Abstract:
A method for conducting secure communications with credential cards using existing reader/writer hardware that enhances the security of the provisioning process is provided. The method moves the sensitive data contained in these communications together with the program that uses this sensitive data for the purpose of interacting with a credential card inside a secure computational element such as an integrated circuit card. The provisioning program inside the secure element issues commands to readers/writers of existing art in order to establish secure communication with the credential card and then uses the secure channel so created for the purpose of direction communication between the secure computation element and the credential card.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention is generally directed to secure access systems and more particularly to secure encoding of credential cards. 
       BACKGROUND 
       [0002]    RFID transponder-based credential cards such as HID Global&#39;s HID Prox™ and iCLASS®, credential cards typically contain identification data, such as a card number and site code as well as additional data, e.g., error detection and correction. Devices referred to as readers or reader/writers are employed to read data from and/or write data to these RFID credential cards although these concepts also apply to other types of machine-readable credentials such as magnetic stripe cards. Although the data storage locations in these credentials can be read and/or written by these devices, typically a device called a programmer is used to initially write sensitive data to a credential card. Other commonly used names include field programmer and encoder. The process of writing initialization data to previously unused credential cards is typically called provisioning. Any device used to either read from or write data to machine-readable credentials shall be referred to as an RWD (Read/Write Device) and, depending on the application, may be a stand-alone device or embedded into another device such as a printer or time clock running a program in firmware possibly under the control of a real-time operating system. Typically RWDs are connected to a host device and this host device may be a computer running a program on a general-purpose, multi-programming operating system such as Windows, Linux, or Mac O/S. A device acting as a host shall be referred to as an initiator. In the current state of the art, the encoding rules that define how data is stored in a credential card, any cryptographic keys required to access the credential card, where the data is to be stored in the credential card, and other secret, sensitive and proprietary information typically resides in the initiator. When the data is located on the initiator, this sensitive data is easily compromised. For example, if the encoding rules are proprietary and trade secrets of the manufacturer or the issuer of the credential card, then a security breach may compromise the manufacturer&#39;s or the issuer&#39;s future source of revenue. 
       SUMMARY 
       [0003]    Therefore, one aspect of the present invention to use a intermediate secure element, such as an integrated circuit card, to store and utilize these secrets and rules (e.g., formats, cryptographic keys, encryption rules, and/or sensitive data) in order to read, write, and provision credentials while guaranteeing the security and privacy of these secrets and rules. 
         [0004]    Embodiments of the present invention allow for secure encoding of credential cards intermediated by a secure processing element that contains sensitive information such as cryptographic keys, data encoding rules and structures, encoder and encoding protocols, metering information, together with the program to perform communications with the credential card involving this data. 
         [0005]    As described previously, RWDs are examples of devices that are capable of securely accessing the data storage area on credential cards in order to read data therefrom or write data thereto. These devices are employed when the machine-readable credential is being manufactured, initialized, personalized or read and/or written by means of a computer program running on a general-purpose, multi-programming operating system such as a Windows, Linux, or Mac O/S. 
         [0006]    In the case that a computer program running on a general-purpose, multi-programming operating system is being employed to move data to and from the machine readable credential, the sensitive data such as cryptographic keys and personal identification data is typically stored in the computing environment of the computer program. In this environment, sensitive data is susceptible to compromise and breach by other programs such as malware, spyware, software probes and debuggers running concurrently in the general purpose, multi-programming operating system. 
         [0007]    In addition, this sensitive data may also be left behind in the computer such as in the memory or in the operating system swap files when the reading/writing program is terminated and even when the computer itself is turned off. In all these cases this sensitive data is subject to discovery and breach. 
         [0008]    In addition to software vulnerabilities enabled by general purpose, multi-programming operating systems, sensitive data can be compromised by exploitation of the hardware platform executing and supporting the movement of data to and from the RWD. Devices such as hardware probes and environmental monitors can detect and even alter sensitive data. 
         [0009]    Embodiments of the present invention propose the use of a secure element, e.g., an integrated circuit card, to contain both the sensitive data and the program used to provision the credential cards. As the program execution and hardware environment of an integrated circuit card are more secure against attack than a general purpose, multi-programming, operating system, the above short-comings of the current art are addressed. 
         [0010]    In accordance with at least some embodiments of the present invention, a secure element is provided generally comprising:
       one or more of cryptographic material such as cryptographic keys, sensitive data such as personally identifiable information, and encoding rules; and   a provisioning program operable to access the one or more of cryptographic material, sensitive data, and encoding rules and provide such information via a secure communication channel to an encoding device.       
