having
an SE entirely controlled by the enterprise adds freedom
and facilitates additional services.

When a TSM operator is an MNO, the smart microSD
memory card allows the TSM to expand NFC services
beyond its customers and to acquire subscribers from other
MNOs. Furthermore, the removable smart microSD memory
card allows TSMs to target specific users, keeping upfront
NFC promotion costs very reasonable compared to othersolutions where contactless communication is provided
whether the user needs it or uses it.

Handset bundle
The removability of the smartSD memory card is a key asset
when adapting a global device to local markets, as it
reduces costs through higher production volume. Not only
does the smart microSD memory card allow available
storage capacity to be adapted to the desired level for themarket and price point in regards to the device positioning,but it also facilitates enabling NFC where needed orrequested by mobile operators. As such, adding smart
microSD memory cards to targeted markets results inoverall cost savings and potentially larger sales revenue
through better market positioning.

Government / Secure communication
Today’s mobile devices provide the average consumer morecommunication abilities than a U.S. president could access
20 years ago. The mobile device is a must-have tool thatprovides instant access to most information, which could
be critical in certain situations. So while the potential ofmobile technology should be embraced, it should be very
secure so that sensitive information and communication
remains protected at all times. The cost of compromised
information could have immeasurable consequences. The
smart microSD memory card could be used to provide
secure voice communication, emails and remote access. It
can also secure the data on mobile devices to ensure thatsensitive information is always protected. Furthermore
smartSD meets BYOD requirements.

Self-service kiosks
At the self-service kiosk – and photo kiosks in particularsince content sizes are growing every day – there isopportunity for improvement and innovation in the way
content and payment are handled. With smartphones andother mobile devices emerging as the de-facto content
source, secure payment would significantly improve theuser experience. Today, issues being reported from thekiosks include growing concerns with respect to user
experience, including issues with Bluetooth™ pairing, cablemanagement and accessing removable media. These
problems multiply in heavy traffic zones and during peakengagement times such as the holiday season.

TSM operator & MNO
There are various business models and opportunities to beconsidered by TSM operators and MNOs. Typically, thesmart microSD memory card with NFC could be subsidized
by charging a fee for loading a new applet on the SE. Whencharging a one-time fee, a few applets could easily cover
the cost of the smart microSD memory card with NFC.
Rental fees could also be considered as an alternative, but
rental fees could have a more direct impact on the service

The smartSD memory card also offers additional upselling
opportunities with the availability of additional storage
capabilities. The removable feature offers consumers theoption to store content from other sources like a camera oranother mobile device. At the service point, the content
from these sources can also be used to generate commerce
like the printing of high-resolution pictures at a photo kiosk.

Activating New Mobile Services and Business models with smartSD Memory Cards

18

www.sdcard.org | ©2014 SD Association. All rights reserved

1

The service provider could then communicate coupons andpromotional materials based on the user activity. The
presence of an SE in the smartSD memory card helps
validate these upsell items both while dispensing andconsuming them. The idea of a two-way communication
between the SE host and the payment point expands theprospects for self-service at the kiosk. The limitations of thecurrent contactless payment tokens are overcome withsmart microSD memory cards.

Secure services for multimedia in consumer
devices
smartSD memory cards also present a convenient approachto provide secure services such as payment or user
authentication for HDTV sets, gaming consoles, ebooks andmore.
For example, a smartSD memory card could be used ingaming to buy credits or additional game tools to move
forward and faster in a game. It can also be used toauthenticate the gamer for online multi-players games or toeasily report success on social networks. Overall, thesmartSD memory card helps protect identity theft, which is
crucial for online gaming where virtual goods are traded.

Pairing of NFC and smartSD memory cards provides asecure and flexible way for transferring content andfacilitates payment at self-service kiosks. This is an
improvement on the current trend of fragmented services
available to consumers. Providing the consumer withmobility, flexibility and security, smartSD technology canhasten the adoption of the mobile device as their payment
source.

In the case of HDTV, the smartSD memory card could be
used to create a link between payment and a Digital Rights
Management feature to grant access to multimedia
content. This smart microSD memory card could be
included with the television, allowing support of DRM
systems from different content providers or with thedownload of a new DRM system. In that architecture, theDRM licensing cost is only paid when the smartSD memory
card is present, allowing for lower upfront cost on the
television for customers who are not interested in personal
video recording.

The GlobalPlatform Consumer Centric Model provides thetechnical framework to connect the token providers andthe service providers in delivering a better retail experience
for the consumers and the service providers and smartSD isperfectly adapted to take full advantage of this model.

Activating New Mobile Services and Business models with smartSD Memory Cards

19

www.sdcard.org | ©2014 SD Association. All rights reserved

1Conclusion
The smartSD memory card is the most versatile solution available today to enablesecure mobile services and to support contactless card emulation. It fits numerous
use cases and brings value to both the service provider and the consumer. smartSD
extends the universal, convenient and portable value of SD memory cards to secure
applications and contactless communication services. smartSD memory cards
present the most benefits to mobilize existing services as it fits with existing
business processes and ensures business independence. Plus, a competitive andthriving ecosystem means smartSD memory cards are available for purchase frommany SDA members.

All Copyrights and Trademarks referenced
in this document are property of theirrespective owners.

Activating New Mobile Services and Business models with smartSD Memory Cards

20

www.sdcard.org | ©2014 SD Association. All rights reserved
SD Logos are trademark licensed by SD-3C, LLC

1