iOS 14 Apple Pay: going the distance with Ultra Wide Band Touchless and QR

It’s that time of year again to look into the WWDC crystal ball and see what changes might be in store for iOS 14 Apple Pay. 2019 was an exciting year with the important Core NFC Read-Write additions for ISO 7816, ISO 15693, FeliCa, and MIFARE tags. Since then we’ve seen iOS apps add support for contactless passports, drivers licenses, retail and manufacturer vicinity NFC tags, transit ticketing, badging, and more. Some expectations ended up on the cutting room floor. The NFC tag Apple Pay feature that Jennifer Bailey showed back in May 2019 has yet to appear. Apple Pay Ventra and Octopus transit services slated for 2019 and iOS 13 failed to launch, as of this writing, still delayed.

Predicting anything in 2020 is risky business because of the COVID-19 crisis. iPhone 12 might be delayed, iOS 14 might be delayed, features brought forward, pushed back…all plans are up in the air, even WWDC. Some developments are clear, but timing is opaque. What follows is based on: (1) NTT Docomo announcement of Ultra Wideband (UWB) ‘Touchless’ Mobile FeliCa additions and JR East developing UWB Touchless transit gates, (2) CarKey and the Car Connectivity Consortium Digital Key 3.0 spec and (3) Mac 9to5 reports of AliPay coming to iOS 14 Apple Pay.

Going the distance
The NFC standard has been around a long time, long before smartphones, conceived when everything was built around close proximity read write physical IC cards. The standards have served us very well. So why are NTT Docomo and Sony (Mobile FeliCa) and NXP (MIFARE) adding Ultra Wide Band + Bluetooth into the mix?

Ultra Wide Band + Bluetooth delivers Touchless: a hands free keep smartphone in pocket experience for unlocking a car door, walking through a transit gate or paying for takeout while sitting in the drive thru. It’s the same combo that powers Apple AirTags. UWB Touchless delivers distance with accuracy doing away with “you’re holding it wrong” close proximity hit areas necessary when using NFC. With Touchless your iPhone is essentially a big AirTag to the reader,

For Apple Pay Wallet cards it means hands free Express Card door access, Suica Express transit gate access and payments that ‘just work’ by walking up to a scan area or car. As Junya Suzuki pointed out recently, UWB Touchless is passive compared to the active NFC ‘touch to the reader’ gesture and will live on smartphones, not on plastic cards. Those will remain limited to NFC which does not require a battery.

Secure Element evolution and digital key sharing
The addition of UWB Touchless however means that the secure element, where transaction keys are kept and applets perform their magic, has to change. Up until now the secure element worked hand in glove with the NFC controller to make sure communications between the reader are secure and encrypted. For this reason embedded secure elements (eSE) usually reside on the NFC controller chip.

Apple chose to put a Global Platform certified Apple Pay eSE in their own A/S series chips. The arrangement gives Apple more control and flexibility, such as the ability to update secure element applets and implement features like global NFC. The addition of UWB Touchless in FeliCa and MIFARE means both smartphone and readers need new hardware and software. Apple already has UWB in the U1 chip on iPhone 11. Mobile FeliCa software support could be coming with the next generation ‘Super Suica’ release in the spring of 2021 that requires updated FeliCa.

Recent screen images of a CarKey card in Wallet…with Express Mode can we call it Suicar?

The arrival of UWB Touchless signals another change in the Secure Element as shown in middle CarKey screen image: digital key sharing via the cloud where the master key on the smartphone devices ‘blesses’ and revokes shared keys. Mobile FeliCa Digital key sharing with FeliCa cards and devices was demonstrated at the Docomo Open House in January, also outlined in the Car Connectivity Consortium (CCR) Digital Key White Paper. An interesting aspect of the CCR Digital Key architecture is the platform neutrality, any Secure Element provider (FeliCa, MIFARE, etc.) can plug into it. Calypso could join the party but I don’t see EMV moving to add UWB Touchless because it requires a battery. EMV will probably stick with battery free NFC and plastic cards.

