Payment providers, issuers, and digital identity teams can now deliver new Trusted Applications securely to iOS apps already installed on their users’ devices. Licel has extended the Licel vTEE with secure over-the-air (OTA) delivery of Trusted Applications on iOS, enabling sensitive payment, identity, and cryptographic functions to be deployed and updated on the provider’s own schedule, without updating the host app. The capability was tested by Applus+ Laboratories as part of the evaluation that led to the Licel vTEE’s renewed EMVCo SBMP TEE approval on iOS.
Each delivery combines three security mechanisms. Trusted Applications travel to the device over a mutually authenticated, encrypted channel based on GlobalPlatform’s SCP11a secure channel protocol. Only packages authorized by the app vendor can be installed, so providers keep full control over what runs inside their app. Once delivered, each Trusted Application runs in isolation inside the Licel vTEE, embedded in the DexProtector-protected host app and anchored in the device’s hardware-backed keystore.
The model will be familiar to payments and telecoms teams. Over-the-air provisioning of applets to SIM cards and secure elements under GlobalPlatform specifications has been standard practice for years. Licel brings that established approach to mobile apps, giving issuers and wallet providers a provisioning process they already know and trust.
Trusted Applications can be developed and tested with JCardSim, Licel’s open-source Java Card simulator. Develop with JCardSim. Deploy over the air. Run securely with the Licel vTEE.
The iOS evaluation renews the Licel vTEE’s approval under EMVCo’s SBMP TEE category, giving it current approval on both Android and iOS for the third consecutive year. Licel evaluates the vTEE twice a year, once for each platform, so its approval remains current as both operating systems evolve.
“This evaluation included secure over-the-air delivery of a Trusted Application into the Licel vTEE on iOS, a capability with clear relevance for mobile payment and identity services,” says Jose Ruiz, Cybersecurity BU Director of Applus+ Laboratories. “It’s the latest in a consistent record of evaluations we’ve carried out for the Licel vTEE across both major platforms.”
“Payment and identity services keep evolving long after an app is released, and the security around them needs to evolve too,” says Mikhail Dudarev, co-founder and CTO at Licel. “Secure over-the-air delivery means our clients can deploy new Trusted Applications to the apps their users already have, using a provisioning model the payments and telecoms industry has relied on for years. Next, we’ll be introducing Trusted Applications designed for specific use cases and sectors, so providers can add sensitive capabilities when their services need them.”
Secure over-the-air delivery of Trusted Applications is available now to Licel vTEE customers on both Android and iOS.
Licel is exhibiting at the PCI SSC Europe Community Meeting in Edinburgh from 20-22 October. Visitors can chat with the Licel team about Trusted Applications for their own payment and identity services. Find them at booth 29.
