To find out more about some of GlobalPlatform’s most recent initiatives, such as its work to standardize the secure element, trusted execution environment and mobile messaging – please read our made simple guides.
The Organization: |
| Q. | What is GlobalPlatform? |
| A. |
GlobalPlatform is a cross industry, non-profit association which identifies, develops and publishes specifications that promote the secure and interoperable deployment and management of multiple applications on secure chip technology. Its proven technical specifications, which focus on the secure element (SE), trusted execution environment (TEE) and system messaging, provide the tools that are regarded as the international industry standard for building a trusted end-to-end solution which serves multiple actors and supports several business models.
GlobalPlatform's objective is to create a standardized infrastructure that accelerates the deployment of secure applications and their associated assets, such as data and cryptographic keys, while protecting them from physical or software attacks. It achieves this by publishing and advancing specifications which address the secure element, trusted execution environment and mobile messaging.
|
| Q. | When was GlobalPlatform created? |
| A. |
GlobalPlatform was launched in October 1999, and the first 'all-member' meeting was held in November 1999.
|
| Q. | What does GlobalPlatform do? |
| A. |
GlobalPlatform creates a standardized infrastructure that accelerates the deployment of secure applications and their associated assets, such as data and cryptographic keys, while protecting them from physical or software attacks. It achieves this by publishing and advancing specifications which address:
- SE. GlobalPlatform's advanced and stable Card Specification v2.2 supports the implementation and management of tamper-resistant chips - such as smart cards and SEs. This supports the deployment of contactless NFC enabled services to mobile devices, identity (ID) documents and advanced services onto smart cards, for example payments, transit or loyalty.
- TEE. GlobalPlatform's work to standardize the TEE - a secure area that resides in the main processor of a connected device which ensures that sensitive data is stored, processed and protected in a trusted environment - supports the needs of smart device stakeholders, such as smartphone and tablet application developers and device manufacturers. The advancement of this technology is crucial for mobile wallets, NFC payment implementations, premium content protection and bring your own device (BYOD) initiatives.
- Messaging. GlobalPlatform clarifies how market participants from the finance, mobile NFC, government and transit sectors can connect their backend systems to the SE, TEE and any other actor within a secure application's ecosystem. This is achieved by defining 'who' is responsible for 'what' and agreeing the 'language' (messages) that will be used. GlobalPlatform Mobile Messaging can be used over-the-air via a mobile network as well as over-the-internet using the cloud environment. This supports trusted service managers (TSMs), as well as the issuance and personalization of secure chip and TEE technology.
As the final piece of the jigsaw puzzle, GlobalPlatform is soon to release end-to-end frameworks that will bring the whole solution together in a format that will address the specific technical requirements of different market sectors.
|
| Q. | What are GlobalPlatform's objectives? |
| A. |
GlobalPlatform works across industries to identify, develop and publish specifications which facilitate the secure and interoperable deployment and management of multiple embedded applications on secure chip technology. GlobalPlatform Specifications enable trusted end-to-end solutions which serve multiple actors and support several business models.
In order to achieve this, GlobalPlatform abides by the following guiding principles:
Specifications:
- To maintain the stability of specifications, changing them to meet market needs, rather than for technical elegance.
- To preserve backwards compatibility when updating technical specifications.
- To support a security architecture with a range of options to meet different market needs.
- To remain form factor independent and allow implementation on a wide range of devices.
- To develop and maintain compliance tools and a compliance program, allowing the industry to validate product adherence to the organizations specifications.
Education:
- To develop materials that educate markets on how GlobalPlatform Specifications can support the mobile NFC, payments, government & ID and transit sectors.
- To host technical training workshops and coordinate business seminars that ensure accessibility and understanding of GlobalPlatform's offering.
Communication:
- To deliver an external communications program that reinforces the interoperability and benefits of the GlobalPlatform Specifications, in order to educate stakeholders and drive adoption of the technology.
Membership:
- To engage members within the Advisory Council, task force initiatives and technical committees and to seek their active participation within the development of marketing and technical documents and GlobalPlatform's external communications program.
|
| Q. | How widely used is GlobalPlatform technology? |
| A. |
As GlobalPlatform provides royalty-free industry specifications, it is hard to track exact usage figures.
