Search

The smart card is a very popular component of many commercial and government system solutions. The ability of the smart card to store data securely and resist a great deal of physical tampering is part of the attraction, but so too is the ability to run algorithms and protocols. Whilst there are successful and popular systems that make use of fairly simple cards with fixed function algorithms, the true potential of the smart card can only be realised when it represents a flexible platform for general application hosting and management. Fortunately such functionality is becoming commonplace on modern cards and so the focus moves to how applications may be practically developed to exploit it. There are a range of ways this can be done, but by way of illustration this chapter restricts itself to Java as one of the most popular development methods and applies it to (U)SIMs; perhaps the most powerful of the mass deployed smart cards. [ABSTRACT FROM AUTHOR]

The banking industry enjoyed the benefits of magnetic stripe card technology for a long time. However, over the last decade, fraud levels were on the increase and the magnetic stripe card technology, at least for the banking sector, appeared to have reached the end of its life time. The major credit card scheme operators realised that they had to act and introduce a new card medium that would be in a position to better safeguard their interests. This resulted in the Europay-MasterCard-Visa (EMV) specifications. This chapter looks into the EMV specifications along with other initiatives that aim to offer additional security in e-commerce and enhanced smart card based authentication, necessary for Cardholder Not Present transactions. [ABSTRACT FROM AUTHOR]

There are well over 2 billion smart cards in use today within mobile communications devices. The cards known as Subscriber Identity Modules ((U)SIMs) represent some of the most technically advanced smart cards that have ever been deployed. Their original role was to safeguard the system security by providing authentication and confidentiality, but they have evolved to support additional security and value added functionality. The success of (U)SIMs has been largely due to the efforts of a number of standardisation bodies and indeed the technical evolution and standardisation is still progressing at pace. There are some exciting developments in the form of Near Field Communication (NFC), high-speed interfaces and high capacity smart cards that may radically expand the role of the (U)SIM and mobile device, but also challenge pre-conceptions about application architectures and protocols. [ABSTRACT FROM AUTHOR]

The concept of a smart card is not particularly new, however the practical use of smart cards in a range of diverse applications has never been more popular. This chapter provides a first introduction to a wide range of smart cards and tokens, considering the various types, capabilities, popular applications and the practicality of their development and deployment. [ABSTRACT FROM AUTHOR]

Smart cards have been deployed as trusted components in a wide range of industries. The basis of the trust on a smart card platform and applications is static and evaluated before the card issuance to cardholders. A dynamic and post-issuance security assurance and validation mechanism can be useful, but it is not considered necessary in the Issuer Centric Smart Card Ownership Model. However, in an open and dynamic smart card environment like the User Centric Smart Card Ownership Model, it is essential to have a mechanism that on request could provide assurance and validation of the implemented and evaluated security mechanisms. Such a framework is the focus of this paper. [ABSTRACT FROM AUTHOR]

NFC is a standardised technology providing short-range RFID communication channels for mobile devices. Peer-to-peer applications for mobile devices are receiving increased interest and in some cases these services are relying on NFC communication. It has been suggested that NFC systems are particularly vulnerable to relay attacks, and that the attacker΄s proxy devices could even be implemented using off-the-shelf NFC-enabled devices. This paper describes how a relay attack can be implemented against systems using legitimate peer-to-peer NFC communication by developing and installing suitable MIDlets on the attacker΄s own NFC-enabled mobile phones. The attack does not need to access secure program memory nor use any code signing, and can use publicly available APIs. We go on to discuss how relay attack countermeasures using device location could be used in the mobile environment. These countermeasures could also be applied to prevent relay attacks on contactless applications using ΄passive΄ NFC on mobile phones. [ABSTRACT FROM AUTHOR]

Multi-application smart card technology facilitates applications to securely share their data and functionality. The security enforcement and assurance in application sharing is provided by the smart card firewall. The firewall mechanism is well defined and studied in the Issuer Centric Smart Card Ownership Model (ICOM), in which a smart card is under total control of its issuer. However, it is not analysed in the User Centric Smart Card Ownership Model (UCOM) that delegates the smart card control to their users. In this paper, we present UCOM΄s security requirements for the firewall mechanism and propose a generic framework that satisfies them. [ABSTRACT FROM AUTHOR]

