Card, mobile credential, payment and security
The most heated battle in the contactless technology market place has not been between different standards but between competing implementations within a single standard. The two unique implementations of the ISO 14443 standard, Type A and Type B, have fought for projects and profits in the worldwide contactless smart card arena. And like many struggles, sometimes the fight was fair and sometimes not so fair. But advancing technology has changed the contactless marketplace and previous adversaries are aligning to promote the ‘contactless cause.'
Over the years, a significant level of misinformation has surfaced surrounding the two types. The practical differences between Type A and Type B have been shrinking as each has progressed from infancy to relative maturity in the seven years since the ISO standard was formally established. While Type A is the clear market leader in terms of units deployed, Type B is gaining share and vendor support at an increasing rate. Most importantly, the worldwide market seems to be wading through the morass to see the benefits of contactless technology while seeing past the confusion surrounding the Type A vs. B debate.
In the following article, a number of the commonly accepted ideas about these two technologies are examined—with surprising results. Many of the public perceptions are not completely accurate, others are simply inaccurate. But before we delve into the perceptions and misperceptions, a fundamental question arises: How did an international standardization body publish a standard that competes with itself? This question leads to an investigation of the history of ISO 14443.
In 1994, the International Organization for Standards began evaluating contactless smart card technology with the purpose of developing an international standard. An Austrian company called Mikron, a leader in this emerging technology, worked alongside the ISO committee in the development of what would become the original 14443 standard. Mikron's own technology, called Mifare, was used as the basis for the standard.
In 1995, Philips purchased Mikron and the Mifare technology became the intellectual property (IP) of the Dutch electronics giant. The rollout of the Mifare technology globally was facilitated through the international reputation and reach of its new owner. Philips continued working with the ISO committees throughout the process until the publication of the ISO 14443 standard in 2001.
This process is not uncommon. International standards bodies frequently rely on the vendor community to provide expertise and modeling for technology standards. The body needs the support and expertise of the vendors to develop and test working standards. When a vendor offers its product as the basis for a standard, it commits to make the technology available to the market at a fair and equitable price and, as stated in the ISO 14443 document, "under reasonable and nondiscriminatory terms and conditions." Following this requirement, Philips's Mifare technology became available for license under these terms following the publication of the ISO 14443 standard.
Concurrently, notable limitations of the early generation of the ISO 14443 technology were coming to light. The initial implementation was a memory card, and no microprocessor card was specified. To some, the lower security and restricted capability of the memory card was seen as a hindrance to the utilization of contactless technology in certain applications.
One such application existed in Paris where transit system operator RATP was endeavoring to upgrade its aging magnetic stripe-based fare collection system. The RATP and a number other European transit operators were cooperatively investigating options to enable a fare collection card that would function beyond transit into electronic purse, identity verification, and other potential applications. They viewed the ability to isolate and protect application data from unnecessary access by other application areas as key to a successful system. They felt that a contactless microprocessor card was the right approach. The group solicited assistance from contact chip patent holder, Innovatron, in the development and specification of the program.
The transit operators and Innovatron worked with ISO to have their implementation included in the 14443 standard, much in the same way that Philips was doing with Type A. When the standard was published in 2001, both interfaces were included.
Thus, Type A and Type B began as complementary implementations of the same standard—Type A as the lower cost, memory-only implementation and Type B as the high end, higher security option. But very quickly, the lines of demarcation between the two blurred until they were virtually unrecognizable. Microprocessor and cryptographic cards were developed for the Mifare line while memory and wired logic cards were added for Type B. The two technologies no longer complemented one and other–they simply competed with each other.
Today, manufacturers create Type A chips, Type B chips, and in some cases chips that support both types. According to John Menzel, HID's Director of Product Line Management for iCLASS, "When we were developing our iClass product as an extension of our long-establish 125 kHz proximity line, we evaluated the standardized options. We found that both 14443 Types A and B as well as ISO 15693 offered strengths that could be beneficial in specific environments. We opted to include all three technologies in our iClass line."
Samsung, Infineon, and Inside Contactless all have released chips that support multiple contactless interfaces. Both Samsung and Infineon offer a chip that supports Type A, Type B, and Sony's FeliCa technology. Inside's PicoPass supports both ISO 15693 and Type B.
