GlobalPlatform

Software
{# Answer-first lead — frontend-gold-standard §1.1. Expects `lead` (plain text, already resolved by apps.content.leads). Rendered directly under the h1 so the self-contained answer is the first prose a reader, a SERP snippet, or an AI extractor meets. No curated-data gate: the view always supplies either curated content_summary or a computed fallback. #}

GlobalPlatform is the industry standard defining the infrastructure for managing applications on secure chip technology — smart cards, Secure Elements, and Trusted Execution Environments. It specifies how applications are securely loaded, installed, deleted, and managed on multi-application cards, forming the administrative framework above the card operating system, which is typically JavaCard. Management is organised around Security Domains. The Issuer Security Domain is the card issuer's master domain, controlling the card lifecycle and delegating privileges; Supplementary Security Domains give application providers delegated management authority; an optional Controlling Authority Security Domain verifies certification authority tokens; and the Card Manager is the on-card entity that routes APDUs and enforces lifecycle policy. Each domain holds its own cryptographic keys, so a payment network can manage its applets independently of a telecom operator's applets on the same card.

Embed This Widget

Theme


      
    


    
    

      Widget powered by
      .
      Free, no account required.
    

  







  
  

    Also known as:
    
    GP
    
  

  





  
  

    
    




    
    
    

      
GlobalPlatform


GlobalPlatform (GP) is an industry standard that defines the infrastructure for managing applications on secure chip technology — smart cards, Secure Elements, and TEEs. It specifies how applications are securely loaded, installed, deleted, and managed on multi-application cards, providing the administrative framework that sits above the card operating system (typically JavaCard).


Key Concepts


GlobalPlatform organizes card management around Security Domains:






Component
Description






Issuer Security Domain (ISD)
The card issuer's master domain — controls card lifecycle and delegates privileges




Supplementary Security Domain (SSD)
Additional domains for application providers with delegated management authority




CASD (Controlling Authority SD)
Optional domain for certification authority token verification




Card Manager
The on-card entity that routes APDUs and enforces lifecycle policies






Each Security Domain holds its own set of cryptographic keys for authenticating management operations. This key separation ensures that a payment network can manage its applets independently of the telecom operator's applets on the same card.


Secure Channel Protocols


All management operations (applet installation, key rotation, card locking) are protected by a secure channel:






Protocol
Cipher
Status






SCP01
3DES
Deprecated




SCP02
3DES
Legacy, still in SIM cards




SCP03
AES-128/192/256
Current standard




SCP11
ECC + AES
For certificate-based mutual authentication






SCP03 is the current production standard, providing AES-based encryption and CMAC integrity protection. SCP11 enables PKI-based authentication, useful for IoT scenarios where pre-shared symmetric keys are impractical.


Card Lifecycle States


GlobalPlatform defines a card lifecycle with controlled transitions:


    

  1. OP_READY — Card manufactured, ready for personalization
    2. 

  2. INITIALIZED — ISD keys loaded
    3. 

  3. SECURED — Production keys set, card ready for deployment
    4. 

  4. CARD_LOCKED — Card temporarily locked (security event)
    5. 

  5. TERMINATED — Card permanently disabled
    6. 



These states are enforced by the card hardware — once a card reaches TERMINATED, it cannot be recovered. This lifecycle model is critical for personalization bureaus managing the secure issuance pipeline.


GlobalPlatform Beyond Smart Cards


GlobalPlatform specifications extend beyond traditional cards to cover TEE management (GPD_SPE_021), eSIM profile management (in coordination with GSMA), and IoT device security. The GP Device Technology specifications define secure device enrollment, firmware update, and device attestation protocols.

    

    

    
    
    

      
Related Content

      

        
        
          

            
            
Understanding ISO 7816

            
            Standards & Protocols
            
          

          
          
          
…application management in a multi-application environment GP-aligned 15 Cryptographic information application Key…

          
        
        
        
          

            
            
GlobalPlatform Card Management

            
            Standards & Protocols
            
          

          
          
          
GlobalPlatform Card Management GlobalPlatform is the industry consortium…

          
        
        
        
          

            
            
ISO 7816 Parts Guide

            
            Standards & Protocols
            
          

          
          
          
…in a multi-application environment Superseded by GlobalPlatform in practice 7816-14 Conformance test plan Test cases for…

          
        
        
        
          

            
            
Secure Channel Protocols (SCP02/SCP03)

            
            Standards & Protocols
            
          

          
          
          
Secure Channel Protocols (SCP02/SCP03) GlobalPlatform Secure Channel Protocols establish a mutually…

          
        
        
        
          

            
            
Smart Card Cryptography

            
            Security
            
          

          
          
          
…800-108 counter-mode KDF or EMV-style diversification. The GlobalPlatform specification governs how card-unique keys are structured…

          
        
        
        
          

            
            
Key Management for Smart Cards

            
            Security
            
          

          
          
          
…Domain EMV Visa / MasterCard 3DES + KCMVP Legacy payment GlobalPlatform SCP02 3DES-CBC Legacy card management SCP03 AES-CMAC based…

          
        
        
        
          

            
            
HSM Integration for Smart Cards

            
            Security
            
          

          
          
          
…personalisation key diversification Per-card derived keys GP SCP02/SCP03 PIN block generation / verification PVK, PEK…

          
        
        
        
          

            
            
TEE vs Secure Element

            
            Security
            
          

          
          
          
…Attestation (Android), Secure Enclave (iOS) Manufacturer + GlobalPlatform Replacement / provisioning OTA firmware update OTA profile…

          
        
        
      

    

    

    
    
{# FAQ block + FAQPage JSON-LD. Expects `faq_items` = [{"question", "answer"}].
   Native 
/ (frontend-gold-standard §1.7): the answer text is in
   the initial HTML and stays reachable with JavaScript disabled, so crawlers and
   AI extractors read answer-shaped chunks without depending on Alpine. #}



  
Frequently Asked Questions


  

    
    

      
        
What is a Security Domain?

        
      
      

        
A Security Domain is an on-card container holding its own cryptographic keys for authenticating management operations. The Issuer Security Domain is the card issuer's master domain controlling the card lifecycle and delegating privileges; Supplementary Security Domains carry delegated management authority for application providers; and an optional Controlling Authority Security Domain verifies certification authority tokens.

      

    

    
    

      
        
How does GlobalPlatform relate to JavaCard?

        
      
      

        
JavaCard is the card operating system and runtime; GlobalPlatform is the administrative framework above it, specifying how applications are securely loaded, installed, deleted, and managed on a multi-application card.

      

    

    
    

      
        
Can two organisations manage applets on the same card?

        
      
      

        
Yes. Because each Security Domain holds its own keys, a payment network can manage its applets independently of a telecom operator's applets on the same card, with the Card Manager routing APDUs and enforcing lifecycle policy.

      

    

    
    

      
        
What is the smart card glossary and who is it for?

        
      
      

        
The smart card glossary is a comprehensive reference of technical terms, acronyms, and concepts used in smart card technology. It covers protocols (APDU, T=0, T=1), security (Common Criteria, EAL, HSM), hardware (SE, EEPROM, contact pad), and applications (EMV, ePassport, eSIM). It serves developers, product managers, and engineers.

      

    

    
    

      
        
Are the glossary definitions available in other languages?

        
      
      

        
Yes. SmartCardFYI provides glossary definitions in 15 languages including English, Korean, Japanese, Chinese, Spanish, Portuguese, Hindi, Arabic, French, Russian, German, Turkish, Vietnamese, Indonesian, and Thai.