Smart Card Environment Research Articles

TESTING PSEUDORANDOM NUMBER SENSORS BUILT IN SMART CARDS

This article explores randomness and how general purpose computers generate it. It also discusses the security requirements that a pseudo-random number generator must satisfy for use in cryptographic applications. And also special attention is paid to the known and new methods of testing random bit sequences. Analyzing the effectiveness of pseudo-random sequence generators is a pressing problem for smart cards when using more advanced methods of encryption and information protection. The available methods show low flexibility and versatility in the means of finding hidden patterns in data. To solve this problem, it is proposed to use algorithms based on multivariate statistics. These algorithms combine all the advantages of statistical methods and are the only alternative for analyzing short and medium-length sequences. The paper considers the scheme of operation of pseudo-random number generators in limited devices. The main requirements for modern smart cards are highlighted. A criterion for checking the randomness of bit sequences of small length (up to 100 bits) is proposed. This approach is appropriate for testing a lightweight pseudo-random number generator in devices with certain resource constraints. The paper presents the compatible distributions of the number of 2-strings and the number of 3-strings of a fixed form of a random bit sequence, which make it possible to carry out a statistical analysis of local sections of this sequence. A possible application of the obtained formulas can be to test the hypothesis of the randomness of the arrangement of zeros and ones in a (0, 1) -sequence of finite length. Research has shown that even with limited resources and a limited entropy environment like a smart card, good quality pseudo-random sequences can be created that can satisfy all the requirements for pseudo-random number generators, even those used for general purpose computers. In the work, the set of statistical tests was expanded to include other tests that are not included in the statistical set of NIST tests, and to analyze the work of the proposed algorithms. The paper presents algorithms for testing a pseudo-random sequence using multivariate statistics to illustrate their possible application in a smart card environment.

Security automaton to mitigate laser-based fault attacks on smart cards

Security and attacks are two sides of the same coin in the smart card industry. Smart cards are prone to different types of attacks to gain access to the assets stored in it and that can cause security issues. It is necessary to identify and exploit these attacks and implement appropriate countermeasures to mitigate their effects. Fault attacks are one among them. They can introduce abnormal behaviour on the smart card environment. The redundancy is necessary to detect this change in their environment. In this work, we propose an automatic method to obtain control flow redundancy using a security automaton to mitigate laser-based fault attacks and hence implement a smart card countermeasure based on the combination of static analysis and dynamic monitoring method. This is a very cost effective approach which can identify and mitigate the effects of fault attacks in an efficient way.

A practical implementation of fuzzy fingerprint vault for smart cards

Biometric-based authentication can provide strong security guarantee about the identity of users. However, security of biometric data is particularly important as the compromise of the data will be permanent. To protect the biometric data, we need to store it in a non-invertible transformed version. Thus, even if the transformed version is compromised, the actual biometric data remain safe. Fuzzy vault is a cryptographic construct to secure critical data with the fingerprint data. In this paper, we implement the fuzzy fingerprint vault, combining fingerprint verification and fuzzy vault scheme to protect fingerprint templates, for the smart card environment. To implement the fuzzy fingerprint vault as a complete system, we have to consider several practical issues such as automatic fingerprint alignment, verification accuracy, template size for storing in the smart card, execution time, error correcting code, etc. Especially, we handled the fingerprints having a few minutiae by applying an adaptive degree of the polynomial, and thus our implementation result can be used for real, large-scale applications.

Integrating Fingerprint Verification into the Smart Card-Based Healthcare Information System

As VLSI technology has been improved, a smart card employing 32-bit processors has been released, and more personal information such as medical, financial data can be stored in the card. Thus, it becomes important to protect personal information stored in the card. Verification of the card holder's identity using a fingerprint has advantages over the present practices of Personal Identification Numbers (PINs) and passwords. However, the computational workload of fingerprint verification is much heavier than that of the typical PIN-based solution. In this paper, we consider three strategies to implement fingerprint verification in a smart card environment and how to distribute the modules of fingerprint verification between the smart card and the card reader. We first evaluate the number of instructions of each step of a typical fingerprint verification algorithm, and estimate the execution time of several cryptographic algorithms to guarantee the security/privacy of the fingerprint data transmitted in the smart card with the client-server environment. Based on the evaluation results, we analyze each scenario with respect to the security level and the real-time execution requirements in order to implement fingerprint verification in the smart card with the client-server environment.

Communication-Computation Trade-off in Executing ECDSA in a Contactless Smartcard

Emerging standards specify a communication rate between a contactless smartcard and a terminal that is of the same order of magnitude as the internal clock rate in the card. This gives a natural ground for the known card-terminal communication-computation trade-off, where non-secure operations should rather be performed by the terminal and not in the card. In this paper we treat an implementation of Elliptic Curve Digital Signature Algorithm (ECDSA), the most cost effective digital signature algorithm, which has a potential of being executed under the heavy constraints imposed by a contactless smartcard environment. This algorithm heavily relies on numerous calculations of modular multiplicative inverses. It is shown in this paper that, based on communicating with the terminal, each modular inverse operation needed to be executed in the card during ECDSA signature generation requires only two modular multiplications in the card. Each modular inverse operation performed during signature verification requires only one modular multiplication in the card. A complete ECDSA implementation over integers or over GF(2n) is then treated in detail

A simple power analysis attack against the key schedule of the Camellia block cipher

This paper presents a simple power analysis attack against the key schedule of Camellia. The attack works for the smart card environment which leaks the Hamming weight of data being processed, making use of the Hamming weight to deduce all key bits. It is shown that determining the cipher key given accurate power analysis data is very fast and does not require any pair of plaintext and ciphertext.

Implementation of Java card Virtual Machine

Java card is a new system for programming smart cards, which is based on the Java language and Virtual Machine. Java card programs (applets) run in Java Card Runtime Environment (JCRE) including the Java Card Virtual Machine (JCVM), the framework, the associated native methods and the API (Application Programming Interface). JCVM is implemented as two separate pieces: off-card VM (Virtual Machine) and on-card VM. The stack model and heap memory structure used by on-card VM and exception handling are introduced. Because there are limited resources within smart card environment, and garbage collection is not supported in JCVM, the preferred way to exception handling does not directly involve the use ofthrow, although thethrow keyword is supported. Security is the most important feature of smart card. The Java card applet security feature is also discussed.