EP1393526A1 - Method for generating a key for signature cards - Google Patents

Method for generating a key for signature cards

Info

Publication number
EP1393526A1
EP1393526A1 EP02742989A EP02742989A EP1393526A1 EP 1393526 A1 EP1393526 A1 EP 1393526A1 EP 02742989 A EP02742989 A EP 02742989A EP 02742989 A EP02742989 A EP 02742989A EP 1393526 A1 EP1393526 A1 EP 1393526A1
Authority
EP
European Patent Office
Prior art keywords
key
signature
key generation
card
generation unit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP02742989A
Other languages
German (de)
French (fr)
Inventor
Ralph Krysiak
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Giesecke and Devrient GmbH
Original Assignee
Giesecke and Devrient GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Giesecke and Devrient GmbH filed Critical Giesecke and Devrient GmbH
Publication of EP1393526A1 publication Critical patent/EP1393526A1/en
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/02—Payment architectures, schemes or protocols involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/0806—Details of the card
    • G07F7/0813—Specific details related to card security
    • G07F7/082—Features insuring the integrity of the data on or in the card
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys

Definitions

  • the invention relates to a method for generating keys for signature cards according to the preamble of claim 1.
  • the signature card has, among other things, the task of storing the secret signature key.
  • This secret signature key must be generated in a secure environment, the key being generated either in the card itself or outside the card.
  • card personalizers for larger quantities of cards, personalization is carried out by card personalizers (example: ec cards, credit cards). Analog transfer of the external key generation to card personalizers is not easily possible due to the high security requirements for signature cards. For this reason, in the case of known concepts, the keys are generated in a high-security environment in a trust center. keys stored in a file and safely brought to the personalizer. This method is also very complex, so that there is no sensible use for the generation of signature keys.
  • On-card key generation is simpler, with the key never leaving the signature card, which means that there are no special requirements for the security of the personalization environment. Due to the limited computing speeds that are available in a chip card, i.e. However, the ⁇ C of a chip card is very long, so that this process is also unsuitable for the use of large quantities of cards to be personalized.
  • the key generation unit Before or after the generation of the secret key, a session key can be agreed between the key generation unit and the signature card for the later data exchange. Finally, the key for the signature card generated in the key generation unit is transmitted using the session key. Contrary to the prior art, in which the key generation is carried out in a security box and the encrypted key is personalized in the signature card, the personalization taking place in the immediate vicinity of the security box, it is not necessary in a method according to the invention that the key generation units are arranged in a trust center in which the personalization is also carried out.
  • the agreement of the session key is advantageously carried out together with an authentication of the key generation unit with respect to the signature card. In this way it can be achieved that the signature card can first check whether the key is actually received by the key generation unit.
  • the transmitted secret key can be signed by the key generation unit, so that the authenticity of the key can be determined in the signature card, which also results in an increase in security.
  • the key generated is transmitted via an online data line.
  • the online data line is preferred, i.e. the transmission path is secured. It is preferably secured by encryption.
  • the personalization device with which the secret key is inserted into the signature card generally has a higher throughput than the key generation units, which is partly due to the higher re processing speed of the personalization device is reached, but on the other hand also in that several cards are processed in parallel in the personalization device, it has proven to be advantageous that several key generation units are operated in parallel.
  • the coordination between the key generation units and the personalization device is managed by a control computer.
  • a personalization device 1 which can personalize several cards 11 sequentially or in parallel.
  • the personalization device 1 is connected via a bidirectional data line, which is preferably secured, to a control computer 3, which in turn is connected to a key generation device 2 via a bidirectional data line.
  • the control computer can optionally also be part of the key generation device.
  • the key generation device contains at least one key generation unit 21, in which the secret key for the signature card or for the signature cards to be processed are generated.
  • the key generation device 2 or the key generation units 21 themselves can each be implemented by a signature card.
  • the number of key generation units 21 depends on the number of cards to be processed simultaneously or sequentially by the personalization device within a time unit. However, the higher the number of key generation units 21, the smaller the influence of the statistical variation of individual key generation times. In particular when using signature cards as key generation This is important because the generation time for a key with a signature card is in the range from 10 to 40 seconds with 1024-bit encryption and from 100 to 400 seconds with 2048-bit encryption.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Finance (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Storage Device Security (AREA)

Abstract

The invention relates to a method for generating a signature key for a signature card, wherein a secret key is initially generated in a key generating unit, a session key is subsequently produced by said key generating unit and the signature key is then produced. The secret key produced is then transferred to the signature card in an encrypted manner.