In the traditional ISO 14443 world, however, most chips support just one type. Mifare remains the dominant technology in the contactless marketplace in terms of volume. With more than 300 million units deployed, industry estimates suggest that it accounts for as much as 80% of the worldwide market. The remainder is shared between Type B, ISO 15693 products, and several non-standardized products including Sony's FeliCa and Cubic's GO CARD. But while the numbers are comparatively small, Type B is gaining attention, market share, and support from chip manufacturers.
So how do issuers select one from the other? Unfortunately, in too many instances decisions are made with less-than-accurate information. In reality, the two types are extremely similar in every practical area. This has led many in the industry to conclude that there is no reason to select one over the other. Groups including the US Department of Defense, Visa, and MasterCard have all publicly stated adherence to ISO 14443 but refuse to specify a type. They will use either type but require a reader infrastructure that supports both types. Still there are a number of general impressions—some based in fact others not based in fact—surrounding the technologies. In the following question and answer section, a variety of public perceptions are addressed.
The arguments for and against each type tend to fall into one of three categories: technical issues, market issues, and licensing issues.
Is one type is faster than the other?
The ISO specification, as it is currently written, allows for data transfer rates of 106 kilobits per second (kb/s). Both Type A and B products meet this maximum allowable rate and both are currently capable of supporting even higher rates. Proposals have been submitted to ISO requesting that these higher rates be incorporated into the specification for both types, enabling speeds up to 848 kb/s.
Atmel recently hosted the Work Group 8 meeting—the ISO committee responsible for contactless standards—at their Colorado office. Says David Dressen, Product Development Manager for Contactless memory products at Atmel, "the amendment to increase the allowable data transfer rates to include 212, 424, and 848 kb/s is widely accepted (among the working group members) and it should be issued late this year or early next year."
This amendment will encompass both types so neither Type A nor B has a speed advantage currently, which should be true for the foreseeable future.
At the onset of the ISO 14443 standards, few would argue that Type B had higher security than Type A. Type B was designed for a microprocessor platform and could capitalize upon the intrinsic security of the controller. But as time progressed and both types supported microprocessor and memory chips, this security issue evaporated.
The next security question then centered on the different modulation techniques employed in microprocessor-based products. Type A utilized a modulation technique that required the chip to power down during data transfer, creating a potential security weakness. But the need to power down the chip was eliminated beginning with the Mifare ProX line. "With the shift to 0.35 micron technology," says Mr. Pilozzi, "the core of the chip is continuously powered while the device is in the field removing any security weakness caused by this modulation technique."
Most seem to agree that there is little if any security differences between the types. Not a single vendor was able or willing to cite a technical element that rendered the security of either Type A or Type B functionally different from the other. Because all parties seem to agree that there are no truly significant security differences remaining between the types, the focus is turning to application security. Says Mr. Dressen, "today, if you require PKI or other advanced security applications you could buy MCUs in Type A or Type B. What you need is available in either type."
The ISO 14443 standard specifies basic communication between card and reader, anticollision procedures, and procedures for activating a specific card. As Mr. Dressen points out, "it does not define the specifics of reading, writing, and encryption. Even part four of the standard about sending blocks—well it doesn't tell you what the blocks do." Thus there are significant areas where apparent incompatibility can occur. This does not mean, however, that the cards are not compatible. Rather it is likely that the application software has minor differences.
If the chip and the reader follow the ISO standard, they will be able to communicate. But, if they don't share a common command set, they will not always understand what the other is saying.
In the past, there have been occasions when Type B offerings from different vendors were not interoperable. This was not a case of an inadequately defined standard, but rather a case of vendors not adhering to the standard. Possibly in an attempt to skirt the Innovatron-held patents on Type B, certain manufacturers created an implementation that did not fully and strictly conform to the specification. These products were almost but not fully compliant and thus not certain to be interoperable.
This could also be in due in part to the development of the Type B product. Says VC Kumar, Strategic Marketing, Wireless Commerce for Texas Instruments RFID Systems (TI-RFid), "Type B is more of an open standard so manufacturers did not have to go to the same source to get the spec. Multiple companies began making product and many had some slight differences."
It seems that this incompatibility—if it existed at all—has been largely rectified. Mr. Kumar notes that TI-RFid successfully read a variety of Type B products when testing their new reader module.
So does one type have real and distinct market advantage?
That depends on how you define market advantage. Certainly Type A/Mifare has a distinct advantage in terms of the raw number of deployed tokens and readers. This can certainly be an advantage as it can be an indicator of a product's acceptance and availability. There are numerous manufacturers building readers and devices for the Mifare technology and it has been successfully implemented across a wide range of applications, environments, and geographic areas. As with any product, a higher number of units in the field typically results in a greater interest from peripheral providers to supply supporting products and services.
