Embed Size (px)
Citation preview
2 | Enabling Commerce Across the Internet of Things
FRAMEWORK’ ‘IOT COMMERCE
The world of the Internet of Things (IoT) is evolving rapidly. The number of IoT connected devices is estimated to reach 50 billion by 2020 according to Cisco, and more companies are investing in IoT technologies to drive operational efficiency, improve product performance, enhance the customer experience and enable new value-added services.
Form factors – from cards to digital solutions – are advancing now more than ever and technology has reached a point where we can deliver secure transactions, irrespective of form factor, all while promoting consumer choice and stronger engagement. It is quite a significant shift. The disruptive business models that have begun to form will impact businesses across industries, demanding new approaches that can provide seamless usability, security, and scalability.
The days of programming VCRs with limited storage and driving out to Blockbuster stores to pick up videos are long behind us. Today, services like Netflix allow for instant viewing, personalized recommendations, and virtually endless options of content. Similarly, IoT Commerce has the potential to enhance our way of life and simplify how we purchase and sell products and services by helping automate the identification of a need, the decision-making process, and the payment experience. IoT device owners are able to set personal preferences, configure rules around how to manage their order and payments details, and interact via their preferred channels.
Thus far, solutions in this space have taken a piecemeal approach to enabling IoT Commerce, often involving a single device and limited use cases. This heterogeneity may impede the rapid growth required for successful implementation and adoption in the broader IoT space. The current lack of consistency in basic principles has created confusion for both solution providers and end-users, ultimately slowing the integration of commerce within the IoT.
To address these issues and help accelerate growth in IoT Commerce, Mastercard and Accenture are investigating and defining the requirements of this new ecosystem of commerce-enabled IoT devices and IoT platforms to support them. This includes outlining a uniform set of principles to be considered and adopted by stakeholders so that commerce on IoT devices can be developed with the same interoperability and scale we’ve come to expect from electronic commerce.
Our white paper introduces to the IoT Commerce community and industry at large, a common framework outlining eight core capabilities that we believe will be key to helping build a ubiquitous, secure IoT Commerce experience.
Here, in the first of a two-part series, we examine the first four capabilities identified in our framework: (i) Devices, (ii) Lifecycle Management, (iii) Transactions, and (iv) Enablement & Management. Each of them will be fundamental to equipment manufacturers, issuers, card networks and commerce service providers seeking to deploy IoT Commerce.
EXECUTIVE SUMMARY: INTRODUCING THE
Enabling Commerce Across the Internet of Things | 3
COMING OF AGEAs the IoT world matures, we’re seeing the same progression we saw with the internet 20 years ago (albeit, at a faster rate): an initial focus on information dissemination, followed by commerce and revenue-generating use cases based upon a critical mass of users. We are now drawing close to a similar tipping point, and there is fast-growing interest from new entrants and players seeking to capitalize on the promise of a commerce-enabled IoT ecosystem.
So what does commerce-enabled IoT look like? To be commerce-enabled, an IoT device must include an embedded system that replicates the actions of a human interacting with commerce platforms such as Amazon or the eBay marketplace. To bring this to life, imagine browsing and shopping on an e-commerce site. Now, picture your screen navigation and associated clicks being performed by an IoT device. It’s important to note that the degree of automation/artificial intelligence will vary, depending on the specific use cases, the set of initial configurations and choices selected by the owner, organizational policy, and the regulatory compliance required. It is critical for the adoption of IoT Commerce that devices should be able to interact via API with existing commerce sites as users would, so that there is no requirement to significantly modify existing sites to adopt IoT Commerce.
We define IoT Commerce as the ability of IoT devices (together with a back-end platform) to autonomously execute the following main activities:
Human steps (now IoT device steps), including, but not limited to:• recognizing when a purchase is intended
based on a predetermined signal
• identifying the specifications of the product and/or service required
• selecting the right supplier from a list of suppliers, or selecting a predetermined supplier per pre-set requirements
• connecting to the supplier’s commerce platforms/websites
• providing shipping address and shipping method, and tracking shipment and delivery, or confirming the completion of services.
B2B and B2C payment transactions, in terms of: • providing a predetermined payment method
(debit, credit, checking account, store value card, gift card, cryptocurrency, etc.) or choosing the most feasible and preferred payment method from multiple options
• authenticating as a legitimate buyer (including verifying identity and authorization, for example, with multi-factor authentication as in 3D secure or other industry standards)
• authorizing the transaction, and receiving acknowledgment that payment has been confirmed by the supplier’s commerce platforms/websites.
