DEV Community

Cover image for 🟢 Android HCE Deep Dive: ISO-DEP, APDU & NFC Type 4 Tag Architecture (Part 1)
Sushil Kumar Prajapat
Sushil Kumar Prajapat

Posted on

🟢 Android HCE Deep Dive: ISO-DEP, APDU & NFC Type 4 Tag Architecture (Part 1)

#android #hce #nfc #kotlin

This article gives you the foundational knowledge you need to build production-grade NFC applications on Android — a topic often glossed over in basic tutorials.

  • why a developer should care
  • what problem they’ll solve by reading this

In this article, you’ll learn how NFC works under the hood — from protocol layers to real card emulation structures — so you can confidently build production-ready Android HCE solutions.

Introduction

Host-based card emulation (HCE) turns an Android device into a contactless smart card without requiring secure hardware. This is the same technology behind mobile payments, access control, and NFC-based identity systems. In this article, you’ll learn how HCE works at the protocol level — from ISO-DEP and APDU to the Type 4 Tag architecture — so you can build reliable, production-ready Android NFC systems.

This is the same underlying technology used in:

  • Mobile payments
  • Access control systems
  • Digital identity cards
  • Smart ticketing
  • Enterprise badge systems

In this article, we’ll deeply explore:

  • NFC architecture layers
  • ISO-DEP protocol
  • APDU command structure
  • NFC Forum Type 4 Tag
  • NDEF file system structure

This is a technical deep dive for intermediate and advanced Android developers.

🔵 1. NFC Architecture Explained

Although NFC doesn’t strictly follow the OSI model, it can be logically understood in three layers:

+----------------------------+
|      Application Layer     |
|  (NDEF, Smart Card Logic)  |
+----------------------------+
|       Data Link Layer      |
|  (ISO-DEP, Error Control)  |
+----------------------------+
|       Physical Layer       |
|  (RF 13.56 MHz, NFC-A/B)   |
+----------------------------+
Enter fullscreen mode Exit fullscreen mode

Physical Layer

  • 13.56 MHz RF communication
  • NFC-A / NFC-B modulation
  • Handles signal transmission

Data Link Layer

  • ISO 14443-4 (ISO-DEP)
  • Frame structure
  • Error detection
  • Reliable data transfer

Application Layer

  • NDEF (NFC Data Exchange Format)
  • APDU commands
  • Smart card logic

🔵 2. What is ISO-DEP?

ISO-DEP (ISO 14443-4) is a higher-level NFC protocol that enables structured communication using APDUs.

It builds on top of:

  • NFC-A
  • NFC-B

Why ISO-DEP Matters?
Because Android HCE only supports:

  • ISO-DEP based card emulation
  • APDU command processing Without ISO-DEP → No HCE.

🔵 3. Understanding APDU (ISO 7816-4)

APDU (Application Protocol Data Unit) is the communication format between:

  • Reader ↔ Smart Card
  • NFC Terminal ↔ Android HCE

APDU Command Structure

CLA | INS | P1 | P2 | LC | DATA | LE
Enter fullscreen mode Exit fullscreen mode
Field Meaning
CLA Class byte
INS Instruction (Select, Read, Update)
P1/P2 Parameters
LC Length of command data
DATA Payload
LE Expected response length

APDU Response Structure

DATA | SW1 | SW2
Enter fullscreen mode Exit fullscreen mode
SW1 SW2 Meaning
90 00 Success
6A 82 File not found
6A 86 Incorrect parameters

Common status words.

🔵 4. NFC Forum Type 4 Tag Architecture

Type 4 Tag is built on:

  • ISO-DEP
  • APDU communication
  • File-based system (ISO 7816)

🧩 Type 4 Tag File System

In Type 4 Tags, the Capability Container (CC) file tells the reader how the tag is structured, and the NDEF file contains the actual NFC data.

NDEF Tag Application (AID)
│
├── CC File (E103)
│
└── NDEF File (E104)
Enter fullscreen mode Exit fullscreen mode

🔵 5. Capability Container (CC) File

The CC file defines:

  • Mapping version
  • Maximum read size (MLe)
  • Maximum write size (MLc)
  • NDEF file identifier
  • Access permissions

CC File Structure

Offset 0x0000 → CCLEN
Offset 0x0002 → Mapping Version
Offset 0x0003 → MLe
Offset 0x0005 → MLc
Offset 0x0007 → NDEF File Control TLV
Enter fullscreen mode Exit fullscreen mode

🔵 6. TLV (Tag-Length-Value) Blocks

TLV structure:

T | L | V
Enter fullscreen mode Exit fullscreen mode

Example:

  • Tag = 04h → NDEF File Control TLV
  • Length = 06h
  • Value = 6 bytes describing NDEF file

🔵 7. NDEF File Structure 

+----------------------+
| NLEN (2 bytes)       |
+----------------------+
| NDEF Message         |
+----------------------+
Enter fullscreen mode Exit fullscreen mode

NLEN indicates the size of the NDEF message.

🔵 8. Complete APDU Flow (Reader → Android HCE) 

1. SELECT NDEF Application
   00 A4 04 00 07 D2 76 00 00 85 01 01 00
2. SELECT CC File
   00 A4 00 0C 02 E1 03
3. READ CC File
   00 B0 00 00 0F
4. SELECT NDEF File
   00 A4 00 0C 02 E1 04
5. READ NLEN
   00 B0 00 00 02
6. READ NDEF Message
   00 B0 00 00 <length>
Enter fullscreen mode Exit fullscreen mode

🔵 9. High-Level Architecture Diagram

HCE Architecture

APDU Sequence

🏁 Conclusion (Part 1)

In this article, we covered:

  • ISO-DEP fundamentals
  • APDU structure
  • Type 4 Tag architecture
  • CC file and TLV blocks
  • NDEF storage model

👉 In Part 2, we’ll build a full Android HCE implementation with real Kotlin code and examine how to handle SELECT and READ commands in HostApduService.

Why I Wrote This

I wrote this article to provide a deeper technical explanation of Android HCE beyond surface-level tutorials. Understanding ISO-DEP and APDU at the protocol level is essential when building reliable NFC systems.

💬 Let’s Discuss

Are you currently building an Android HCE or NFC-based application?

Do you have questions about ISO-DEP, APDU structure, or HostApduService implementation?

Drop your questions in the comments — I’d be happy to help and may address them in Part 2.

Top comments (0)