On the other hand, there are more chip manufacturers supplying—or ready to supply—products meeting the Type B specification. While only Philips and Infineon have deployed Mifare products to date (Hitachi—newly renamed Renesas—has also obtained a license from Philips to manufacture Mifare), at least seven manufacturers are promoting their Type B chips today. To some observers, a larger pool of potential chip suppliers could indicate a market advantage.
In reality, the question is unanswerable. And it seems to make little difference today. Changes in the reader products have rendered the debate between Type A and B far less significant. The major players on both sides of the specification seem to agree. Suggests Philips' Joe Pilozzi, "Today, an issuer need not choose Type A or B. As Visa, MasterCard, and the US Department of Defense have done, they should simply specify fully compliant ISO 14443 readers."
By definition, a fully compliant reader must support both Type A and B. Transportation fare collection provider, Cubic, has done this for some time via their Tri-technology reader supporting their own GO CARD technology, Type A, and Type B. TI-RFID is also doing this today with their new reader module that supports Type A, Type B, ISO 15693, and 134 kHz proximity technology (as used in Speedpass). And Philips now offers a reader IC that supports both Types A and B.
Even early participants in the development of Type B are now publicly supporting ISO 14443 as a whole, rather than a specific type. Bruno Moreau, Deputy General Manager of Business Development for ASK, says "the industry is recognizing that support for both A and B is good for the business. The reader should have the ability to read both cards. For ASK we now promote both Type A and B."
We live in a world of patents, intellectual property (IP), and licensing. It is the foundation of a market-driven, entrepreneurial economy. Nearly every product we purchase has, or at one time had, some form of IP associated with it. In most cases, end users never know of royalties or licensing fees associate products or its component parts as they are paid prior to final assembly. When a customer purchases an automobile, they are purchasing thousands of component parts, many of which carry some IP and associated licensing fees. The consumer is not concerned about these component fees, but rather the final purchase price of the car.
When it comes to contactless technology, however, there is an inordinate focus on the importance of licensing fees—more so than with nearly any other finished product. As with automobiles and nearly every other product, contactless technology licensing fees are not paid by the end purchaser but by the manufacturer of the component part, in this case the chip manufacturer. Both Type A and Type B have IP and licensing fees associated with them. But far too much focus is placed on this.
With Type A, Philips owns IP related to the anticollision portion of the standard. Thus any manufacturer creating chips for Type A products must pay a licensing fee to Philips. Further, Philips owns all IP surrounding the Mifare-specific implementation of Type A. Any manufacturer creating chips for Mifare products must pay a licensing fee to Philips.
With Type B, Innovatron and the original transit organizations that funded development of the Calypso technology own IP related to the anticollision and modulation portion of the standard. Any manufacturer creating chips for Type B must pay a licensing fee to Innovatron.
There is a bit of a caveat here. A number of the manufacturers of Type B chips have not obtained this license from Innovatron. There is some debate in the industry as to the scope of the patents held and the legal requirement to pay license fees. The major manufacturer of Type B chips, STMicroelectronics, and NEC do hold a license and others report that their organizations are evaluating the issue currently.
According to Frederic Levy, head of Spirtech, an expert in the Calypso technology and representative of the Calypso Association, "When you have a patent you need to convince the manufacturers that they are using it and must pay. Today, the technology is quite new and Innovatron has not yet established this (need to pay among all manufacturers). But when you are using Type B you must use 2 or 3 of the patented elements."
In summary, there are license fees on both sides. They are extremely small—in both cases less than a couple of percentage points of the chip's final sale price. They are paid by the chip manufacturer so neither the card or token manufacturer pays a fee nor does the end purchaser. And such fees are a necessary part of nearly every product produced in our modern economy.
It seems that today there is little reason to specify one type over the other. There are very few real differences remaining that are significant enough to justify the choice. It is more likely that the final decision will be made based on pricing, availability, and the business relationship between the issuer and the product suppliers or system integrators. Mr. Kumar agrees, "the decision will likely come down to the relationship between the chip manufacturer and the decision maker."
That is a good thing for ISO 14443 and the whole of the contactless market. As the industry moves beyond the confusion and rhetoric of the past, it becomes easier for decision-makers to select contactless technology.