Description

Verfahren zur Schlüsselgenerierung für Signaturkarten Key generation method for signature cards
VERFAHREN ZUR SCHLÜSSELGENERIERUNG FÜR SIGNATURKARTENMETHOD FOR KEY GENERATION FOR SIGNATURE CARDS
Die Erfindung betrütt ein Verfahren zur Generierung von Schlüsseln für Signaturkarten nach dem Oberbegriff des Anspruchs 1.The invention relates to a method for generating keys for signature cards according to the preamble of claim 1.
Um die Rechtssicherheit bei der Verwendung von digitalen Unterschriften sicherzustellen, gibt es bestimmte Rahmenbedingungen, die gesetzlich vorgegeben und ergänzend bzw. genauer definiert in internationalen Normen beschrieben sind. Die beiden wesentlichen Komponenten eines Signa tursy- stems sind dabei das Trust-Center einerseits und die Signaturkarte andererseits. In diesen beiden Instanzen finden die sicherheitsrelevanten Abläufe der digitalen Signatur statt.In order to ensure legal certainty when using digital signatures, there are certain framework conditions that are prescribed by law and described in addition or more precisely defined in international standards. The two essential components of a signature system are the trust center on the one hand and the signature card on the other. The security-relevant processes of the digital signature take place in these two instances.
In diesem System fällt der Signaturkarte unter anderem die Aufgabe zu, den geheimen Signaturschlüssel aufzubewahren. Die Erzeugung dieses geheimen Signaturschlüssels hat in einer sicheren Umgebung zu erfolgen, wobei der Schlüssel entweder in der Karte selbst oder außerhalb der Karte erzeugt wird.In this system, the signature card has, among other things, the task of storing the secret signature key. This secret signature key must be generated in a secure environment, the key being generated either in the card itself or outside the card.
Bei der externen Schlüsselgenerierung ist es bekannt, die Schlüssel in einer Sicherheitsbox zu erzeugen und bei der Personalisierung verschlüsselt in die Signaturkarte einzubringen. Die Personalisierung erfolgt dabei in der sicheren Umgebung eines Trust-Centers, wobei der Aufwand vergleichsweise hoch ist, so dass der Einsatz nur für Kleinserien sinnvoll ist.In the case of external key generation, it is known to generate the keys in a security box and to encode them in the signature card during personalization. The personalization takes place in the secure environment of a trust center, whereby the effort is comparatively high, so that the use only makes sense for small series.
Bei größeren Mengen von Karten erfolgt die Personalisierung durch Karten- personalisierer (Beispiel: ec-Karten, Kreditkarten). Eine analoge Übertragung der externen Schlüsselgenerierung auf Kartenpersonalisierer ist aufgrund der hohen Sicherheitsanforderungen für Signaturkarten nicht ohne weiteres möglich. Aus diesem Grund werden bei bekannten Konzepten die Schlüssel in einer Hochsicherheitsumgebung in einem Trust-Center erzeugt, ver- schlüsselt in eine Datei abgelegt und auf sicherem Weg zum Personalisierer gebracht. Auch dieses Verfahren ist sehr aufwendig, so dass ein sinnvoller Einsatz für die Generierung von Signaturschlüsseln nicht gegeben ist.For larger quantities of cards, personalization is carried out by card personalizers (example: ec cards, credit cards). Analog transfer of the external key generation to card personalizers is not easily possible due to the high security requirements for signature cards. For this reason, in the case of known concepts, the keys are generated in a high-security environment in a trust center. keys stored in a file and safely brought to the personalizer. This method is also very complex, so that there is no sensible use for the generation of signature keys.
Einfacher gestaltet sich die On-Card-Schlüsselgenerierung, bei der der Schlüssel zu keinem Zeitpunkt die Signaturkarte verlässt, wodurch keine besonderen Anforderungen an die Sicherheit der Personalisierungsumge- bung zu stellen sind. Aufgrund der begrenzten Rechengeschwindigkeiten, die in einer Chipkarte, d.h. dem μC einer Chipkarte zu erreichen sind, erge- ben sich jedoch sehr lange Generierungszeiten, so dass auch dieses Verfahren nicht für den Einsatz großer Mengen zu personalisierender Karten geeignet ist.On-card key generation is simpler, with the key never leaving the signature card, which means that there are no special requirements for the security of the personalization environment. Due to the limited computing speeds that are available in a chip card, i.e. However, the μC of a chip card is very long, so that this process is also unsuitable for the use of large quantities of cards to be personalized.
