Good morning everyone. Very exciting wallet session this week. And I think as we say in French, the mayes is, is taking. And I think for of us it's very interesting and challenging project. When you think about it, it's very compelling. You have all your identity credential at the tip of your finger on the mobile phone, but not just identity. You also have your strong customer authentication. And now we are talking about having new large scale pilots around payment and banking. And means that you would've all your digital valuables into your mobile phone.
And of course if you are like me, you will securely store your iPhone below the towel when you go swimming at the beach. So that's probably why we could be scary for some of us. But I think we don't have to worry that much because as the legislation puts it, the wallet is the highest level of security. So today we are going to see what it means, the highest level of security e exactly how to reach it. And we are going to the attic, the vault down, deep down in the bottom of the architecture reference framework, component diagram, what they call the wallet secure cryptographic device.
And we'll see is it possible to do this magic, to have a high level of assurance so that if I lose my iPhone or if I continue browsing on the web, then I'm still leaving a high level of security for my digital identity.
Ooh, cool. So what does say the regulation, the regulation say that the wallet should have the highest level of security and how do we measure the security? It says that it should have level of assurance high, and for that it suggests that we use temporary resistant devices like securement. And for most of the people, these are very fuzzy notions.
What does it mean the highest level of security? Exactly what do I have to do? How can I have a high level of assurance? What is the level of assurance and how can I prove it? And if I have to use securement, how do I use securement? 'cause probably this is something we don't do every day. So that will be the, the things we are going to work today in the presentation.
First, the high level of assurance, high level of assurance. In fact, it's a generic concept that is coming from the Cybersecurity Act and the Cybersecurity Act defined that when you are designing a a certification scheme, and usually it's the NA, the European National Security Information Agency Information Security Agency that is designing certification scheme, when they design a certification scheme, they will define exactly what is a level of assurance, high, substantial or basic.
And normally this should be defined in a wallet certification scheme, but today the ZA is not working on a wallet certification scheme. It doesn't have the mandate yet, it'll come. It's only worked on the EU CC common criteria scheme that has been out early this year and it's still working on the 5G and cloud security scheme. So there's no wallet scheme and there's no definition on what is level of assurance high.
One other challenge that we have to face is that even if you have a high security of assurance, you want also that the security is not affecting the convenience.
Because if you have to go through a very painful user experience to have a high security, then the wallet also will not maybe fly. And of course the last challenge is, is the reach. Because even if it's convenient and secure, but there's only a handful of funds where you can have this high level of assurance, it it'll not be useful in term of, in term of volume.
Now as I say, there's no ED certification scheme and if we look in the past, you can see that the nr, it took two, three years to have the first scheme and it's still working on a 5G and cloud security.
So it's two, it's too late to our certification scheme for the issuance of the wallet in 2026. So what is going to happen is that each of the member state will have to define and operate a wallet certification scheme that will be transitional and they will define how they certify the wallet to level high in this scheme.
But there, there will be some guidelines and if you look to annex six of the architecture reference framework, you start to have some idea of what will be the minimum requirements that the NR would put in the implementing act concerning the, the certification of the wallet. Of course it's a, it's a draft document under discussion, but I think it's probably with the basis for the implementing act, the implementing act on certification would be coming out in less than six months.
Now it's, it's planned for six months after the regulation has been finally approved.
And finally, one of the other challenges is besides the certification, you have also to manage the security, which is not enough to have highly secure WSCD, also if to manage it, who has the right control and what are the policies that you can manage, for example, the securement. And this also has to be defined and I will say these are the three main pain point that the, the member set will face in the next two years. So there's a lot of talk about choosing tam proof devices and secure element.
So I would like to just have a quick show of hand who has a secure element in his mobile phone. Yeah, that's, that's not too bad. I I would say roughly 15%, but that in fact that was a trick question because you all have a secure element in your mobile phone. That's the SIM card. So the sim card is a secure element and it holds secure securely the credential for logging to the network. Maybe what is more, what you were thinking about is not the securement general securement member, the embedded securement. So let's have another show and who has an embedded element into his mobile phone?
