This paper examines how monitoring power consumption signals might breach smart-card security. Both simple power analysis and differential power analysis attacks are investigated. The theory behind these attacks is reviewed. Then, we concentrate on showing how power analysis theory can be applied to attack an actual smart card. We examine the noise characteristics of the power signals and develop an approach to model the signal-to-noise ratio (SNR). We show how this SNR can be significantly improved using a multiple-bit attack. Experimental results against a smart-card implementation of the Data Encryption Standard demonstrate the effectiveness of our multiple-bit attack. Potential countermeasures to these attacks are also discussed.

Examining smart-card security under the threat of power analysis attacks

A mobile apparatus includes a removable SIM chip card having data-processing means intended among other things for storing identification data of a subscriber in a GSM mobile radio network. The mobile apparatus has additionally at least one wireless interface integrated in the housing. The interface may be infrared or inductive. By means of this interface, the SIM card can communicate directly, without making use of the mobile radio network, with an outside device in both directions. The chip card contains additionally a communication controller to encrypt data and transmit them via the interface. The contactless interface may preferably be fed independently of the mobile apparatus.

Mobile device, chip card and method of communication

Open, horizontal service platforms are described Service providers can, via network operators, load software associated with a service onto a dedicated, service platform server The service platform server is connected, via a LAN, to one or more remote devices (eg, sensors, transducers, processors, etc) The functionality associated with the service can be distributed among two or more of the entities involved in the architecture The distributed software operates and/or monitors these remote devices to implement the subscribed service

Application and communication platform for connectivity based services

A secure token device, such as a smart card or an ibutton, provides a user with a vehicle for accessing services that are provided by an Internet Service Provider (ISP). The user places the secure token device in communication with a reader that is coupled to a computer system. The computer system includes a web browser for accessing the services provided by the ISP. The secure token device may perform an authentication protocol to authenticate itself to the ISP. The ISP may also be required to authenticate itself. The secure token device may hold an electronic currency token for payment of services rendered by the ISP. The secure token device may contain stored personal information about the user. The user may stipulate what portions of this personal information are provided to the ISP upon request. Contextual information regarding sessions with the ISP may also be stored on the secure token device and used to restore a context of a previous session during a subsequent session.

Secure token device access to services provided by an internet service provider (isp)

A Method and system are disclosed for accessing personal Web site or executing electronic commerce with security in a smart Java card. A personal Web site which includes personal or private information is stored in a personal smart Java card. Before a user can access the Web site stored in the smart Java card, the user is validated by any one of or in combination of PIN, facial images, hand images, eye image, voice characteristics, and finger prints. In addition, an encryption engine embedded in the smart Java card decodes and compares the entered PIN combined with a secure key or security certificate to verify the identity of the user. Before the bank account can be accessed freely by the user, the bank's computer system checks the combined secure data to ensure the authenticity of the card and the user's identity with multiple check points using Internet security protocols via Web browsers.

Personal website for electronic commerce on a smart Java card with multiple security check points

The smart card-which offers Internet programmers a truly safe place to generate and store a private encryption key-will soon be recognized as a useful component of Internet computing. Until now the security precautions surrounding smart-card technology have effectively prevented its use in general computing systems, but the recent implementation of the secure Internet language Java on a smart card not only opens up smart-card programming to everyone but connects smart cards directly with standard programming applications in use on the Internet.

S.B. Guthery

Papers

Java card: Internet computing on a smart card