Research conducted by Eurosmart confirmed that 2013 shipments of microcontroller smart secure devices (secure chips) exceeded 7.1 billion units, of which 2.9 billion units deployed were based on the GlobalPlatform Card Specification.
|
| Q. | Does GlobalPlatform hold any educational workshops or training on its specifications? |
| A. |
Yes. GlobalPlatform hosts both business and technical seminars and training events worldwide. They are often delivered in conjunction with major industry conferences and events taking place throughout the year. Training on GlobalPlatform Specifications can also take place at a customer location so as to cater to the unique training needs of that organization. For more information about GlobalPlatform Training Programs, please visit the training section of the public website. |
| Q. | Who is on the GlobalPlatform Board of Directors? |
| A. |
The Board consists of 11 Directors from organizations that have joined as Full Members. These positions are elected by the voting members of the organization and are held for two years.
At the discretion of GlobalPlatform's Board of Directors, Strategic Directors may be appointed to steer the organization in a specific market or technical direction. This allows the Board to fully utilize the strengths and skills of member organizations when additional advice or expertise is required regarding a particular strategic issue.
The Board sets the strategic vision and oversees the management of GlobalPlatform including setting organizational priorities and determining the allocation of the organization's resources, including the budget. The Board has final approval of all changes to the specifications.
|
| Q. | What is the role of Kevin Gillick as Executive Director? |
| A. |
Kevin Gillick is Executive Director of GlobalPlatform. Within this role he is responsible for driving awareness and accelerating adoption of GlobalPlatform Specifications across global markets. Kevin Gillick coordinates and manages the organization's strategic planning and oversees all marketing and business development initiatives within key vertical market sectors. He works closely with GlobalPlatform's Technical Director, all three of the organization's technical committees - Card, Device and Systems - and GlobalPlatform Task Forces. Kevin Gillick is directly responsible to the Board of Directors and GlobalPlatform membership. |
| Q. | What is the role of Gil Bernabeu as Technical Director? |
| A. |
Gil Bernabeu is the Technical Director of GlobalPlatform. His main role within GlobalPlatform is to drive forward the development of GlobalPlatform Specifications and related technical initiatives. Gil Bernabeu also acts as the central liaison point, coordinating the efforts of GlobalPlatform's three technical committees - Card, Device and Systems - GlobalPlatform's Task Forces and liaison activities with other closely aligned technical industry associations. He ensures that all elements of GlobalPlatform's technology is interoperable and offers backwards compatibility with previous releases. |
| Q. | How often does GlobalPlatform meet? |
| A. |
The frequency of meetings (face-to-face and/or conference call) vary by committee and task force.
ALL MEMBER MEETINGS - GlobalPlatform hosts 'all-member' meetings that occur twice per year and are open to all membership categories. These meetings are further supported by all-member webinars which aim to update members unable to attend the scheduled gathering.
TECHNICAL COMMITTEE MEETINGS - Full and Participating Members have membership status allowing them to directly participate in committees that develop and review work proposals to evolve the specifications. These committees will meet at least four times each year and may also have several conference calls throughout the year to advance the work as determined and prioritized by the members.
TASK FORCE MEETINGS and ADVISORY COUNCIL – All members are entitled to participate in task force activity and the Advisory Council. General Advisory Council meetings are held at least twice each year. In addition, Regional Advisory Council meetings are held throughout the year, scheduled on an ad-hoc basis by the Executive and/or Technical Director, and are often aligned with their attendance at key industry event gatherings. Task force meetings generally take place (face-to-face) at least twice annually, supported by several conference calls throughout the year as determined by the task force chair and membership.
BOARD OF DIRECTORS - The Board of Directors meets three times each year with one of those gatherings focused exclusively on strategic planning.
|
| Q. | Are there any similar organizations in place? |
| A. |
There are a number of organizations focused on various aspects of the near field communication (NFC), eID, epayments and transit ecosystems involving the secure delivery and use of applications onto platform products. GlobalPlatform, however, is the only organization focused on establishing standards for managing those applications on secure chip technology and ensuring their interoperability across the entire infrastructure for both single and multi-application schemes. GlobalPlatform's members achieve this by creating specifications that are timely, relevant and supportive of market convergence and innovative new cross-sector partnerships.
|
The GlobalPlatform Committees: |
| Q. | What are the GlobalPlatform committees? |
| A. |
There is an Advisory Council, three technical working committees and five task forces within GlobalPlatform.
The Advisory Council is a forum where the member representatives of GlobalPlatform are able to discuss the following with the Board of Directors: technical developments, planned enhancements to the specifications, marketing initiatives, educational programs, compliance, industry partnership collaboration, membership development, any new activities and other issues or topics that are deemed to be appropriate for the forum to discuss. The Advisory Council meetings are led by the Executive Director and will typically occur twice each year.
