Electronic Payment Systems 20-763 Lecture 8 Smart and Stored-Value Cards

1. Electronic Payment Systems20-763 Lecture 8Smart and Stored-Value Cards

2. Outline • Smart card types • Operating systems • Wireless cards • Card manufacture and issuance • Security • Octopus • Mondex • Mobile systems

3. ePayment by Smart Card • Objective: replace cash • Cash is expensive to make and use • Printing, replacement • Anti-counterfeiting measures • Transportation • Security • Cash is inconvenient • not machine-readable • humans carry limited amount • risk of loss, theft • Additional smart card benefits

4. Smart Cards • Magnetic stripe • 140 bytes, cost $0.20-0.75 • Memory cards • 1-4 KB memory, no processor, cost $1.00-2.50 • Optical memory cards • 4 megabytes read-only (CD-like), $7-12 • Microprocessor cards • Imbedded microprocessor • (OLD) 8-bit processor,16 KB ROM, 512 bytes RAM • Equivalent power to IBM XT PC • 32-bit processors now available

5. Smart Card Costs NEW: RW Optical 500 MB 32-bit $15 Reader: $200 SOURCE: SUN

6. Laser Optical Memory Card Capacity: 1MB - 1GB

7. Microprocessor Card Adoption MILLIONS OF CARDSWORLDWIDE 1999: 500 M microprocessor cards 2004: 1750 M microprocessor cards • SOURCE: DATAQUEST (10/2000)

8. Card Taxonomy SOURCE: BURGER, CAROLL & ASSOCIATES

9. Private Key(s) Digital Certificates Biometric Data Encryption Key Employee Data Password Cache Employee Picture Magnetic Stripe or RF Door Access Multi-Application Smart Card SSL Secure Web S/Mime Secure Mail Customer PKI Application ACE (Active Customer Enrollment) Authentication Single Sign-On Biometric Authentication Local File Encrypt Secure Screen Saver Application Login SOURCE: SECURITY DYNAMICS

10. Microprocessor Contacts Card (Upside-down) Epoxy Smart Card Structure Contacts: Contacts (8) SOURCE: SMART CARD FORUM

11. Old Smart Card Architecture EEPROM: Electrically Erasable Programmable Read-Only Memory SOURCE: SMART CARD FORUM

12. CARDLETS 2 3 1 JAVA VIRTUAL MACHINE OPERATING SYSTEM MICROPROCESSOR Cyberflex™ Java Smart Card • Complete 32-bit Java run-time environment on a card • Utilities for compiling and loading cardlets onto the card from a PC

13. Smart Card Architecture • File structure (ISO 7816-4) • Cyclic files • Database management on a card • SCQL (Structured Card Query Language) • Provides standardized interface • No need to know file formatting details

14. Contactless Cards • Communicates by radio • Power supplied by reader • Data rate 106 Kb/sec • Read 2.5 ms, write 9 ms • 8 Kb EEPROM, unlimited read, 100,000 writes • Effective range: 10 cm, signals encrypted • Lifetime: 2 years (data retention 10 years) • Two-way authentication, nonces, secret keys • Anticollision mechanism for multiple cards • Unique card serial number SOURCE: GEMPLUS

15. How RFID Works Antenna • Tag enters RF field • RF signal powers tag • Tag transmits ID, plus data • Reader captures data • Reader sends data to computer • Computer determines action • Computer instructs reader • Reader transmits data to tag Tag Computer RFID Reader SOURCE: PHILIPS

16. RFID SOURCE: SANJAY SARMA

17. IC Design Millions of tags 1-2¢ 20¢ 1¢ 20¢ 1¢ 5¢ 5¢ 1¢ Total ~ 4-5¢ Billions of tags Low-Cost RFID End Antenna Antenna/IC IC Conversion users Manufacture Assembly Manufacture to Package Total ~ 40¢ SOURCE: SANJAY SARMA

18. Java Ring • Java-enabled iButton • Communicates by contact at 142 Kbps • 64 KB ROM and 134 KB RAM • Stores 30 digital certificates with 1024-bit keys • Uses: authentication, epayment, access • Cost: $15-30 in unit quantity SOURCE: IBUTTON.COM

19. OpenCard Framework (OCF) CardService Layer (TALKS TO CARD) CardTerminal Layer (TALKS TO READER) SOURCE: OPENCARD.ORG

20. CVC = Card Verification Code PVV = PIN Verification Value SOURCE: L. M. CHENG, CUHK

21. ATM and Debit Card Cryptography • PIN cannot be stored anywhere in plaintext • PIN cannot be reverse-engineered from the card or any database • Generate a random 4-digit number (the PIN) • Combine PIN with other data (account number) to form a data block • Encrypt the data block using 3DES and secret bank keys • Select several digits from the encrypted data to use as the Pin Verification Value (PVV)

22. ACCOUNT NUMBER 4-DIGIT PIN ENCRYPTED DATA BLOCK SECRET BANK KEYS 3DES SELECT 4-6 DIGITS FROM ENCRYPTED DATA BLOCK TO FORM PVV PIN VERIFICATION VALUE (PVV) CARD HAS ACCOUNT NUMBER AND PVV Forming the Pin Verification Value

23. ACCOUNT NUMBER 4-DIGIT PIN PVVs MATCH? USER IS AUTHENTIC PVVs DIFFERENT? USER IS REJECTED ATM MACHINE READS ACCOUNT NUMBER AND PVV USER TYPES PIN MACHINE NOW HAS: PVV CARD HAS ACCOUNT NUMBER AND PVV COMPARE CARD PVVWITH COMPUTED PVV MACHINE HAS BANK KEYS IN HARDWARE: DECRYPTED DATA BLOCK SECRET BANK KEYS PVV 3DES COMPUTE PVV Using the Card