Diagram from Car Connectivity Consortium (CCR) Digital Key White Paper

The QR Code Equation
There is another possible eSE change for Apple Pay. A few weeks ago a reader asked for some thoughts regarding the AliPay on iOS 14 Apple Pay rumor with a link to some screen/mockup images on the LIHKG site. Before getting to that it’s helpful to review some key Apple Pay Wallet features for payment cards: (1) Direct Face/Touch ID authentication and payment at the reader, (2) Device contained transactions without a network connection, (3) Ability to set a main card for Apple Pay use.

The images suggest a possible scenario implementing AliPay in iOS 14 Apple Pay:

  • AliPay has a PassKit API method to add a ‘QR Card’ to Wallet.
  • Wallet QR Card set as the main card is directly activated with a button double-click for Face/Touch ID authentication and dynamic QR Code payment generation in Apple Pay.
  • Direct static QR Code reads activate AliPay Apple Pay payment.

If Apple is adding AliPay to the ranks of top tier Wallet payment cards, they have to provide a way in. The new “PKSecureElementPass” PassKit framework addition in iOS 13.4 could be just that. Instead of PassKit NFC Certificates, the additions suggest a Secure Element Pass/certificate. Secure Element Certificates instead of NFC Certificates. The burning question here is does AliPay have a Secure Element Java Card applet performing transactions with keys and without a network connection? If so we have QR Wallet payment cards. Direct Apple Pay Wallet QR integration would open up things for 3rd party (non bank) payment players. QR integration might also help Apple skirt NFC monopoly allegations that got Apple Pay in trouble the Swiss government.

Dual Mode and flexible front ends
The addition of QR and UWB with NFC for payments opens up a long term possibility suggested by Toyota Wallet. The current app lets the user attach a QR code app payment method and/or a NFC Wallet payment method to an account. It’s intriguing but clunky. Wallet QR Payment support would allow Toyota Wallet to move the entire payment front end to Wallet and let the user choose to add one or both.

It’s the latter that interests me most. Instead of having separate NFC and QR payment cards from the same issuer for the same account, I’d much rather have one adaptive Wallet card that smartly uses the appropriate protocol, QR, NFC, UWB for the payment at hand. Capable, flexible, smart. This is what digital wallets should do, things that plastic can never achieve. Let’s hope Apple Pay Wallet makes it there someday.

Advertisements

Special Mobile Suica Maintenance Notice

JR East issued a Mobile Suica system maintenance notice, the downtime will run longer than usual: all services will be offline from midnight to 6:30 am March 21 JST. This includes Apple Pay Suica recharge so be sure to recharge before then, or use cash recharge at the nearest convenience store.

The special maintenance is related to the recent Shinkansen eTicket service launch and preparation for an updated Eki-net App that will eventually support it.

JR East Shinkansen eTicket Service Launch

Today, March 14, marks the end of Mobile Suica Shinkansen ticketing in Suica App and the start of a new open IC transit card eTicket Shinkansen service. It doesn’t have name. It’s just one of many ticket options available in the good old JR East ‘Eki-net’ (Station-net) online ticket reservation service, well known and not loved by many. A Japanese friend said it best, “You would think that a top tier Japanese company like JR East with many smart employees would create something better than Eki-net or pay somebody to do so.”

The problem is not that Eki-net doesn’t work. It works, but throwing everything new (IC transit card eTickets) and old (email tickets and paper tickets) in same Eki-net shoebox is a cluttered unwieldy package, a confusing and messy UI not nearly as convenient as JR East wants us to believe. Instead of a sleek new Shinkansen eTicket service, we get the same stodgy paper ticket service with a new hard to find eTicket option.

