Introductions - History 1950s - The proliferation of plastic cards started in the USA 1970s - It possible to integrate data storage and processing logic on a single silicon chip 1974 - Roland Moreno registered his smart card patents in France 1984 - The French PTT (postal and telecommunications services agency) successfully carried out a field trial with telephone cards
The primary tasks of a smart card operating system Transferring data to and from the smart card Controlling the execution of commands Managing files Managing and executing cryptographic algorithms Managing and executing program code.
Smart Card OS - I/O I/O manager Protocol state machine Send block Send byte Send bitReceive bit Receive byte Receive block Hardware Data flow
Data transmission Structure of a character for data transmission 31245678 Start bitParity bit high low t
Data transmission conventions (a) direct convention, (b) inverse convention
Data transmission Protocols ProtocolMeaning T=0Asynchronous, half-duplex, byte oriented [ISO-7816-3] T=1Asynchronous, half-duplex, block oriented [ISO-7816-3] T=2Asynchronous, full-duplex, block oriented [ISO-10536] T=3Full duplex; not yet specified T=4Asynchronous, half-duplex, byte oriented, extension of T=0, not yet specified T=5 … T= 13 Reserved for future use, not yet specified T=14For national use, not standardized by ISO T=15Reserved for future use, not yet specified
Message structure (APDU) Structure of the command APDU
Message structure (APDU) Structure of the response APDU
ClassApplication 0XStandard commands compliant with ISO/IEC 7816- 4/7/8 80Electronic purses compliant with EN 1546-3 8XApplication-specific and company-specific commands (private use) 8XCredit cards with chips, compliant with EMV A0GSM mobile telecommunication system compliant with GSM 11.11
User Identification Symmetric unilateral Authentication Asymmetric unilateral Authentication Symmetric mutual Authentication Smart Security Attacks at the social level Attacks at the physical level Attacks at the logical level
Attacks on smart cards 1/2 Attacks at the social level attacks that are primarily directed against people that work with smart cards can only partially be countered by technical measures Attacks at the physical level it is necessary to obtain physical access to the smart card microcontroller hardware can be static or dynamic
Attacks on smart cards 2/2 Attacks at the logical level most known successful attacks on smart cards arise from pure mental reflection or computation classical cryptanalysis, known faults in smart card operating systems and Trojan horses in the smart card application.
Power Analysis Attacks Simple Power Analysis (SPA) is power analysis based on single power generated by an algorithm run on a smart card. Differential Power Analysis (DPA) is a technique where power traces are combined in a statistical manner to obtain information about the algorithm running on the smart card.
The Smart Card Life Cycle 1/3 Phase 1: Production of the chip and the smart card Designing the chip Generating the smart card operating system Fabricating the chips and modules Producing the card body Embedding the module in the card body
The Smart Card Life Cycle 2/3 Phase 2: Card preparation Completing the smart operating system Phase 3: Application preparation Initializing the applications(s) Personalizing the applications(s), both visually and electrically
The Smart Card Life Cycle 3/3 Phase 4: Card usage Activating the applications Deactivating the applications Phase 5: Termination of card usage Deactivating the applications Deactivating the card
The GSM System The subscriber identity module (SIM) Security Subscriber identification SIM authentication Data encryption
The GSM System Data storage Dialing numbers Short messages Mobile telephone settings Subscriber information SIM characterization Managing services and supplementary applications Subscriber administration
The UMTS System Third generation of mobile telecommunications system - Universal Mobile Telecommunication System (UMTS) Universal Subscriber Identity Module (USIM) UMTS security builds on the security of GSM UMTS uses mutual authentication
Important Standards for USIM StandardTitle TS 21.111USIM and IC card requirements TS 31.102Characteristics of the USIM Application TS 31.110Numbering system for the telecommunication IC card application TS 31.111USIM Application Toolkit (USAT) TS 31.121USIM Application Test Specification TS 31.122USIM Conformance Test Specification TS 102.221Physical and Logical Characteristics TS 102.222Administrative Commands