Method and system for facilitating memory and application management on a secured token

• US 7,874,492 B2
• Filed: 06/12/2007
• Issued: 01/25/2011
• Est. Priority Date: 12/04/2001
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.), Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.), Visa USA, Inc. (Visa, Inc.)
• Inventors: Levy, Philippe, Gorden, Mary, Simcox, Virginia, Sloan, Jerry, Hammad, Ayman
• Primary Examiner(s): Frech; Karl D.
• Application Number:
  US11/761,920
• Publication Number:
  US 20070250925A1
• Time in Patent Office: 1,323 Days
• Field of Search: 235/379, 235380-382, 235/441, 235/487, 235/488, 235/492, 705 64- 66, 705/41, 713/159, 713/172, 194/205, 361/373, 707/101
• US Class Current: 235/492
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3574 Multiple applications on card
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A system for facilitating memory and application management on a smartcard the system includes a client having a number of applications and a smartcard having specification logic allowing file structures and security and access conditions to be defined using a set of common commands. Each application has a corresponding group of data on the smartcard. An applet instance is created for each application and corresponding group of application data. At the time of instantiation, the specification logic allows an application to specify the file structure and/or to specify security and access conditions for its group of data. An application can utilize passcode and credential management so that a single passcode is used to access the smartcard regardless of whether the application utilizes the common commands to specify a file structure.

Claims

1. A system comprising:

a client including a first application; and

a secured token including an applet providing a set of common commands including a first plurality of commands allowing specification of different file structures for separate instances of the applet and a second plurality of commands providing passcode and credential management for instances of the applet,

wherein the applet is operable to be instantiated to create a first applet instance for the first application utilizing the second plurality of commands to allow a holder of the secured token to access data in the secured token for the first application using a passcode regardless of whether the first applet instance utilizes the first plurality of commands to specify a file structure for the first applet instance, the passcode being a single passcode for the secured token operable to provide access to data in the secured token relating to any instance of the applet.

2. The system of claim 1 wherein the secured token is a smartcard.

3. The system of claim 1 wherein the client includes a plurality of applications, the set of common commands providing functionality that is commonly utilized by the plurality of applications.

4. The system of claim 1 wherein the applet is further operable to instantiate a second applet instance for a second application, the first plurality of commands further allowing a second file structure to be specified for the second application that is different from a first file structure used to store application data for the first application in the secured token.

5. The system of claim 1 wherein the first application includes control logic for managing data and does not utilize the first plurality of commands.

6. The system of claim 1 wherein the first plurality of commands includes a first set of commands that is available when a corresponding applet is in a first state and a second set of commands that is available when the corresponding applet is in a second state.

7. The system of claim 6 wherein the first set of commands includes a select command for selecting a desired applet instance, an initialize command for establishing a secure channel between the client and the secured token, an authenticate command for authenticating the client to the secured token, a store command for storing information when the secured token is in a personalization phase, and an end-personalization command designed to transition the corresponding applet to the second state.

8. The system of claim 7 wherein communications with the secured token are protected by secure messaging.

9. The system of claim 1 wherein the set of common commands includes a select command for selecting a desired applet instance, a retrieve command for retrieving information from a desired applet instance, a file read command for reading data from a desired file, a record read command for reading data from a desired record in a file, a file update command for updating data in a desired file, a record update command for updating a desired record, and a verify passcode command for verifying the passcode in order to access the secured token.

10. The system of claim 1 wherein the set of common commands includes a get status command for retrieving information detailing an internal status of the corresponding applet, and wherein the second set of commands includes a get status command for retrieving information detailing an internal status of the corresponding applet, an internal authenticate command for providing credential management services for incoming data, a change passcode command for modifying the passcode used for accessing the secured token, and an unblock passcode command for unblocking the passcode.

11. The system of claim 1 wherein the second plurality of commands includes at least one cryptographic service utilizing a signature selected from the group consisting of DES-MAC and RSA signatures.

12. The system of claim 1, wherein the second plurality of commands provides passcode management and credential management utilizing an authentication mechanism including at least one of a symmetric key and a public key for secure access.

13. A method comprising:

providing an applet on a secured token, the applet providing a set of common commands including a first plurality of commands allowing specification of different file structures for separate instances of the applet and a second plurality of commands providing passcode and credential management for the separate instances of the applet; and

instantiating a first applet instance for a first application utilizing the second plurality of commands to allow a holder of the secured token to access data in the secured token for the first application using a passcode regardless of whether the first applet instance utilizes the first plurality of commands to specify a file structure for the first applet instance, the passcode being a single passcode for the secured token operable to provide access to data in the secured token relating to any instance of the applet.

14. The method of claim 13 further comprising:

providing the secured token, wherein the secured token is a smartcard.

15. The method of claim 13 further comprising:

using the first application in a client to interact with the first applet instance.

16. The method of claim 13 further comprising:

protecting communications with the secured token by secure messaging.

17. The method of claim 13 further comprising:

utilizing at least one cryptographic service provided by the second plurality of commands and utilizing a signature selected from the group consisting of DES-MAC and RSA signatures.

18. The method of claim 13 further comprising:

utilizing an authentication mechanism of the second plurality of commands for passcode and credential management including at least one of a symmetric key and a public key for secure access.

19. The method of claim 13 further comprising using the secured token for financial transactions.

20. A computer program product embedded in a computer readable medium for managing data on a secured token, comprising:

program code for providing a set of common commands in an applet including a first plurality of commands allowing specification of different file structures for separate instances of the applet and a second plurality of commands providing passcode and credential management for instances of the applet; and

program code for instantiating a first applet instance for a first application utilizing the second plurality of commands to allow a holder of the secured token to access data in the secured token for the first application using a passcode regardless of whether the first applet instance utilizes the first plurality of commands to specify a file structure for the first applet instance, the passcode being a single passcode for the secured token operable to provide access to data in the secured token relating to any instance of the applet.

21. The computer program product of claim 20, further comprising:

program code for protecting communications with the secured token by secure messaging.

22. The computer program product of claim 20, further comprising:

program code for providing at least one cryptographic service utilizing a signature selected from the group consisting of DES-MAC and RSA signatures.

23. The computer program product of claim 20, further comprising:

program code for utilizing an authentication mechanism for passcode and credential management including at least one of a symmetric key and a public key for secure access.