Mobile phone app (iOS)

The NBT Brand Protection mobile phone app (view on GitHub) is a Swift-based Xcode project which showcases the OPTIGA™ Authenticate NBT in the brand protection (BP) with offline authentication use case.

Installation

Instructions to build the app and install it on an iOS device can be found in the README file of the GitHub repository (view on GitHub).

Software architecture

The application is structured using the MVVM (Model-View-ViewModel) pattern and utilizes the modules of the OPTIGA™ Authenticate NBT Host Library for Swift. The library modules are included in the Libraries/optiga-nbt-lib-swift folder and added as dependencies to the Xcode project.

All the essential cryptographic-specific functionalities in this example application are provided by the Swift Security package.

../../_images/nbt_bp_ios_software_architecture.png

Fig. 49 High-level software architecture of the iOS app.

Components

  1. Mobile application:

    • HomeView: Displays the main interface for verifying brand protection tags.

    • BpUseCaseManager: Manages the brand protection use case logic, including certificate verification and authentication.

    • CertificateVerificationViewModel: Handles the business logic for verifying certificates.

    • AuthenticationViewModel: Manages the authentication process and signature verification.

  2. OPTIGA™ Authenticate NBT host library (in Libraries/optiga-nbt-lib-swift):

    • CommandSet: APIs for sending APDU commands.

    • CommandBuilder: Constructs APDU commands.

    • ResponseParser: Parses responses from the NFC tag.

  3. Communication channel:

    • NfcChannel (from Libraries/InfineonChanneliOSNfc): Implements the communication interface for NFC using Core NFC.

    • NFCSessionManager (in Services/): Manages Core NFC sessions and tag communication.

Application flow

When tapping a brand protection-configured OPTIGA™ Authenticate NBT to the NFC antenna of the mobile phone, the NDEF file holding the certificate is read and verified. Afterwards, the application will notify the user about the validity of the certification data on the OPTIGA™ Authenticate NBT. After a few seconds, the user interface will reset to its initial state and wait for another OPTIGA™ Authenticate NBT tag to verify.

../../_images/nbt_bp_ios_ui.png

Fig. 50 Visualization of the app’s views during operation.

The first and only view to be started is the HomeView, which is waiting for the OPTIGA™ Authenticate NBT sample to be read out. Once the NFC tag with an NDEF file is detected, an intent is called to read out and process the content of the file.

Further processing steps are handled by the BpUseCaseManager class and its underlying methods, which are triggered by the performBrandVerification() method. The respective steps include:

  1. Parse the certificate from the tags NDEF message (By the NDEF handler interface (INdefHandler) and InfineonHandler (using libraries by Infineon Technologies) - can also be done by the IOSHandler using iOS libraries)

  2. Verify the certificate (verifyCertificate())

  3. Send an authenticate command (authenticate()) with a random challenge (generated in the constructor) to recieve a signature from the OPTIGA™ Authenticate NBT

  4. Extract the public key from the root certificate and verify the signature received in the previous step (verifySignature())

Application details

The application is developed using Xcode and follows the standard iOS project structure.

Project layout

The project is structured as a standard Xcode project with a modular folder layout:

Listing 18 Project layout (simplified).
optiga-nbt-example-bp-ios/
├── docs/                            # Documentation and images
├── InfineonNBTBP/                   # Main app target
│   ├── Business/                    # Business logic and view models
│   ├── Presentation/                # SwiftUI views, assets, and resources
│   ├── Services/                    # Service classes (e.g., NFC, logging)
│   ├── InfineonNBTBP.entitlements   # App entitlements
│   └── InfineonNBTBP.plist          # App configuration
├── LICENSES/                        # License files
├── Libraries/                       # External and internal library modules
│   ├── InfineonChanneliOSNfc/       # Infineon NFC channel library for iOS
│   ├── InfineonConsoleLogger/       # Infineon console logger library
│   └── optiga-nbt-lib-swift/        # OPTIGA™ Authenticate NBT Host Library for Swift
├── InfineonNBTBP.xcodeproj/         # Xcode project file
├── LICENSE                          # License information
└── README.md                        # Project documentation

Project configuration

This can be done in the project settings in Xcode:

  • Deployment Target: Set to iOS 15.0 or later.