IoT Commerce also involves the sale of products and services, where the seller’s IoT devices are able to autonomously identify when a buyer needs a product or service, connects to the buyer’s system, selects a payment method, and executes the sale. Another example of an IoT device involved in selling, is an autonomous car (an IoT device with a different form factor) can receive requests and sell a service autonomously, such as a ride purchased by a human.
IOT COMMERCE
4 | Enabling Commerce Across the Internet of Things
The value of IoT Commerce is that it can make our lives smarter and simpler. The goal should be to enable devices to provide utmost security, identification and authentication, and intelligence to assist and provide a seamless commerce experience. The same principle applies to the design of trading algorithms to manage stock markets. The key here is the purchase “decision” rather than simply the automation of a payment transaction.
There is also meaningful value in the pre- and post-transaction activities. But before this value can be captured, multiple questions must be answered: What kind of credentials should be used? How will they be secured? How will devices transmit data to each other? How will credentials be linked to real funds? How do we trust the devices to secure this information? How will we know the information is used as wisely as the owner would have done (without the owner having to do it)? What incentives are there for merchants and users to adopt IoT Commerce?
Users will benefit when payment is seamless within the overall IoT experience. It’s what we’ve seen with ride-sharing services, which have popularized the concept of invisible payments by focusing on the experience instead.
SHOW ME THE VALUE:
LEARNING THE LESSONS OF MOBILE PAYMENT
There is also meaningful value in the pre- and post-transaction activities. But before this value can be captured, multiple questions must be answered:
Enabling Commerce Across the Internet of Things | 5
6 | Enabling Commerce Across the Internet of Things
Mastercard and Accenture believe the core capabilities in our Framework (see below) are key to the successful adoption and deployment by organizations of seamless and secure IoT Commerce solutions. By providing a set of principles for all ecosystem players and partners, the Framework is designed to propose the same interoperability and scale that we’ve come to expect from electronic payments.
A FRAMEWORK FOR
SECURE, UBIQUITOUS IOT COMMERCE
CAPABILITY FRAMEWORK TO IMPLEMENT IOT COMMERCE 1.0 Devices The various channels and devices
for IoT Commerce transactions
2.0 Lifecycle Management
Capabilities required to acquire/manage and care for customers and merchants
3.0 Transaction Capabilities needed to process a transaction
4.0 Enablement and Management
Capabilities needed to enable IoT Commerce
5.0 Loyalty and Rewards Capabilities needed to help drive IoT Commerce adoption
6.0 Technology Enabling technologies required for IoT Commerce
7.0 Organizational Organizational functions like Legal and HR needed to support IoT Commerce deployment
8.0 Ongoing Regulatory and Governance
Capabilities needed to meet regulatory and corporate governance requirements
Enabling Commerce Across the Internet of Things | 7
We’ve identified several categories of commerce-enabled IoT devices. Each of these categories may include IoT devices with various form factors ranging from devices with embedded sensors and firmware to devices with contactless or remote transaction capabilities. These can autonomously make a purchase or generate purchase requisition for approval via mobile app or a dedicated UI on the device itself.
Sample use cases include:
1. IoT Commerce enables home and office appliances to automatically reorder items like groceries and office supplies as well as open up a new contextual channel for consumers to order goods and services
2. Motor vehicles, trains, ships and airplanes with onboard systems that can autonomously make purchases or generate purchase requisitions for user acknowledgement and consent
3. Connectivity and intelligence built into industrial products enable OEMs to derive additional service revenue from IoT Commerce by allowing industrial and building equipment to manage and harness signals, alerts, and data collected from connected assets; IoT Commerce provides the ability to automatically order maintenance and repair parts and services from suppliers
4. Medical devices with embedded sensors and firmware that detect when a medical device needs to be re-calibrated or replaced
5. IoT Commerce enables contactless payments capabilities, such as NFC, to be embedded in wearables for seamless POS transactions. For example, a wearable device that allows for a ‘tap and pay’ entrance fee to a venue, allowing a new express entrance line for guests that don’t have to interact with a ticket office or attendant.
Commerce-enabled IoT devices are currently proprietary capabilities, with fierce competition between manufacturers in this space. This is holding back the emergence of ubiquitous IoT Commerce, to the detriment of all stakeholders.