 
         [0013]    In one aspect of the present invention, the provisioning program resides inside an integrated circuit card. 
         [0014]    In one aspect of the present invention, the encoding rules are utilized by the encoding device to provision a credential card. 
         [0015]    In one aspect of the present invention, the encoding rules are provided to the encoding device in response to the secure element receiving a request for the encoding rules. 
         [0016]    In one aspect of the present invention, the intermediate secure element resides within the encoding device. 
         [0017]    In one aspect of the present invention, the intermediate secure element is a peripheral device to the encoding device. 
         [0018]    In one aspect of the present invention, the intermediate secure element comprises two communication channels, a first of the two channels being in communication with an initiator and a second of the two channels being in communication with a device comprising the encoding device. The first channel may comprise communication using a USB protocol and the second channel may comprise a communication using a serial communication protocol. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0019]      FIG. 1  depicts a first system configuration for writing data to and reading data from a credential card in accordance with at least some embodiments of the present invention; 
           [0020]      FIG. 2  depicts a second system configuration for writing data to and reading data from a credential card in accordance with at least some embodiments of the present invention; 
           [0021]      FIG. 3  depicts a third system configuration for writing data to and reading data from a credential card in accordance with at least some embodiments of the present invention; 
           [0022]      FIG. 4  depicts a fourth system configuration for writing data to and reading data from a credential card in accordance with at least some embodiments of the present invention; 
           [0023]      FIG. 5  depicts a fifth system configuration for writing data to and reading data from a credential card in accordance with at least some embodiments of the present invention; and 
           [0024]      FIG. 6  depicts a sixth system configuration for writing data to and reading data from a credential card in accordance with at least some embodiments of the present invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0025]    Referring initially to  FIG. 1 , a first configuration of a system  100  used to provision credential cards  116  will be described in accordance with at least some embodiments of the present invention. The system  100  may include a host or initiator computer  108  that is operated by a security administrator or similar type of security personnel. Exemplary types of hosts  108  include, but are not limited to, personal computers, laptops, and/or a hardware appliance such as a time clock. In some embodiments, the host or computer  108  is adapted to run a program on a general-purpose, multi-programming operating system such as Windows, Linux, or Mac O/S. 
         [0026]    The host or computer  108  is in communication with an insecure reader/writer  112  that has the capability to read and write data from the credential card  116 . The host or computer  108  as well as the reader/writer  112  are typically insecure in that data stored thereon may be relatively easily accessed by unauthorized persons. More specifically, while the host or computer  108  and reader/writer  112  may be utilized to initiate data reads/writes to credentials  116  using third party proprietary or sensitive data, the host or computer  108  and reader/writer  112  is not operated by the third party and, thus, may not employ security provisions in accordance with the third party&#39;s requirements. 
         [0027]    Accordingly, embodiments of the present invention propose the use of an intermediate secure element  104  for interfacing with the insecure reader/writer  112 . The intermediate secure element  104  may contain any proprietary, secret, or sensitive third party data and that data may be secured in accordance with the third party&#39;s requirements. In the configuration depicted in  FIG. 1 , a security administrator can interface with the host or computer  108  (for example using a graphical user interface) and the host or computer  108  is capable of communicating directly with the insecure reader/writer  112 . The communications between the host or computer  108  and insecure reader/write  112  typically include instructions to initiate a read/write of data from/to the credential card  116 . 
         [0028]    Upon receiving such a command from the host or computer  108 , the insecure reader/writer  112  is configured to communicate with the secure element  104  and retrieve the necessary secrets and/or rules to complete the data read/write. 
         [0029]    In accordance with at least some embodiments of the present invention, the secure element  104  may correspond to an integrated circuit or circuit card that is insertable into the reader/writer  112 . Once inserted into the reader/writer  112 , the secure data and/or rules can be obtained from the secure element  104  (e.g., cryptographic keys, sensitive data, encoding rules and a provisioning program operable to access the encoding rules). The secure element  104  can then provide the sensitive data and the secure data and/or encoding rules to the reader/writer  112  via a secure communication channel and said sensitive data and rules can be used by the reader/writer  112  for reading data from or writing data to the credential card  116 . 