In this paper two mobile website authentication schemes are proposed. The first enables authentication credentials (username and password) to be stored and retrieved securely from a mobile handset, and requires no changes to existing websites. The second scheme, which may optionally be used with the first, utilises a one-time password and is intended for applications requiring an enhanced level of authentication, e.g. financial services. Both authentication schemes use a Java SIM and ubiquitous mobile phone; with its familiar and convenient form factor and high user acceptance. Both schemes also provide protection against online phishing attacks. [ABSTRACT FROM AUTHOR]

The predominant smart card ownership model is the issuer centric, and it has played a vital role in the proliferation of the technology. However, recent developments of multi-application smart card technology lead to new potential ownership models. One of the possible models is the User Centric Smart Card Ownership Model. In this model, the ownership is with smart card users. To support user΄s ownership, we require a framework that can assist cardholders to manage applications on their smart cards. In this paper, we present such a framework for managing application securely on a smart card. [ABSTRACT FROM AUTHOR]

Smart cards are being integrated into a diverse range of industries: ranging from banking, telecom, transport, home/office access control to health and E-passport. Traditionally, cardholders are required to carry a smart card for each application. However, recent developments in the Near Field Communication (NFC) have renewed the interest in multiple applications for different services on a single device. This paper builds onto the NFC initiative and avoids the smart card ownership issues that hinder the adoption of such devices. The proposal integrates the Global Positioning System with the NFC in mobile phones to provide a ubiquitously and flexible service access model. [ABSTRACT FROM AUTHOR]

This chapter examines the historical use of technology in smart cards and the trends in the future. It considers the options that are available and the choices which must be made with a smart card scheme and the issues which affect the design of the card and its applications. The influence of consumer demand is discussed and the drivers that will define the use smart card technology in the future. [ABSTRACT FROM AUTHOR]

In this chapter we discuss eID cards and e-Passports. A number of countries have introduced eID cards and some other countries are planning the introduction. The reasons generally, are requirements for a more secure identification and additional functions like eGovernment. The US requirements for the VISA Waiver countries to issue biometric enabled Passports by October 2006. The European Commission set the implementation time-frame so that all Member States had to implement the facial image requirements by 2006. This requirements led to worldwide introductions of e-Passports. [ABSTRACT FROM AUTHOR]

An increasing number of ‘contactless' systems are based on passive Radio Frequency Identification (RFID) technology. A passive RFID token is powered by a transmitted RF carrier, which is also used for bi-directional communication. RFID technology comprises of several standards, which are suitable for different applications. Electronic Product Code (EPC) tags, contactless credit cards, e-passports and access control are just a few examples of systems that use a subset of this technology. This chapter contains a brief explanation of RFID operating principles along with an overview of prominent implementations and industry standards. [ABSTRACT FROM AUTHOR]

The aim of this chapter is to describe the main middlewares used to manage and access smart card readers. It is illustrated by samples1 of code that the reader of this book will be able to reuse to quickly develop his/her first host applications to communicate with smart cards. [ABSTRACT FROM AUTHOR]

In the GSM mobile communication industry, the end user — called subscriber — is identified in the operator's network by the use of the Subscriber Identity Module SIM. In the third generation network 3G the equivalent application is called Universal Subscriber Identity Module USIM card. A (U)SIM card is a removable Smart Card for mobile phones. A mobile network operator is a telephone company that provides services for mobile phone subscribers. [ABSTRACT FROM AUTHOR]

In this chapter, a description of the various attacks and countermeasures that apply to secure smart card applications are described. This chapter focuses on the attacks that could affect cryptographic algorithms, since the security of many applications is dependent on the security of these algorithms. Nevertheless, how these attacks can be applied to other security mechanisms is also described. The aim of this chapter is to demonstrate that a careful evaluation of embedded software is required to produce a secure smart card application. [ABSTRACT FROM AUTHOR]