Yeah, I would say about 10, 10%. And, and it's probably more than that. And you don't know you have a secure embedded, secure element in the phone.
In fact, if your phone, you can pay with it with contactless or you are using ticketing, for example, for your mass transit metro with your phone. In fact, you have a securement into your mobile phone.
If we, if we look to the numbers of mobile phone issuance per year, it's about 1.1, 1.2 billion, and the secure element for mobile phone is a little more than half a billion, which mean that today half the mobile phone coming out as a secure element. And the most important use case for the, the mobile phone is the payment. And I would say if you are using the payment, you can say it's pretty much convenient and and secure. There's another secure element and probably some of you are using it, which is the, the embedded simm.
And the embedded SIMM is not for payment, it's just the replacement of the removable simm. What is happening is that the new mobile phones and, and you start even to see mobile phones without even a removable SIM slot. The new mobile phone have at an embedded secure element, which is the SIM functionality. But what is happening is that you download the profile after you purchase the phone, you can choose their subscription and you could switch subscriptions. And all this is managed by the GSMA and it's the remote subscription provisioning.
And this is very practical and it's another embedded secure that is gaining more and more volume into the smartphones. So we see that there's already a lot of securement, the number of securement is growing, some of them are sim, some of them are embedded securement, and it's not really can we have a secure end for secure the wallet. It's more how can access the secure element which are already on the phone and will come on the market.
It's, it's just a, in fact not a technological problem in itself. It's, it's more an access problem, but I think you all know the say where there is a will, there is a way. So we have to find a way to access those secure elements.
Just one slide on what is exactly a secure element. A secure element in fact is a, is a, is a, is a chip temporary resistant where you can download the code that is executed security and where you can host data, for example, the the wallet data, and this is very TAM proof and there's no way this can be accessed.
What it means, there's no way, it means that usually it's certified, there are several schemes to certify the securements. One of them, for example, for payment is a MZ code. If you look to the embedded scheme, it's a scheme operated by the GSMA, it's called ESA for E-U-I-C-C, security assurance. And some of them are certified with something which is called the common criteria, which is an ISO standard. And all these schemes, if we take common criteria, for example, there is a number, a magic number, which is called vulnerability assessment number.
And if you have a cheap common certified EAL four with number four, it means that you are resistant to attackers of high attack potential, which is what we need for, for the wallet. So I think secure elements are, are a good fit.
What's interesting also is that this is running the Java card operating system and it's a little non fact, but there's about 6 billion secure elements issued each year with the Java card operating system. So it's pretty much a mass market proven and and secure. And so that's, I would say the summary of the secure element.
And after this brief summary, let's look to what are our options, what are our options already available in the smartphone where we can use a securement and have a high level of assurance. So the first securement I mentioned was the embedded securement, the one used for payment. And generally this one is owned and purchased by the smartphone manufacturer. So the the the use case is that you want people to buy your smartphone and have the best experience and people want to pay. So you have to install a embedded securement and you can provide a contactless payment with your phone.
If we look to the, the, the wallet use case, you see that that's also interesting for all the smartphone manufacturers because most of them are already proposing digital identity wallets. They are proposing, for example, mobile driving license for some states. And we have seen this week that their pilot project and for example, Samsung has been selected as, as by the German government to have a, a pilot for the, for the wallet.
So I think it's a natural fit and and wallet manufacturer, this is something that they're probably interested in in using the embedded secure element to provide the WSCD for the wallet. Now it's good for, I would say the onset manufacturers, but what if you are a member state or what if you are a private company that would like to access the securement to host the wallet credentials and in this case it'll go down that you have to negotiate and if contextual agreement with the onset manufacturer to access the secure element, maybe some of them would be interested, maybe not.
