Industry Interviews

    Media & Resource Center  > Industry Interviews 

> Back to Industry Interviews

GlobalPlatform Industry Interview | UL

GlobalPlatform spoke with Maarten Bron, Director Innovations at UL. Maarten provided an introduction to the company and his role, highlighted the current challenges facing the secure chip industry and discussed UL’s engagement with GlobalPlatform.

What is your role within UL and what are your company's objectives for the forthcoming twelve months relating to secure chip testing solutions?

UL is a global safety standards company – many of us may recognize the UL safety marks on mobile phones, solar panels, car batteries, life vests, or one of the other 20,000 types of products that UL certifies. Besides testing and certifying real-world products, UL recently extended the scope of its public safety mission into digital and virtual environments as well. The UL Transaction Security unit (UL TS) is where all of these activities are concentrated. Secure chip technology is instrumental to digital world safety, which is why UL TS joined the GlobalPlatform ranks as a Full Member. UL TS was formed by combining operations and expertise of Collis in the Netherlands, RFI Global in the UK, and Witham Laboratories in Australia.

Developments in the digital world can occur at an extremely high pace. Some hypes become change drivers, others don’t. Real world industries usually evolve at a much slower rate. Secure chip technology is the gateway between both worlds. Future-proofing your technology is therefore key. Of course for us as a knowledge company, future-proofing our service and product offering is of equal importance. As Director Innovations I try to fuel this process by ascertaining what is driving change and demand in our markets and how our customers today can benefit from this. I also determine how UL TS can best influence changes in our markets. This is because we have a unique, independent view of the industry that is vertically integrated across all stakeholders, but also horizontally diversified across different markets. Sometimes what the industry needs is not what the market wants. Industry forums such as GlobalPlatform are a concrete way for us to provide feedback to the industry.

Testing of secure chip technology, also GlobalPlatform technology, is something we have been doing for quite a while and are committed to doing in the future as well. For us, the coming 12 months will bring expansion of geographical footprint as well as expansion of service portfolio. The test and certification activities in our lab often mark the end of an intense R&D process that our clients go through. To this point, much of the work UL is doing takes places in the moment prior to testing and certification: empowering clients with our knowledge and tools, for instance by allowing developers to work faster, or to make product designers aware of the hoops that their product has to jump through with formal certification.

What challenges do you currently recognize in the global chip marketplace and how is your organization working to overcome them?

At UL there are different ways in which we look at the global chip marketplace. Firstly, there is the demand-side of the market, containing large scale initiatives such as an EMV liability shift, public transport implementation or biometric passport projects. Elaborate undertakings, where secure chip technology is applied ‘in the society’ on a large scale. I’d say this is a typical characteristic for secure chip implementations as there’s no economics - in terms of costs as well as acceptance – in proprietary solutions. This also means that there needs to be clear demand drivers. Of course regulatory mandates make our industry flourish - I haven’t seen technology-push work out yet. The challenge on the demand side of the global chip marketplace is not technology as such, but the way it is implemented. A nice example, is for instance, the ‘Deployment Models’ of GlobalPlatform technologies. We actively engage with our clients to determine what is fit for purpose and fit for use.
Then there is the supply-side of the market. This is where UL has traditionally been very strong with lab-centric activities related to secure chips as well as the devices this technology is embedded in. Here you sometimes see the difference in pace that I was referring to earlier. Let’s take GlobalPlatform as an example. On paper, GlobalPlatform technology evolves very fast, taking market requirements of payments, identification, government and health industries into consideration. This creates demand, but also market entry barriers because it is not always clear what the baseline is. Or: how much better the next baseline will be. Or: which other components are to be included in the next baseline. Our clients sometimes feel like early-adopters because of this, and act accordingly. Our training and education programs help here to take away ‘fear of cold water’.
Also on the supply-side of the market we see that vertical integration also applies to security and Secure Elements. Security is no longer a feature, but a managed service. This allows suppliers to engage with their customer’s customers. I cannot disclose the details, but we will see a lot of movement there in the coming 12 months.

Which GlobalPlatform initiatives are your company most actively engaged in at the present and why?

On a high level, UL sees GlobalPlatform as an organization with three main lines of business: Specifications, Compliance and Education. To start with compliance, UL is a qualified GlobalPlatform lab providing services to GlobalPlatform technology suppliers. Besides these laboratory services, UL is also a provider of GlobalPlatform qualified testing tools. Because of our tools and services, we actively contribute to adoption and deployment of GlobalPlatform technology world-wide! To the point of education, GlobalPlatform is running a training curriculum about its standards and technology. GlobalPlatform has certified one of our experts, Mr. Xiaodong Guo, to be a qualified trainer under this program. We are quite pleased with this, because delivering training is, for us, a way of experiencing first-hand how the industry perceives or implements certain technologies. As a third, there are the specification and standardization activities of GlobalPlatform. UL positions itself in these activities as an ‘active follower’ of most activities in the Card, Systems and Device committees. UL is not a provider of core GlobalPlatform technology, but rather a catalyst under its adoption in the industry. To support our certification activities, testing tool development and training activities UL needs to remain up to date with all developments.
I personally follow the work of the Mobile Task Force (MTF) with great interest because of the synergies it creates between the Card, Device and Systems Committees. Many other attempts at standardizing technology related to mobile payments, ticketing or transactions in general have proven challenging because of a limited scope. As I mentioned, combining card, device and system expertise provides sufficient coverage of the mobile ecosystem to actually make an impact.

Why do you believe industry compliance programs are important for the management of applications in the secure chip landscape?

At UL we have seen and participated in many different compliance programs over the past decades. Depending on whom you ask, answers may differ as to the importance of compliance programs. Some may point out the risks associated to non-compliance as opposed to benefits of being compliant. Licensors want to safeguard brand experience, licensees want brand exposure and end-consumers usually aren’t bothered too much.

In my view, the GlobalPlatform compliance program is very well balanced between available specs, laboratories, tools, self-test options etc. So- called plug-fests further ensure the readiness of test tooling and compatibility with real products. UL is ready to support GlobalPlatform’s future TSM compliance program activities.

Especially in the NFC ecosystem, compliance and interoperability of business architecture will prove equally important as interoperability and compliance on technical infrastructure level. Expanding the scope of a compliance program to include business aspects is however not always possible nor desired. For one, there will always be a line between cooperative space and competitive space between stakeholders. Compliance is a good way to safeguard the boarders of the cooperative domain. Secondly, the industry may lose its freedom to innovate. GlobalPlatform will need to continue to liaise with other industry organization to make sure we don’t over-engineer or duplicate efforts. The composite certification model is a good example of constructive industry collaboration.