24. Credit Card Fraud • Stealing — A legal card may be stolen and used in ATMs or EPOSs. • Altering and re-embossing a genuine card, modifying visual features. • Skimming or altering data on the magnetic stripe, e.g. expiration date or credit limit, stored value. • Copying data from a genuine card to another online — “white plastic fraud” • Counterfeiting — “color plastic fraud” — encoding information from one card to another card off-line SOURCE: L. M. CHENG, CUHK

25. OP Security Assumptions • OP card is merely a component • Need to trust: • back-office systems • cryptographic key management • card/chip operating environment (COE) • off-card security procedures (actors and roles) • There are vulnerabilities the OP card cannot protect itself against SOURCE: GAMMA

26. Group 5 Group 6 ATTACKS ON THE RUN-TIME ENVIRONMENT THROUGH THE CARD ACCEPTANCE DEVICE (CAD) THREATS FROM CARD APPS AND NEED TO SHARE RESOURCES Clone Future Group 7 Past Group 3 Current THREATS BASED ON RTE IMPLEMENTATION ATTACKS USING CARDS NOT YET ISSUED, OLD CARDS, CLONES CAD Group 4 Group 1 ATTACKS ON CARD’S INTERFACE TO THE OUTSIDE, E.G. PREMATURE REMOVAL Group 2 DIRECT ATTACKS ON CHIP CIRCUITRY INDIRECT ATTACKS ON CHIP CIRCUITRY OP Card Security Threats SOURCE: GAMMA

27. Smart Card Security • Observers • Active defenses • Attacks: • Microprobing, microscopy • Differential fault analysis • (Boneh et al. 1997) • Induce errors, observe output differences • Differential power analysis SOURCE: Kömmerling et al. SOURCE: cryptography.com

28. SMART CARD POWER CONSUMPTION DURING DES ENCRYPTION 16 DES ROUNDS INITIAL PERMUTATION FINAL PERMUTATION EXPANDED VIEW OF ROUNDS 2 & 3 SOURCE: cryptography.com Differential Power Analysis • Send different inputs to the Smart Card to learn details of its encryption key • When a correct key value is tried, the algorithm responds • Incorrect keys have zero average response

29. Smart Card Optical Vulnerabilities “DEPACKAGED” PIC16F84 MANUAL PROBER WITH PHOTOFLASH LAMP SRAM ARRAY, MAGNIFIED (STATIC RANDOM ACCESS MEMORY) SOURCE: ROSS ANDERSON

30. Smart Card Sales Leaders (2000) VENDOR # OF CARDS SHARE Gemplus 185,000,000 29% Schlumberger 152,000,000 24% Oberthur Smart Cards 85,000,000 14% Giesecke & Devrient 76,000,000 12% Orga Card Systems 53,000,000 8% TOTAL 628,000,000 SOURCE: CARDWEB.COM

31. Octopus • Transaction time < 300 milliseconds • Transaction fees: HK$0.02 + 0.75% • $10 transaction costs $0.095 (0.95%) • Applications • Transit • Telephones • Road tolls • Point-of-sale • Access control • Anonymous / personalized • How does money get to service providers? • Net settlement system operated by Creative Star

32. Octopus SONY RC-S833 CONTACTLESS SMART CARD SONY READER/WRITER I/O SPEED: 211 Kbps SOURCE: SONY

33. Octopus System SOURCE: WORLD BANK

34. Bus Smart Card Systems SOURCE: MITSUBISHI

36. Mondex • Subsidiary of MasterCard • Smart-card-based, stored-value card (SVC) • NatWest (National Westminister Bank, UK) et al. • Secret chip-to-chip transfer protocol • Value is not in strings alone; must be on Mondex card • Loaded through ATM • ATM does not know transfer protocol; connects with secure device at bank • Spending at merchants having a Mondex value transfer terminal

37. Mondex Overview SOURCES: OKI, MONDEX USA

38. Mondex Security • Active and dormant security software • Security methods constantly changing • ITSEC E6 level (military) • VTP (Value Transfer Protocol) • Globally unique card numbers • Globally unique transaction numbers • Challenge-response user identification • Digital signatures • MULTOS operating system • firewalls on the chip

39. Payment Cards EMV = EUROPAY INT’L, MASTERCARD,VISA MPCOS = MULTI PAYMENT CHIP OPERATING SYSTEM • 8-128 Kb • Data rate 115 Kb/sec • ISO 7816 compliant • Visa-certified • PIN management and verification • 3DES algorithm for authentication, secure messaging • ePurse with payment command set (debit,credit, balance, floor limit management) SOURCE: GEMPLUS

40. MOTOROLA P7389 TRIBAND WAP PHONE WITH SMARTCARD READER Mobile Card Systems

41. Merchants Clearing & Settlement OPTION 1: Multi-app: SIM + EMV (CEC) Mobile EMV Chip Debit/Credit Card Issuers Voice or IP Browsing & Offer Request Wallet simply forwards cardholder’s address details Merchant Acquirer Merchant Offer Acquiring Payment Engine WAP or i-Mode Gateway Wallet Server Purchase Request SET or SSL/TLS Shipment Confirmation Authorisation Request / Response M/CHIP transaction with ARQC and ARPC / ARC data classed as “Card Present” Transaction Option 2: Dual slot phone with full size EMV SOURCE: MAOSCO

42. Comparison of Payment Methods

43. Major Ideas • Potential of cards is unexplored; new uses every day • Powerful microprocessors allow • cryptography • certificates, authentication • secure purses • Wireless (contactless) cards enable new business models • Huge capacity laser CD-DVD cards allow large databases of personalized information

44. Q A &