1.0 DEVICES: THE VARIOUS CHANNELS ANDDEVICES FOR IOT TRANSACTIONS
8 | Enabling Commerce Across the Internet of Things
When it comes to IoT Commerce-enabled devices, the business logic around the purchase decision during pre-transaction, during transaction and post-transaction side can run:
• In the cloud: The IoT device is a sensor that captures and transmits data to the cloud via API with no decision capability
• On the IoT device: The device can have embedded intelligence and logic to make decisions in concert with the commerce platform running in the cloud
• Both: The logic can be shared between the IoT device and the commerce platform. Similar to mobile commerce with a user’s wallet app on the smartphone that communicates via API with the mobile commerce platform in the cloud, some of the business logic can run on the IoT device while exchanging information via API with the IoT Commerce platform in the cloud.
The intelligence capabilities of an IoT device will vary across OEMs, commerce service providers, and their business model and intellectual property. The ability for an IoT device to receive delegation for trust from their owner in the form of preference management is central to IoT commerce. OEMs that choose to go with intelligent IoT devices, with capabilities similar to mobile wallets, will include applications that are generally in the form of a system on chip (SOC).
IoT Commerce SOC must support proximity-based payments, as well as medium- and long-distance wireless and wired payments leveraging low and high data rates, depending on the use case.
Because this capability is fundamental to all IoT Commerce-enabled devices, the industry would benefit from a set of shared standards that can establish standardized inter-connectivity across device manufacturers, card networks and issuers.
Enabling Commerce Across the Internet of Things | 9
Lifecycle Management entails the acquisition, management and termination of the customer relationship (2.1) and the merchant’s relationship with the commerce service provider (2.2).
2.1 Customer lifecycle managementIoT Commerce is just another commerce channel and commerce service providers, device manufacturers, card networks and issuers should all define a customer strategy that includes how to acquire new users. The following proposed sub-capabilities should be taken into consideration:
• Customer identification: A set of standards will have to be defined around associating key data sets to identify devices for any cardholder or customer account
• Terms and conditions: Any IoT Commerce device should be able to seamlessly incorporate required terms and conditions, to balance legal requirements with customer experience in this new form
• Customer service: An IoT Commerce-enabled device should be able to recognize when a customer service issue arises and alert the customer (eg. when a transaction is declined or there is an error during the transaction)
Account management and customer service are all proprietary capabilities where commerce service providers and card networks will continue to compete with each other. However, customer identification and T&Cs are fundamental capabilities where the industry will benefit from common standards.
2.2 Merchant lifecycle managementCommerce service providers, device manufacturers, card networks and issuers will need to align and define a merchant strategy for acquiring merchants into this new space as well as leverage existing infrastructures and common standards like NFC to help drive consumer adoption and scale. The following sub-capabilities should be taken into consideration:
• Fraud prevention: This should not be any different from the role merchant acquirers play today. Acquirers must be able to assess the risk of a merchant to ensure the prevention of fraud committed through IoT devices
• Data transparency: The need to accommodate at a network level and to share with merchants which devices are enabling payments/transactions and from where a token was requested.
• Merchant onboarding: Commerce service providers should make merchant onboarding as frictionless as possible by providing tailored technology support, account management, taking into account security, transparency, and consumer data protection. It’s critical for the adoption of IoT Commerce that devices ought to be able to interact with existing merchant sites as humans would, so that there is no need to significantly modify existing sites to adopt IoT Commerce.
2.0 LIFECYCLE MANAGEMENT:THE CAPABILITIES REQUIRED TO ACQUIRE/MANAGE AND CARE FOR BOTH CUSTOMERS AND MERCHANTSIN THE IOT COMMERCE WORLD
10 | Enabling Commerce Across the Internet of Things
3.0 TRANSACTION: THE TRANSACTIONAL CAPABILITIES NEEDED TO PROCESS AN IOT COMMERCE TRANSACTION
Whether the IoT Commerce journey begins with a smart appliance or a connected car, it should allow for a consumer to efficiently and seamlessly complete their desired transaction. As the digital world continues to evolve, customer expectations of swiftness within commerce will only increase – from minimal clicks, to one-click, to no clicks. IoT Commerce must both compete and coexist against several existing methods, namely web and in-app. A true paradigm shift to a successful IoT Commerce ecosystem must deliver a valuable, easy, and secure experience. A number of issues must be considered from a customer and merchant perspective:
3.1 Customer perspectiveThere are three critical components to be considered from the customer perspective:
• A clear interaction mechanism with the user: because a visual user interface is often lacking, IoT Commerce must be incorporated into devices in a way that reduces the input required from users while allowing them to manage their own device configuration and preferences.
• New methods of authentication: existing methods of typing information and passwords, are not sufficient, on their own, to provide a seamless user experience. The IoT’s promise of ease and convenience must include methods for users to securely authenticate via API in a contextually beneficial way. We must transition away from the default of typing in information, passwords, and engaging with a keyboard.
