HCE (Host Card Emulation)

What Is HCE?

Host Card Emulation (HCE) is a technology introduced in Android 4.4 (KitKat, 2013) that enables smartphones to emulate NFC smart cards entirely in software, without requiring a hardware secure element. HCE routes card emulation mode traffic directly to an Android application running on the device's main processor, democratizing NFC payment and access control development.

How HCE Works

In traditional card emulation, the NFC controller routes all incoming commands from an external reader to a hardware secure element, a tamper-resistant chip that stores cryptographic keys. The host processor is not involved in the transaction. HCE changes this routing so commands go to an Android service instead.

The architecture involves three layers:

1. NFC controller. Detects the RF field and handles the physical layer (NFC-A or NFC-B protocol).
2. Android NFC service. Routes incoming Application Protocol Data Units (APDUs) to the registered HCE service based on the Application ID (AID).
3. HCE application. Processes APDUs, performs authentication, and returns response data.

When a POS terminal sends a SELECT command with a specific AID, Android routes it to the HCE service registered for that AID. The application then handles the full EMV transaction flow in software.

HCE vs Secure Element

The most significant advantage of HCE is openness. Before HCE, deploying a card emulation application required negotiating access to the SIM-based or embedded secure element with mobile carriers or device manufacturers. HCE removed this barrier entirely.

Security Model

HCE compensates for the absence of hardware key protection through several mechanisms:

Tokenization. Instead of storing the actual card PAN (Primary Account Number), HCE applications use limited-use tokens issued by the card network. Each token is valid for a small number of transactions and is geographically restricted, minimizing fraud risk if the token is compromised.

Cloud-based keys. Cryptographic keys for generating transaction cryptograms can be stored on a remote server and fetched as needed. This requires network connectivity but provides strong key protection.

Android Keystore / TEE. On supported devices, keys are stored in the Trusted Execution Environment (TEE), which provides hardware-backed isolation without a dedicated secure element.

Applications Beyond Payments

HCE enables a wide range of NFC applications beyond contactless payment: building access control, loyalty cards, transit passes, student IDs, and corporate badges. Any ISO 14443-4 smart card application can be emulated using HCE, making it a versatile platform for NFC-based identity and access solutions.