JR East would have been better off making a clean break by rebranding the new eTickets as a completely different service with a new spiffy name and separate multi-lingual app, just like JR Central’s SmartEX with the addition of new eTicket options over time. The less is more SmartEX approach focuses exclusively on Shinkansen eTickets and eliminates local line travel options because those are covered by Suica/ICOCA/Toica, etc. Eki-net on the other hand makes a big deal of ‘big trip’ options covering everything from Shinkansen and regular express trains to tour packages and car rentals.

The Eki-net approach does have one advantage over the 2-tier JR Central/JR West SmartEX (free membership with small discounts) and EX-Press Reserve (annual membership fee/special IC card/bigger discounts): Eki-net is ‘flat’ with free membership, offering the same discounts to all members in one service. Shinkansen eTickets are only available at launch from the online Eki-net site. I recommend the more streamlined smartphone online browser version. JR East has announced an updated Eki-net App for App Store/Google Play with eTicket support that should be coming March 21 (now postponed to an unknown future date). The new eTicket service is also available to JR West e5489 ticket reservation service members as JR West shares Hokuriku Shinkansen operations with JR East.

The end of Mobile Suica eTickets in Suica App means a mandatory app update that strips out the retired service. Users must update to the new 2.6 version by March 18. After this date older Suica App versions stop working. The migration from the old Mobile Suica Shinkansen eTicket service has good and bad points:

Good Points
JR East Shinkansen eTickets are compatible with all major transit IC cards. This finally opens JR East operated Shinkansen lines to plastic and mobile transit cards, the old system was limited to Mobile Suica. An interesting new twist is that up to 6 transit IC cards can be attached to one account for family or group travel.

Bad Points
The migration from the Mobile Suica Shinkansen/Suica App system means no more Suica App/Apple Pay in-app purchases, you must register an Eki-Net account, yes another JR East service, and a credit card. The current Eki-net system is designed around the account registered credit card for paper ticket pickup at station kiosks using the card PIN code, this effectively eliminates Apple Pay/Google Pay as an in-app purchase choice. Last but not least the new Shinkansen eTicket service is Japanese language only.

New IC/QR gates at JR Takanawa Gateway Station opening March 14

Shinkansen eTickets are only the first step in a long term migration away from mag strip paper tickets. Mag strip ticket gates are more expensive than transit gates with NFC or QR readers with higher maintenance costs, there is also the increasing cost of recycling the special mag strip paper.

Paper tickets for all transit will remain a cash purchase at station kiosks, as they must, these will be QR codes instead of mag strip. The tricky parts are: 1) how much ticketing can be ported over to the transit IC card side 2) what local transit fare tiers apply to QR. Since Shinkansen eTickets are simply one time purchase options attached to a transit IC card number in the cloud, theoretically any purchased option can be attached to a transit IC card number. Local transit has fare tier for cash tickets and a less expensive one for transit IC cards.

I see local transit cash fare tiers staying in place for station kiosk purchased QR paper tickets, but I don’t see smartphone app QR Codes for one time local transit. The cheaper fare tier incentive for reusable transit IC cards will likely remain in place. This leaves smartphone app QR Codes for express trains, limited use tourist/season/campaign passes and group travel.

Mag strip tickets have served us very well for the past 30 years. The final migration to Mobile/NFC/QR will be interesting but I’ll miss those marvelously mechanical ticket gates from Omron.

Mobile PASMO Q&A

What is Mobile PASMO?
Mobile PASMO is an app service, identical to Mobile Suica, for Android v6 Osaifu Keitai devices or later. Users can recharge a virtual PASMO card on the device with a registered credit card, purchase or renew commute plans, view use history, restore the PASMO card from the cloud in case of a lost device, PASMO bus transit users can also earn ‘Bus Toku’ points. Mobile PASMO launched March 18. Details are listed on the Mobile PASMO site (Japanese only).

Is it compatible with Google Pay? (Updated)
Not at this time. Users need to be careful: active Google Pay can block Mobile PASMO transactions. Bank cards are limited to Mobile PASMO app registered credit cards: American Express, JCB, Mastercard, Visa. Credit card registration is processed by PASMO and seems to be the weakest part of the system where users are experiencing the most trouble (the rest of the system appears to be licensed Mobile Suica IT assets). Only Japanese issue cards are accepted.

