Smart card data transaction system and methods for providing high levels of storage and transmission security

• US 7,380,125 B2
• Filed: 05/22/2003
• Issued: 05/27/2008
• Est. Priority Date: 05/22/2003
• Status: Expired due to Fees

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Reilly, Dylan Maxwell, Fellenstein, Craig William, Di Luoffo, Vincenzo Valentino
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): Dada; Beemnet W
• Application Number:
  US10/443,670
• Publication Number:
  US 20040250066A1
• Time in Patent Office: 1,832 Days
• Field of Search: 713/164, 713/168, 713/169, 713/172, 713/167, 713/173, 726/2, 726/3, 726/9, 380/277, 380/281
• US Class Current: 713/172
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A smart card system is disclosed for secure transmission of post issuance data to a embedded chip using a chip relay module, a plurality of hardware security modules, a first communication system having two security layers and a second communication system having four security layers.

The first communication system may be considered a server side system and comprises a chip management system, a security server having a first hardware security module, a distribution server having a second hardware security module and a computer system connected by a network. The first communication system has a first security layer and a second security layer. The first security layer comprises mutual authentication that makes each component of the first communication system a trusted node to the others through client mutual authentication. The second security layer comprises system keys for secure communication between the hardware security modules.

The second communication system may be considered a client side system and comprises the computer system connected to the distribution server by a network, a PC/SC card reader driver, a Web browser application, and a chip relay module and is for secure communication between the distribution server and the chip of a smart card inserted in the card reader/writer. The second communication system has a third, fourth, fifth and sixth security layer.

Claims

1. An apparatus for secure transmission of a post issuance data from a distribution server to a smart card comprising:

a smart card inserted in a card reader;

a chip embedded in the smart card and electronically connected to the card reader;

a computer connected to the card reader and to the distribution server by a network;

a chip relay module in a browser in the memory of the computer;

wherein the chip relay module establishes a secure session with the distribution server;

wherein the post issuance data is transmitted from the distribution server to the smart card in an XML message that has been provided with a code derived from an issuer'"'"'s master key;

wherein the issuer'"'"'s master key is obtained from a first hardware security module on a security server by a second hardware security module on the distribution server for the purpose of deriving the code;

wherein the issuer'"'"'s master key is identified using a reference in a chipholder profile; and

,

wherein when identified the issuer'"'"'s master key is transmitted securely from the first hardware security module to the second hardware security module.

2. The apparatus of claim 1 wherein the code is a message authentication code.

3. The apparatus of claim 1 wherein the code is a message authentication code encrypted.

4. The apparatus of claim 2 wherein the message authentication code is derived from a first card key.

5. The apparatus of claim 4 wherein the first card key is derived from the issuer'"'"'s master key.

6. The apparatus of claim 3 wherein the message authentication code encrypted is derived from a second card key.

7. The apparatus of claim 6 wherein the second card key is derived from the issuer'"'"'s master key.

8. The apparatus of claim 1 wherein the issuer'"'"'s master key is obtained from a first hardware security module in a security server and transmitted to a second hardware security module in the distribution server.

9. The apparatus of claim 8 wherein the issuer'"'"'s master key is encrypted using a system public key.

10. The apparatus of claim 9 wherein the issuer'"'"'s master key is decrypted in the second hardware security module using a system private key.

11. The apparatus of claim 1 wherein the chip relay module establishes a secure communication between the chip and the distribution server by a second mutual authentication.

12. The apparatus of claim 1 wherein the chip relay module establishes a session context security using a session key.

13. The apparatus of claim 1 wherein a data marker is a precondition for a secure transmission between the distribution server and the chip.

14. The apparatus of claim 1 wherein a flag is a precondition for a secure transmission between the distribution server and the chip.

15. The apparatus of claim 1 further comprising a secure communication between the distribution server and the browser using a first mutual authentication.

16. The apparatus of claim 1 further comprising a chip management system connected to the network.

17. The apparatus of claim 16 wherein the chip management system further comprises a plurality of chipholder files.

18. The apparatus of claim 17 wherein the chipholder files further comprise a card file.

19. The apparatus of claim 18 wherein the card file further comprises a reference key.

20. The apparatus of claim 19 wherein the reference key is used to obtain the issuer'"'"'s master key.

21. The apparatus of claim 16 wherein the chip management system and the distribution server share a means for a first mutual authentication.

22. The apparatus of claim 1 wherein the post issuance data is encrypted for transmission from a security server to the distribution server.

23. The apparatus of claim 1 wherein the post issuance data is digitally signed for transmission from a security server to the distribution server.

24. The apparatus of claim 1 wherein the post issuance data is encrypted and digitally signed for transmission from a security server to the distribution server.

25. The apparatus of claim 1 wherein the post issuance data is bulk data and the bulk data is encrypted using a system symmetric key.

26. The apparatus of claim 1 wherein the post issuance data is encrypted using a system symmetric key and is further encrypted using a system public key.

42. The apparatus of claim 1 wherein the chip has a set of installed card keys.

43. The apparatus of claim 1 wherein in order to securely transmit the post issuance data from the distribution server to the chip, the post issuance data must be message authentication coded.

