For years of discussed on mobile payment, China Mobile Research Institute has been dedicated to payment security technology. The Institute has closely communicated and cooperated with GlobalPlatform on the issue of TEE, which has received attention as a method to ensure mobile security. In this talk, we will explain the Institute's understanding of and views on TEE standard, as well as the latest changes and future trends of various applications in the NFC ecosystem.

Today, with the advent of the mobile Internet era, a variety of emerging applications are in the ascendant. The demand for secure transaction has covered finance, transportation, Government ID and new applications of mobile payments. With the unprecedented convenience features, various security risks are attendant. In the next decade, more cross-border integration applications will come. In the Internet of Things era, represented by smart home, the Internet of Vehicles, Industry 4.0 and a new generation infrastructure, etc. all kinds of security challenges and threats will occur, security requirements will be everywhere all the time. Infineon Technologies, leading the security industry for over 25 years, will continue to provide the most extensive security solutions via continual innovation. Infineon's innovative security will become the trust anchors and protection shield for upcoming intelligent era.

TEE has become a new battlefield. There are many different TEE platforms in the world. What are their differences? More and more attackers are now interested in TEE and some of them have successfully compromised several TEE platforms. Is TEE secure enough to be "trusted"? What opportunities and challenges will the new secure features of hardware bring to TEE? In this talk, we will introduce the evolution as well as the state of art of TEE from the perspectives of both academia and industry. We will also show various attacks against TEE, and discuss TEE's future.

In the card business offered by traditional financial institutions, security payment starts from card issuance in personal banking and retail banking services. Issuance security should be protected in all the steps from card production to distribution and activation. As a traditional card security technology and solution provider committed to "Secure Issuance Anywhere", with nearly 50 years of achievement in innovation and scientific research, Entrust Datacard is not only the industry leader in card technology, but also has taken a step forward in emerging internet transaction security. Datacard will collaborate with Chinese financial customers in a new way to carry out this security service that addresses the new normality of Internet + Finance and to provide new solutions for identity authentication, data protection and transaction security for new payments. In this way, we will get better involved in the Chinese market and serve the public.

Mobile payment solutions using HCE are changing the balance of how much software and hardware security we may want to implement in our devices. Despite a strong push from the industry to harmonize security evaluation process and requirements, a lot remains to be clarified. Do we still need hardware security? How much should we rely on code obfuscation and other software hardening techniques? For which critical data should we switch to an SE based solution? Can we and should we certify our product/app? The laboratory broke my solution, what does it mean? Are we really at risk? Riscure will elaborate on common vulnerabilities, mitigation techniques (obfuscation, Whitebox crypto, cloud, more hardware); composition, rating and delta evaluation will be some of the discussed topics.