We, we will see if I, again, I see what happened in Germany with the previous digital id, I think, and Samsung again had a, a series of a few onset that was supporting the, the German id. So this, this is much possible, but it does not always fly because if you are a member state and you're basing this on this solution, it is not very scalable because you have to go through all the onset manufacturers. And also if you look globally, you don't want a handset for Germany and a handset for France and 27 brand of handsets. You just want one handset ideally globally or eventually for Europe.
And so that does not scale. It only scaled if you are subcontracting everywhere, everything to the, the handset manufacturer that will take care of the wallet. The the second option is the embedded sim.
So it was, there's more and more embedded sim and it's available in the handset.
So why not put the WSCD inside the embedded sim. And then we have another ownership problem, which is that the embedded SIM does not, is not open and it belongs, it's purchased by the smartphone manufacturer, but it's managed by the GSMA. So the GSMA is the body that is governing the embedded UICC and that is allowing mobile network operators provided they are certified with their certification scheme to download virtual sim into the embedded sim.
What does it mean if you want to use the the embedded team as as A-W-S-C-D, it means that you would've to go through your local mobile network operators and ask them to put an app outlet, the a wallet app outlet that will perform the WSCD features into their profile. What would happen is that, for example, if I have a subscription in France for is, I dunno, orange then if I have a wallet enabled simm, they would ask the WSCD in the, in the sim and when I download my profile, I will have the app outlet, but for that I would've to have a business agreement with the mobile network operators.
And another drawback is that it's not scalable because if you have two, three mobile network operators, you will, you would've to go through all of them. It's if you want the, the full coverage. And also another drawback would be that if you change operator then you, you will have to reach your the wallet because it's in the, in the profile. Now the source was identified by the GSMA and for that they seen the value of using the embedded SIM for third party applications.
And what they did is two, three years ago they had a specification requirement specification, which is called a secured application for mobile. And this allows to share the embedded SIM without, with third parties, without any dependencies on the mobile network operators.
Last month's global platform issued the technical specification of the sum. And what it means with the sum is that you can now share the SIM cards and put for example the WSDD on a SIM card provided you have the rights to do this.
And how, how this is done is that you would need to have the a member state or EU central authority route certificate into the embedded sim into the the SAM security domain. And for that there's several way to do it is e either a voluntary basis or it could be through regulation and in fact U 5G, the, the group defining the U 5G is considering by regulation having some certification that would've this preloaded.
The two other options is the hybrid solution where you have your WSCD protected by your HSM on the cloud, but here again you, you need strong customer authentication or tapping an external device like the NFC card on the, on the device. I think I have just five seconds. I was kind of afraid I couldn't say everything. So I will go directly to the takeaway slide and some message. Okay. Secure elements are available and they can be satisfied through the highest level of assurance.
They are convenient and they're used in mass market use cases like payments and everybody enjoys this security and I hope we can use them. They're available for the digital wallet case. And as I said, it's not a matter of availability, it's a matter of access
Certification has to be a composite because there's so many component in the wallet. If you look on the phone from the operating system, the application, the securement, all of this has frequent updates, independent actors, so we need composite certification.
And finally each of the model embedded si, SI or embedded securement already have governments in place and servers that can manage security. The securement. Thank you.
Yeah,
Good luck. Thank you very much. Very much appreciated it. We have a question from the audience that I'd like to ask you. So is the GSMA working on producing a standardized interface to access and use EIM for the EODI wallets on a global way towards telcos.
Okay.
There, there's no standard defining the access to the secure element or the SIM that is available both on iOS and Android, which are the main operating system. There is one for Android, which is called Open Mobile, API. And if you have an Android phone, it's installed virtually in our mobile Android phones. And with this specification you can access the secure element. So I would say there is a specification on a P, but there's no open specification on iOS.
Thank you very much. You're
Welcome.
And another round of applause. Thank you. Bye.
