DE10107527A1 - Method for combining card specific data with individual personal data in a smart card production plant such that not more than one card can be produced with individual personal data - Google Patents

Abstract

Method in which the personal data that is to be transferred to the card is generated and transferred to the chip card production plant where it is used in a personalization machine with a security module for combining individual card data and secret data. At the same time the data is at least partially stored in a database. According to the method a secure dialogue is established between the security module (4) and the chip card (1) and a data set (6) is generated that combines card specific data with personal secret data. The data set or record is stored at the same time in a secure database (5) that is then accessed to check individual data that has been placed in a card previously and block production of cards with duplicate data.

Description

The invention relates to a method for introducing a card-specific Date together with other pre-created individual cards Personalization data in exactly one chip card, one Personalization data record PD is generated, which goes to the chip card production is surpassed in the chip card with a personalization machine a security module SAM for the introduction of individual cards and passes through secret data, and also partially in a database CA-DB is filed.

DE 199 02 722 A1 describes a replacement method of at least one secret initial value between one Processing station and a chip card known. Using the procedure of known publication are security problems in the initialization a chip card, which is transmitted on the basis of a plain text and stored key arise, overcome.

The solution to the security problems is that between. Processing station and chip card only parts of the key exchanged and the key in the chip card and the processing station from the Share is generated.  

DE 198 58 343 A1 discloses a method and an apparatus for Reduction of the reject rate when personalizing chip cards. For this the integrated circuits and the card body are separated from each other personalized and then the personalized circuitry in the personalized card body introduced.

The known documents DE 199 02 722 A1 and DE 198 58 343 both allow a generated set of Personalization data in several chip cards. This was quite so wanted to enable post-production of cards.

For other personalization data, e.g. B. ID information, it can on the other hand, it may be a provision or a statutory provision that this card-specific data verifiably in just one chip card be introduced.

It could be an easy way to meet these requirements consist of the card-specific date with a random number generator to generate the chip card. However, this creates higher ones Manufacturing times for the chip cards and additional data paths because typically the date generated in the card to a central instance storage there must be reported back. This would be the Significantly slow down and increase the cost of card production.

So introduces the introduction of the German signature law identical personalization data in more than one chip card. serious violation of the binding requirements of Signature Act, Ordinance [SigV, § 16, I] and the subordinate Measures catalog for technical components according to the Signature Act of July 15, 1998 by the Regulatory Authority for Telecommunications and Post  [MASS, chap. 1, I]. After that is a clear assignment and accurate unique existence of the secret cardholder signature key required.

The object of the invention is therefore an economically optimized To provide a method that includes the introduction of the card-specific date into multiple smart cards.

The solution to the problem is realized in that between the Security module SAM and the chip card a secure dialogue takes place and a data record DS is created for each chip card, which contains the individual card Date logically linked to the respective chip, and then based on the data records that can be verifiably transferred to the CA-DB database DS recognizes a card-specific date inserted into several chip cards and the affected smart cards are blocked.

The method according to the invention has the advantage that it is clear Assignment of the card-specific date to a chip as physical Carrier medium for this date with comparatively low Production costs are possible.

In a special embodiment, the card-specific date is made out taken from the personalization data record PD. This reduces additional ones Data paths, which maximizes processing speed and the Manufacturing costs can be minimized.

A favorable embodiment of the method enables the chip to pass through a feature introduced in advance in the chip is identified. This In contrast to externally applied classification features, the cost-effective identification of the chips even with large quantities.  

Advantageously, a feature introduced into the chip beforehand Chip serial number CSNR used. This is used in the manufacture of the chip introduced into the chip by the chip manufacturer and is tamper-proof Part of the chip. In addition, the chip can be clearly identified because the chip serial number is only assigned once.

In an advantageous embodiment, the card is individual Date by key for an asymmetric cryptographic procedure. This enables cryptographically generated ciphers to be proven to be exactly one Assign chip card.

The card-specific date is advantageously RSA- Key. Then the burden of proof can be met that an RSA signature could be carried out with just one chip card.

In a favorable embodiment, each card-specific date is in his personalization data a unique, logical card number ICCSN assigned. This enables the identification of a complete, chip card individual personalization data set by a single date ICCSN.

In a particular embodiment, the serial number CSNR, which is as unique feature of the chip there in advance when it is manufactured was introduced together with this ICCSN in the data set DS set tamper-proof. This will link the Chip hardware with the chip card-specific personalization data record possible using only two data.

In a further embodiment, the generation of the data record DS lies in Security module SAM is based on a dialog with the chip in the card, whereby the flow of this dialogue including repetition and error traps in  both components by a logical state machine tamper-proof is specified. This can be the logical safeguard the correctness and practicability of the procedure for the good case and for conceivable errors in the dialog between the components involved be performed.

The completeness of the data records is advantageously used on the basis of counters DS checked in the database CA-DB. This gives the advantage of one Completeness control of the recorded data records DS in the database CA-DB with a simple mechanism.