GlobalPlatform currently supports five member-driven task forces: the Government Task Force, Mobile Task Force, Internet-Of-Things Task Force, Premium Content Task Force and Japan Task Force.
Task forces are responsible for establishing the business requirements for their respective sectors, then providing those business requirements to the appropriate technical committee for further development. View GlobalPlatform’s roadmap for 2013 for further details on current work priorities.
|
| Q. | Do the committees follow a process when developing and releasing specifications? |
| A. |
Yes. GlobalPlatform has rules that govern the Document Development Process; from initial business requirement gathering and scope validation, to specification development and finally specification approval. The process covers details such as specification management, document identification and document version management. There is also a defined process to assist in conflict resolution and to ensure that a stated majority have agreed to the nature, scope and direction the specifications are taking within a given committee. |
| Q. | What are the main steps in this process? |
| A. |
GlobalPlatform follows a documented process that guides the workflow of the technical committees from the time documents have passed committee review, through to all-member review and finally a public review. When the documents are fully vetted through this process, the Board of Directors makes a final determination on the release of the document and if, given the nature of the document, it will be made available to the general public for free, the general public for a fee, or only to the members as a benefit of membership .
The Card, Device and Systems Committees define functional and technical requirements for the development and evolution of open interoperable technical specifications. As appropriate, they will also develop the relevant compliance framework for released specifications. All three groups formulate strategic business models and define guidelines for multiple industry implementation and deployment.
|
Membership: |
| Q. | Who are the members of GlobalPlatform and how do interested parties join? |
| A. |
To understand the benefits of becoming a GlobalPlatform member and the caliber of organizations that participate and drive the association forward, visit our membership pages. |
| Q. | What is the cost of GlobalPlatform Membership? |
| A. |
Annual dues, which cover the cost of meetings and seminars, administration and publications, vary according to an organization's desired level of access and participation within GlobalPlatform. The annual fees are as follows:
Full Members: US $30,000
Participating Members: US $24,000
Observer Members: US $12,000
Public Entity Members: US $6,000
Consultant Members: US $1,500.
GlobalPlatform's fiscal year begins on 1 October and ends on 30 September. Membership fees for incoming members are prorated to the number of months of the fiscal year remaining at the time of joining. Joining on any day within a given month requires fees to be paid for that entire month. |
Global Platform Implementation: |
| Q. | Which industries have adopted GlobalPlatform technology? |
| A. |
GlobalPlatform Specification and best practice guidelines have been implemented globally across finance, mobile near field communication (NFC), government, healthcare, retail and transit sectors. As these markets converge to deliver innovative cross-sector secure chip services, GlobalPlatform’s proven and stable specifications offer an attractive framework that promotes market interoperability and long-term scalability.
The specifications have been widely endorsed by GlobalPlatform’s association partners.
Read GlobalPlatform’s industry interviews with Nice contactless project Cityzi to find out more about the role of the GlobalPlatform Specifications. |
| Q. | Does GlobalPlatform have any association with other specifications bodies? |
| A. |
GlobalPlatform works with relevant partners to ensure its work is not completed in isolation. GlobalPlatform connects with a range of industry associations, including:
- Technology liaisons with the NFC Forum, SD Association and Trusted Computing Group.
- Mobile engagement with the European Technology Standards Institute and GSMA.
- Government / ID partnerships with the European Committee for Standardization (CEN) and the International Organization of Standardization (ISO).
- Payments relationships with EMVCo and the European Payments Council.
View all of GlobalPlatform’s industry relationships.
|
| Q. | Where geographically is GlobalPlatform technology implemented? |
| A. |
GlobalPlatform technology is currently deployed in Europe, North and South America, Africa, the Middle East and Asia Pacific. |
The Technology: |
| Q. | What are GlobalPlatform Specifications? |
| A. |
GlobalPlatform offers an interoperable, flexible and future-proof technology foundation for secure chip programs. Solutions based on GlobalPlatform Specifications can be sourced competitively from multiple suppliers, ensuring that providers are not locked into single source commercial relationships. GlobalPlatform compliant cards, devices and systems are interoperable, regardless of technology vendor and the flexibility of the technical infrastructure ensures that it can respond to requirements that are unforeseen at the time of initial deployment. This gives issuers the reassurance that the infrastructure they have chosen will be able to adapt and grow as business conditions change - essentially 'future-proofing' the time and money invested in the development of the program.
- Card Specifications relate to the deployment and management of multiple embedded applications on secure chip technology. The specification is supported by market configurations that explain how to implement the specification for that specific community, for example: ID and government, mobile NFC and financial.
