# Presentation: 582173

## PKI Enabled

***Smart Card Value Chain***
**Standards and Specifications**

**Philip S. Lee**
- Chief Technologist, Smart Cards
- Baltimore Technologies
**April 17, 2001**

- GSA Presentation

- April 17, 2001

## Overview

** ****Smart Card Value Chain**
** ****Standards & Specifications**
** ****Implementation Issues**
** ****Recommendations**

- GSA Presentation

- April 17, 2001

## PKI

**Chip**

**Smart Card**

**Client**
**Terminal**

**Internet**

**PKI**

**Wafer**

**Smart Card Management System**

**PKI Enabled Smart Card Value Chain**

**Centralized Card Issuance**

**Smart Card**

**Reader**

- GSA Presentation

- April 17, 2001

## Smart Chip - 2001+

**Smart Chip - 2001+**

- Co-Processor
- & 3-DES Engine

- 16/32-bit RISC
- Processor

- Contact:
- ISO 7816
- and USB

- ROM** **(96 KB)

- EEPROM
- (64+ KB)
- FLASH
- (64 KB)

**Power**
**(1.8 Volt)**

- Ground

- Clock

- Reset

- ISO
- 7816 I/O

- RAM (4 KB)

- MMU

- USB I/O (2)

- DPA & SPA
- Resistant Logic

- Contactless: ISO 14443

- GSA Presentation

- April 17, 2001

## Smart Chip Security Features

** ****Dual BUS with 20+ MHz Internal Clock**
** ****Randomized Memory Cell Location**
** ****Tamper Resistant Hardware Protection Layers**
** ****Intrusion Sensors Closely Coupled with OS**
** ****Random BUS Cycle Injection**
** ****Certified Random Number Generator**
** ****Encrypted Key Storage**
** ****Biometrics Storage and one-to-one Comparison**
** ****Hardware Java Interpreter Engine**

- GSA Presentation

- April 17, 2001

## Smart Chip Standards,

**Specifications and Issues**

** ****FIPS 140-1 Certification: Level 2**
** ****Multiple Interfaces**
** ****ISO 7816 Part 3**
** ****USB Specification**
** ****ISO 14443**
** ****EUROSMART Protection Profile (PP) EAL 4+**
** ****Security Requirements & Chip Security Target**
** ****Configurable Information Assurance Profile**
** ****Multiple I/O Options: Lagging Standard Process**

- GSA Presentation

- April 17, 2001

## PKI Enabled Multi-Application

**Smart Card**

- Smart Chip Hardware

- Card OS (Proprietary)

- Interpreter (Virtual Machine)

- Card Virtual Machine API

**Card Manager**
**Sec Domain**

**API**

**PKI**
**Applet**
**Sec Domain**

**API**

**. . .**

**PKI Enabled Multi-Application**
**Smart Card**

- GSA Presentation

- April 17, 2001

## Operating System Options

**Open Platform (Card Manager & Security Domain) API**

**Windows**
**for**
**Smart Card**
**by**
**Microsoft**
**and**
**Global**
**Platform**

**Java Card**
**by**
**Sun Micro**
**and**
**Global**
**Platform**

**Multos**

**Credit/Debit**

**WIM**
**SIM**

**Logical &**
**Physical Access**

**Loyalty**
**E-Purse**

**or**

**or**

**Operating System Options**

**MULTOS**
**by**
**Mondex**
**International**
**and**
**MAOSCO**
**Council**

- GSA Presentation

- April 17, 2001

## Smart Card

**Standards & Specifications**

** ****ISO 7816 Part 3, 4, 7, 8, 11 and 15**
** ****EMV Card Specification**
** ****Java Card Consortium (VM, API)**
** ****Global Platform OP Card Specification**
** ****MAOSCO Council MULTOS Specification **
** ****RSA Consortiums (PKCS #11 and #15)**
** ****FIPS 140-1 and 2**
** ****SCSUG  PP (VISA, NIST, NSA)**

- GSA Presentation

- April 17, 2001

## Smart Card

**Implementation Issues**

** ****Card Reader Interfaces: EMV, PC/SC and USB**
** ****FIPS 140 Certification: Power-on Self Test and Others**
** ****Java Card Interoperability Certification: SIM Alliance**
** ****Open Platform Card Specification: Proton World CALC**
** ****Open Platform Card Certification: Visa OP Certification**
** ****PKCS #11 and #15 Implementation and Acceptance**
** ****Open Platform and MULTOS Convergence**
** ****Windows for Smart Card: Beta in June, OP Compliant**
** ****Certification of Test Labs: Illusive Common Ground**