         [0030]    Referring now to  FIG. 2 , an alternative configuration of system  200  elements is shown in accordance with at least some embodiments of the present invention. In this particular configuration, the insecure host or computer  108  may communicate with the reader/writer  112  through the intermediate secure element  104 . Thus, rather than sending a message directly to the reader/writer  112  instructing it to obtain encoding rules from the secure element  104 , the host or computer  108  can communicate directly with the secure element  104  and instruct the secure element  104  to retrieve sensitive data and encoding rules and provide said sensitive data and encoding rules to the reader/writer  112 . 
         [0031]    In the embodiment depicted in  FIG. 2 , the intermediate secure element may comprise two different communication channels. The first channel may be used to facilitate communications with the host or computer  108  while the second channel may be used to facilitate communications with the reader/writer  112 . In accordance with at least some embodiments of the present invention, the first channel may comprise a USB communication protocol or similar communication protocol that is capable of facilitating communications with a host or computer  108  in a native format of the host or computer  108  and the second channel may comprise a serial communication protocol (e.g., SCSI, RS-232, and RS-422). 
         [0032]      FIG. 3  depicts yet another alternative configuration of the system  300 . Here, system elements are configured in accordance with at least some embodiments of the present invention. In this particular configuration, the system  300  may utilize an intermediate secure element  104  that can communicate with the credential card  116  in the absence of a reader/writer  112 . In accordance with at least some embodiments of the present invention, the secure element  104  may include an encoding device  208  (i.e., functionality of the reader/writer  112 ) and may also be provided with an antenna  120 . The credential card  116  may also be provided with an antenna  124 . Wireless communications between the secure element  104  and credential card  116  can be facilitated via the antennas  120 ,  124  using known wireless communication standards and techniques such as FSK, PSK, ASK, ISO/IEC 14443, ISO/IEC 15693, etc. 
         [0033]      FIG. 4  depicts still another alternative configuration of the system  400 . Here, system elements are configured in accordance with at least some embodiments of the present invention. This particular embodiment shows an initiator  212  (which may be similar or identical) a host computer  208  in communication with an encoding device  204 . The encoding device is capable of reading/writing data from/to the credential  216 . The initiator  212  is generally similar or identical to the host or computer  108  and the encoding device  204  may be similar or identical to the reader/writer  112  depicted in  FIGS. 1-3 . As can be seen in  FIG. 4 , the encoding device may comprise a secure element  104 , which is also referred to as a secure processing element or SPE, and an encoder  208 . The internal secure element  104  may still contain generally secret or proprietary data (e.g., encoding rules, sensitive data, cryptographic keys, protocols to be used with initiator  212  and/or protocols to be used between the encoder  208  and credential  216 ) and the encoder  208  can be used to execute read/write operations of the encoding device  204 . The encoder  208  is adapted to retrieve sensitive data and encoding rules from the intermediate secure element  104  prior to communicating with the credential  216 . The communications between the secure element  104  and encoder  208  may be either wired (e.g., USB, RS485, TTL, etc.) or wireless (e.g., Bluetooth, Zigbee, Wi-Fi, ISO/IEC 14443, ISO/IEC 15693, NFC, etc.) communications. 
         [0034]    In accordance with at least some embodiments of the present invention, the secure element  104  may include one or more of a contact smart card, a Subscriber Identity Module (SIM) card, a Security Authentication Module (SAM) card, a Trusted Platform Module (TPM), or any similar type of device. The secure element  104  may be integral to the encoder  208  or may be a peripheral device to the encoder  208 . 
         [0035]      FIG. 5  depicts yet another alternative configuration of the system  500 . Here system elements are configured in accordance with at least some embodiments of the present invention. The system  500  may include a intermediate secure element  104  in the initiator  212  and the encoding device may comprise one or more of an encoder  208  and firmware  220 . Encoding rules and other sensitive data from the secure element  104  may be provided directly to the encoding device  204  using RF circuitry. Alternatively, or in addition, data from the secure element  104  may be provided to the embedded encoder  208  using the encoder&#39;s protocol (e.g., ISO 7816). Alternatively, or in addition, data from the secure element  104  may be provided to the encoding device  204  using wired or wireless communications with the firmware  220  that is embedded in the device  204 . Once the data from the secure element  104  is received at the encoding device  204 , the encoder  208  can be configured to read/write data from/to the credential  216 . 
         [0036]      FIG. 6  depicts yet another alternative configuration of the system  600 . Here, system elements are configured in accordance with at least some embodiments of the present invention. In this configuration the intermediate secure element  104  is separate from both the initiator  212  and encoding device  204  (i.e., the secure element  104  is a stand-alone device). Communications from the initiator  212  to the encoding device  204  may flow through the secure element  104  which injects any secure data or encoding rules that is necessary for the encoder  208  to communicate with the credential  216 . The data from the secure element  104  may be provided to the encoding device  204  in any number of different ways previously discussed in connection with  FIG. 5 . 
