Smart Card Technology (1)

8/8/2019 Smart Card Technology (1)

1/21

Smart Card TechnologySmart Card Technology

Why is a Smart Card So Smart?Why is a Smart Card So Smart?

CIS4360CIS4360 Introduction Computer SecurityIntroduction Computer SecurityJoey FerreiraJoey Ferreira

Joshua LawrenceJoshua Lawrence


2/21

HistoryHistory

19681968German inventor Jurgen Dethloff along with Helmet Grotrupp filedGerman inventor Jurgen Dethloff along with Helmet Grotrupp fileda patent for using plastic as a carrier for microchips.a patent for using plastic as a carrier for microchips.

19701970

Dr. Kunitaka Arimura of Japan filed the first and only patent onDr. Kunitaka Arimura of Japan filed the first and only patent onthe smart card conceptthe smart card concept

19741974Roland Moreno of France files the original patent for the IC card,Roland Moreno of France files the original patent for the IC card,later dubbed the smart card.later dubbed the smart card.

19771977Three commercial manufacturers, Bull CP8, SGS Thomson, andThree commercial manufacturers, Bull CP8, SGS Thomson, andSchlumberger began developing the IC card product.Schlumberger began developing the IC card product.

Source: smart.govSource: smart.gov


3/21

HistoryHistory

19791979Motorola developed first single chip Microcontroller for FrenchMotorola developed first single chip Microcontroller for FrenchBankingBanking

19821982

World's first major IC card testingWorld's first major IC card testing

19921992Nationwide prepaid card project started in DenmarkNationwide prepaid card project started in Denmark

19991999

Federal Government began a Federal employee smart cardFederal Government began a Federal employee smart cardidentificationidentification

Source: smart.govSource: smart.gov


4/21

What is a Smart Card?What is a Smart Card?

The standard definition of a a smart card, orThe standard definition of a a smart card, orintegrated circuit card (ICC), is any pocket sizedintegrated circuit card (ICC), is any pocket sizedcard with embedded integrated circuits.card with embedded integrated circuits.

Loosely definedLoosely defined, a smart card is any card with a, a smart card is any card with acapability to relate information to a particularcapability to relate information to a particularapplication such as:application such as: Magnetic Stripe CardsMagnetic Stripe Cards

Optical CardsOptical Cards

Memory CardsMemory Cards

Microprocessor CardsMicroprocessor Cards


5/21

Magnetic Stripe CardsMagnetic Stripe Cards

Standard technology for bank cards, drivers licenses, library cards,and so on


6/21

Optical CardsOptical Cards

Uses a laser to readUses a laser to readand write the cardand write the card

CANPASS Contains:CANPASS Contains: Photo IDPhoto ID

FingerprintFingerprint


7/21

Memory CardsMemory Cards

Can store:Can store:

Financial InfoFinancial Info

Personal InfoPersonal Info

Specialized InfoSpecialized Info

Cannot process InfoCannot process Info


8/21


Has an integratedHas an integratedcircuit chipcircuit chip

Has the ability to:Has the ability to:

Store informationStore information

Carry out localCarry out localprocessingprocessing

Perform ComplexPerform Complex

CalculationsCalculations


9/21


Contact Smart CardContact Smart Card


10/21

ContactContact


11/21


Contactless Smart CardContactless Smart Card


12/21


Combi /H

ybrid CardsCombi /H

ybrid Cards Hybrid CardHybrid Card

Has two chips: contact and contactlessHas two chips: contact and contactlessinterface.interface.

The two chips are not connected.The two chips are not connected.

Combi CardCombi Card Has a single chip with a contact andHas a single chip with a contact and

contactless interface.contactless interface. Can access the same chip via a contact orCan access the same chip via a contact orcontactless interface, with a very high level ofcontactless interface, with a very high level ofsecurity.security.


13/21


Combi /H

ybrid CardsCombi /H

ybrid Cards


14/21

How are Smart Cards Used?How are Smart Cards Used?

Commercial ApplicationsCommercial Applications

Banking/paymentBanking/payment

IdentificationIdentification

TicketingTicketing

Parking and toll collectionParking and toll collection

Universities use smart cards for ID purposesUniversities use smart cards for ID purposesand at the the library, vending machines,and at the the library, vending machines,copy machines, and other services oncopy machines, and other services on

campus.campus.

Mobile TelecommunicationsMobile Telecommunications

SIM cards used on cell phonesSIM cards used on cell phones

Over 300,000,000 GSM phones with smartOver 300,000,000 GSM phones with smartcardscards

Contains mobile phone security, subscriptionContains mobile phone security, subscriptioninformation, phone number on the network,information, phone number on the network,billing information, and frequently calledbilling information, and frequently callednumbers.numbers.


15/21

How are Smart Cards Used?How are Smart Cards Used?