A favorable embodiment is used to secure the dialogue a symmetrical one between the security module SAM and the chip card Cryptography used. This creates a powerful, Tamper-proof procedure in data collection to protect both against both outside and inside offenders.

As an alternative to securing the dialog between the security module SAM and the smart card with symmetric cryptography can also asymmetrical basic keys and card-specific, symmetrical Session keys are used. This represents a tamper evident Procedure with a simple and secure key distribution.

In an advantageous embodiment, the dialogue is safeguarded between the security module SAM and the chip card by means of a message Authentication codes MAC performed. This configuration ensures Protection of the data with simultaneous transmission in plain text what the Further processing of the data facilitated.

In a special embodiment, the data records DS become regular reported back to the database CA-DB. This will make an early  Identification of card duplicates demonstrably through a clear methodology guaranteed during data transmission.

The invention is explained below using an exemplary embodiment.

The figure shows a schematic representation of the data flow between the Components.

The figure shows schematically the data flow between the components, starting from the generation point ( 9 ), where the personalization data record PD ( 2 a) with the card-specific date ( 2 b) is generated. Parts ( 7 ) of PD are sent to the database CA-DB ( 5 ); the complete PD ( 2 a) is transmitted to the personalization machine ( 3 ) on or in which the security module SAM ( 4 ) is located. The security module SAM ( 4 ) and the chip (not shown) on the chip card ( 1 ) exchange data with one another in the message dialog ( 8 ), from which the data record DS ( 6 ) is formed. DS, which logically links the card-specific date from ( 2 b) with the chip on the respective chip card ( 1 ), is sent back to the CA-DB ( 5 ). After checking the data records DS for completeness, the CA-DB checks the card-specific data of all the DS it has for duplicate freedom.

LIST OF REFERENCE NUMBERS

1

smart card

2

a Personalization record PD

2

b card-specific date

3

personalization machine

4

Security module SAM

5

CA-DB database

6

Record DS

7

Parts of the personalization data

8th

Dialogue between

1

and

4

for the formation of

6

9

generating station

Claims (14)

1. A method for introducing a card-specific date ( 2 b) together with other previously generated card-specific personalization data into exactly one chip card ( 1 ) provided with a chip, a personalization data record PD ( 2 a) being generated. is transferred to the chip card production, in which the chip card ( 1 ) runs through a personalization machine ( 3 ) with a security module SAM ( 4 ) for introducing card-specific and secret data, and is additionally partially stored in a database CA-DB ( 5 ) , characterized in that a secure dialogue ( 8 ) takes place between the security module SAM ( 4 ) and the chip card ( 1 ) and a data record DS ( 6 ) is created for each chip card ( 1 ) which logically links the card-specific date with the respective chip , and then on the basis of the data records DS ( 6 ), which can be proven to have been completely transmitted to the database CA-DB ( 5 ), a card-specific date inserted into a plurality of chip cards ( 1 ) is recognized and the chip cards ( 1 ) concerned are blocked. 2. The method according to claim 1, characterized in that the card-specific date ( 2 b) from the personalization data set PD ( 2 a) is removed. 3. The method according to any one of claims 1 or 2, characterized in that that the chip by a feature previously introduced into the chip is identified. 4. The method according to claim 3, characterized in that as in advance feature incorporated into the chip is a chip serial number CSNR is used.   5. The method according to any one of claims 1-4, characterized in that the card-specific date ( 2 b) is a key for an asymmetrical cryptographic method. 6. The method according to any one of claims 1-5, characterized in that the card-specific date ( 2 b) is RSA key. 7. The method according to any one of claims 1-6, characterized in that each card-specific date ( 2 b) is assigned a unique, logical card number ICCSN in its personalization data. 8. The method according to claim 7, characterized in that the chip serial number CSNR is set manipulation-proof together with the card number ICCSN in the data record DS ( 6 ). 9. The method according to any one of claims 1-8, characterized in that the generation of the data record DS ( 6 ) in the security module SAM ( 4 ) is based on a dialog ( 8 ) with the chip in the card, the course of this dialog including Repetition and failures in both components are predetermined by a logic state machine tamper-proof. 10. The method according to any one of claims 1-9, characterized in that the completeness of the data records DS ( 6 ) in the database CA-DB ( 5 ) is checked using counters. 11. The method according to any one of claims 1-10, characterized in that a symmetrical cryptography is used to secure the dialog ( 8 ) between the security module SAM ( 4 ) and the chip card ( 1 ). 12. The method according to any one of claims 1-10, characterized in that asymmetrical basic keys and card-specific, symmetrical session keys are used to secure the dialog ( 8 ) between the security module SAM ( 4 ) and the chip card ( 1 ). 13. The method according to any one of claims 11 or 12, characterized in that the securing of the dialog ( 8 ) between the security module SAM ( 4 ) and the chip card ( 1 ) is carried out by means of a message authentication code MAC. 14. The method according to any one of claims 1-13, characterized in that the data records DS ( 6 ) are regularly reported back to the database CA-DB ( 5 ).