Welcome - Marc Sel
Mass Transport Cards and Systems
Historically, in Europe, public transport was established mostly under some form of monopoly. The EC gradually pushed forward with ideas
of liberalisation. The current situation can be described as a rather heterogenuous blend of public and private sector concepts in most countries/cities.
The transport systems are typically multi-modal (bus, metro, tramway, ...) and often multi-operator. This results in often complex
requirements with regard to roles and responsibilities, cost/benefits allocation and clearing & settlement.
In most countries, transport operators prefer to control the physical access of travellers to the transport network. This is achieved by issuing some form
of token. Historically these tokens were based on magnetic stripe cards, on a paper carrier.
The different client types and high maintenance cost for magstrip cards make smart cards very attractive:
- "ad hoc" user, e.g. a traveller passing through the city for one day;
- "stable" user, relying on a seasonal ticket or similar (e.g. school ticket, a senior-citizen ticket, an employer-sponsored commuting ticket);
- "flexible" user who is always chosing the optimal travel mode (e.g. a local resident who also ownes a car and a bike).
This leads to 'disposable' tickets for the first category and 'smart card' tickets for the two others. Until overtaken by security problems, the NXP
Mifare Ultralight and Mifare Classic where prime examples of such cards. They are now often replaced by e.g. SmartMX.
RFID/NFC aspects - standards
In transport applications, cards suffer from daily use, for which reason contactless cards are preferred. Contact cards are more prone to hardware wear-out,
hence contactless cards are better suited in the transport sector. This led to the creation of the RFID standard, ISO 14443, composed of 4 parts. It operates
in the non-licensed 13.56 Mhz band. As there were two main "competitors", there are two substandards:
Later under impetus from Sony, the NFC standard was established as ISO 18092. It's a backward compatible extension to RFID, mainly aiming at use
in mobile phones. It's was actually proposed as ISO 14443 type C by Sony, based on FeliCa. It's used e.g. in the Hong Kong Octopus and Singapore EZ-link
systems. It did not make it to the 14443 standard, but came back as NFC.
- ISO 14443 type A (origine: NXP)
- ISO 14443 type B (origine: RATP)
RFID/NFC aspects - non-standards
Mifare Classic makes use of type A (parts 1, 2, 3) but implements a proprietary protocol over them instead of part 4. It also includes the proprietary
and considered broken CRYPTO1 algorithm. Mifare Ultralight is a variation of the Classic without crypto.
Others that did not make it to the standard were from Legic and Cubic.
Migration from contactless card onto mobile devices takes various forms. There is significant impact from the Global Platform model, e.g. Calypso's
"portable objects" are implementable as a Java Applet on a GP device.
CASSIS implemented for example the NFC card in Malaysia (Maxis/Fast Tap), based on GP TSM architecture, allowing many different SE form factors. On the GP
platform client, both a Mifare proxy (emulator) and Visa PayWave application co-exist.
Gemalto licenses the NFC-for-Mobile from NXP.
Brussels STIB/MIVB project - MOBIB
The Public Transport Operator for Brussels STIB/MIVB started to issue their first smart card based Mobib cards in 2008.
They are based on the Calypso concept. The validators are all to be migrated to the ISO 14443 interface.
Timeline for Mobib
The timeline can be approximated as:
- 1993 - introduction of a magstripe transport card by STIB/MIVB
- 2000 - Management Board approves MOBIB, the smart card e-ticketing solution based on Calypso
- 2003 - Conseil d'Administration and Comex approve also
- 2004-2007 - preparation and implementation
- first test tickets issued
- due diligence contract assigned to PwC
- subscriptions for students are the first large scale go-life test over the summer
- MOBIB's maturitylevel incrementally increases by going from V1 to V4
- NMBS/SNCB starts to sell MOBIB
- second assistance contract assigned to PwC
- the 'Belgian Mobility Platform' is created
- 2010 Mobib V5 prepares SESAME, the closing of the doors at the metro stations
- 2011 Doors at the metro stations are gradually closed
- 2012 Mobib Basic is launched, the anonymous version for occasional users
Besides the STIB/MIVB, other parties involved in establishing a more universal Belgian transport card are:
Originally, this was referred to as "Ubigo". Later the four operators established BMC, the Belgian Mobility Card company. In Ile de France, a similar
activity is undertaken by STIF.
