PRESENTED BY:
M.MANJUSHA
M.MOUNIKA

---

[attachment=11788]
Abstract
A smart card is a piece of plastic, the same size as a credit or debit card, with a silicon chip embedded in it. The chip contains a microprocessor, which is a miniature computer which can perform calculations and store data in its memory. These chips hold a variety of information, from stored (monetary)-value used for retail and vending machines, to secure information and applications for higher-end operations such as medical/health care records. The card is "smart" because it is "active", that is that it can receive information, process it and then "make a decision".
1. Introduction
A chip-card is a standard-sized plastic card that "contains an integrated circuit or 'chip' which gives the card the ability to store and/or process data"
Chip-cards are of three different kinds:
• 'memory cards', which contain storage but no processing or significant security capabilities;
• 'smart-cards', which contain a processor, systems software and applications software and permanent data engraved into non-volatile memory, and some (less expensive) volatile memory for use as a working storage area; and
• 'super-smart cards', which are smart-cards with a (very small) key-pad and display.
The mainstream area of development is in smart-cards, and this paper concerns itself exclusively with that form.
A smart card resembles a credit card in size and shape, but inside it is completely different. First of all, it has an inside -- a normal credit card is a simple piece of plastic. The inside of a smart card usually contains an embedded microprocessor. The microprocessor is under a gold contact pad on one side of the card. Think of the microprocessor as replacing the usual magnetic stripe on a credit card or debit card.
Smart cards help businesses evolve and expand their products and services in a rapidly changing global market. In addition to the well known commercial applications (banking, payments, access control, identification, ticketing and parking or toll collection), in recent years, the information age has introduced an array of security and privacy issues that have called for advanced smart card security applications (secure logon and authentication of users to PC and networks, storage of digital certificates, passwords and credentials, encryption of sensitive data, wireless communication subscriber authentication, etc.)
2. History
• 1968- German inventors patent combination of plastic cards with micro chips.
• 1970- Japan patent different version.
• 1974- Roland Moreno invents integrated chip card and patents it in France.
• 1977- Motorola produces first smart card microchip.
• 1979- Motorola develops first single chip microcontroller for bank in France.
• 1982- ATM cards with smart chips tested and smart chips placed on telephone cards.
• 1991- AT&T declared its contactless smart card.
• 1992- Germany uses smart card for health care.
• 1996- First university campus deployment of chip cards.
3. Technical Overview
The basic components of the smart card subsystem are based on PC/SC standards. These basic components include:
• A resource manager that uses a Win32® application programming interface (API).
• A user interface (UI) that works with the resource manager.
• Several base service providers that provide access to specific services.
The following illustration shows the relationships of these components in the overall smart card architecture.
What’s in a Card?
Typical Configurations:
 256 bytes to 4KB RAM.
 8KB to 32KB ROM.
 1KB to 32KB EEPROM.
 Crypto-coprocessors (implementing 3DES, RSA etc., in hardware) are optional.
 8-bit to 16-bit CPU. 8051 based designs are common.
The microprocessor on the smart card is there for security. The host computer and card reader actually "talk" to the microprocessor. The microprocessor enforces access to the data on the card. If the host computer read and wrote the smart card's random access memory (RAM), it would be no different than a diskette.
Smarts cards may have up to 8 kb of RAM, 346 kilobytes of ROM, 256 kilobytes of programmable ROM, and a 16-bit microprocessor. The smart card uses a serial interface and receives its power from external sources like a card reader. The processor uses a limited instruction set for applications such as cryptography.
Features:
• Chip is tamper-resistant.
• Information stored on the card can be PIN protected and/or read-write protected.
• Capable of performing data encryption.
• Capable of processing (not just storing) information.
• Post-issuance update of information and application.
Smart Card Classification:
Component Based Classification:
Memory Cards:
• Most common and the cheapest.
• Contain EEPROM and ROM.
– ROM holds card number, card holder name.
– EEPROM holds data that changes with time, usually application data. E.g. in pre-paid phone card, it holds talk time left.
– EEPROM can be locked with a PIN.
• Cost around $1, when produced in bulk.
• Areas where used: Pre paid telephone cards, parking schemes, ticketing, vending machines
Chip Cards:
• Cards that contain a microprocessor.
• Various parts of a Chip Card
– ROM: Also called the Mask of the card. Holds the Operating System.
– EEPROM: Holds the application programs and their data.
– PROM: Holds the card number.
– RAM: Used as temporary storage space for variables.
– Processor: 8 bit processor based on CISC architecture. Moving towards 32 bit due to JavaCards
– I/O Interface for data transfer to and from the card.
Interface Based Classification:
Contact Cards:
• Require insertion into the reader.
• 6-8 gold plated contacts
• Contact cards further divided into:
– Landing Contacts
– Sliding Contacts
• Limitations
– Contacts get worn out
– Card Tearing
– Electrostatic Discharges
Contactless Cards:
• No insertion required.
