Handle CDCVM

Overview

NFC Wallet SDK supports multiple CVM (Cardholder Verification Method) to authenticate the end user during payment, such as CDCCVM, online PIN and signature.

CDCVM (Consumer Device Cardholder Verification Method) is a CVM relying on device to verify the end user before an NFC payment.

Most NFC Wallet programs use CDCVM. CDCVM relies on the device’s user authentication.

In this section, we explain that NFC Wallet SDK is relying on Android secure device unlock method as CDCVM.

CDCVM Android (device unlock)

NFC Wallet SDK for Android uses the Android secure lock screen for CDCVM. It supports:

• Biometric: strong biometric credentials, such as fingerprint or face.
• Device credentials (keyguard): PIN, pattern, or password.

NFC Wallet uses Android Keystore user authentication. See Android Keystore user authentication.

Recommendations

Handle CDCVM early in your integration:

• Check device CDCVM capabilities before before you start wallet enrollment or Tokenization.
• Prompt the end user to enable a secure lock screen when required.

NFC device capability check

Check your device supports HCE as stated in Declare NFC features. You can perform check at application installation (Google Play device filtering) or at runtime.

If you use a runtime check, hide NFC Wallet features for unsupported devices.

SDK integration

Check device CDCVM capabilities

Use DeviceCVMEligibilityChecker.checkDeviceEligibility to check device capabilities.

It returns a DeviceCVMEligibilityResult. Use it to evaluate biometric and keyguard support.

Run this check after you initialize the NFC Wallet SDK, and before you start wallet enrollment or Tokenization.

Check biometric support

Call DeviceCVMEligibilityResult.getBiometricsSupport.

It returns BiometricSupport.SUPPORTED when biometric CDCVM is available. Check the possible error in case biometric is not supported in table below.

Biometric eligibility error

Result	Description
ANDROID_VERSION_NOT_SUPPORTED	Returned when the device runs Android earlier than 6.0 (API level 23).
NO_FINGERPRINT_SENSOR	Returned when no biometric sensor is available on the device.
NO_FINGERPRINT_ENROLLED	Returned when the end user has not enrolled biometrics on the device.
PERMISSION_NOT_GRANTED	Returned when the required biometric permission is missing in the manifest.
SECURE_LOCK_NOT_PRESENTED	Returned when no secure lock screen is enabled on the device.

Check device keyguard support

Call DeviceCVMEligibilityResult.getDeviceKeyguardSupport.

It returns DeviceKeyguardSupport.SUPPORTED when device keyguard CDCVM is available. Check the possible error in case keygard is not supported in table below.

Device keyguard eligibility error

Result	Description
ANDROID_VERSION_NOT_SUPPORTED	Returned when the device runs Android earlier than 6.0 (API level 23).
SECURE_LOCK_NOT_PRESENTED	Returned when no PIN, pattern, or password is enabled on the device.

Implementation example

// Check Device's Eligibility for Choosing CDCVM
DeviceCVMEligibilityResult result =
        DeviceCVMEligibilityChecker.checkDeviceEligibility(getApplicationContext());

if(result.getBiometricsSupport() == BiometricsSupport.SUPPORTED) {
    // Biometric is supported
    // ...
}
else if(result.getDeviceKeyguardSupport() == DeviceKeyguardSupport.SUPPORTED){
    // If Biometrics are not supported, Device KeyGuard should be used.
    // Device keyguard is supported
    // ...
}
else {
    // Log Error, Device is not supported
    // or end user does not enable secure lock screen
    // We recommend to prompt the end user to enable a secure lock screen
    // ...
}