• Simple and invisible payments: the user should ideally have limited to no direct interaction with payment methods beyond any initial set-up. The commerce journey must be built in such a way that after a user has confirmed their intent to transact, the IoT device can complete the rest of the process itself based on pre-set parameters established by the device owner. Context is also critical when building out IoT Commerce components. Consideration of the overall use case and methods of interaction must help drive development of the associated technology. For example, commerce through a home-hub via voice will ideally tether its experience to itself, with minimal interaction with other traditional devices (ie. mobile phone, tablet, desktop, etc.) and only provide alternative options if the use case dictates.
Enabling Commerce Across the Internet of Things | 11
3.2 Merchant perspectiveWith regard to the transactional capabilities of IoT Commerce, the underlying transaction model is similar to that of a traditional one involving four key players – a consumer, a merchant, an issuer, and an acquirer. After a consumer begins a transaction, the issuer authorizes the transaction and the flow of payment continues through to the acquirer and merchant. Three key issues arise:
• Payment processing: although this area may be familiar, there are several layers that will require updating for IoT Commerce. IoT Commerce can and often will involve many devices that are all connected, making it essential to have a payment transaction model that can flex to the use case. Whether it’s ordering a delivery off a home central hub or ordering a morning coffee through the car, players in the ecosystem are required to think through and comprehensively account for the context of the transaction and data exchange for facilitating the commerce transaction
• Risk management: determining what sort of data and credentials are passed across which devices and players will dictate how
information is handled and must drive alignment in the ecosystem, especially as new entrants like OEMs and integrators enter the marketplace. As incremental information is passed across multiple devices by multiple parties this new data will have to be permissioned for the device / ecosystem partners, and these components must evolve to match the advancement of IoT Commerce
• Data protection and fraud: clear ownership of liability, education of data privacy standards, and the continual deployment of fraud detection to the broader IoT space is mandatory. It will also be important to define, align, and enforce new standards of regulatory governance. As more AI is introduced into the IoT world (in areas like auto-replenishment, sensors, data and analytics), IoT Commerce should convey the same standards of assurance as a secure transaction using traditional methods. From device OEMs to integrators to payment platforms to merchants and so on, all parties will be stakeholders in the foundation of a safe commerce experience within the new world of the IoT.
12 | Enabling Commerce Across the Internet of Things
4.0 ENABLEMENT & MANAGEMENT: THE CAPABILITIES THAT COMMERCE SERVICE PROVIDERS, OEMS AND ISSUERS NEED TO ENABLE IOT COMMERCE
4.1 IoT Commerce device enablement: This sub-capability entails adding the commerce function into an existing commercial product by modifying the physical and technical specifications and with the optional ability to communicate via standard communication protocols (eg. Bluetooth, Wi-Fi, etc.) with an app installed on smartphones, tablets etc. In order to differentiate themselves, each OEM is expected to determine its own path forward.
4.2 Payment accountThis sub-capability relates to how various payment products (debit, credit, private label card, checking account, cryptocurrency, etc.) are stored by the consumer in the IoT device, whether directly via:
• UI screen on the actual device (eg. adding a tab on a photocopy machine mini-screen)
• an app on a mobile device that transmits the card details to the IoT device, or
• a mobile wallet (eg. Masterpass, Bank wallet, Apple Pay, Android Pay, etc).
Overall, there should be a standardized way of adding, storing, managing and removing card details (either the Primary Account Number [PAN] or a token).
4.3 SecurityFor IoT Commerce to work effectively and at scale, the security of IoT transactions must be established beyond question.
Nothing will undermine the value-generating potential of the IoT more than uncertainty over whether critical data is safe from breach, unauthorized transaction or misuse. This will be especially true as more and more devices become part of the equation. For the expected billions of connected devices to create smart decisions (often autonomously), they’ll have to be entrusted with sensitive user information. The use case of a refrigerator proactively reordering a service part requires, at a minimum, awareness of the owner’s identification and location and access to their payment credentials. To avoid repudiation of transactions, it will be necessary to define a secure mechanism to recognize devices. Data security can be an even more sensitive issue in medical situations (for example where a glucose meter is required to reorder test strips).
The large amounts of data required in more complex use cases can create even more challenges. Consider a company that owns a group of printers that can share ink-level statuses to determine when bulk orders should be made (based on predicted usage patterns). Not only do the owner’s name and credentials have to be accessible on each edge device, but the location, frequency of use and awareness of all devices (along with owner preferences) are all part of the information that must be secured. Contextual and historical data will be best managed in a secure cloud infrastructure linked to these devices, and a trusted service should be required to manage that.
