Smart Card

Cutting Edge 2005 workshop, IIT Kanpur

BRIJENDRA MOHAN EC 8th SEMESTER ROLL NO:0614331021

Cutting Edge 2005 workshop, IIT Kanpur

What are smart cards What is in smart card Classification of smart cards Security mechanisms Applications Challenges

cards (and therefore memory too) Credit card size

Cutting Edge 2005 workshop, IIT Kanpur

Processor



With or without contacts.

Cards

have an operating system

too. The OS provides  

A standard way of interchanging information An interpretation of the commands and data.

Cards

must interface to a computer or terminal through a

Classification of smart cards •Contact and contactless type smart cards •Memory and microprocessor type smart cards

Cutting Edge 2005 workshop, IIT Kanpur

A second type is the contactless smart card, in which the chip communicates with the card reader through RFID induction technology (at data rates of 106 to 848 kbit/s). The standard for contactless smart card communication. A related contactless technology is RFID (radio frequency identification). tions is

Cutting Edge 2005 workshop, IIT Kanpur

The automated chip card was invented by German rocket scientist Helmut Gröttrup and his colleague Jürgen Dethloff in 1968, The first mass use of the cards was for payment in French pay phones, starting in 1983 . The major boom in smart card use came in the 1990s, with the introduction of the smartcard-based SIM used in GSM

cards can be used for identification, authentication, and data storage. Smart cards provide a means of effecting business transactions in a flexible, secure, standard way with minimal human intervention. Smart card can provide strong authentication.

Cutting Edge 2005 workshop, IIT Kanpur

Smart

Cutting Edge 2005 workshop, IIT Kanpur

.

A smart card is like a ‘pocket-size power The chip in the smart card is composed of memory a microprocessor. They require only a card acceptor, often known as card reader. They are susceptible to chip

Cutting Edge 2005 workshop, IIT Kanpur

VCC

Reset

Clock

Reserved GND

VPP

I/O

Cutting Edge 2005 workshop, IIT Kanpur

CLK

RFU

I/O RST Vcc

GND

RFU Vpp

Cutting Edge 2005 workshop, IIT Kanpur

 Password  Card

holder’s protection

Cryptographic

challenge

Response



Entity authentication

Biometric 

information

Person’s identification

A

combination of one or more

Credit

Cutting Edge 2005 workshop, IIT Kanpur

cards Electronic cash Computer security systems Wireless communication Loyality systems Banking Satellite TV Government identification

Cutting Edge 2005 workshop, IIT Kanpur

256 bytes to 4KB RAM. 8KB to 32KB ROM. 1KB to 32KB EEPROM. 8-bit to 16-bit CPU. 8051 based designs are common.

The price of a mid-level chip when produced in bulk is less than US$1.

asks the user to provide a password. Password is sent to Card for verification. Scheme can be used to permit user authentication. Cutting Edge 2005 workshop, IIT Kanpur

Terminal



Not a person identification scheme

Cutting Edge 2005 workshop, IIT Kanpur

Data

is stored in smart cards in E2PROM



Card OS provides a file structure mechanism File types Binary file (unstructured) Fixed size record file Variable size record file

Cutting Edge 2005 workshop, IIT Kanpur

Card is inserted in the terminal ATR negotiations take place to set up data transfer speeds, capability negotiations etc. Terminal sends first command to select MF Terminal prompts the user to provide password Terminal sends password for verification Terminal sends command to select MF again

Terminal sends command to read EF1

Card gets power. OS boots up. Sends ATR (Answer to reset)

Card responds with an error (because MF selection is only on password presentation) Card verifies P2. Stores a status “P2 Verified”. Responds “OK”“OK” Card responds Card supplies personal data and responds “OK”

Cutting Edge 2005 workshop, IIT Kanpur

Terminal with two card readers

Banker’s card

Application software runs here

1. Authenticate user to bank officer card: 1a. Get challenge from banker card. User’s card 1b. Obtain response for the challenge from passport (IAUTH). 1c. Validate response with officer card (EAUTH) 2. Authenticate officer card to passport. 3. Transfer money to the user’s card

The terminal itself does not store any keys, it’s the two cards that really authenticate each other. The terminal just facilitates the process.

Cutting Edge 2005 workshop, IIT Kanpur

At

RTOs, two RTO officers are required to create a DL

These two work in pair.  Have a usage counter of key built in.  RTO keys are generated and given in the RTO cards 

STA

can revalidate the usage counter. STA keys are also generated.

Cutting Edge 2005 workshop, IIT Kanpur

www.google.com www.wikwpedia.com www.cs.fsu.ed