• Data/Power transfer over RF via antenna inside.
• Reading Distance: few cms to 50 cms.
• Used when transaction has to be carried out quickly.
• Advantages
– Higher reliability as lesser moving parts involved.
– Longer Life, due to lesser wear and tear.
– Require Lesser Maintenance
Hybrid or Combo Cards
• Cards which can be used as either Contact Cards or as Contactless Cards
• Ways this can be done:
– Card could have two interfaces: One for contact readers, other for contactless readers.
– Or a contact card can be slipped into a pouch which has battery and antenna.
• Not too prevalent, might be used in future when multi application cards are introduced.
OS Based Classification:
• Smart Card Operating Systems (SCOS) are placed on the ROM and usually occupy lesser than 16 KB.
• SCOS handle:
– File Handling and Manipulation.
– Memory Management.
– Data Transmission Protocols.
• Various SCOS available are:
– Cyberflex.
– MultOS.
– MFC.
– StarCOS.
– Oscar.
– JavaCard.
Smart Card Readers:
• Smart Card by itself is useless. Requires a reader.
• Reader is often called the Read-Write Unit as it can read as well as write to the card.
• Readers of two types:
– Insertion Readers: Cheaper, but manual.
[Card Swipe Machine]
– Motorized Readers: Automatic card capture and release. Costly. [Bank ATM Machines]
• Cost of a reader varies from $10 to $100.
• Readers often come with keypad for entry of PIN.
Readers are standard devices in a smart card system. They are controlled through drivers, and are introduced to and removed from the system through Plug and Play or through the control panel Devices applet.
Each reader must be defined for use by the smart card subsystem. The subsystem is not responsible for any reader not specifically given to it.
Smart Card Interfaces:
A smart card interface consists of a predefined set of services available within a smart card, the protocols necessary to invoke the services, and any assumptions regarding the context of the services.
With respect to smart cards, the term "interface" is similar to how it is used in COM, which in turn is similar in concept to the ISO 7816/5 application identifier but with a different scope.
Each smart card interface is identified by a globally unique identifier (GUID). For example, an interface might be defined that provides biorhythm information to its holder. If a given smart card supports this service, then it may claim to support that interface GUID. Using the interface GUIDs, an application may search for a particular set of interfaces, locating any card that supports that set, to complete a task.
Although an interface has one GUID, it might be implemented differently on different cards. For example, the biorhythm interface mentioned above can have several different implementations, yet all are referenced using the same GUID. The different implementations would not change the interaction between the application and the smart card; however, the interaction between the service provider and the smart cards may differ depending on the interface's implementation.
4. Applications
Trials commenced with storage-only chips in the late 1970s and with smart-cards during the early 1980s. Much of the initiative in the area has emanated from France and French companies, but Japanese and American suppliers have also been active in the area.
Smart-cards have been applied to a variety of functions, including:
• the identification of the card-holder;
• the authentication of card-holder's authority to conduct a transaction;
• the authentication of the transaction;
• the authentication of the data representing the transaction;
• the encryption and decryption of messages;
• data storage; and
• data processing.
Smart-cards have been used in or proposed for a variety of settings, including:
• financial applications of a number of different kinds, including:
o debit cards (payment against the account-holder's own funds);
o credit cards (payment against a line of revolving credit);
o account charging (e.g. for telephone calls and pay-television, and for tele-banking and tele-shopping); and
o frequent buyer schemes;
• as 'electronic cash' for low-value payments, sometimes referred to as 'tokens', 'pre-paid cards', or an electronic wallet or purse;
• access security for buildings and sites;
• access security for sensitive data access and data processing functions;
• account ownership and access (e.g. for videotext and e-mail);
• road and parking-site usage control and charging;
• organisational membership;
• the health care sector; and
• tourism.
The most common smart card applications are:
• Credit cards
• Electronic cash
• Computer security systems
• Wireless communication
• Loyalty systems (like frequent flyer points)
• Banking
• Satellite TV
• Government identification
There are many significant smart card applications.
• Banks: Small trials in the U.S.; entire countries using the card in Europe and places like South Africa.
• Medical applications: In Germany 80 million people can use smart cards when they go to the doctor.
• Voting: In Sweden you can vote with your smart card, which serves as a non-repudiation device.
• Entertainment: Most DSS dishes in the U.S. have smart cards.
• Telecommunications: Many cellular phones come with smart cards in Europe and will soon be shipping in the United States.
• Mass Transit: British Air relies on rail and air connections more than most airports. There were many delays because customers could not be tracked while they were in transit, so no one knew where the customers were, which caused aircraft to be held for phantom customers. To solve this problem, British Air gives passengers contactless smart cards, and radio receivers track them throughout the facility. Now flights only wait when necessary, controllers can be given estimated ready times, and new departure slots can be calculated.