Secure multiple application card system and process

• US 7,469,339 B2
• Filed: 08/17/2001
• Issued: 12/23/2008
• Est. Priority Date: 05/15/1997
• Status: Expired due to Fees

• Current Assignee: Multos Ltd
• Original Assignee: Multos Ltd
• Inventors: Everett, David Barrington, Richards, Timothy Philip, Miller, Stuart James, Viner, John Charles, Simmons, Ian Stephen, Peacham, Anthony David
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US09/932,013
• Publication Number:
  US 20010056536A1
• Time in Patent Office: 2,685 Days
• Field of Search: 713/172, 713/156, 713/166, 713/187, 235/492
• US Class Current: 713/172
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06K 19/0719 at least one of the integrated circuit chips comprising an arrangement for application selection, e.g. an acceleration sensor or a set of radio buttons application selection on smart cards using pure software control, see G07F7/10
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3574 Multiple applications on card
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure multiple application card system and process is provided having secure loading and deleting capability by use of a Certification Authority and Personalization Bureau. The certification authority maintains the security of the system by requiring IC cards to be injected with its public key and a card identifier for uniquely identifying each card, by providing a personalization data block for each card, and by signing with its private key all applications to be loaded or deleted from the IC card.

Claims

1. A method for securely loading an application onto at least one integrated circuit (IC) card, comprising:

a first step of determining, based at least upon an encrypted personalization data block, whether the at least one IC card is part of a qualified set of IC cards to accept loading of said application; and

a second step of loading the application onto the IC card only if the first step determines that the IC card is qualified to accept the loading of the application.

2. A method for securely deleting an application from at least one integrated circuit (IC) card, comprising:

a first step of determining, based at least upon an encrypted personalization data block, whether the at least one IC card is part of a qualified set of IC cards to accept deleting of said application; and

a second step of deleting the application from the IC card only if the first step determines that the IC card is qualified to accept the deleting of the application.