Es ist deshalb Aufgabe der Erfindung, ein Verfahren anzugeben, welches die sichere und wirtschaftliche Generierung von Signaturschlüsseln zuläßt.It is therefore an object of the invention to provide a method which allows the secure and economical generation of signature keys.
Diese Aufgabe wird ausgehend von der Merkmalen des Oberbegriffs des Anspruchs 1 durch die kennzeichnenden Merkmale dieses Anspruchs gelöst.This object is achieved on the basis of the features of the preamble of claim 1 by the characterizing features of this claim.
Vorteilhafte Ausgestaltungen der Erfindung sind in den abhängigen Ansprüchen angegeben.Advantageous embodiments of the invention are specified in the dependent claims.
Gemäß der Erfindung ist vorgesehen, den geheimen Schlüssel für die Signaturkarte in einer Schlusselgenerierungseinheit zu erzeugen. Vor oder nach der Erzeugung des geheimen Schlüssels kann für den späteren Datenaustausch ein Sitzungsschlüssel zwischen der Schlusselgenerierungseinheit und der Signaturkarte vereinbart werden. Schließlich wird mit Hilfe des Sitzungsschlüssels der in der Schlusselgenerierungseinheit erzeugte Schlüssel für die Signaturkarte übermittelt. Entgegen dem Stand der Technik, bei dem die Schlüsselgenerierung in einer Sicherheitsbox ausgeführt wird und der erzeugte Schlüssel verschlüsselt in die Signaturkarte personalisiert wird, wobei die Personalisierung in unmit- telbarer Umgebung der Sicherheitsbox stattfindet, ist es bei einem Verfahren gemäß der Erfindung nicht notwendig, dass die Schlüsselgenerierungsein- heiten in einem Trust-Center angeordnet sind, in der die Personalisierung ebenfalls durchgeführt wird.According to the invention, it is provided to generate the secret key for the signature card in a key generation unit. Before or after the generation of the secret key, a session key can be agreed between the key generation unit and the signature card for the later data exchange. Finally, the key for the signature card generated in the key generation unit is transmitted using the session key. Contrary to the prior art, in which the key generation is carried out in a security box and the encrypted key is personalized in the signature card, the personalization taking place in the immediate vicinity of the security box, it is not necessary in a method according to the invention that the key generation units are arranged in a trust center in which the personalization is also carried out.
In vorteilhafter Weise wird die Vereinbarung des Sitzungsschlüssels zusammen mit einer Authentisierung der Schlusselgenerierungseinheit gegenüber der Signaturkarte durchgeführt. Auf diese Weise kann erreicht werden, daß die Signaturkarte zunächst eine Überprüfung durchführen kann, ob der Schlüssel tatsächlich von der Schlusselgenerierungseinheit erhalten wird.The agreement of the session key is advantageously carried out together with an authentication of the key generation unit with respect to the signature card. In this way it can be achieved that the signature card can first check whether the key is actually received by the key generation unit.
Alternativ dazu kann der übertragene geheime Schlüssel von der Schlusselgenerierungseinheit unterschrieben werden, so dass die Authentizität des Schlüssels in der Signaturkarte festgestellt werden kann, wodurch sich ebenfalls eine Erhöhung der Sicherheit ergibt.Alternatively, the transmitted secret key can be signed by the key generation unit, so that the authenticity of the key can be determined in the signature card, which also results in an increase in security.
Gemäß einer weiteren vorteilhaften Ausgestaltung der Erfindung ist vorgesehen, dass die Übertragung des erzeugten Schlüssels über eine Online- Datenleitung erfolgt. Bevorzugt ist die Online-Datenleitung, d.h. der Übertragungsweg gesichert. Die Sicherung erfolgt vorzugsweise durch Ver- schlüsselung.According to a further advantageous embodiment of the invention, it is provided that the key generated is transmitted via an online data line. The online data line is preferred, i.e. the transmission path is secured. It is preferably secured by encryption.