- GSA Presentation

- April 17, 2001

## Smart Card Reader

**Standards and Specifications**

** ****ISO 7816 Part 3**
** ****ISO 9992 Interface Device Standard**
** ****EMV Terminal Specification**
** ****PC/SC Working Group: Interface Spec**
** ****Open Card Framework (OCF)**
** ****Trusted PC Industry Consortium**

- GSA Presentation

- April 17, 2001

## Smart Card Reader

**Implementation Issues**

** ****Lack of Certified Reader Test Labs**
** ****Microsoft PC/SC Self Certification**
** ****OCF and PC/SC Compatibility**
** ****ISO 7816 Part 3: Software I/O Timing**
** ****Multiple Clock Speeds  for 7816 & USB I/O**
** ****Integrated Reader with Dual Interfaces**
** ****Multitude of Reader Options**
** **Key-board with Smart Card and/or Finger Print Reader
-  Mouse with Smart Card and/or Finger Print Reader
-  Portable Reader with Encrypted PINPAD
-  Infrared Interface for Set-Top Box Interface

- GSA Presentation

- April 17, 2001

## PKI Enabled Client Terminal

**PKI Enabled Client Terminal**

**PKI Aware Smart Card Applications**

**Cryptographic Service Provider**
**with PKCS #15 Card Edge API**

**Resource Manager**

**PC/SC Reader Driver**

**Smart Card Reader**

**PKCS #11 and CAPI**

**Client PC**

- GSA Presentation

- April 17, 2001

## Client Terminal Specifications

**and Implementation Issues**

** ****PC/SC Specifications**
** ****Open Card Framework (OCF)**
** ****CAPI (Microsoft) and PKCS #11 (Netscape)**
** ****PKCS #15 PKI Enabled Card Specification**
** ****PKCS #11 Implementation & Extensions**
** ****PKI Enabled GSM/SIM Implementation**
** ****PKCS #15 Industry Acceptance (WIM)**
** ****Emerging Open Platform Specification**
** ****XML Based PKI Card Application Interface**

- GSA Presentation

- April 17, 2001

## Smart CardManagement System

- Bureau Service

**Smart Card****Management System**

**Life Cycle Management**

**Application Management**

**Personalization**
**Management**

**Post-Issuance Management**

**Configuration Management**

**Issuer Support and Service**

**Bus/Tech Rules Engines**

**Conflict Management**

**Site Management & Report**

**Card,**
**Product &**
**Application**
**Profiles**

- Application
- Provider

- Issuer
- System

- Script
- Builder

**Application Download**

**Card Life Cycle**

**Key Management**

**Certificate**
**Authority**

- GSA Presentation

- April 17, 2001

## SCMS Specifications

**and Implementation Issues**

** ****Open Platform (OP) SCMS Requirements**
** ****OP SCMS Implementation Guide**
** ****OP Card Configuration Specification**
** ****OP Script Builder Specification**
** ****In-depth Understanding of OP Smart Cards**
** ****In-depth Understanding of MULTOS Cards**
** ****Flexible and Scalable Data Base & web Engines**
** ****Flexible and Scalable Communication Packages**
** ****Understanding of Business & Technical Rules**
** ****GUI for Automated Conflict Management**
** ****Flexible Card Service Bureau Interface**
** ****Secure and Detachable CMS and AMS Architecture**
** ****Flexible Batch or On-line Personalization Modes**
** ****Secure Post-Issuance Card Life Cycle Management**

- GSA Presentation

- April 17, 2001

## Recommendations

- GSA Presentation

- April 17, 2001

## PKI Enabled Smart Card Value Chain

**Chip**

**Smart Card**

- Smart Chip

- Card OS

- Interpreter (VM)

- Card OS API

**CM**
**SD**

**API**

**PKI**
**SD**

**API**

**. . .**

**Smart Card Reader**

**Reader Driver**

**Terminal OS (RM)**

**Card Edge API**

**PKI Middle-ware**

**PKI Application API**

**Card PKI**
- Application

**Browser**

**Terminal **(PC, PDA, Mobile)

**Internet**

**PKI**

**CMS**

- Issuer S & S

- Profile Mngr

- Product

- Card

- Application

- Card Config

- Bureau Intf

- Script Build

- Auto Conflict

**Perso Mngr**

**Rule Engines**

**AMS**

- AP Interface

- AMS Portal

**Site Mngr**

**Report Gen**

**Post-Issue**

**Key Manager**

- CA Interface

**Wafer**

**SCMS**

**PKI Enabled Smart Card Value Chain**

**CA**

**CAO**

**RA**

**RAO**

**ARM**

**WEB RAO**

**Centralized Card Issuance**

- GSA Presentation

- April 17, 2001

## Thank You 

**Philip S. Lee**
**(O) 703-749-1406**
**(C) 202-674-5104**
**philip.lee@baltimore.com**
**pleesmart@aol.com**

- GSA Presentation

- April 17, 2001