Smart Cards: Java Gets Pats on Back From Card Businesses In Belgium and

Two major smart card organizations in Europe have given Sun Microsystems Inc.'s Java language a boost.

Proton World International of Belgium said it would distribute a version of its electronic purse based on the Java Card API, or application programming interface. The e-purse applet will be easily linked to other services on a smart card, such as ticketing and loyalty, Proton said.

In France, Bull Group formed a joint venture with a national research institute to develop open-standards-based microprocessor cards, with Java key among those standards.

The new venture, Trusted Logic, is to research, develop, and sell sophisticated levels of security, prove their workability in electronic banking and other fields, and perhaps profit further by licensing intellectual property.

These moves, announced last week, may say more about the smart card industry's desire for technical common denominators than about Java specifically. The Java Card specification is vying with Multos, which is associated with the Mondex smart card system, and with Microsoft Corp.'s Smart Cards for Windows. Each lays claim to being an open framework that invites innovation.

But with the Microsoft entry in the market for less than half a year, and with Multos still fending off criticism that it is more proprietary than open, Java seems to be taking advantage of its relative maturity. The language itself is about four years old and well suited to Internet transactions, including the remote loading of applets-small software applications-or other data onto smart cards.

Proton officials have long expressed support for Java, a position reinforced last year when Visa International, a Java partisan, took an equity interest in the Brussels-based smart card company.

Dominique Bolignano, chairman of Trusted Logic, said advances in theoretical technology and programming languages are accelerating just as "demand is developing significantly" for smart card systems in mobile phones, payment terminals, and elsewhere. "The catalyst for this change will be Java," he said.

The Java Card API dates to 1996. Its 2.0 version followed in October 1997, and 2.1 enhancements came out in October 1998.

Visa embraced Java for its Visa Open Platform program. Proton World-co- owned by American Express Co., Banksys of Belgium, ERG Ltd. of Australia, and Interpay of the Netherlands-bills itself as a "strategic business partner" of the Java Card Forum, which has a strong hand in setting the technical specifications. Forum members include major chip card manufacturers and International Business Machines Corp., Citibank, and National Westminster Bank of London. Natwest invented Mondex and later sold most of its shares to MasterCard International and about two dozen financial institutions around the world.

Proton, which began as part of the Banksys payment system consortium in Belgium and has more than 30 million electronic purse cards operating on its system in 15 countries, said its Java e-purse would be incorporated into the next generation of multiple-application cards.

The stored-value program will "remain at the cutting edge of smart card technology through this important new development with Sun," said Yves Moulart, Proton World's executive vice president of research and development.

Patrice Peyret, director of Sun Microsystems' consumer and embedded division in California, said Proton on the Java Card API "enriches the selection of financial services available" for Java smart cards.

"Proton World is a leader in the deployment of secure smart card technology worldwide," Mr. Peyret said. "This applet demonstrates Sun's continuing efforts to work with strategic associates to make Java Card the premier solution for multi-application smart cards."

Trusted Logic-the result of collaboration between Bull Smart Cards and Terminals and INRIA, the French National Institute for Research in Computer Science and Control-will be applying a mathematical technique, formal proof, to bolster smart cards' ability to withstand security threats.

Formal proof is a requirement of Common Criteria, a set of internationally recognized security standards on which microprocessor and data security vendors, among others, are seeking to be rated.

"With the arrival of open platforms such as Java, guaranteeing and proving security has become essential," said Christian Goire, a Bull executive, who also serves as chairman of Java Card Forum. "I am delighted with the creation of Trusted Logic, since it corresponds to the needs expressed by the forum's strategic partners in the banking and telecom sectors."

Bernard Larrouturou, chairman of INRIA, said, "Fifteen years of research will now be applied to the fast-expanding market of smart cards, a market where European manufacturers, in particular Bull, are the world leaders." He said Bull and INRIA "have made great headway in terms of research and its subsequent marketability, and, thanks to Dominique Bolignano, (this) led to the creation of a high-tech company."

David Levy, managing director of Bull Smart Cards and Terminals, said a desire to expand in the field of open systems such as Java motivated Bull's participation in Trusted Logic. The efforts with formal proof "will play an essential role in demonstrating the security of future smart card applications," he said. "Bull thus strengthens its position as No. 1 in the field of security." That claim is likely to be disputed, but it indicates that security is becoming a competitive battleground.

IBM, which does joint Java Card development with Gemplus of France, made a recent deal with Philips Semiconductors to pursue chips that can pass muster with Common Criteria or with the related ITSEC methodology- Information Technology Security Evaluation Criteria.

Mr. Peyret said "Sun is very enthusiastic about the arrival of Trusted Logic in the microprocessor card software industry. It goes to show that open systems such as Java favor new actors with new services."

He praised "Trusted Logic's key actors" for past contributions to the development of Java Card API and said "their know-how in this domain should give them an excellent start."

u

Bull Smart Cards and Terminals said it has demonstrated a system for loading value onto smart card chips via mobile telephone.

The system is based on Sun Microsystems Inc.'s Java technology and can be used in phones with two card slots conforming to the GSM, or Global System for Mobile communications, standard.

Bull's major chip card rivals, including Gemplus and Schlumberger, have also been developing remote commerce applications for GSM phones. The market for chip-based SIM cards-subscriber identity modules required to authenticate users of those phones-is one of the most active in the smart card industry.

The demonstration this month involved a Bull Rock'n Tree SIM card in one phone slot, and a Proton electronic purse card in the other. With a call to a bank's e-purse server, the phone plays the role of a reloading terminal.

Bull said that through its SIM Rock'n Lab, such applications can be "developed in record time, even by users with no knowledge of the Java language."

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER