Smart Card Security-Applications, Attacks, and Countermeasures

139 Pages·2019·8.951 MB·\139

by  B.B. Gupta (Author), Megha Quamara (Author)

Smart Card Security

Smart Card Security
Applications, Attacks,
and Countermeasures
B.B. Gupta
Megha Quamara
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2020 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
International Standard Book Number-13: 978-0-367-35440-4 (Hardback)
This book contains information obtained from authentic and highly regarded sources.
Reasonable efforts have been made to publish reliable data and information, but the author and
publisher cannot assume responsibility for the validity of all materials or the consequences of
their use. The authors and publishers have attempted to trace the copyright holders of all material
reproduced in this publication and apologize to copyright holders if permission to publish in this
form has not been obtained. If any copyright material has not been acknowledged please write
and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information
storage or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access
www.copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center,
Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit
organization that provides licenses and registration for a variety of users. For organizations that
have been granted a photocopy license by the CCC, a separate system of payment has been
arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks,
and are used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Dedicated to my parents and family for their constant support during
the course of this book.
—B. B. Gupta
Dedicated to my mentor, my parents, and my friends for their constant
encouragement and belief during the course of this book.
—Megha Quamara

Contents
List of Figures xi
List of Tables xiii
Preface xv
Acknowledgment xvii
About the Authors xix
1 Smart Cards: Evolution, Statistics, and Forecasts 1
1.1 Introduction 1
1.2 Evolution of Smart Cards 2
1.3 Related Statistics 5
1.4 Industrial Forecasts 8
1.5 Conclusion 8
References 9
2 Classification of Smart Cards and How They Work 11
2.1 Introduction 11
2.2 Classification of Smart Cards 11
2.2.1 Based on Capabilities or Configuration 13
2.2.2 Based on Security Features 14
2.2.3 Based on Communication Interface 14
2.2.4 Based on Embedded Components 16
2.2.5 Based on the Nature of Application 16
2.2.6 Programmable Cards 17
2.3 How Smart Card–Based Systems Work 18
2.4 Conclusion 19
References 20
3 Hardware-Level Security Attacks and Logical
Threats in Smart Cards 23
3.1 Introduction 23
3.2 Hardware-Level Security Attacks 24
3.2.1 Invasive or Active Attacks 24
3.2.2 Semi-Invasive Attacks 26
vii
viii Contents
3.2.3 Noninvasive Attacks 28
3.3 Software-Level Security Attacks 31
3.4 Countermeasures 34
3.4.1 Countermeasures for Hardware-Level
Security Attacks 34
3.4.1.1 Countermeasures for Invasive Attacks 35
3.4.1.2 Countermeasures for Semi-Invasive
Attacks 36
3.4.1.3 Countermeasures for Noninvasive
Attacks 36
3.4.2 Countermeasures for Software-Level
Security Attacks 38
3.5 Conclusion 40
References 40
4 Data Security in Smart Cards 45
4.1 Introduction 45
4.2 Types of Data-Level Security Attacks in Smart Cards 46
4.2.1 Breach of Confidentiality 46
4.2.2 Integrity Violation 48
4.2.3 Availability Loss 49
4.2.4 Other Concerns 49
4.3 Countermeasures 50
4.4 Conclusion 52
References 53
5 Remote User Authentication Mechanisms
in Smart Card–Based Applications 55
5.1 Introduction 55
5.2 Related Work 57
5.3 Preliminaries 58
5.3.1 Elliptic Curve Cryptography (ECC) 59
5.3.2 Collision-Resistant One-Way Hash Function 60
5.3.3 Functional and Security Requirements 61
5.3.4 Threat Assumptions 61
5.4 Proposed Model 62
5.4.1 System Entities 62
5.4.2 System Model 63
5.4.3 System Working 64
5.5 Experiments and Results 71
5.5.1 Prerequisites for the Experiments 71
Contents ix
5.5.2 Modeling of the Authentication Mechanism
in AVISPA-SPAN 72
5.5.3 Policy Formulation in ACPT 74
5.5.4 Results and Discussion 76
5.6 Security Analysis 77
5.6.1 Informal Security Analysis 80
5.6.2 Formal Security Analysis 82
5.6.3 Comparative Analysis 84
5.7 Performance Analysis 85
5.8 Conclusion and Future Scope 88
References 89
6 Smart Card Communication Standards, Applications,
and Development Tools 93
6.1 Introduction 93
6.2 Communication Standards 94
6.3 Application Areas 97
6.4 Open Source Tools 99
6.4.1 Development Tools 99
6.4.2 Middleware Libraries 101
6.4.3 Key Stores 101
6.4.4 Certificate Authority Software 102
6.4.5 Testing Tools 102
6.5 Conclusion 102
References 103
7 Blockchain Integration and Quantum Smart Cards 105
7.1 Introduction 105
7.2 Blockchain Technology 106
7.2.1 What Is Blockchain Technology? 106
7.2.2 Smart Cards and Blockchain 106
7.3 Quantum Smart Cards 107
7.3.1 What Is Quantum Computing? 108
7.3.2 Quantum Smart Cards 108
7.4 Conclusion 110
References 110
Index 113