SPECIAL ISSUE: Learning Under Uncertain Environment and Its Application to Pattern Recognition; Edited by X. Wang, Y. Tang and D. YeunNo Access

A STRATEGY FOR SECURING APDU TRANSMISSION

MING-SHENG LIU

Department of Computer Science and Technology, Handan College, Handan 056005, China

Search for more papers by this author

HUI LIU

School of Computer and Infromation Engineering, Shijiazhuang Railway Institute, Shijiazhuang 050043, China

Search for more papers by this author

, and

JIAN-WU ZHENG

School of Computer and Infromation Engineering, Shijiazhuang Railway Institute, Shijiazhuang 050043, China

Search for more papers by this author

https://doi.org/10.1142/S0218001408006120Cited by:0 (Source: Crossref)

Abstract

The smart card is being used all over the world, because of its power to store data securely and execute calculations confidentially. This paper proposes an easy way to implement the strategy which can guarantee data integrity and privacy in the transmission path between the terminal application of the smart card and the smart card. This strategy consists of cryptographic functions of message and methods for transmitting APDU and managing secret keys. Some cryptographic functions of message are defined and developed for transmitting APDU confidentially. These cryptographic functions can keep the byte length of input and output messages identical. This strategy for transmitting APDU points out how to call cryptographic functions to encode or decode the data body of APDU, and how to construct a modified APDU message structure according to the original APDU message structure, which will be sent to its intended recipient instead of the original APDU message structure. With the proper secret keys, the authorized party can recover this modified APDU to its corresponding original APDU properly, without any information leakage. The transfer of secret keys to other parties is the most difficult aspect of secure APDU transmission, whereas data encryption/decryption is relatively straightforward. Two distinct strategies for managing secret keys, namely the static and the dynamic are introduced and compared. The dynamic strategy is preferred for a terminal application and smart card which do not need to authenticate each other. The implementation of this dynamic strategy has been detailed.

Keywords:

References

R. Anderson and M. Kuhn, Tamper resistance-a cautionary note, Second USENIX Workshop on Electronic Commerce Proc. (USENIX Press, 1996) pp. 1–11. Google Scholar
Cardlogix, inc., Smart Card & Security Basics (July 2000), http://www.cardlogix.com . Google Scholar
J. Daemen and V. Rijmen, AES Proposal: Rijndael, AES Algorithm Submission (3 September 1999) . Google Scholar
D. Davis, Fraud and the case for smart cards, Card Technology Mag. (1 October 2003) . Google Scholar
W. Diffie and M. E. Hellman, IEEE Trans. Inform. Th. IT 22, 644 (1976), DOI: 10.1109/TIT.1976.1055638. Crossref, Web of Science, Google Scholar
International Standard ISO/IEC 7816-Part 3: Electronics Signals and Transmission Protocols (December 1997) . Google Scholar
International Standard ISO/IEC 7816-Part 4: Interindustry Command for Interchange (November 1998) . Google Scholar
B. Kaliski, IETF RFC 1319: The MD2 Message-Digest Algorithm (April 1992) . Google Scholar
A. Menezes , P. Van Oorschot and S. Vanstone , Handbook of Applied Cryptography ( CRC Press , New York , 2001 ) . Google Scholar
Microsoft Corporation, NGSCB, Available: http://www.microsoft.com/resources/ngscb/default.mspx . Google Scholar
National Institute of Standards and Technology, FIPS Publication 81: DES Modes of Operation (31 May 1996) . Google Scholar
National Institute of Standards and Technology, FIPS Publication 46-3: Data Encryption Standard (25 October 1997) . Google Scholar
National Institute of Standards and Technology, FIPS Publication 197: Advanced Encryption Standard (26 November 2001) . Google Scholar
National Institute of Standards and Technology, FIPS Publication 180-2: Secure Hash Standard (August 2002) . Google Scholar
R. Rivest, A. Shamir and L. Adleman, Commun. ACM 21(2), 120 (1978), DOI: 10.1145/359340.359342. Crossref, Web of Science, Google Scholar
R. Rivest, A. Shamir and L. Adleman, On digital signatures and public-key cryptosystems, MIT Laboratory for Computer Science, Technical Report, MIT/LCS/TR-212 (January 1979) . Google Scholar
R. Rivest, IETF RFC 1321: The MD5 Message-Digest Algorithm (April 1992) . Google Scholar
RSA Laboratories, PKCS #3 V1.4: Diffie-Hellman Key-Agreement Standard (1 November 1993) . Google Scholar
RSA Laboratories, PKCS #1 V2.1: RSA Cryptography Standard (14 June 2002) . Google Scholar
B. Schneier, J. Kelsey, D. Whiting, D. Wagner, C. Hall, N. Ferguson, T. Kohno and M. Stay, The Twofish Team'S Final Comments on AES Selection (15 May 2000) . Google Scholar
B. Schneier and A. Shostack, Breaking up is hard to do: modeling security threats for smart cards, USENIX Workshop on Smart Card Technology (USENIX Press, 1999) pp. 175–185. Google Scholar

Vol. 22, No. 01

Metrics

Downloaded 19 times

History

Keywords

PDF download

System Upgrade on Tue, May 28th, 2024 at 2am (EDT)

A STRATEGY FOR SECURING APDU TRANSMISSION

Abstract

Recommended