- Device Specifications relate to the deployment and management of multiple embedded applications on secure chip devices. Most recently, GlobalPlatform has been implementing specifications on how applications are secured in a trusted execution environment (TEE).
- System Specifications relate to the back-end systems which facilitate the deployment and management of multiple embedded applications on secure chip technology. Within the NFC landscape, as one such example, this includes defining the ‘messages’ that can be exchanged between all actors in an NFC deployment in an interoperable, secure and reliable web services format.
|
| Q. | Who owns and controls the GlobalPlatform Specifications? |
| A. |
The GlobalPlatform Specifications are owned, managed, developed and maintained by GlobalPlatform. The future direction of the technology is defined by the membership and GlobalPlatform's independent and member elected Board of Directors. |
| Q. | Are there any conditions in using GlobalPlatform Specifications? |
| A. |
No. There are no restrictions in implementing and using any of the GlobalPlatform Specifications. There is a possibility, however, that some elements of the material available for download from the specification pages on the GlobalPlatform website may be subject to third party Intellectual Property Rights (IPR). Some, but not all, of which are identified here .
|
| Q. | Are there any fees for obtaining GlobalPlatform Specifications or independently developing products / solutions that abide by the specifications? |
| A. |
There is no licensing fee to implement and use any of the GlobalPlatform Specifications. Other suppliers to the industry, however, may have license fees associated with their particular technology. Adopters of technology are advised to research where licensing and / or royalty requirements exist from parties outside of GlobalPlatform. Visit our IP Disclaimers page for further details and to download GlobalPlatform's comprehensive Intellectual Property Rights (IPR) Policy .
Although the specifications are freely available, market configurations and test suites that are based on the specifications may or may not be. Typically market configurations and test suites are made available to members for free, as a benefit of membership. Non-members may be charged a nominal fee for market configurations and test suites. Non-members who wish to purchase these documents are encouraged to visit the store on the public website.
|
| Q. | What are the benefits of GlobalPlatform Specifications over other alternatives? |
| A. |
GlobalPlatform technology is open, scalable and offers well defined standards of interoperability at the platform, smart device and system level interfaces. As a consequence, deployments utilizing GlobalPlatform technology allow implementers / adopters to protect their investment in infrastructure and expand business interests by adding / altering applications over time.
Please refer to our made simple guides for documents highlighting the benefits of specific GlobalPlatform Specifications and work priorities.
|
| Q. | How difficult is GlobalPlatform to implement? |
| A. |
As GlobalPlatform has become a de-facto standard, and is implemented across many different markets worldwide, it offers a ready to use and qualified solution, with products based on the specifications available from the vendor community and consultants who are able to assist with implementation and deployment.
For further information, please see GlobalPlatform’s annual training calendar and an up-to-date list of qualified products .
|
| Q. | Are GlobalPlatform Specifications customizable? |
| A. |
Yes. GlobalPlatform defines specifications for the technology without inhibiting customization within the framework. GlobalPlatform Specifications define many options for implementers / adopters to choose from, allowing a wide range of business models, and supporting a large variety of security as well as technical requirements. |
| Q. | My program is very simple with only one application - how would GlobalPlatform benefit me? |
| A. |
An issuer of a single embedded application on secure chip technology can also benefit from the adoption of GlobalPlatform. For example, being GlobalPlatform compliant permits the issuer to multi-source vendors for the same application code. Also leveraging the back-office utilization of standardized issuance and personalization systems (e.g. scripts for personalization) allows the issuer to multi-source production (e.g. the flexibility to move production from one bureau operation to another) without additional costs. It also provides the issuer with a future-proof infrastructure that can be migrated to other (either mono or multi-application) infrastructures. |
| Q. |
What technology works with GlobalPlatform Specifications? |
| A. |
A GlobalPlatform compliant smart device can work with any (GlobalPlatform compliant or non-GlobalPlatform) secure platform as long as both comply with the application specific interface specifications. Similarly, a GlobalPlatform compliant application or device management system can work with any secure platform.
|
| Q. | Will I require any specific technology to implement the GlobalPlatform Card Specification? |
| A. |
GlobalPlatform's Card Specification can be implemented on any environment that allows dynamic memory management. The standardized application management command and the security scheme are independent of a run time environment. This is why a product vendor can easily support standard commands and the security scheme in the environment of their choice.
