NFC TimesThe premier source for news, analysis and commentary on
Near Field Communication and all contactless technology

European antitrust regulators have approved a planned joint venture by UK-based chip designer ARM and smart card and security companies Gemalto and Giesecke & Devrient.

The three companies announced the proposed joint venture in April, planning to develop and market products that can enhance the security of applications that run on smartphones and other devices, such as mobile payment on NFC phones.

The European Commission in an announcement this week said it had initial concerns that the joint venture “could have enabled ARM to shut out competitors.”

The joint venture withdrew its first application to the commission in early July and resubmitted it in September, giving regulators commitments that the ARM processors supporting the technology, called a trusted execution environment, or TEE, would be open to competitors.

The TEE is a secure area on the processor, which, for example, could store encryption keys or ward off keystroke logging viruses that could steal banking or payment PIN codes that consumers enter on the handset keypads. A consumer might enter his PIN, for example, to conduct a high-value transaction on an NFC phone.

ARM supplies the design for the hardware, called TrustZone, for the TEE and Gemalto, G&D and other vendors provide the software.

Among ARM's commitments to regulators was that it would not favor Gemalto and G&D in providing information and specifications needed for the other vendors to design TEE products.

“ARM will provide the necessary hardware information to competitors at the same conditions as to the joint venture to enable them to develop alternative TEE solutions,” said the European Commission in a statement. “Moreover, ARM will not design its IP in a way that would degrade the performance of alternative TEE solutions.”

The commission said the commitments would remain in force for eight years. GlobalPlatform is also standardizing the TEE architecture and an API for service providers or vendors to use to develop applications that would run inside the trusted environment.

ARM has been including TrustZone in designs for nearly all of its application processors since 2005, so the hardware is widely rolled out. ARM-based chips today are used in 95% of smartphones.

It’s not clear whether Oberthur Technologies, chief rival of France-based Gemalto and Germany-based G&D, opposed the joint venture with regulators. France-based Safran-Morpho, the No. 4 smart card vendor worldwide, told NFC Times it did not oppose the deal.

The joint venture still requires approval from Chinese regulators, G&D told NFC Times. That could happen in coming weeks.

While not as tamper-resistant as secure elements or other smart card chips, the TrustZone area on a smartphone processor can securely store encryption keys that could be used to authenticate either users or the devices themselves, says backers, who see Android phones as especially in need of the additional security they say trusted execution environment products can provide.

France-based Trusted Logic, which was fully acquired by Gemalto in 2009, was the first to come up with software for TrustZone, which it calls Trusted Foundations. G&D followed with its own product, MobiCore.

Gemalto licenses its Trusted Foundations to makers of ARM-based processors for a fee, G&D gives MobiCore away to chip makers, then seeks to charge fees to service providers when they use the secure environment for applications. G&D, for example, manages the keys in the trusted execution environment for service providers.

G&D told NFC Times it would continue to follow this revenue model with the joint venture. That would mean, for example, it would charge a bank to secure payment or banking applications. This is similar to the revenue model that G&D and other vendors use for providing TSM services in NFC phones.

It’s unclear whether Gemalto would continue with its revenue model of charging chip makers to support Trusted Foundations. It’s also unclear whether the joint venture will split revenue.

While most ARM processors have the hardware to support TEE products, there are few applications that use it today.

That is the main reason for the joint venture. So after years of competition Gemalto and G&D decided to pool their intellectual property in the joint company.

The card vendors and ARM declined to say how much each would be putting into the venture in IP value and funding, but ARM would own 40% of the new company, while Gemalto and G&D would each claim a 30% share.