Enabling Commerce Across the Internet of Things | 13
We believe that any comprehensive security program should include six major components:
• Governance: define policies, procedures, service-level requirements
• Users and identity: design, manage and monitor user access
• Application: manage how applications are distributed, provisioned and accessed
• Data: manage data security by classifying, authenticating, and encrypting data
• Network: manage communications and connectivity over the network
• Devices: manage how devices can be accessed and how they connect to enterprise systems.
Card networks and issuing banks are required to partner with OEM devices manufacturers to verify that all IoT devices are certified and tested to confirm adherence to the card network’s PCI compliance requirements. In addition to tokenization for PCI compliance, we encourage merchants to take this a step further with tokenization of Personal Identifiable Information (PII data).
Security is a fundamental capability for the industry and common security standards will help to accelerate uptake of IoT Commerce. Although both capabilities below are proprietary, collaboration between participants in each area will help build a seamless IoT Commerce marketplace.
4.4 IoT device managementNon-commerce IoT devices will be managed in many ways, from physical and logistical aspects, to software and security. A strong device management system helps provision both devices and applications, distribute software updates, track device configuration, and remotely track data from devices that have been lost or stolen. This capability already exists in the market from IoT Connected Platform providers. However, the management capability of the commerce firmware application running independently will have to be orchestrated between OEMs, issuers, and commerce service providers to enable the procurement, deployment, configuration, performance monitoring, tracking and erasing of payment credentials and transactions data, along with updating and uninstalling the commerce application. There should be common standards governing how this orchestration of sub-capability is handled between the various players.
14 | Enabling Commerce Across the Internet of Things
SEAMLESS IOT COMMERCE
TOWARD
In this white paper we’ve established the need for a uniform framework that all stakeholders in the IoT Commerce ecosystem can help develop and use to roll out their offerings. Because some of the capabilities required are fundamental to all participants, we believe there’s an urgent requirement for standardization to help confirm the secure interoperability of IoT devices, at scale.
In the follow-up white paper, we’ll be featuring the remaining four core capabilities in our IoT Commerce Capability Framework.
Enabling Commerce Across the Internet of Things | 15
LEAD AUTHORS
Diegane Dione Senior Manager, Accenture Digital [email protected]
Gregory Riche Senior Manager, Accenture Digital [email protected]
Joshua Cho Vice President, Commerce for Every Device, Mastercard
CONTRIBUTORS
Robert Hasson Managing Director, Accenture Digital [email protected]
Piergiorgio Rettaroli Senior Manager, Accenture Digital [email protected]
Kiki Del Valle Senior Vice President, Commerce for Every Device, Mastercard [email protected]
16-3197
Copyright © 2016 Accenture All rights reserved.
Accenture, its logo, and High Performance Delivered are trademarks of Accenture.
This document is produced by consultants at Accenture as general guidance. It is not intended to provide specific advice on your circumstances. If you require advice or further details on any matters referred to, please contact your Accenture representative.
ABOUT ACCENTURE DIGITALAccenture Digital, comprised of Accenture Analytics, Accenture Interactive and Accenture Mobility, offers a comprehensive portfolio of business and technology services across digital marketing, mobility and analytics. From developing digital strategies to implementing digital technologies and running digital processes on their behalf, Accenture Digital helps clients leverage connected and mobile devices; extract insights from data using analytics; and enrich end-customer experiences and interactions, delivering tangible results from the virtual world and driving growth. Learn more about Accenture Digital at
www.accenture.com/digital.
ABOUT ACCENTUREAccenture is a leading global professional services company, providing a broad range of services and solutions in strategy, consulting, digital, technology and operations. Combining unmatched experience and specialized skills across more than 40 industries and all business functions—underpinned by the world’s largest delivery network—Accenture works at the intersection of business and technology to help clients improve their performance and create sustainable value for their stakeholders. With approximately 384,000 people serving clients in more than 120 countries, Accenture drives innovation to improve the way the world works and lives.
Visit us at www.accenture.com.
ABOUT MASTERCARDMastercard (NYSE: MA), is a technology company in the global payments industry. We operate the world’s fastest payments processing network, connecting consumers, financial institutions, merchants, governments and businesses in more than 210 countries and territories. Mastercard products and solutions make everyday commerce activities – such as shopping, traveling, running a business and managing finances – easier, more secure and more efficient for everyone. Follow us on Twitter @MastercardNews, join the discussion on the Beyond the Transaction Blog and subscribe for the latest news on the Engagement Bureau.