44. The apparatus of claim 43 wherein in order to message authentication code the post issuance data, a set of card keys corresponding to a set of card keys in the chip is generated using an issuer'"'"'s master key.

45. The apparatus of claim 44 wherein in order to generate the set of card keys, the issuer'"'"'s master key is requested from the security server.

46. The apparatus of claim 45 wherein responsive to a request for the issuer'"'"'s master key by the distribution server, a first hardware security module in the security server encrypts the issuer'"'"'s master key using a system encryption key, and transmits the encrypted issuer'"'"'s master key to the distribution server.

47. The apparatus of claim 45 wherein responsive to the receipt of the encrypted issuer'"'"'s master key by the distribution server, a second hardware security module in the distribution server, decrypts the issuer'"'"'s master key.

48. The apparatus of claim 47 wherein responsive to decryption of the issuer'"'"'s master key in the second hardware security module, the hardware security module uses the issuer'"'"'s master key to generate a set of card keys.

27. A method for secure transmission of a post issuance data between a distribution server and a chip comprising:

inserting a smart card having a chip into a card reader connected to a computer and a network; and

responsive to authentication of the chip at the distribution server, using a chip relay module to establish a secure communication between the chip and the distribution server;

wherein the post issuance data is transmitted from the distribution server to the chip in an XML message provided with a code derived from an issuer'"'"'s master key;

wherein the issuer'"'"'s master key is obtained from a first hardware security module on a security server by a second hardware security module on the distribution server for the purpose of deriving the code;

wherein the issuer'"'"'s master key is identified using a reference in a chipholder profile; and

,

wherein when identified the issuer'"'"'s master key is transmitted securely from the first hardware security module to the second hardware security module.

28. The method of claim 27 further comprising:

generating a set of card keys at a hardware security module of the distribution server;

using the card keys to encrypt an XML message containing the post issuance data; and

transmitting the post issuance data from the distribution server to the chip.

29. A method for secure transmission of a post issuance data between a distribution server and a chip comprising:

configuring a first communication system having a distribution server, a security server, a chip management system and a first security layer;

configuring a second communication system having the distribution server and a client card system having a chip relay module;

using the chip relay module to establish a third security layer in the second communication system;

using a chip identification number to obtain the post issuance data from the chip management system;

using a card key to encrypt the post issuance data for transmission from the distribution server to the chip; and

wherein the card key is generated from an issuer'"'"'s master key obtained from the security server;

wherein the issuer'"'"'s master key is obtained from a first hardware security module on the security server by a second hardware security module on the distribution server for the purpose of deriving the card key;

wherein when the issuer'"'"'s master key has been obtained by use of the reference, the issuer'"'"'s master key is transmitted securely from the first hardware security module to the second hardware security module.

30. The method of claim 29 further comprising:

configuring a second security layer in the first communication system.

31. The method of claim 29 further comprising:

configuring a fourth security layer in the second communication system.

32. The method of claim 29 further comprising:

configuring a fifth security layer in the second communication system.

33. The method of claim 29 further comprising:

configuring a sixth security layer in the second communication system.

34. The method of claim 30 further comprising:

using a first system key to establish the second security layer.

35. The method of claim 31 further comprising:

using a session key to establish the fourth security layer.

36. The method of claim 32 further comprising:

using a data marker or flag to establish a fifth security layer.

37. The method of claim 33 further comprising:

using a MAC to establish a sixth security layer.

38. The method of claim 33 further comprising:

using a MAC encrypted to establish a sixth security layer.

39. The method of claim 34 further comprising:

using a second system key to encrypt the post issuance data.

40. The method of claim 34 further comprising:

using a second system key to wrap a post issuance data that has been encrypted using a symmetric key.

41. An apparatus for secure transmission of a post issuance data from a distribution server to a smart card comprising:

a first communication system connecting a security server, a distribution server and a chip management system;

a second communication system connecting the distribution server and a client card system having a card reader;

a chip embedded in the smart card and electronically connected to the card reader;

wherein the post issuance data is transmitted from the distribution server to the chip encrypted by a card key;

wherein the post issuance data is transmitted from the distribution server to the smart card in an XML message provided with a code derived from an issuer'"'"'s master key by a second hardware security module;

wherein the issuer'"'"'s master key is obtained from a first hardware security module on a security server by a second hardware security module on the distribution server for the purpose of deriving the code;

wherein the issuer'"'"'s master key is identified using a reference in a chipholder profile; and

,

wherein when identified the issuer'"'"'s master key is transmitted securely from the first hardware security module to the second hardware security module.

49. The apparatus of claim 41 wherein post issuance data is encrypted for transmission from the security server to the distribution server using a system public key.

50. The apparatus of claim 41 wherein post issuance data is encrypted for transmission from the distribution server to the chip using a set of card keys.

51. The apparatus of claim 41 wherein, when post issuance data is bulk data, the bulk data is first encrypted using a system symmetric key and then encrypted using a system public key.

52. The apparatus of claim 41 wherein post issuance that has been encrypted is decrypted at the distribution server using a system private key.

53. The apparatus of claim 41 wherein post issuance data that is bulk data is decrypted at the distribution server using a system private key and a system symmetric key.