Currently the GlobalPlatform Card Specification supports API's for developing applications on Java Card and Multos.
|
| Q. | Can I use GlobalPlatform Specifications with my own proprietary card? |
| A. |
Yes. GlobalPlatform technology provides an open standard, in order to protect your investment, and smoothly migrates to multiple applications, multiple platforms and multiple services. You can decide to deploy GlobalPlatform technology for acceptance devices or for systems with your current proprietary platform. Also, see response to the above question. |
| Q. | What is the difference between a specification and a configuration? |
| A. |
GlobalPlatform Specifications offer an interoperable, flexible and future-proof technology foundation for secure chip programs. As an addition to this, GlobalPlatform produces configurations which outline how a specification can be implemented to meet the needs of different vertical markets. The configurations detail the behavior of each and every actor that might wish to implement a particular specification, how they should be represented and offer a summary of their roles and responsibilities in a variety of business models. |
| Q. | What are the current priorities for the GlobalPlatform Committees? |
| A. |
The outcome of GlobalPlatform's current work is centered on:
- Supporting the needs of the mobile services community as more secure applications are delivered via mobile devices. This includes work to standardize the SE and TEE , as well as to define the messaging used between the back-office systems of different mobile services stakeholders.
- Engaging with governments globally to deploy services in a government-to-citizen and government-to-employee environment.
- Securing the bring your own device (BYOD) initiative by using TEEs and SEs to deploy enterprise or government solutions in a standardized secure end-to-end infrastructure.
- Enhance GlobalPlatform Card Specifications to support privacy as required by markets and mandated by various countries.
- Support and drive the future integration of secure chip technology with the internet protocol (IP) landscape. GlobalPlatform's internet-of-things standardization activity aims to support more security and privacy when connecting a device within the cloud and machine-to-machine (M2M) domains, for example.
- Addressing the requirements of premium content providers to protect their services on smart connected devices such as smartphones and tablets. Content management and protection on devices is a key driver for TEE adoption.
To view further details of each committee’s 2013 work program, visit their individual webpages.
|
| Q. | How can I test compliance to GlobalPlatform technology? |
| A. |
GlobalPlatform manages, maintains and evolves a compliance program for secure chips and devices to confirm that products meet the functional requirements outlined in GlobalPlatform market specific configurations and will perform as intended once live in the marketplace. In addition to establishing market stability and confidence, the program ensures long-term application interoperability and scalability.
Working with a number of test tool developers and advanced testing providers, GlobalPlatform created and launched the GlobalPlatform Compliance Program. The program incorporates accredited laboratories, certified test tools and qualified products. The market has embraced the framework – many products have been qualified – and it has been recognized by the certification body EMVCo, the EMV® standards body collectively owned by American Express, JCB, MasterCard, UnionPay and Visa. In 2012 it formally announced the program as an integral part of the mobile payment certification process.
At present that are two elements to GlobalPlatform’s program:
- Testing the compliance of a secure chip to the functional requirements outlined in GlobalPlatform’s market configurations for UICC or financial products. This program continues to grow and will see smart micro SD cards and embedded SEs added in the coming year.
- Testing the compliance of a trusted execution environment (TEE) to the requirements of the GlobalPlatform TEE Specifications. To respond to market needs, the compliance program was driven to market less than 12 months after the specifications were finalized.
GlobalPlatform is committed to the continued evolution of this work and regularly communicates the latest advancements.
|
| Q. | What is the latest GlobalPlatform initiative for security certification? |
| A. |
GlobalPlatform provides vital contributions to this landscape by establishing best practices that other industry bodies value and reference in their individual certification schemes.
In December 2012 GlobalPlatform updated its Composition Model, which streamlines security evaluation of NFC contactless mobile applications to shorten product time to market and lower the cost of the certification process. The model, which was first released in 2011, essentially achieves this by recommending how certificates can be re-used for chips and SE platforms that have previously been certified.
More recently, GlobalPlatform’s Security Working Group within GlobalPlatform’s Device Committee has developed a TEE Protection Profile. The document explains how GlobalPlatform’s TEE Internal API Specification should be implemented to ensure it aligns with Common Criteria security requirements. This addresses threats, security objectives, assumptions as well as security functional and assurance requirements.
|
| Q. | What are GlobalPlatform’s priorities with regard to Privacy? |
| A. |
GlobalPlatform is currently working to define and clarify the existing terminology used by the industry in relation to privacy: removing all ambiguity.
Once defined, the terms / properties can become genuinely meaningful to developers and, as a next step, GlobalPlatform can determine how to implement each property within GlobalPlatform Specifications for platform products and backend systems. GlobalPlatform will therefore deliver specifications that, when implemented, will result in privacy-enhanced technology deployments.
To learn more, read our Privacy Framework made simple guide.
|
