Calypso Backers Seek to Expand Mobile Ticketing on Android Phones

The recent move by CTS, the transit agency serving the French city of Strasbourg, to make its NFC mobile-ticketing service available to users of nearly all Android phones, could signal greater use of Google’s host-card emulation technology by supporters of Calypso, one of the world’s major technologies for closed-loop fare cards.

While there has long been skepticism in France, Calypso’s largest market, about the security of software-based solutions like host-card emulation to store payments cards, that is changing. The Calypso Networks Association, which manages the closed-loop technology, has issued specifications and guidelines, which it says strengthens the security of HCE, and last year launched a certification process for HCE applications.

That could be enough to encourage large Paris regional transit authority Île-de-France Mobilités to support HCE. This would mean the giant Navigo fare-collection system could greatly expand its base of devices available for customers to tap to pay fares on board buses, and at train and metro gates.

Both Calypso Networks and Wizway Solutions, the Paris-based joint venture that implemented mobile ticketing technology in Strasbourg, Paris and some other cities using Calypso, told Mobility Payments that Île-de-France Mobilités would indeed support HCE. According to Calypso Networks’ CEO Philippe Vappereau, that could happen in “some months,” though he didn’t know exactly when.

HCE enables card issuers, including banks and transit authorities and operators to load digital versions of their cards in software on the phones, thus avoiding the need to store the virtual cards in NFC secure elements in the devices.

Limited Availability of Devices
Riders in Paris, Strasbourg and a few other cities have had to make do with a limited set of Android devices, including Samsung Galaxy S8 and later high-end devices. That only happened after Samsung agreed to support the Calypso application on embedded secure elements in these devices. The only other NFC phones available for mobile ticketing in these cities have been those that can support NFC SIM cards, which can be used to store the Calypso application. The NFC SIM, however, is a dying technology, with few, if any, telcos still issuing the cards.

Apple Pay has been available in France since 2016, but does not support Navigo or any other fare card in the country in its Wallet for use with NFC-enabled iPhones and smartwatches. Navigo users can buy tickets and passes with Apple Pay in an updated version of the Paris transit authority’s app released earlier this year. They then load the passes onto their Navigo cards by tapping them on the NFC interface on the back of their iPhones, using NFC reader mode.

That ability to reload Calypso cards is also available on some Android phones that have launched mobile payments and is actually more popular among customers than tapping the phones on board buses or at gates to pay fares directly, Vappereau, a former unit head with Paris Metro and bus operator RATP, told Mobility Payments recently. That is likely due to the ability to load cards from the iPhone.

He said transit operators and authorities, such as Île-de-France Mobilités, or IDFM, want to be sure that HCE is secure enough to store their fare payments cards. There haven’t been any high-profile hacks of Google’s HCE technology, but France, after all, is the home of smart card technology, which is used globally to provide hardware-based security to EMV payments, as well as ID and other cards.

“Some things that IDFM (Île-de-France Mobilités) in Paris is requiring because the stakes are more important in the Paris region than your city of 5,000,” he told Mobility Payments. “So when you have such an important application, an operator or authority wants to be sure of the security of what you buy.”

Louis Brosse, CEO of Wizway, the joint venture of Paris’ two major transit operators, RATP and SNCF, along with telco Orange and technology supplier Thales, told Mobility Payments that HCE is “slightly less secure” than secure elements, and that the security “countermeasures” from the Calypso guidelines include rotation of cryptographic keys in the Calypso readers.

“As opposed to the eSE (embedded secure element), which is fully compatible with existing readers, this requires some software update on the readers,” said Brosse, when asked why it took so long for the Strasbourg transit authority to enable HCE following launch of mobile ticketing there on eSEs in 2018. “These software changes have required some time to be implemented on the reader side.”

Meanwhile, transit authorities and operators have already launched HCE with Calypso for mobile ticketing in three other major French cities, Lyon, Toulouse and Nice, along with trains in the Italian region of Emilia-Romagna, according to Calypso Networks. France-based Paragon ID, a partner of Wizway, provided the secure HCE technology for the projects in Toulouse and Nice.

All told, there are 500,000 Calypso-compatible terminals globally, according to Calypso Networks. Most are concentrated in Europe, but there are Calypso deployments in Canada, Latin America and to a lesser extent in Africa and Asia. Calypso technology is used by public transit agencies in more than 160 cities globally to collect fares. Besides Paris, that includes Brussels, Milan, Lisbon and Montreal.

Wizway, which announced the expansion of mobile ticketing by the Strasbourg transit authority in early June 2021, said it expects other cities to use the same technology to roll out mobile payments with HCE.

The technology it uses complies with the HCE Calypso interoperable application specification, or HCIA, which ties into Calypso’s Hoplink interoperable technology. When implemented by agencies and technology suppliers, HCIA could eventually enable customers to tap their HCE-based Calypso virtual card on terminals with more than 40 agencies that support Hoplink.

But despite being introduced more than three years ago, at present, only two agencies, one of them in Lille, France, are live with Hoplink. And the interoperability is only at the terminal level, not the business level, so a customer who buys tickets in Strasbourg, for example, cannot spend them in Lille, even if his cards and smartphone work at the Lille terminals. There is no central clearing-and-settlement body for the Calypso world. Customers have to buy the tickets or passes for the city where they will spend them, either online through that city’s app or in-person at a counter or vending machine.

Seeking to Stay Competitive
Promoting mobile ticketing with HCE is only one of the ways that Calypso Networks is trying to stay competitive amid such global trends in fare collection as open-loop payments, account-based ticketing and QR code-based payments–all of which would lessen the importance of Calypso cards, chips and terminals that Calypso members make.

The association the past three years has moved its technology to open source to attract more developers and applications, diversified its range of card types and sought a merger with the vendor-run OSPT Alliance. The latter is made up mainly of chip and card manufacturers. OSPT’s Cipurse technology hasn’t caught on in the market after 10 years, going up against Mifare and other competing technologies.

Both the Calypso Networks Association and OSPT tout their technologies as following “open standards,” with multiple chip, card and other component makers able to supply fare-collection projects, which they stress are not locked into one vendor.

“We decided we needed to really open the technology, and to make it really a true open standard, able to be used and developed and maintained by many actors; and so that’s why we decided on our strong démarche toward the open-source solution,” Vappereau said. “It was really linked with the new mobilities and mobility-as-a-service, which means many new actors.”

_{© Mobility Payments and Forthwrite Media. Mobility Payments content is for individual use and cannot be copied or distributed without the express permission of the publisher.}