  • Swift Language Version: Set to Swift 5.0 or later.

  • Signing & Capabilities: Ensure the app has the necessary entitlements for NFC access.

Certificates for verification

Table 12 Certificates used by the application. :header-rows: 1 :widths: 30 30 40

Filename

Path

Comment

SampleRootCertificate.pem

app/src/main/res

OPTIGA™ Authenticate NBT dummy manufacturing certificate

NFCBridgeCLTagDevices-ManufacturingCA.pem

app/src/main/res

Infineon NFC bridge and CL tag devices manufacturing certificate

See Keys and certificates for a detailed list of keys and certificates used by the provided applications.

Integration of the Swift host library

The OPTIGA™ Authenticate NBT Host Library for Swift is included in the project as a module. The library provides the necessary APIs for sending APDU commands to the OPTIGA™ Authenticate NBT device. The library is located in the Libraries/optiga-nbt-lib-swift folder and is added as a dependency in the Xcode project. The app uses the library’s APIs to construct and send APDU commands, handle responses, and manage NFC communication. The library is structured into several modules, including:

  • CommandSet: Contains APIs for sending APDU commands to the OPTIGA™ Authenticate NBT device.

  • CommandBuilder: Provides methods to construct APDU commands.

  • ResponseParser: Parses responses from the OPTIGA™ Authenticate NBT device.

Usage of NFC in the app

The app uses Core NFC to communicate with the OPTIGA™ Authenticate NBT device. NFC sessions are managed by the NFCSessionManager class in the Services layer, using NFCNDEFReaderSession and NFCISO7816Tag for APDU-level communication.

NFC Capability enabled in Xcode:

In your Xcode project, select your target → Signing & Capabilities tab → click + Capability → add Near Field Communication Tag Reading.

NFC Usage Description:

To comply with App Store guidelines, you must provide a usage description for NFC in your app’s Info.plist file. This informs users why your app needs access to NFC functionality. To add the NFC usage description, you can either edit the Info.plist file directly or use Xcode’s property list editor. The key is NFCReaderUsageDescription, and the value should be a string explaining why your app uses NFC. To add the NFC usage description in the Info.plist file, you can use the following XML snippet:

Listing 19 Project layout.
<key>NFCReaderUsageDescription</key>
<string>This app uses NFC to communicate with the OPTIGA Authenticate NBT device.</string>

This can also be specified in the Xcode project settings.

NFC Entitlement in .entitlements file

To enable NFC functionality, the app must have the appropriate entitlements. The following key is added to the InfineonNBTADT.entitlements file: This enables NFC hardware access at the system level.

Listing 20 Add NFC entitlement.
<key>com.apple.developer.nfc.readersession.formats</key>
<array>
   <string>TAG</string>
</array>
Listing 21 Add NFC entitlement for ISO7816 tags with the the NFC Type 4 Tag application ID (AID).
<key>com.apple.developer.nfc.readersession.iso7816.select-identifiers</key>
<array>
   <string>D2760000850101</string>
</array>

This entry allows your app to use Core NFC to select and communicate with ISO7816 tags that have the specified AID (D2760000850101).

Session handling:

NFC sessions in the iOS app are managed by the NFCSessionManager class, located in InfineonNBTADT/Services/NFCSessionManager/NFCSessionManager.swift.

  • NFCSessionManager implements the NFCTagReaderSessionDelegate protocol.

  • When an NFC operation is required (e.g., the user selects “Read” or “Write”), the app calls startNFCTagReaderSession(withAlertMessage:):

    • Creates a new NFCTagReaderSession for ISO14443 tags.

    • Sets the delegate to NFCSessionManager.

    • Starts the session with .begin() and displays an alert message to the

      user.

  • When a tag is detected, the delegate method tagReaderSession(_:didDetect:) is called:

    • A NfcChannel is created for the tag and session.

    • The channel is wrapped in an ApduChannel and a NbtCommandSet is created.

    • The app connects to the tag, selects the application, and executes the ADT use case logic (read or write).

  • If the session is invalidated (e.g., user cancels or an error occurs), tagReaderSession(_:didInvalidateWithError:) is called:

    • The session is cleaned up.

    • The UI is updated with the appropriate state or message.

  • Session state and messages are published using @Published properties, allowing the UI to react to changes.