EP2553867A1

EP2553867A1 - Method for securely transmitting an application from a server to a reading unit

Info

Publication number: EP2553867A1
Application number: EP11710438A
Authority: EP
Inventors: Dieter Weiss; Gisela Meister; Jan Eichholz; Florian Gawlas
Original assignee: Giesecke and Devrient GmbH
Current assignee: Giesecke and Devrient GmbH
Priority date: 2010-03-29
Filing date: 2011-03-25
Publication date: 2013-02-06
Also published as: CN102823191B; US9325504B2; DE102010013202A1; WO2011124333A1; CN102823191A; US20130031357A1

Abstract

The invention relates to a method and a system for securely transmitting an application from a server (S) to a reading unit (2) by authenticating a user with a data carrier unit (1). According to the invention, the server (S) provides the application, where a first cryptographically secure channel (K1) based on a first cryptographic information (A) is established between the data carrier unit (1) and the server (S), and a second cryptographically secure channel (K2) based on a second cryptographic information (B) is established between a security module (3) of the reading unit (2) and the server (S). The application is transmitted from the server to the reading unit via the second cryptographically secure channel (K2).

Description

Procedures for safely transferring an application from a server to a reader device

The invention relates to a method and a system for the method for securely transferring an application from a server to a reader unit. In many technical fields of application, it is desirable to ensure a secure transfer of an application from a server to a reader device while authenticating a user by means of a data carrier unit. For this purpose, a protected Kornmunikationsverbindung should be established between the disk unit and the server or the reader and the server.

The server in this application is an application server that offers applications, so-called e-services. E-services are all services and activities that are created by computers and interactively offered and executed via electronic media such as the Internet. The term server in this application is synonymous with the term application server.

For example, an application to be transferred offered by the e-service will be information and educational services such as e-education, e-learning, e-teaching, e-publishing, e-book, e-zine and e Catalog to provide procurement, trading and ordering services such as e-business, e-commerce, e-procurement, e-cash, e-shop, e-intermediary, e-auction, cultural and administrative services such as e-culture, E-government or e-vote to improve the services of marketing, the product or the customer relationship to electronic consulting such as E-Consult or E-Advising.

The application is preferably security-related services, production-related, scientific or logistic services. E-services will be used in many other applications in the future.

Among the applications to be transferred is understood in particular eBanking, ticketing, VPN or much more, which are provided on the server, for example, the server of a bank for performing payment transactions, the server of an official office to perform an official matter (tax return etc) , the server of a transport association for the electronic purchase of travel tickets. The type of server for offering an application that requires the secure transfer of an application and local installation and use of the application is not limiting here.

It is an object of the present invention in a simple manner to ensure secure transmission of such an application and then secure use of the application on an untrusted device. It is also an object to personalize the application before or immediately after being transmitted to a user. This object is achieved by the measures described in the independent independent claims.

In the method according to the invention, a first cryptographically secured channel is established between the data carrier unit and the server built on a first cryptographic information. Furthermore, a second cryptographically secured channel based on a second cryptographic information is set up between a security module of the reader unit and the server. Finally, the application is transferred from the server to the reader unit via the second cryptographically secured channel.

For example, this cryptographic information may be access data, passwords, PINs or other secret information.

In a particularly preferred embodiment of the inventive method, the data carrier unit negotiates with the server a first cryptographic key over which the first cryptographically secured channel is established. Analogously, the security module of the reader unit negotiates with the server a second cryptographic key over which the second cryptographically secured channel is established. For negotiating the keys, methods known from the prior art can be used again. For example, the Diffie-Hellmann key exchange can be used to generate the first or second cryptographic key.

The data carrier unit is preferably portable data carriers, in particular with corresponding security functionalities, such as smart cards, chip cards, tokens and / or electronic identity documents, such as an electronic identity card, passport etc with machine-readable identification data of a person stored on a chip. In a further, particularly preferred embodiment of the invention, the data carrier unit is used with a contactless, for example NFC, interface. The reader unit is preferably a so-called smart reader. Such reader units or terminals often contain corresponding security elements or security modules, such as a security element or a SAM module (SAM = Secure Application Module). The smart reader is a reader with a contact interface, in particular USB, and a security module therein. The security module, for example a smartcard chip, preferably has a contactless interface for communicating with the data carrier unit, so that the contactless interface of the data carrier unit and the security module is used to set up the first cryptographically secured channel.

In an alternative embodiment, the reader unit is a mobile terminal, in particular a mobile device. In the mobile terminal while a security element is integrated. The security element is configured in particular as a hardware component and arranged as a firmly integrated component in the mobile terminal, wherein it can not be removed either in the form of the mobile terminal, for example as M2M module, co-processor or Trusted Base or as a removable module with Security functionality is connected to the mobile terminal, for example as a smart card, in particular a Subscriber Identification Module, SIM card short, smart card, mass storage card, USB token, multimedia card, Secure MicroSD card, Mobilfunknetztoken, eg a UMTS Surfstick. Alternatively, the security element is a software component in the form of a trusted platform module as a trustworthy part of the operating system. system kernel of the mobile terminal or designed as a security software algorithm. The mobile terminal is equipped with communication interfaces to the server and to the data carrier unit. In a preferred embodiment, the reader unit is used with a contact interface, wherein the contact interface is used to build the second cryptographically secured channel. Preferably, after the application has been transferred, the application is installed and managed on the security module of the reader unit, in particular with Global Platform Card Management Interfaces, GPCS for short.

The application is preferably personalized for the user before being transmitted. Thus, the application is already personalized prior to installation on the security module, which is achieved due to the user authentication by means of the data carrier unit.

Alternatively, the application on the reader module safety module is personalized for the user only after installing the application.

In a further variant of the method according to the invention, the server is a signature terminal known from the prior art for electronic identity documents, the so-called secure messaging providing the first and / or second cryptographically secured channel between the signature terminal and the first and second or second data carrier unit, which are each electronic identity documents, is constructed. Secure messaging is preferably based on a password-based Transport protocol and particularly preferably based on the PACE protocol, see Technical Guideline TR-03110, "Advanced Security Mechanisms for Machine Readable Travel Documents", Version 2.02, BSI, 2009.

Preferably, the reader unit is incorporated in a data processing device and operable by means of the data processing device. As a data processing device are PC, notebook, especially untrustworthy devices to call. The data processing unit uses a secure data connection, in particular by means of transport layer security (TLS), to the server for establishing the first and / or second cryptographically secured channel (K1, K2).

Furthermore, the reader unit and in particular the security module are preferably connected via the contact-type interface to the data processing unit, so that the untrusted data processing unit can be connected to the server via the security module. This allows personalization at any time in a simple way even on an insecure computing device, such as a PC in the Internet cafe, or a PC that you do not trust allowed.

In a further embodiment of the method according to the invention, the first cryptographically secured channel is established directly between the contactless interface of the data carrier unit via the contactless interface of the reader unit to the server via the data processing device, whereas the second cryptographically secured channel between the contact interface of the reader unit via the data processing device Server is built. Preferably, the application is enabled only by authentication of the user by means of the data carrier unit on the reader unit, in particular by restriced identification. In addition to the method described above, the invention further relates to a system consisting of server, data carrier unit and reader unit, which is configured such that the method according to the invention and in particular also one or more preferred variants of this method can be carried out during operation of the system.

Embodiments of the invention are described below in detail with reference to the accompanying drawings.

Show it:

Fig. 1 shows a first embodiment of an inventive

A method for securely transferring an application;

FIG. 2 is a diagram illustrating a message exchange performed in the embodiment of FIG. 1. FIG.

1 shows an embodiment of a method according to the invention, in which the first and second cryptographically secured channels K1 and K2 are used for the secure loading of applications. In that shown in Fig. 1

The data carrier unit 1 represents an elD token, for example an electronic identity card. The reader unit is represented by a so-called smart terminal 2, which has a security module 3 (eg a SAM module). The smart terminal has a contact-based te interface 2a, for example USB, and via a contactless interface 2b. The smart terminal is configured in particular as a smart reader, which is integrated via a USB interface in a data carrier processing device 4, for example a notebook. The smart terminal 2 and the elD token 1 can communicate with one another via corresponding interfaces, preferably via NFC interfaces, as indicated by the arrow P. Remote to the smart terminal 2, the elD token 1 and the notebook 4, a central server S is arranged, which provides electronic services (so-called eServices). In this case, the server S represents an eService Terrninal server, for example a bank server for mternetbanking, a tax office server or a trust center, which can communicate via a network with the notebook 4 in the form of a PC. The connection of the server S with the notebook 4 takes place in particular via the Internet, for example using the TLS protocol (TLS = Transport Lay er Security). In this case, an end-to-end encrypted Internet connection or a VPN connection is established between the server S and the smart reader 2, which is connected via its USB interface 2 a to a corresponding USB interface of the notebook 4. The communication between notebook 4 and server S is indicated in Fig. 1 by the arrow TLS.