Da die Personalisierungsvorrichtung, mit der der geheime Schlüssel in die Signaturkarte eingebracht wird, in der Regel einen höheren Durchsatz aufweist als die Schlüsselgenerierungseinheiten, was zum einen durch die höhe- re Verarbeitungsgeschwindigkeit der Personalisierungsvorrichtung erreicht wird, zum anderen aber auch dadurch, daß in der Personalisierungsvorrichtung gegebenenfalls mehrere Karten parallel bearbeitet werden, hat es sich als vorteilhaft erwiesen, dass auch mehrere Schlüsselgenerierungseinheiten parallel betrieben werden. In diesem Fall wird die Koordinierung zwischen den Schlüsselgenerierungseinheiten und der Personalisierungsvorrichtung durch einen Steuerrechner verwaltet.Since the personalization device with which the secret key is inserted into the signature card generally has a higher throughput than the key generation units, which is partly due to the higher re processing speed of the personalization device is reached, but on the other hand also in that several cards are processed in parallel in the personalization device, it has proven to be advantageous that several key generation units are operated in parallel. In this case, the coordination between the key generation units and the personalization device is managed by a control computer.
Eine entsprechende Anordnung ist in der Figur beschrieben.A corresponding arrangement is described in the figure.
In der Figur ist eine Personalisierungsvorrichtung 1 dargestellt, welche mehrere Karten 11 sequentiell oder parallel personalisieren kann. Die Personalisierungsvorrichtung 1 ist über eine bidirektionale Datenleitung, die vorzugsweise gesichert ist, mit einem Steuerrechner 3 verbunden, welcher wie- der um über eine bidirektionale Datenleitung mit einer Schlüsselgenerie- rungseinrichtung 2 verbunden ist. Der Steuerrechner kann gegebenenfalls auch Teil des Schlüsselgenerierungseinrichtung sein. Die Schlüsselgenerie- rungseinrichtung enthält wenigstens eine Schlusselgenerierungseinheit 21, in der der geheime Schlüssel für die Signaturkarte bzw. für die zu bearbeiten- den Signaturkarten erzeugt werden. Die Schlüsselgenerierungseinrichtung 2 bzw. die Schlüsselgenerierungseinheiten 21 können selbst jeweils durch eine Signaturkarte realisiert sein.In the figure, a personalization device 1 is shown, which can personalize several cards 11 sequentially or in parallel. The personalization device 1 is connected via a bidirectional data line, which is preferably secured, to a control computer 3, which in turn is connected to a key generation device 2 via a bidirectional data line. The control computer can optionally also be part of the key generation device. The key generation device contains at least one key generation unit 21, in which the secret key for the signature card or for the signature cards to be processed are generated. The key generation device 2 or the key generation units 21 themselves can each be implemented by a signature card.
Die Anzahl der Schlüsselgenerierungseinheiten 21 ist abhängig von der An- zahl der von der Personalisierungsvorrichtung gleichzeitig bzw. sequentiell zu bearbeitenden Karten innerhalb einer Zeiteinheit. Je höher jedoch die Zahl der Schlüsselgenerierungseinheiten 21 ist, um so geringer wird der Einfluß der statistischen Variation von individuellen Schlüsselgenerierungszei- ten. Insbesondere beim Einsatz von Signaturkarten als Schlüsselgenerie- rungseinheiten 21 ist dies von Bedeutung, da die Generierungszeit für einen Schlüssel mit einer Signaturkarte im Bereich von 10 bis 40 Sekunden bei einer 1024 Bit- Verschlüsselung und von 100 bis 400 Sekunden bei einer 2048 Bit- Verschlüsselung liegt. The number of key generation units 21 depends on the number of cards to be processed simultaneously or sequentially by the personalization device within a time unit. However, the higher the number of key generation units 21, the smaller the influence of the statistical variation of individual key generation times. In particular when using signature cards as key generation This is important because the generation time for a key with a signature card is in the range from 10 to 40 seconds with 1024-bit encryption and from 100 to 400 seconds with 2048-bit encryption.

Claims

P a t e n t a n s p r ü c h e Patent claims
1. Verfahren zur Erzeugung eines Signaturschlüssels für eine Signaturkarte, mit folgenden Verfahrensschritten: - Erzeugen eines geheimen Schlüssels in einer Schlusselgenerierungseinheit,1. A method for generating a signature key for a signature card, with the following method steps: generating a secret key in a key generation unit,
- Erzeugen eines Sitzungsschlüssels durch die Schlusselgenerierungseinheit und die Signaturkarte,Generating a session key by the key generation unit and the signature card,
- verschlüsselte Übertragung des erzeugten Schlüssels an die Signatur- karte.- encrypted transmission of the generated key to the signature card.
2. Verfahren nach Anspruch 1, dadurch gekennzeichnet, dass mit Vereinbarung des Sitzungsschlüssels eine Authentisierung der Schlusselgenerierungseinheit gegenüber der Signaturkarte durchgeführt wird.2. The method according to claim 1, characterized in that with agreement of the session key, an authentication of the key generation unit is carried out against the signature card.
3. Verfahren nach Anspruch 1, dadurch gekennzeichnet, dass die übertragenen geheimen Schlüssel von der Schlusselgenerierungseinheit unterschrieben werden, so dass die Authentizität des Schlüssels in der Signaturkarte festgestellt werden kann.3. The method according to claim 1, characterized in that the transmitted secret keys are signed by the key generation unit, so that the authenticity of the key can be determined in the signature card.
4. Verfahren nach einem der Ansprüche 1 bis 3, dadurch gekennzeichnet, dass die Übertragung des erzeugten Schlüssels online erfolgt.4. The method according to any one of claims 1 to 3, characterized in that the transmission of the generated key takes place online.
5. Verfahren nach einem der Ansprüche 1 bis 4, dadurch gekennzeichnet, dass der Übertragungsweg gesichert ist.5. The method according to any one of claims 1 to 4, characterized in that the transmission path is secured.
6. Verfahren nach einem der Ansprüche 1 bis 5, dadurch gekennzeichnet, dass als Schlusselgenerierungseinheit eine Signaturkarte eingesetzt wird. erfahren nach einem der Ansprüche 1 bis 6, dadurch gekennzeichnet, dass mehrere Schlüsselgenerierungseinheiten parallel betrieben werden, wobei die Koordination einer zugeordneten Personalisierungsvorrichtung zu den Schlüsselgenerierungseinheiten durch einen Steuerrechner erfolgt. 6. The method according to any one of claims 1 to 5, characterized in that a signature card is used as the key generation unit. experienced according to one of claims 1 to 6, characterized in that several key generation units are operated in parallel, wherein the coordination of an associated personalization device to the key generation units is carried out by a control computer.
EP02742989A 2001-05-14 2002-05-10 Method for generating a key for signature cards Ceased EP1393526A1 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
DE10123664 2001-05-14
DE2001123664 DE10123664A1 (en) 2001-05-15 2001-05-15 Method for generating a signature code for a signature card uses a code-generating unit and a signature card to create a secrete code as well as a session code and encoded transmission of the generated code to the signature card.
PCT/EP2002/005174 WO2002093868A1 (en) 2001-05-14 2002-05-10 Method for generating a key for signature cards

Publications (1)

Publication Number Publication Date
EP1393526A1 true EP1393526A1 (en) 2004-03-03

Family

ID=7684896

Family Applications (1)

Application Number Title Priority Date Filing Date
EP02742989A Ceased EP1393526A1 (en) 2001-05-14 2002-05-10 Method for generating a key for signature cards

Country Status (3)

Country Link
EP (1) EP1393526A1 (en)
DE (1) DE10123664A1 (en)
WO (1) WO2002093868A1 (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102004058020A1 (en) 2004-12-01 2006-06-08 Siemens Ag Method for personalizing smart cards
EP1755092A1 (en) * 2005-08-01 2007-02-21 Axalto SA Manufacturing machine and method for programming portable devices
DE102007057001A1 (en) * 2007-11-27 2009-05-28 Giesecke & Devrient Gmbh Writing operating data to a portable data carrier

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
SE468068C (en) * 1991-09-30 1994-01-13 Comvik Gsm Ab Procedure for personalization of an active card, for use in a mobile telephone system
WO1993010509A1 (en) * 1991-11-12 1993-05-27 Security Domain Pty. Ltd. Method and system for secure, decentralised personalisation of smart cards
EP0723251A3 (en) * 1995-01-20 1998-12-30 Tandem Computers Incorporated Method and apparatus for user and security device authentication
US5889941A (en) * 1996-04-15 1999-03-30 Ubiq Inc. System and apparatus for smart card personalization
DE19720431A1 (en) * 1997-05-15 1998-11-19 Beta Research Ges Fuer Entwick Device and method for personalizing chip cards
AU755458B2 (en) * 1997-10-14 2002-12-12 Visa International Service Association Personalization of smart cards
FR2786292B1 (en) * 1998-11-24 2000-12-29 St Microelectronics Sa INTEGRATED CIRCUIT TEST AND CUSTOMIZATION SYSTEM
DE19947986A1 (en) * 1999-10-05 2001-04-12 Ibm Method of downloading of application parts via distributed systems on to a chip-card, requires provision of secret code or session key by the server prior to loading command-sequence of commands for downloading

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
GOVIL M.K.; FU M.C.: "Queueing Theory in Manufacturing: A Survey", JOURNAL OF MANUFACTURING SYSTEMS, vol. 18, no. 3, 1 January 1999 (1999-01-01), SOCIETY OF MANUFACTURING ENGINEERS, DEARBORN, MI, US, pages 214 - 240, XP004182932 *
See also references of WO02093868A1 *

Also Published As

Publication number Publication date
WO2002093868A1 (en) 2002-11-21
DE10123664A1 (en) 2002-11-21

Similar Documents

Publication Publication Date Title
EP1818844B1 (en) Method for using security tokens
DE4142964C2 (en) Data exchange system with verification of the device for authentication status
EP0030381B1 (en) Process and apparatus for the manufacture of documents protected against counterfeiting and misuse, and document used therein
EP1099197B1 (en) Device for supplying output data in reaction to input data, method for checking authenticity and method for encrypted data transmission
EP2689553B1 (en) Motor vehicle control unit having a cryptographic device
DE3122534C1 (en) Process for creating and checking documents, as well as document and device for carrying out the process
EP1124206A1 (en) Method and assembly for the mutual authentication of two data processor units
DE3018945A1 (en) DATA TREATMENT DEVICE AND METHOD FOR SECURING THE TRANSMISSION OF DATA
EP0654919A2 (en) Method for the authentication of one participant by another participant in an information transfer system according to the Challenge-Response principle
DE102007011309B4 (en) Method for authenticated transmission of a personalized data record or program to a hardware security module, in particular a franking machine
EP2235598B1 (en) Field device and method of operation thereof
DE102008028701B4 (en) Method and system for generating a derived electronic identity from a main electronic identity
DE10213658B4 (en) Method for data transmission between components of the on-board electronics of mobile systems and such components
DE19523009C2 (en) Authentication system
DE112018007132T5 (en) In-vehicle function access control system, in-vehicle device and in-vehicle function access control method
WO2002093868A1 (en) Method for generating a key for signature cards
EP1652337B1 (en) Method for signing a data set in a public key system and data processing system for carrying out said method
EP1912184A2 (en) Data generating device and method
EP3367285B1 (en) Terminal, id-token, computer program and corresponding methods for authenticating access authorization
DE19801241C2 (en) Process for generating asymmetric crypto keys at the user
EP2169579A1 (en) Method and device for accessing a machine readable document
DE4344280C2 (en) Method for authorizing digitized data from texts, images and the like
EP2230648A1 (en) Single-use code mask for deriving a single-use code
DE19960047B4 (en) Method and unit for secure information handling in a cryptographic information processing system
DE10130099B4 (en) Challenge-response device, authentication system, method for generating a response signal from a challenge signal and method for authentication

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20031215

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE TR

AX Request for extension of the european patent

Extension state: AL LT LV MK RO SI

17Q First examination report despatched

Effective date: 20040805

APBK Appeal reference recorded

Free format text: ORIGINAL CODE: EPIDOSNREFNE

APBN Date of receipt of notice of appeal recorded

Free format text: ORIGINAL CODE: EPIDOSNNOA2E

APBR Date of receipt of statement of grounds of appeal recorded

Free format text: ORIGINAL CODE: EPIDOSNNOA3E

APAF Appeal reference modified

Free format text: ORIGINAL CODE: EPIDOSCREFNE

APAF Appeal reference modified

Free format text: ORIGINAL CODE: EPIDOSCREFNE

REG Reference to a national code

Ref country code: DE

Ref legal event code: R003

APBT Appeal procedure closed

Free format text: ORIGINAL CODE: EPIDOSNNOA9E

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20131115