Expertise across secure-element systems
ConSec specializes in secure elements and embedded security, connecting card applications with host software, communication interfaces and key infrastructure. Our technical scope spans Java Card and GlobalPlatform, HSM integration, middleware, tooling and testing.
Capability map
The device contains a secure element and its application. Separate areas represent host software and key infrastructure. The connections illustrate related areas of engineering expertise; the exact interfaces depend on the project.
Secure Elements & Java Card
Secure-element applications operate within specific memory, lifecycle and cryptographic constraints. ConSec supports applet design, development, integration and testing, with technical scope that also extends to Java Card operating systems and development environments.
Work can address the application itself or the interfaces and tooling needed to use it within a wider system.
- Java Card applet design, implementation and test suites
- Integration with different card platforms and host applications
- Application behavior under memory, transaction and performance constraints
- Authentication, identity, payment and proprietary application use cases
Example outputs: Applets, interface tests, integration tooling and technical documentation.
Standards and application experience
ConSec brings development, testing and integration experience across the following standards, specifications and technology families in Java Card and secure-element projects.
| Area | Specifications and technologies |
|---|---|
| Authentication | FIDO U2F, FIDO UAF, FIDO2 |
| PKI | PIV/CAC (NIST SP 800-73-4/5), GIDS |
| Car key / vehicle access | CCC Digital Key, proprietary specifications |
| Access | Aliro (CSA), MIFARE Classic/Plus, MIFARE DESFire (EV2, EV3), LEGIC, NTAG 424 |
| Payment | EMV (Mastercard, VISA) |
| ePassport | ICAO Doc 9303 — BAC/PACE/EAC |
| Crypto | BIP32/44, ECDSA, EdDSA |
| Transport | VDV-KA, etiCORE |
| IoT | IoT SAFE (GSMA) |
package com.consec.card; import javacard.framework.*; public final class DemoApplet extends Applet { private DemoApplet() {} public static void install( byte[] data, short offset, byte length) { new DemoApplet().register(); } public void process(APDU apdu) { if (selectingApplet()) return; ISOException.throwIt( ISO7816.SW_INS_NOT_SUPPORTED); }}GlobalPlatform & Secure Provisioning
Card management involves more than issuing commands. Security domains, privileges, lifecycle states, keys and secure channels must work together in a defined workflow.
ConSec supports provisioning and personalization through specification-driven scripts, command analysis and tools that help teams understand and reproduce card behavior.
- Card lifecycle and security-domain management
- Secure-channel workflows, including SCP02, SCP03 and SCP11 where applicable
- Applet loading, installation and personalization flows
- APDU/TLV decoding, registry parsing and response analysis
- Script generation and automated regression checks
Example outputs: Provisioning scripts, lifecycle flows, parsers and script-management tools.
HSMs & Key Management
Secure-element workflows often connect to a wider cryptographic infrastructure. ConSec supports HSM-related host software, firmware contributions and integration with production and personalization systems.
The scope can include cryptographic APIs, administration tooling and the relationship between key-management operations and the applications that depend on them.
- Integration through industry-standard cryptographic APIs and REST APIs
- Host software and firmware-component development and testing
- Key derivation, wrapping and import/export concepts within the applicable security policy
- Integration into production and personalization workflows
Example outputs: API integration, HSM-aware provisioning concepts, administration tools and integration tests.
Cryptographic API experience
ConSec has experience integrating HSMs through the following interfaces, selected to suit the application and HSM platform:
| Interface | Architecture or integration model |
|---|---|
| PKCS#11 | Public-Key Cryptography Standards #11 |
| JCA / JCE | Java Cryptography Architecture / Extension |
| CNG / KSP | Cryptography Next Generation / Key Storage Provider |
| OpenSSL Engine / Provider | OpenSSL cryptographic integration |
| REST APIs | Service-based cryptographic interfaces |
HSM platform experience
- On-premise HSMs: Utimaco (u.trust, CryptoServer), Thales (Luna)
- Cloud HSMs: AWS CloudHSM, Google Cloud HSM
Middleware, Drivers & Test Automation
Applications need reliable ways to communicate with cards and secure devices. ConSec develops drivers, middleware and tools that connect these components to host applications and make their behavior easier to inspect.
Testing covers the relevant applet, interface and integration scope, with tools for interpreting responses and reproducing failures.
- PC/SC drivers for Windows and Linux
- PKCS#11, CSP/minidriver and PKI middleware integration
- Remote PC/SC and BLE-based communication
- CLI/GUI tooling and APDU/TLV parsers
- Applet-interface, integration and regression test suites
Example outputs: Drivers, middleware components, diagnostic tools and automated tests.
Embedded Security & System Architecture
Device security draws on different building blocks: Secure Elements (SE), Trusted Execution Environments (TEE) and Trusted Platform Modules (TPM). Their roles and suitability depend on the target platform, threat model and application requirements. ConSec considers these technologies within the wider system architecture, connecting device software, communication interfaces and backend services into a coherent security concept.
ConSec connects security concepts and architecture work with software development and integration. Relevant application contexts include Digital Key, secure-update concepts and connected-device systems.
- Requirements and system-security concepts
- Authentication protocols and interface reviews
- Architecture and integration of device-security components (SE, TEE, TPM) with embedded software
- NFC/BLE communication interfaces
- Secure firmware/software update and provisioning concepts
Example outputs: Specifications, architecture concepts, implementation contributions and integration checks.
PQC Transition & Crypto-Agility
ConSec offers assessment and migration support for cryptographic architectures, with attention to constrained embedded devices, secure elements and HSM environments. Scope includes crypto inventories, migration concepts, hybrid approaches and evaluation of memory, performance and interoperability constraints.
The contribution is defined against the target system and the capabilities of its platforms and interfaces.
Example outputs: Crypto inventory, migration concept and evaluation of platform constraints.
NFC & BLE integration
Connectivity is part of the system’s engineering scope. ConSec supports software and interface integration for Near Field Communication (NFC) and Bluetooth Low Energy (BLE), linking devices, host software and secure-element workflows.
| Interface | Relevant scope |
|---|---|
| NFC | Contactless device/card communication, including Digital Key and identity-related integration |
| BLE | Communication with connected devices, wearables and phones, including driver and middleware work |
These interfaces are considered in their specific project context. Their role depends on the devices, applications and security requirements involved.
Application contexts
The same platform expertise can support different application requirements. Standards and application families are addressed within the scope of the relevant implementation and integration work.
| Context | Engineering focus |
|---|---|
| FIDO/FIDO2 | Authentication applets and integration testing with FIDO-enabled applications and browsers |
| PIV/GIDS and PKI | Credential applets, card profiles, certificate handling and middleware integration |
| Payment applications | Java Card payment applets and related mobile-payment architecture and integration work |
| CCC Digital Key | Device/vehicle applets, security concepts, interfaces and test development |
| eID and IoT SAFE | Identity and connected-device application requirements on secure-element platforms |
| Connected devices / eSIM | Consumer eSIM/LPA integration and related connected-system work |
Discuss your platform and interfaces
Tell us where specialist support is needed: on the card, in host software, across an interface or within the provisioning workflow.