The second cryptographically secured channel K2 is established between server S and smart reader 2 via this connection. In addition, the encrypted connection between server S and smart reader 2 is also used within the framework of the construction of the first cryptographically secured channel K1. The communication is routed via the Smart Reader 2. In this case, the first cryptographically secured channel K1 between server S and elD token 1 via the encrypted connection to the smart reader 2 and via the contactless interface of the smart reader is functioning as an RFID reader for the data carrier unit 1 2 and the elD Token 1 set up. For this purpose, corresponding keys A and B are negotiated for the individual channels K1 or K2.

In particular, a password-based or asymmetric transport protocol (e.g., the PACE protocol known in the art) may be used. A key A between server S and elD Token 1 can be generated, which is provided for the encryption of the communication in the channel Kl. In an analogous manner, a second session key B, which is provided for the encrypted communication in the channel K2, is generated by the same mechanism within the framework of the construction of a second secure channel K2 between the smart reader 2 and the server S. In a preferred variant, an identifier is used in the generation of the corresponding key A, B, which does not correspond to the identity identifier of the elD token 1 or the security module 3. Preferably, a so-called. Restricted ID is used.

Between the elD token 1 and the server S, therefore, a first cryptographically secured channel is established, which in turn is designated by Kl. The connection is established via Secure Messaging (denoted by SM) and an authentication between the server S and the elD token 1 with protocols known per se is carried out. In this case, the smart terminal 2 can take an active role in the execution of the logs. In a preferred variant, the smart terminal 2 executes the PACE protocol.

In addition to the channel K1, a second cryptographically secured channel K2 is also established between the server S and the smart terminal 2 or the security module 3. In this case, an authentication takes place between the server S and the security module 3. In analogy to the above-described NEN variant cryptographic information or a cryptographic key A, B was again used in the construction of the channels Kl and K2. After the establishment of the second cryptographically secure channel K2, an application in the form of an applet is transmitted from the server S via this channel K2 to the security module 3 of the smart terminal 2 and installed there. Subsequently, a personalization of the applet can take place via the same channel, for which purpose a corresponding identification of the elD token 1 or corresponding authentication data is used which has been made available to the server S via the first secure channel K1. If necessary, the personalization can also take place at a later time, in which case a secure channel between server S and security module 3 has to be set up again separately.

The installed applet can represent any program and cover various applications from the field of e-banking, ticketing and the like. The applet can be installed and managed with the known from the prior art Global Platf orm Card Management Schruttstellen. As part of the later use of the applet is analogous to the method described above, in turn, the construction of a cryptographically secure channel K3 between the Smart-Temünal 2 and the elD token 1. Furthermore, for the use of the application and a secure channel K2 between server S. and smart terminal 2. The elD token 1 can be used again in this phase as user authentication and, if necessary, identification with respect to the server S. Furthermore, authentication is performed between the elD token 1 and the installed and personalized application on the smart terminal 2. In particular, the already mentioned above Restricted Identification of an electronic passport can be used to unlock the application. FIG. 2 again shows a flow chart which clarifies the method steps carried out in the embodiment of FIG. The messages exchanged between elD token 1, smart reader 2 and server S are clarified. With I the installation phase of the applet is indicated and with U the later use or use phase. First, in step S1 and S2, the authentication between the server S and the elD token 1, which is denoted by AUT. Subsequently, in step S3 and S4, the authentication takes place between the server S and the smart reader 2 or the security module 3, which in turn is designated AUT. Finally, in step S5, the applet is installed by the server S on the smart terminal 2 or the security module 3. This is called INST. Finally, in step S6, a suitable personalization of the applet based on an identity of the elD token 1 takes place.

In a later use of the applet takes place in accordance with steps S7 and S8 an authentication between the elD token 1 and the smart reader 2, which in turn is designated by AUT. Subsequently, a restricted identification (referred to as RI) of the elD token is transmitted to the smart terminal 2 in step S9. Finally, in step S10 and Sil an authentication of the smart terminal 2 with respect to the server S, which in turn is indicated by AUT. The installed application can then be unlocked via the restricted identification RI, which is then used in step S12, which is illustrated by the designation US.

As can be seen from the foregoing description, with the embodiment described with reference to FIGS. 1 and 2, a secure loading and installing of an applet on a corresponding smart terminal is described. reached. Using a cryptographically secured channel between the elD token 1 and the smart terminal 2 then this applet can be used even for insecure devices, such as notebooks 4. To load the applet, a first cryptographically secured channel K1 and a second cryptographically secured channel K2 are constructed using corresponding cryptographic information or keys A, B respectively. In turn, an authentication key for establishing a secure channel between smart terminal 2 and elD token 1 in the use phase of the applet is then defined using this cryptographic information.

