GlobalPlatform Industry Interview | UL
GlobalPlatform spoke with Maarten Bron, Director
Innovations at UL. Maarten provided an introduction to the company and his role,
highlighted the current challenges facing the secure chip industry and discussed UL’s
engagement with GlobalPlatform.
What is your role within UL and what are your company's
objectives for the forthcoming twelve months relating to secure chip
UL is a global safety standards company – many of us may recognize the
UL safety marks on mobile phones, solar panels, car batteries, life vests,
or one of the other 20,000 types of products that UL certifies. Besides
testing and certifying real-world products, UL recently extended the scope
of its public safety mission into digital and virtual environments as
well. The UL Transaction Security unit (UL TS) is where all of these
activities are concentrated. Secure chip technology is instrumental to
digital world safety, which is why UL TS joined the GlobalPlatform ranks
as a Full Member. UL TS was formed by combining operations and expertise
of Collis in the Netherlands, RFI Global in the UK, and Witham
Laboratories in Australia.
Developments in the digital world can occur at an extremely high pace.
Some hypes become change drivers, others don’t. Real world
industries usually evolve at a much slower rate. Secure chip technology is
the gateway between both worlds. Future-proofing your technology is
therefore key. Of course for us as a knowledge company, future-proofing
our service and product offering is of equal importance. As Director
Innovations I try to fuel this process by ascertaining what is driving
change and demand in our markets and how our customers today can benefit
from this. I also determine how UL TS can best influence changes in our
markets. This is because we have a unique, independent view of the
industry that is vertically integrated across all stakeholders, but also
horizontally diversified across different markets. Sometimes what the
industry needs is not what the market wants. Industry forums such as
GlobalPlatform are a concrete way for us to provide feedback to the
Testing of secure chip technology, also GlobalPlatform technology, is
something we have been doing for quite a while and are committed to doing
in the future as well. For us, the coming 12 months will bring expansion
of geographical footprint as well as expansion of service portfolio. The
test and certification activities in our lab often mark the end of an
intense R&D process that our clients go through. To this point, much
of the work UL is doing takes places in the moment prior to testing and
certification: empowering clients with our knowledge and tools, for
instance by allowing developers to work faster, or to make product
designers aware of the hoops that their product has to jump through with
What challenges do you currently recognize in the global chip
marketplace and how is your organization working to overcome them?
At UL there are different ways in which we look at the global chip
marketplace. Firstly, there is the demand-side of the market, containing
large scale initiatives such as an EMV liability shift, public transport
implementation or biometric passport projects. Elaborate undertakings,
where secure chip technology is applied ‘in the society’ on a
large scale. I’d say this is a typical characteristic for secure
chip implementations as there’s no economics - in terms of costs as
well as acceptance – in proprietary solutions. This also means that there
needs to be clear demand drivers. Of course regulatory mandates make our
industry flourish - I haven’t seen technology-push work out yet. The
challenge on the demand side of the global chip marketplace is not
technology as such, but the way it is implemented. A nice example, is for
instance, the ‘Deployment Models’ of GlobalPlatform
technologies. We actively engage with our clients to determine what is fit
for purpose and fit for use.
Then there is the supply-side of the market. This is where UL has
traditionally been very strong with lab-centric activities related to
secure chips as well as the devices this technology is embedded in. Here
you sometimes see the difference in pace that I was referring to earlier.
Let’s take GlobalPlatform as an example. On paper, GlobalPlatform
technology evolves very fast, taking market requirements of payments,
identification, government and health industries into consideration. This
creates demand, but also market entry barriers because it is not always
clear what the baseline is. Or: how much better the next baseline will be.
Or: which other components are to be included in the next baseline. Our
clients sometimes feel like early-adopters because of this, and act
accordingly. Our training and education programs help here to take away
‘fear of cold water’.
Also on the supply-side of the market we see that vertical integration also applies to
security and Secure Elements. Security is no longer a feature, but a managed service.
This allows suppliers to engage with their customer’s customers. I cannot disclose the
details, but we will see a lot of movement there in the coming 12 months.
Which GlobalPlatform initiatives are your company most
actively engaged in at the present and why?
On a high level, UL sees GlobalPlatform as an organization with three
main lines of business: Specifications, Compliance and Education. To start
with compliance, UL is a qualified GlobalPlatform lab providing services
to GlobalPlatform technology suppliers. Besides these laboratory services,
UL is also a provider of GlobalPlatform qualified testing tools. Because
of our tools and services, we actively contribute to adoption and
deployment of GlobalPlatform technology world-wide! To the point of
education, GlobalPlatform is running a training curriculum about its
standards and technology. GlobalPlatform has certified one of our experts,
Mr. Xiaodong Guo, to be a qualified trainer under this program. We are
quite pleased with this, because delivering training is, for us, a way of
experiencing first-hand how the industry perceives or implements certain
technologies. As a third, there are the specification and standardization
activities of GlobalPlatform. UL positions itself in these activities as
an ‘active follower’ of most activities in the Card, Systems
and Device committees. UL is not a provider of core GlobalPlatform
technology, but rather a catalyst under its adoption in the industry. To
support our certification activities, testing tool development and
training activities UL needs to remain up to date with all developments.
I personally follow the work of the Mobile Task Force (MTF) with great
interest because of the synergies it creates between the Card, Device and
Systems Committees. Many other attempts at standardizing technology related
to mobile payments, ticketing or transactions in general have proven
challenging because of a limited scope. As I mentioned, combining card,
device and system expertise provides sufficient coverage of the mobile
ecosystem to actually make an impact.
Why do you believe industry compliance programs are
important for the management of applications in the secure chip landscape?
At UL we have seen and participated in many different compliance
programs over the past decades. Depending on whom you ask, answers may
differ as to the importance of compliance programs. Some may point out the
risks associated to non-compliance as opposed to benefits of being
compliant. Licensors want to safeguard brand experience, licensees want
brand exposure and end-consumers usually aren’t bothered too much.
In my view, the GlobalPlatform compliance program is very well balanced
between available specs, laboratories, tools, self-test options etc. So-
called plug-fests further ensure the readiness of test tooling and
compatibility with real products. UL is ready to support
GlobalPlatform’s future TSM compliance program activities.
Especially in the NFC ecosystem, compliance and interoperability of
business architecture will prove equally important as interoperability and
compliance on technical infrastructure level. Expanding the scope of a
compliance program to include business aspects is however not always
possible nor desired. For one, there will always be a line between
cooperative space and competitive space between stakeholders. Compliance
is a good way to safeguard the boarders of the cooperative domain.
Secondly, the industry may lose its freedom to innovate. GlobalPlatform
will need to continue to liaise with other industry organization to make
sure we don’t over-engineer or duplicate efforts. The composite
certification model is a good example of constructive industry