- VVM (De Lijn)
- SRWT (Societé Regionale Wallone de Transport)
- furthermore, cooperation via 'Triangle' with RATP, SNCF and OPTIL
Success and failure
The London Oyster was gradually introduced and by 2007 approximately 10 million people had such a transport card. It is based on a Philips Mifare card.
Hong Kong operates the Octopus system, Paris RATP operates the Navigo system. All of these systems have been successfully in use for many years.
Sample failure 1
The Dutch OV-chipcard was originally based on Mifare Classic, with the proprietary CRYPTO1. There were various hacking demonstrations between 2007 and
2010. In January 2011 there was software released on Windows to reload your card for free (taking a backup and writing it back after the travel).
As a consequence, the government decided to commision various studies, resulting in the establishment of the Open Ticketing Institute. They also
initiated the migration towards an Open Platform solution, based on SmartMX (sourced from NXP/Infineon). The new card contains both a Mifare Classic
emulator (backward compatibility) and a new more secure applet.
Sample failure 2
The Sydney Tcard serves an illustrative purpose of a larger scale failure. After 11 years and 95 million Australian dollars, the government called the program
a halt in january 2008. Sydney's public transport system is overseen by the NSW government, and includes State Transit, Sydney Ferries and CityRail.
The main contractors were Integrated Transit Solutions Limited and ERG Group.
Various reasons have contributed to the overall failure, including the government demand to include
multiple complex tariff schemes and 120 different CityRail ticket products for busses and ferries.
Facing a potential 95 million dollar claim, ERG temporarily suffered a self-imposed trading halt on the Australian Stock Exchange. The project went back
to the drawing board.
In 2010, the Pearl Consortium was awarded the new contract.
Sample risk - security by obscurity - Mifare Classic and Oyster revisited
Many systems including the London Oyster (used by approximately 10 million people in 2007) are based on a Philips/NXP Mifare Classic card.
In december 2007, hackers published their break of the proprietary CRYPTO1 algorithm by reverse engineering the chip logic. Subsequent
attacks on the mathematical strenght of the LFSR algorithm cumulated in the detailed release on October 7, 2008, by researchers from Radbout University
of their MIFARE CLASSIC hack.
- International Association of Public Transport
- American Public Transport Association
- APTA Standards
- EU research on interoperable fare solution
- EU rfid interoperability
- FR/BE - Calypsonet - Association
- FR - Spirtech/Calypso tech support and publications (free userid required)
- FR - Calypso Technology - technical support
- FR - Calypso Technology - on-line demo
- BE - UCL's Mobib data extractor
- UK - ITSO - Interoperable Travel Card for UK
- UK - GO-AHEAD - bus, train, aviation handling
- DE - e-ticket Deutschland
- DE - VDV -
- DE - VDV - Kern Applicationen
- DE - VDV - Kern Applicationen - based on SECCOS cards
- DE - Kompetenzcenter elektronisches Fahrgeldmanagement - Nordrhein-Westfalen
- FR - Transdev - exploitations des réseaux urbains et interurbains: France, Allemagne, Australie, Espagne, Grande Bretagne, Italie et Portugal.
- FR - Paris - RATP - Navigo (Calypso-based) from Gemalto
- BE - STIB-MIVB (Transdev partner)
- BE - STIB-MIVB - MOBIB - Calypso
- BE - STIB-MIVB - "the new metro"
- BE - Vlaamse Vervoermaatschappij De Lijn
- BE - TEC - InfoTec
- NL - Translink Systems - OV-chip (Openbaar Vervoer)
- NL - OV-chipkaart
- Implemented by East-West Consortium: Thales, Vialis, Accenture, MTR Corporation and Octopus Cards
- It is based on the Hong Kong Octopus system, tailored to the Dutch market
- Based on NXP Mifare
- NL - Siekerman/van der Schee's MIFARE ULTRALIGHT HACK details
- NL - Radbout's MIFARE CLASSIC HACK details
- BE - ProData - Mobility - Rio, Moscow, Manilla, ...
- FR - Parkeon - fare and parking terminals e.g. used in Paris and Brussels
- FR - Spirtech - smartcards, teleticketing, ISO 9796
- SE - Arcontia - fare terminals e.g. used in Sweden and the Netherlands
- US - Cubic/Cubic Transportation Systems - e.g. in Sydney
- IN - Delhi Integrated Multimodal Transport System