Information TechnologyInformation Technology

Secure logon and authentication of users to PCs and networksSecure logon and authentication of users to PCs and networks

Encryption of sensitive dataEncryption of sensitive data

Other ApplicationsOther Applications Over 4 million small dish TV satellite receivers in the US use aOver 4 million small dish TV satellite receivers in the US use a

smart card as its removable security element and subscriptionsmart card as its removable security element and subscriptioninformation.information.

PrePre--paid, reloadable telephone cardspaid, reloadable telephone cards

Health Care, stores the history of a patientHealth Care, stores the history of a patient

Fast ticketing in public transport, parking, and road tolling inFast ticketing in public transport, parking, and road tolling inmany countriesmany countries


16/21

AdvantagesAdvantages

In comparison to its predecessor, the magnetic strip card,In comparison to its predecessor, the magnetic strip card,smartsmart

cards have many advantages including:cards have many advantages including:

Life of a smart card is longerLife of a smart card is longer A single smart card can house multiple applications. Just oneA single smart card can house multiple applications. Just one

card can be used as your license, passport, credit card, ATMcard can be used as your license, passport, credit card, ATMcard, ID Card, etc.card, ID Card, etc.

Smart cards cannot be easily replicated and are, as a generalSmart cards cannot be easily replicated and are, as a generalrule much more secure than magnetic stripe cardsrule much more secure than magnetic stripe cards

Data on a smart card can be protected against unauthorizedData on a smart card can be protected against unauthorizedviewing. As a result of this confidential data, PINs andviewing. As a result of this confidential data, PINs andpasswords can be stored on a smart card. This means,passwords can be stored on a smart card. This means,merchants do not have to go online every time to authenticatemerchants do not have to go online every time to authenticatea transaction.a transaction.


17/21

AdvantagesAdvantages

chip is tamper chip is tamper--resistantresistant-- information stored on the card can be PIN code and/or readinformation stored on the card can be PIN code and/or read--write protectedwrite protected-- capable of performing encryptioncapable of performing encryption-- each smart card has its own, unique serial numbereach smart card has its own, unique serial number

capable of processing, not just storing information capable of processing, not just storing information-- Smart cards can communicate with computing devicesSmart cards can communicate with computing devicesthrough a smart card readerthrough a smart card reader-- information and applications on a card can be updatedinformation and applications on a card can be updatedwithout having to issue new cardswithout having to issue new cards

A smart card carries more information than can be A smart card carries more information than can beaccommodated on a magnetic stripe card. It can make aaccommodated on a magnetic stripe card. It can make a

decision, as it has relatively powerful processing capabilitiesdecision, as it has relatively powerful processing capabilitiesthat allow it to do more than a magnetic stripe card (e.g., datathat allow it to do more than a magnetic stripe card (e.g., dataencryption).encryption).


18/21

DisadvantagesDisadvantages

+NOT tamper proof+NOT tamper proof

+ Can be lost/stolen+ Can be lost/stolen

+ Lack of user mobility+ Lack of user mobility only possible if user has smartonly possible if user has smart

card reader every he goescard reader every he goes+ Has to use the same reader technology+ Has to use the same reader technology

+ Can be expensive+ Can be expensive

+Working from PC+Working from PC software based token will be bettersoftware based token will be better

+No benefits to using a token on multiple PCs to using a+No benefits to using a token on multiple PCs to using a

smart cardsmart card+ Still working on bugs+ Still working on bugs


19/21

Security MechanismsSecurity Mechanisms


20/21

OS Based ClassificationOS Based Classification

Smart cards are also classified on the basis of theirSmart cards are also classified on the basis of theirOperating System. There are many Smart Card OperatingOperating System. There are many Smart Card OperatingSystems available in the market, the main ones being:Systems available in the market, the main ones being:

1. MultOS1. MultOS2. JavaCard2. JavaCard3. Cyberflex3. Cyberflex4. StarCOS4. StarCOS5. MFC5. MFC

Smart Card Operating Systems or SCOS as they areSmart Card Operating Systems or SCOS as they arecommonly called, are placed on the ROM and usuallycommonly called, are placed on the ROM and usually

occupy lesser than 16 KB. SCOS handle:occupy lesser than 16 KB. SCOS handle: File Handling and Manipulation. File Handling and Manipulation. Memory Management Memory Management Data Transmission Protocols. Data Transmission Protocols.


21/21

ReferencesReferences

http://sec.isi.salford.ac.uk/download/smart.pdfhttp://sec.isi.salford.ac.uk/download/smart.pdf http://www.smart.govhttp://www.smart.gov http://www.gemplus.comhttp://www.gemplus.com http://www.smartcardalliance.org/industry_info/smart_cardhttp://www.smartcardalliance.org/industry_info/smart_card

s_primer.cfms_primer.cfm http://www.axalto.com/Company/Governance/pdf/Annualhttp://www.axalto.com/Company/Governance/pdf/Annual

%20Report%202004.pdf%20Report%202004.pdf http://www.smartcard.co.uk/tutorials/scthttp://www.smartcard.co.uk/tutorials/sct--itsc.pdfitsc.pdf

Documents

Smart Card Technology (1)