An Asymmetric Cryptography Secure Channel Protocol for Smart Cards

IFIP — The International Federation for Information Processing, 2005

Smart card secure channel protocols based on public key cryptography are not widely utilised mainly due to processing overheads introduced in the underlying smart card microprocessors and the complexities introduced by the operation of a PKI infrastructure. In this paper we analyse the significance of public key secure channel protocols in multi-application smart cards. We believe that multi-application smart card technology (e.g. the GlobalPlatform smart card specification) should benefit more from the advantages of public key cryptography specifically for the initiation and maintenance of a secure channel. This paper introduces a public key based cryptographic protocol for secure entity authentication, data integrity and data confidentiality. The proposed secure channel protocol uses a combination of public key, secret key and the main idea behind the Diffie-Hellman key establishment protocols in order to achieve the desired goals.

12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom-13), 2013

The User Centric Smart Card Ownership Model (UCOM) provides an open and dynamic smart card environment enabling cardholders to request installation/deletion of an application to which they are entitled. As in this model, smart cards are not under the control of a centralised authority; hence, it is difficult for an application provider to ascertain their trustworthiness. At present, proposed secure channel protocols for the smart card environment do not provide adequate assurance required by the UCOM. In this paper, we explore the reasons behind their failure to meet the UCOM requirements and then propose a secure and trusted channel protocol that meets them. In addition, the proposed protocol is also suitable to GlobalPlatform's consumer-centric smart cards. A comparison of the proposed protocol with existing smart card and selected Internet protocols is provided. Then we analyse the protocol with the CasperFDR tool. Finally, we detail the implementation and the performance measurement.

Computer Networks, 2001

Today, cryptology is essential for security of information and communication systems. But 25 years ago, it was a classi®ed and highly con®dential activity. Presented here from the point of view of smart cards, this quick evolution of cryptology re¯ects the revolution of digital information, e.g., mobile phone and MPEG television. The link between smart cards and cryptology is very strong: smart cards eciently con®ne keys and algorithms. Their security relies on a speci®c software, named here secure-ware, which demonstrates the value of the Common Criteria methodology. Ó

2008

Smart cards are an ideal medium for use in secure applications. Such applications require mechanisms for cryptographic authentication, password based authentication, confidential data exchange, detection of data tampering and verification of origin integrity. Cryptographic techniques based on symmetric key algorithms and/or public key cryptography can be used to address these issues. In this thesis, we focus on development of public key infrastructure on smart cards. Public key cryptography provides easier key management since keys are assigned on per user basis as opposed to per communication pair basis as in the case of symmetric key cryptography. Further, the public key cryptography can be used to perform key exchange for symmetric key and then the symmetric key cryptography can be used to perform further cryptographic operations. Smart cards are secure devices since the keys are kept in it securely and only the operations using such keys are permitted to be performed.

2013 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, 2013

The User Centric Smart Card Ownership Model (UCOM) provides an open and dynamic smart card environment enabling cardholders to request installation/deletion of an application to which they are entitled. As in this model, smart cards are not under the control of a centralised authority; hence, it is difficult for an application provider to ascertain their trustworthiness. At present, proposed secure channel protocols for the smart card environment do not provide adequate assurance required by the UCOM. In this paper, we explore the reasons behind their failure to meet the UCOM requirements and then propose a secure and trusted channel protocol that meets them. In addition, the proposed protocol is also suitable to GlobalPlatform's consumercentric smart cards. A comparison of the proposed protocol with existing smart card and selected Internet protocols is provided. Then we analyse the protocol with the CasperFDR tool. Finally, we detail the implementation and the performance measurement.

Applied Sciences

In the modern computing environment, smart cards are being used extensively, which are intended to authenticate a user with the system or server. Owing to the constrictions of computational resources, smart card-based systems require an effective design and efficient security scheme. In this paper, a smart card authentication protocol based on the concept of elliptic curve signcryption has been proposed and developed, which provides security attributes, including confidentiality of messages, non-repudiation, the integrity of messages, mutual authentication, anonymity, availability, and forward security. Moreover, the analysis of security functionalities shows that the protocol developed and explained in this paper is secure from password guessing attacks, user and server impersonation, replay attacks, de-synchronization attacks, insider attacks, known key attacks, and man-in-the-middle attacks. The results have demonstrated that the proposed smart card security protocol reduces the ...

2012

The Security-by-Contract (S×C) framework has recently been proposed to support software evolution in open multi-application smart cards. The key idea lies in the notion of contract, a specification of the security behavior of an application that must be compliant with the security policy of the card hosting the application. In this paper we address a key issue to realize the S×C idea, namely the outsourcing of the contractpolicy matching service to a Trusted Third Party (TTP). In particular, we present the design and implementation of (SC) 2 (Secure Communication over Smart Cards), a system securing the communication between a smart card and the TTP which provides the S×C matching service.

IJCSIS, 2019

In a highly vulnerable environment, marked by fraud and sophisticated types of attacks, authentication and identity security remain key elements of security policy. However, solutions such as the use of a simple authentication based on the couple (identifier / password), are no longer sufficient. New approaches based on strong authentication solutions or various certification protocols must be deployed. In this context, and in the case of an academic entity, we seek to develop a global platform that supports multiple services with different levels of security and different users (students, professors, administrators). The goal is to protect access to various sensitive areas of a university for example while ensuring flexibility of operation. In this context, this contribution relies on public key infrastructure technologies associated with PKI smart cards to secure authentication. To further refine our architecture, we will use the most efficient cryptography techniques. The purpose of such an approach is to guarantee simultaneous and secure access of different actors to various data and services with several levels of classification. Keywords: Authentication, Smart Card, Security, Access Control, Information System, Public Key Infrastructure, Password, Encryption

ijmer.com

Elliptic curve cryptography is one of the emerging techniques that stand as an alternative for conventional public key cryptography. Elliptic curve cryptography has several applications of which smart cards are also one among them. A smart card is nothing but a ...

14th International Workshop on Database and Expert Systems Applications, 2003. Proceedings., 2003

This paper presents an open protocol for interoperability across multi-vendor programmable smart cards. It allows exposition of on-card storage and cryptographic services to host applications in a unified, card-independent way. Its design, inspired by the standardization of on-card Java language and cryptographic API, has been kept as generic and modular as possible. The protocol security model has been designed with the aim of allowing multiple applications to use the services exposed by a same card, with either a cooperative or a no-interference approach, depending on application requirements.