Why is certification essential?
To encourage competition between manufacturers and ensure continued evolution, Calypso relies on international standards, helping ensure sustainable and commercially viable investments and solution deployments.
A standard provides a common reference, which may be subject to interpretation, and products developed complying with these standards enable improved interoperability without compromising functionality or security.
However, it is not enough to rely solely on international standards.
An independent technical evaluation and certification of a product is necessary to provide assurance that it conforms to specified standards.
Certification for cards and mobile
The Calypso standard defines a contactless secure transmission of data between a traveller’s card or phone and a ticketing reader.
This relies on NFC contactless technology. As a member of the Smart Ticketing Alliance (STA), CNA promotes a certification process of the contactless communication protocol specified by the CEN TS16794 standard, both for cards and terminals. For mobiles, conformance with specifications set by the NFC Forum is strongly recommended.
Learn more about contactless protocol certification and see a list of certified cards.
The Calypso standard supports three main card products:
- Calypso Prime
- Calypso Light
- Calypso Basic
As well as two solutions for mobile phones:
- Calypso Applet
- Calypso HCE
All these products are subject to a Calypso functional certification associated with the use of the Calypso brand.
Learn more about Calypso functional certification and a list of certified products.
To protect data stored in the products, Calypso uses the hardware security provided by smart cards, except for Calypso HCE, which is a fully software-based solution.
For smart card-based products, CNA requires a security certification of the hardware component based on the Common Criteria scheme.
For Calypso HCE, CNA has defined a security certification process that aims to increase confidence in the solutions offered by the vendors. See the certificates.
To understand more about security certification for Calypso HCE, click here.
Certification for terminals
To improve interoperability between Calypso cards and terminals, CNA is implementing a type approval process. Its objective is to ensure that terminals process Calypso cards correctly. This type of approval comprises three certificates, each evaluating the various terminal layers:
1. The certification of the contactless protocol based on the CEN TS16794 standard.
Learn more about contactless protocol certification and see a list of certified terminals
2. The reader layer certification, based on the Reader Layer Requirements document published by CNA, helps to manage all types of cards and SAMs by a smartcard reader at the lower level of the transaction. Until the technical assessment programme is operational (expected by the end of 2023), CNA has put in place a declaratory procedure where the vendor undertakes compliance with the requirements.
This registration procedure is not a certification but a simple validation by CNA that the Vendor’s declaration is consistent.
See the list of the Registered Readers.
Learn more about the declarative process for the Reader Layer
3. The Calypso layer certification, based on the Calypso Layer Requirements document, covers the specific requirements for the management of Calypso cards and SAMs in strict compliance with Calypso specifications. Until the technical assessment programme is operational (expected by the end of 2023), CNA has put in place a declaratory procedure where the vendor undertakes compliance with the Calypso Layer Requirements.
This registration procedure is not a certification but a simple validation by CNA that the Vendor’s declaration is consistent.
See the list of the registered Calypso Layer libraries.
Learn more about the declarative process for the Calypso Layer
A terminal is approved by CNA when it can provide these three certificates.
Cards | Mobile | Terminal | |||||||
Prime | Light | Basic | Applet | HCE | Reader Layer | Calypso Layer | Ticketing layer | ||
Contactless Protocol | Certificate Issuer |  | | |  | | | ||
Standard | CEN TS 16794 | CEN TS 16794 | CEN TS 16794 | CEN TS 16794 | |||||
Process | |||||||||
Products | |||||||||
Calypso functional conformance | Certificate Issuer | | | | |  | | | Calypso Networks Association |
Standard | Calypso HCE | Ticketing Layer Requirements | |||||||
Process | Calypso Terminals Certification (Expected by the end of 2023) | ||||||||
Products | Certified Products | Products | Products | ||||||
Security | Certification scheme | Common Criteria | Common Criteria | Common Criteria | Common Criteria | | |||
Level/Standard | EAL4+ hardware | EAL4+ hardware | EAL4+ hardware | ||||||
Linked process | |||||||||
Linked products | Certified products | ||||||||
* This list includes non Calypso products