This paper will consider how Common Criteria evolved, how it is defined and how it is used in practice. As an example we will look at how Common Criteria is applied to smart card evaluations. This paper will not attempt to define in detail Common Criteria, nor should the reader expect to understand it in sufficient detail to be able to immediately participate in evaluations. It will, however, give a gentle introduction to what is a complex and demanding evaluation methodology. [ABSTRACT FROM AUTHOR]

The Trusted Platform Module (TPM) and smart card devices have many features in common. Both are low cost, tamper resistant, small footprint devices used to provide the basis of a secure computing environment. This chapter presents an introduction to the security mechanisms provided by the TPM highlighting those not typically found on a smart card. The concept of "ownership" is one of the major differences between the TPM and a smart card and this is described in some detail before concluding with a review of some of the security services uniquely provided by the TPM. [ABSTRACT FROM AUTHOR]

This chapter presents an overview of a well known application of smart card technology, namely that of pay-TV systems. The focus is on the security issues of this particular application and the mechanisms available to meet the security requirements. The chapter begins by establishing the requirements for the application and then looks in detail at the security mechanisms provided by current broadcast standards. [ABSTRACT FROM AUTHOR]

Although smart card technology has been available for many decades, it is only in the last few years that they have become widely considered as one of the most common secure computing devices. They are encountered in a number of applications (e.g. secure wireless access in mobile networks, banking, identification) satisfying a diverse range of uses. One of the fundamental factor contributing towards the success of smart card technology is tamper resistance. As the underlying smart card processing power increases at a constant pace, more and more functionality becomes available. It was soon realised that in order to grasp the full benefits of the underlying hardware, parallel advances in the corresponding smart card operating systems would be necessary. This chapter provides an overview of the most widely utilised smart card operating systems or platforms that enable multiple applications to be securely managed and reside in the same smart card. [ABSTRACT FROM AUTHOR]

This chapter gives an introduction to the production steps in the lifecycle of a (smart) card. After a short introduction the manufacturing of the card body will be described. The next paragraphs give information on the personalization process chain from data processing and on to card personalization and additional services such as packaging and shipment. A separate paragraph focuses on quality and security issues. At the end there are a few thoughts on current trends and challenges for the smart card industry. [ABSTRACT FROM AUTHOR]

This paper discusses the development and research for the detection of fraud in Smart-Card environments by using artificial intelligence. The current research deals with behaviour based detection engine, which will detect abnormalities by learning the usual behaviour of the user and detecting new unusual behaviours. The behaviour-based detection engines is based on `Neural Networks΄. This work considers the feasibility of implementing `Neural Network΄ fraud engine on a Smart card platforms. [ABSTRACT FROM AUTHOR]

In this paper we present a methodology and protocol for establishing a security context between a Mobile Operator's application server and a GSM/UMTS SIM card. The methodology assumes that the already issued Mobile Station is capable but unprepared. The proposed scheme creates a secure entity within the Mobile Station "Over The Air" (OTA). This secure entity can then be used for subsequent SIM authentications enabling m-Commerce, DRM or web service applications. To validate our proposal we have developed a proof of concept model to install and execute the security context using readily available J2ME, Java Card, J2SE and J2EE platforms, with the KToolBar MIDP2.0 emulator tool from Sun, and a Gemplus Java Card. Keywords: Mobile Station, Security Agent, Application Deployment, Smart Card, GSM, Security Protocol, JSR177, MIDP2.0. [ABSTRACT FROM AUTHOR]

The satellite TV industry relies heavily on the use of smart card technology at the very heart of broadcasted services that are protected by legacy conditional access systems. The process of Satellite TV signal protection is distributed amongst a number of system components, e.g. smart cards, receivers, Conditional Access Modules (CAM) and the content provider. However, the introduction of "Open" Satellite Receivers, providing a highly configurable environment with software emulation of conditional access systems, enabled the implementation of whole range of new attacks. A widely deployed attack is often referred to as the "card sharing" attack, by which one legitimate user colludes to provide protected content to a larger group of unauthorised users. This paper proposes a countermeasure that increases the bandwidth requirements of this attack to the point where it is no longer practical with a standard internet connection, with a minimal impact on existing protocols and architectures. [ABSTRACT FROM AUTHOR]