In an embodiment, not shown, the reader unit is a mobile device with integrated security element. The security element is either in the form of an M2M module, co-processor or

Trusted Base or as a removable module with security functionality with the mobile terminal is ally, for example, as a smart card, in particular a Subscriber Identification Module, short SIM card, smart card, mass storage card, multimedia card, Secure MicroSD card. Alternatively, the security element is designed as a software component in the form of a trusted platform module as a trusted part of the operating system of the mobile terminal or as a security software algorithm. The mobile terminal is equipped with communication interfaces to the server and to the data carrier unit.

Communication to the server takes place via pure TLS via the mobile radio network, in particular UMTS or GPRS. The connection to the data carrier unit is via NFC, RFID or contact-based. LIST OF REFERENCE NUMBERS

1 volume of data

2 smart readers, reader unit

2a Contact interface

2b Contactless interface

3 SAM module

4 data processing device, notebook

Kl, K2, cryptographically secured channels

P contactless communication connection

TLS Transport Layer Security, secure data connection

S server

Claims

P a n t a n s p r e c h e

A method for securely transferring an application from a server (S) to a reader device (2) by authenticating a user by means of a volume device (1), the server providing the application in which:

- a first cryptographically secured channel (Kl) is established between the data carrier unit (1) and the server (S) based on a first cryptographic information (A);

a second cryptographically secured channel (K2) is established based on a second cryptographic information (B) between a security module (3) of the reader unit (2) and the server (S); and

Transferring the application from the server to the reader unit via the second cryptographically secured channel (K2).

A method according to claim 1, characterized in that after the transfer of the application, the application on the security module (3) of the reader unit (2) installed, in particular with Global platform card management interfaces, and managed.

A method according to claim 1 or 2, characterized in that the application is personalized before being transmitted to the user.

A method according to claim 1 or 2, characterized in that after installing the application, the application on the security module (3) of the reader unit (2) is personalized for the user. Method according to one of the preceding claims, characterized in that the data carrier unit (1) negotiates with the server (S) a first cryptographic key (A), via which the first cryptographically secured channel (K1) is set up, and the reading unit (2) with the server (S) negotiates a second cryptographic key (B) over which the second cryptographically secured channel (K2) is established.

Method according to one of the preceding claims, characterized in that the server (S) is a signature terminal for electronic identity documents and secure messaging, in particular based on a password-based transport protocol and particularly preferably based on the PACE protocol, the first and / or second cryptographically secured channel (K1, K2) is established between the signature terminal and the data carrier unit (1), which is an electronic identity documents.

Method according to one of the preceding claims, characterized in that in the method:

the data carrier unit (1) is used with a contactless interface, in particular a chip card and / or a token and / or an electronic identity document;

- The security module (3) of the reader unit (2) with a contactless interface (2b) is used, wherein the contactless interface of the data carrier unit (1) and the security module (3) for establishing the first cryptographically secure channel (Kl) is used. Method according to one of the preceding claims, characterized in that in the method, the security module in the reader unit (2) with a contactless interface (2b) and / or the reader unit (2) is also used with a contact interface (2a), wherein the contactless and / or the contact interface (2a, 2b) are used to construct the first and / or second cryptographically secured channel (K1, K2).

Method according to one of the preceding claims, when dependent on claims 7 and 8, characterized in that the reader unit (2) is incorporated in a data processing device (4) and the data processing unit (4) a secure data connection, in particular by a Transport Layer Security (TLS ), to the server (S) for establishing the first and / or second cryptographically secure channel (Kl, K2) used.

Method according to one of the preceding claims, if dependent on claim 9, characterized in that the reader unit (2) and in particular the security module (3) are connected via the contact interface (2a) to the data processing device (4).

Method according to one of the preceding claims, characterized in that the application is unlocked only by authentication of the user by means of the data carrier unit (1) on the reader unit (2), in particular by restriced identification. System comprising server (S), data carrier unit (1) and reading device unit (2), which is designed in such a way that in operation of the system:

- Between the data carrier unit (1) and the server (S) a first cryptographically secured channel (Kl) based on a first cryptographic information (A) for the purpose of authentication of a user by means of the data carrier unit (1) is built on the server (S) ;

- between a security module (3) of the reader unit (2) and the server (S), a second cryptographically secured channel (K2) based on a second cryptographic information (B) is established; and

- An application from the server (S) is transmitted to the reader unit via the second cryptographically secure channel (K2).

System according to claim 12, characterized in that with the system, a method according to any one of claims 1 to 12 is feasible.