A Brief Primer on Smart Card Operating Systems

2008

Smart cards are used extensively for data security and authentication purposes in various id card based applications. The data security in smart card is provided by access control based on passwords and cryptographic techniques. The smart card chip carries an operating system which implements cryptography and provides secure storage of data for application for interacting with the smart card. IIT Kanpur along with Government of India developed an application-independent smart card operating system standard known as SCOSTA-CL. SCOSTA-CL provides inter-operable command set for interaction between smart card data and applications. In this thesis, we focus on the implementation of a SCOSTA-CL based Smart Card Operating System known as (SCSOS). The SCSOS implements contact and contact-less mode of communication with the smart card reader. The communication can be protected against eavesdropping through secure messaging. SCSOS implements symmetric key cryptography and has its own security architecture for the protection of resources such as data and commands. Along with resource protection, it also allows applications to perform cryptographic operations such as encryption, decryption, checksum computation and verification etc. The SCSOS has been developed in a generic manner so as to support multiple applications on a single smart card. The modular design of SCSOS allows development and integration of new features with little effort. The developed operating system has been ported to the various existing smart card processors and rigorously tested for reliability and robustness. iii Acknowledgments I take this opportunity to express my sincere gratitude towards my supervisor Prof. Dr. Rajat Moona for his valuable guidance. I am grateful to him for his constant motivation, support and ideas that he gave throughout the year for my thesis. This work would not have been possible without his guidance. The flexible meeting hours with sir even on weekends really helped in the continuous progress of work. Overall, it has been great learning experience and I consider myself extremely fortunate that I got a chance to work under his guidance. I would like to thank Ministry of Information System, Government of India for sponsoring this project. I would like to thank my colleague Aditi Gupta for the discussion that we had during my thesis work. I would also like to thank Srishti Srivastava who helped me during the testing phase of my project work. I thank my classmates and friends for helping me during writing my thesis especially Anirudh, Vishal and Riyaz. I thank CSE faculty and department for their support to provide all the necessary resources required for my thesis. I immensely thank my family for their moral support during my work. 1. The smart card reader sends a command to the card operating system. 2. The smart card operating system receives command via serial I/O interface.

The operating system of a smart card is a safety critical system. Distributed in millions, smart cards with their small 8-bit CPU support applications where transferred values are only protected by the strength of a cryptographic protocol. This strength goes no further than the implementation of the software in the card and terminal allows. Because of its complexity, to guarantee absolute reliability of the smart card software is prohibitively expensive. Obtaining a high level of confidence in the implementation of a smart card application is essential for their widespread acceptance. A highly structured design of the smart card operating system gives the designer control over the complexity of the system.

IEEE Transactions on Consumer Electronics, 2004

Smartcard is originally designed as a passive authentication device. Retaining this passive role will limit its potential and it will eventually be superceded by other technologies. Therefore, it is a must for smartcard to take the active role in the near future. In light of this, this paper presents a novel Card-Centric Framework, in which the Smartcard becomes the Master whereas the card-connected terminal only a slave. The system prototype based on current smartcard technologies shows reasonable results, whereas another demo system that makes use of enhanced smartcard technologies provides a significant improvement in user perception and proves the feasibility of the framework in the future. Anticipating technology advancement so that all the performance requirements are met, applications will benefit from the framework in portability, data integrity, and chances for hardware-software customization.

IFIP International Federation for Information Processing, 2004

The Intelligent Adjunct (IA) model‚ proposed by Balacheff et al in [1]‚ is a novel paradigm for smart card applications‚ in which off-card resources are provided for smart cards to run application logics. This paper presents the Card-Centric Framework as an evolution of the conceptual IA model to provide a more rigorous solution for smart cards to access off-card I/O resources. It consists of a system model and a communication protocol. With the Card-Centric Framework‚ smart cards can run any applications that involve user interactions. A system prototype constructed with the current smart card technologies showed only reasonable performance. To cater for performance issues‚ another demo system that made use of enhanced smart card technologies was implemented. It not only shows a significant improvement in performance‚ but also proves the feasibility of the framework in the future.

Micro, IEEE, 1999

1996

IEEE Communications Surveys & Tutorials, 2009

An efficient and strongly secure smart card mechanism involves the use of a technological background taken from the fields of computers, VLSI design and material science. The result of such a mixture is a miniature, fully operational, computation system. The nature of the data involved in smart card transactions and smart card intended uses, introduce another important factor in the smart card design mechanism which is security. The evolution of VLSI technology allows the efficient implementation of costly cryptographic operations in the smart card design methodology. Apart from the traditional cryptographic algorithms, additional techniques and special design materials have been introduced in order to protect the smart card system from cryptanalytic attacks. New architectures of software design, like object-oriented programming, give the opportunity to implement programmable multi-application cards. Thus, smart cards are transformed into highly secure devices and their establishment in the modern computer market can be considered certain. This establishment is bound to finance upcoming research in smart cards so that this product can become the basic component of electronic commerce worldwide.

16th International Conference on Human-Computer Interaction, 2014

Creating security architectures and processes that directly interact with consumers, especially in consumer electronics, has to take into account usability, user-experience and skill level. Smart cards provide secure services, even in malicious environments, to end-users with a fairly straightforward limited usage pattern that even an ordinary user can easily deal with. The way the smart card industry achieves this is by limiting users' interactions and privileges on the smart cards they carry around and use to access different services. This centralised control has been the key to providing secure and reliable services through smart cards, while keeping the smart cards fairly useable for end-users. However, as smart cards have permeated into every aspect of modern life, users have ended up carrying multiple cards to perform mundane tasks, making smart card-based services a cumbersome experience. User Centric Smart Cards (UCSC) enable users to have all the services they might be accessing using traditional smart cards on a single device that is under their control. Giving "freedom of choice" to users increases their privileges, but the design requirement is to maintain the same level of security and reliability as traditional architectures while giving better user experience. In this paper, we will discuss the challenges faced by the UCSC proposal in balancing security with usability and "freedom of choice", and how it has resolved them.

14th International Workshop on Database and Expert Systems Applications, 2003. Proceedings., 2003

This paper presents an open protocol for interoperability across multi-vendor programmable smart cards. It allows exposition of on-card storage and cryptographic services to host applications in a unified, card-independent way. Its design, inspired by the standardization of on-card Java language and cryptographic API, has been kept as generic and modular as possible. The protocol security model has been designed with the aim of allowing multiple applications to use the services exposed by a same card, with either a cooperative or a no-interference approach, depending on application requirements.

2014 Eighth International Conference on Software Security and Reliability, 2014

Due to the fast evolving of trusted computing environments and internet-of-things an eager need has been established for open platforms which support interchangeable technologies to co-exist without threatening system's security. Certainly, future embedded applications will need high performance operating systems to support the intensivecomputing algorithms required for satisfying acceptable response and secure the application inside the vulnerable open environment; hence, new inevitable requirements for embedded operating systems have arisen including hard real-time response, support for native applications, system openness and system scalability. This paper introduces a new design for secure and open smart card operating system, called ESCOS (Egypt Smart Card Operating System), based on the prevalent Java Card technology. The new design provides competitive characteristics in the main three factors of judging smart card platforms; namely, system security, supported technology and system response. In addition, ESCOS is designed to have high degree of modularity and re-configurability to meet fastchanging business needs and diverse hardware platforms.