Is the Mobile PASMO app multi-lingual? (Updated)
Everything is Japanese language only. Android users can download the Mobile PASMO app on Google Play.

Can I use Mobile Suica and Mobile PASMO on the same device? (Updated)
Only 6 recent Osaifu Keitai Type 1 devices support multiple transit card installs. On older Type 2 devices you can only install one and have to choose. As FeliCa Dude explains in his excellent Reddit post, “Mobile PASMO: the “me-too” that’s all about them, and not you” the Mobile FeliCa Android stack on older FeliCa chip devices isn’t like Apple Pay and does not support multiple transit cards or the ability to select one for Express Transit. Type 1 devices updated to Osaifu Ketai 8.2.1 can set one (and only one) ‘main card’ for Express Transit use, with Mobile Suica and Mobile PASMO on the same device. Here is a full device list of Type 1 (Mobile Suica and Mobile PASMO), Type 2 (Mobile Suica or Mobile PASMO), Type 3 (Mobile Suica).

I have a Mobile PASMO capable Type 2 device, which mobile transit service should I use?
It all comes down to commuter pass use, if you live in the Suica/PASMO region and use a JR East line on any part of your commute, Mobile Suica gives you the most options. If you do not use a JR East line as part of your commute, Mobile PASMO is the natural choice.

Will Mobile PASMO be coming to Apple Pay? (Updated)
iOS 13.4 has some indications that Mobile PASMO might be coming at some point. Mobile PASMO uses licensed Mobile Suica assets and technology, the backend is very similar with a different operator. Apple Pay Wallet does have the ability to host multiple transit cards and select one for Express Transit. In theory a user could have a Suica and a PASMO together in Wallet. We’ll have to wait and see if the PASMO group has enough cloud resources to plug into Apple Pay/Google Pay and how willing they are to deal with non-JP issue credit cards.

Isn’t next generation ‘2 cards in 1’ Suica supposed to fix this? (Updated)
Mobile PASMO throws cold water on the one big happy mobile transit family concept of next generation Suica: sharing resources instead of “me too” fiefdoms. Even if the new card architecture fixes all the current shortcomings, which it is supposed to do, nothing can fix the selfish mindset of transit companies who refuse to cooperate. As FeliCa Dude points out, Mobile PASMO is a boondoggle, the result of JR East and PASMO Association failing to cooperate and mutually host commute plans. I suspect that auto-charge transit company premium branded credit cards are getting in the way. Japanese transit companies need to put aside old grudges and cooperate intelligently to get all transit players on mobile as fast as possible. Everybody loses out if they do not.

UPDATE: Japanese programmers digging into Mobile PASMO details find that PASMO licensed Mobile Suica IT assets for Mobile PASMO service. This makes a lot of sense and is an encouraging sign that Mobile Suica cloud resources can be licensed to host other transit IC cards for mobile (ICOCA, TOICA, manaca, etc.).

UPDATE 2: Junya Suzuki posted an article with more Mobile PASMO system details. One leading company in the PASMO Association (Tobu, Keio or Odakyu) licensed Mobile Suica assets and technology from JR East. Cut and paste IT. As said above, this is encouraging because other transit companies (JR West, JR Central et al) can license Mobile Suica assets and park it on whatever cloud service they want: AWS, Azure, NTT Data and so on. Mobile plumbing for connecting Apple Pay and Google Pay is already in place.

Mandatory Suica App update on March 14

As predicted, a new version of Suica App is coming in tandem with the new JR East Shinkansen eTicket service launch on March 14. Suica App users must update to v2.6 by March 18, after that date older versions can no longer login to Mobile Suica.

A new Eki-net app that supports the new eTicket service should be coming at the same time. The old Suica App Shinkansen eTicket service ends March 13.