OSPT Alliance Debuts With Open Security Standard to Foster Next-Generation Transit Fare Collection

Forming Ecosystem to Support Secure, Interoperable and Flexible Solutions for Smart Cards, NFC Devices and Transit Infrastructure

CARTES & IDENTIFICATION 2010, PARIS, France, December 7, 2010 — Founded by four leading technology companies, the Open Standard for Public Transport (OSPT) Alliance made its debut today and introduced an open security standard to foster the next generation of more secure, cost-effective, scalable and extensible transit fare collection systems. Now open to new members, the alliance will work to establish an ecosystem of transit operators, technology suppliers, consultants and integrators, government agencies, and mobile ecosystem product and service providers, as well as other industry associations, to develop new, interoperable transit fare collection solutions based on open-standard security both for current and future fare collection systems.

The Alliance also announced today that Beijing-based Watchdata Technologies Ltd., a developer of data security and smart card technology, and the Open Ticketing Institute of the Netherlands have joined the original four founding members - Giesecke & Devrient GmbH (G&D), Infineon Technologies AG, INSIDE Secure S.A. and Oberthur Technologies S.A.— and will participate in the alliance's activities and ecosystem.

Additionally, OSPT announced it is in contact with Calypso Networks Association (CNA) in order to create a common working group.

The OSPT Alliance ecosystem will be a key component for advancing the open security standard for transit fare collection, known as Cipurse^™. The ecosystem will offer transit operators the opportunity to choose from among a number of vendors, consultants and integrators to help them deploy or upgrade to a more secure and cost-effective transit fare collection system. Likewise, it will provide mobile device manufacturers with next-generation open standard solutions. Government agencies that need to evaluate bids for new or upgraded transit payment systems will have access to a much broader array of solution vendors and partners delivering a wider range of innovative, flexible and secure transit fare collection solutions. The OSPT Alliance ecosystem will benefit transit system consultants and integrators by bringing together a greater assortment of vendors offering more product choices and richer capabilities than available with proprietary systems. For mobile device manufacturers, the open security standard will be the next 'must-have' checklist item they include in all next-generation NFC implementations.

"We are always keeping abreast of the latest security standards for our fare collection system, and have adopted open standards for all of our transit applications, including the Contactless e-Purse Application 2009. Now, we are looking to future-proof our fare collection infrastructure by ensuring it is interoperable with NFC mobile devices as they start to be deployed commercially," said Silvester Prakasam, director of the fare system at Land Transport Authority (LTA) in Singapore. "Cipurse is an important step towards establishing standardized, secure and interoperable fare collection for all public transport schemes, and we plan to adopt it for future releases of CEPAS."

The OSPT Alliance currently is developing the initial version of the open security standard, as well as documentation and reference implementations, which will enable technology suppliers to develop and deliver innovative, more secure and interoperable transit fare collection solutions for cards, stickers, fobs, mobile phones and other consumer devices, as well as infrastructure components. Unlike systems based on proprietary technologies that limit choices, are potentially less secure and cost more to acquire, deploy and maintain, products that conform to this standard will include the most advanced security technologies, help ensure compatibility with legacy systems, and be available in a variety of form factors.

"For a system integrator, the OSPT Alliance holds the promise of providing greater product choices with richer capabilities than is currently available with proprietary systems," said Pradip Mistry, vice president, engineering, Cubic Transportation Systems, Inc. "This will enable us to recommend and design solutions that generate higher customer satisfaction. Interoperability with NFC devices is a critical element for transit fare collection systems because it means simpler development with faster time to deployment, and the flexibility to adapt to any payment scheme or application. We are thrilled that the OSPT Alliance is offering an open standard security solution."

An Open Security Standard

The Cipurse open security standard promises to bring higher performance and advanced system security for public transport applications, as well as increase the availability of multiple sources for chip products. Through independent testing, the open standard will also provide optimized interoperability to enable simple and fast integration into public transport schemes.

This open security standard defines an authentication scheme, a secure messaging protocol, four minimum mandatory file types and a minimum mandatory command set to access these file types. It also specifies encryption keys and access conditions. Its advanced security mechanisms include a unique cryptographic protocol that encourages fast and efficient implementation with robust, inherent protection against differential power analysis (DPA) and differential fault analysis (DFA) without requiring dedicated hardware measures, eliminating the need for a massive overhead of software and hardware countermeasures against these attacks. This unique advantage makes it possible to cost-efficiently guard against counterfeiting, cloning, eavesdropping, man-in-the-middle attacks and other security risks that threaten the integrity of transit fare collection systems.

To enable such security capabilities, the standard builds upon existing, proven, open standards—the ISO 7816 smart card standard, as well as the 128-bit advanced encryption standard (AES-128) and the ISO/IEC 14443-4 protocol layer—to provide a platform for securing both new and legacy transit fare collection applications, and has the potential to be used within existing application frameworks around the world. At the same time, because it is an open standard, it promotes vendor neutrality, cross-vendor system interoperability, lower technology adoption risks, higher quality and improved market responsiveness, all of which result in lower operating costs and greater flexibility for transport system operators.

The open security standard is designed to address the need by local and regional transit authorities for future-proof fare collection systems with more advanced security than currently in use. These systems will be capable of enabling the public to use a single payment device—from simple, standalone tickets to multi-application cards, microSD cards and NFC mobile phones—seamlessly across several modes of transport in different locations, even across different regions and systems.

About the OSPT Alliance

The OSPT Alliance is an international association chartered to define a new open standard for secure transit fare collection solutions. It provides industry education, creates workgroup opportunities and catalyzes the development and adoption of innovative fare collection technologies, applications and services. Founded by leading technology companies Giesecke & Devrient, Infineon Technologies, INSIDE Secure and Oberthur Technologies, OSPT Alliance membership is open to transit operators, solution vendors, government agencies and other stakeholders in the transit ecosystem. For additional information, please visit ww.osptalliance.org.

OSPT Alliance

Patrick Corman
Corman Communications, LLC
+1-650-326-9648
patrick@cormancom.com

OSPT Alliance Member Quotes

"INSIDE Contactless is committed to implementing the open security standard across our product lines," said Remy de Tonnac, CEO for INSIDE Contactless. "The OSPT Alliance will create the foundation for the emerging ecosystem of transport industry stakeholders, and INSIDE looks forward to participating with this group in advancing the standard."

"The OSPT Alliance and the creation of the Cipurse standard mark a milestone in the evolution of modern transit fare collection systems," said Dr. Helmut Gassel, president of the chip card & security division at Infineon Technologies. "Infineon is proud of the work it has accomplished towards the advancement of this standard, and looks forward to working with other alliance members to create new and innovative solutions for the industry."

"G&D is happy to be a founding member of the OSPT Alliance, and is committed to playing a key role in the development of the open security standard and supporting it with its application security expertise," said Willem Bulthuis, CTO and group vice president of Giesecke & Devrient. "By facilitating enhanced security and interoperability at lower cost through an open standard, we believe the alliance is taking an important step toward achieving the goals of creating more convenient transit systems for customers and greater revenue opportunities for transit operators."