         [0037]    As one exemplary application, and regardless of system configuration, embodiments of the present invention make use of the elevated security context available to programs executing within a secure element  104 , such as an integrated circuit card, to provide a secure conduit between the provisioning program and the credential card being provisioned. 
         [0038]    In accordance with at least some embodiments of the present invention, a provisioning program running in the secure element  104  accesses data stored also in the same secure element and:
       Outputs to the RWD commands to establish a communication channel between the RWD and the credential to be provisioned;   Outputs to the RWD commands that establish a shared security context between the provisioning program running inside the secure element  104  and the credential being provisioned; and/or   Outputs to the RWD commands to be relayed forward to the credential being provisioned. These commands which are executed inside the credential card achieve the provisioning of the credential card without exposing the data they convey due to the shared security context between the secure element  104  and the credential card.       
 
         [0042]    It should be noted that the establishment of the shared security context may include authentication of the credential card by the provisioning program running inside the secure element  104  and authentication of the provisioning program running inside the secure element by the credential card. 
         [0043]    In addition, digital rights management (DRM) may be employed so that only an allowed subset of sensitive data and encoding rules may be utilized. In addition, the secure element can contain metering data so that only a certain number of credentials can be encoded or deciphered. Of course the secure elements meters could be altered or changed using a secure interchange between itself and an initiator or even by using data that resides on a machine readable credential. 
         [0044]    In addition to containing the sensitive data involved in a communication with a credential card and being able to create a secure channel between itself and the credential card in order to communicate this data directly to the credential card, the secure element  104  may also perform protocol and data translation services on the communication between the insecure host computer and the credential card. Of particular applicability for the current teaching are protocol and data translation services which are based on the sensitive data contained in the secure element  104 . 
         [0045]    One advantage offered by the present invention is that one need only provide an additional communication channel on the programmer/reader-writer/encoder to enhance the security of communication with credential cards. One does not need to modify the intrinsic functionality of existing programmer/reader-writer/encoder as it is being driven by the same set of commands as are currently sent to it from an initiator program running in an insecure execution environment. 
         [0046]    The systems, methods and protocols of this invention can be implemented on a special purpose computer in addition to or in place of the described access control equipment, a programmed microprocessor or microcontroller and peripheral integrated circuit element(s), an ASIC or other integrated circuit, a digital signal processor, a hard-wired electronic or logic circuit such as discrete element circuit, a programmable logic device such as TPM, PLD, PLA, FPGA, PAL, a communications device, such as a server, personal computer, any comparable means, or the like. In general, any device capable of implementing a state machine that is in turn capable of implementing the methodology illustrated herein can be used to implement the various data messaging methods, protocols and techniques according to this invention. 
         [0047]    Furthermore, the disclosed methods may be readily implemented in software. 
         [0048]    Alternatively, the disclosed system may be implemented partially or fully in hardware using standard logic circuits or VLSI design. Whether software or hardware is used to implement the systems in accordance with this invention is dependent on the speed and/or efficiency requirements of the system, the particular function, and the particular software or hardware systems or microprocessor or microcomputer systems being utilized. The analysis systems, methods and protocols illustrated herein can be readily implemented in hardware and/or software using any known or later developed systems or structures, devices and/or software by those of ordinary skill in the applicable art from the functional description provided herein and with a general basic knowledge of the computer arts. 
         [0049]    Moreover, the disclosed methods may be readily implemented in software that can be stored on a storage medium, executed on a programmed general-purpose computer with the cooperation of a controller and memory, a special purpose computer, a microprocessor, or the like. In these instances, the systems and methods of this invention can be implemented as program embedded on personal computer such as a JAVA® or CGI script, as a resource residing on a server or computer workstation, as a routine embedded in a dedicated communication system or system component, or the like. The system can also be implemented by physically incorporating the system and/or method into a software and/or hardware system, such as the hardware and software systems of a communications device or system. 
         [0050]    It is therefore apparent that there has been provided, in accordance with the present invention, systems, apparatuses and methods utilizing a secure element to facilitate provisioning of credential cards. While this invention has been described in conjunction with a number of embodiments, it is evident that many alternatives, modifications and variations would be or are apparent to those of ordinary skill in the applicable arts. 
         [0051]    Accordingly, it is intended to embrace all such alternatives, modifications, equivalents and variations that are within the spirit and scope of this invention.