Mobile Access: Zutrittskontrolle mit dem Handy (NFC)

Transcription

1 SICHERHEITS-Fachkongress 2013 Mobile Access: Zutrittskontrolle mit dem Handy (NFC) Dominik Gruntz, Institut für Mobile und Verteilte Systeme FHNW (Fachhochschule Nordwestschweiz)

2 NFC Experience at FHNW 2005/06 First NFC demonstrator (with Siemens CX70 Emoty) NFC was included in a removable cover 2009/10 Mobile Payment project (Nokia 6131 NFC, S40 Phone) touch'n'pay Self Service Shop (together with NEXPERTS / e24) Supported by the Hasler foundation NFC Forum Global Competition: First price in the category "The Best NFC Service of the Year 2010" 2010/11 Android Nexus S (with NFC) Tag reading/writing and P2P (several publications) 2012 Access Project MIFARE on NFC devices 2013/14 NFC Projects Access Control with BIXI [KTI] and P2P [AFF] SICHERHEITS-Fachkongress

3 Mobile Access with NFC NFC Applications & Operating Modes What is NFC? NFC Architecture What is the Secure Element? NFC Access Systems How do we apply NFC to access solutions? NFC Summary Open Questions SICHERHEITS-Fachkongress

4 What is NFC NFC (Near Field Communication) Communication technology based on radio waves at MHz frequency Compatible to ISO/IEC A (Mifare), B and F (FeliCa) Short range (<= 10 cm theoretical) Effective: 1-4 cm Low speed (106 / 216 / 414 kbps) => 13-50KBytes per sec Effective: 24 kbps => 3KB per sec Low friction setup (no discovery and no pairing as with Bluetooth) Setup-time < 0.1 Sec Standardization: NFC Forum (founded 2004 by NXP, Sony, Nokia) Definition of standards Popularization of NFC Today: More than 150 members SICHERHEITS-Fachkongress

5 NFC Devices NFC Devices Android: Samsung Galaxy SII / Nexus / S4, HTC One SV / X BlackBerry: Z10, Q10, Curve, Bold 9900/9930 Windows Mobile: Nokia Lumia. HTC Windows Phone 8X, Samsung Ativ S Shipped NFC devices 2011: 30 Mio devices, 2012: 100 Mio devices, 2014: 500 Mio [ABI] Swisscom Switzerland 25% of the devices sold in Q1/2013 support NFC! 2013: 40% of devices sold by Swisscom support NFC Market share of the iphone: 50-60% => almost all non-iphone devices sold do support NFC! SICHERHEITS-Fachkongress

6 NFC Applications Smart Poster Reading data from a tag (comparable to QR-code-reading) Tasks Use NFC tags to automate tasks (e.g. set volumes, set alarms, etc) or to configure a WiFi network SICHERHEITS-Fachkongress

7 NFC Applications Device Connection ear-phones, speakers, cameras or printers (Bluetooth connection initiated by NFC) Sharing Data Videos, pictures, business cards, coupons SICHERHEITS-Fachkongress

8 NFC Applications Access Control Emulation of a contactless card Mobile Payment Emulation of a contactless card SICHERHEITS-Fachkongress

9 NFC Device Operating Modes Reader-Writer Mode Peer-To-Peer Mode Tag/Card Emulation Mode SICHERHEITS-Fachkongress

10 NFC Device Operating Modes Reader-Writer Mode Mobile Device is able to read external tags/smartcards, Device becomes RFID reader/writer (and can launch applications) Tag content: Text, URI (WebLink, Phone Number), SmartPoster Like QR-Codes, but faster Tags No need to launch an application With Android, an intent is thrown if a tag is detected Different form factors for NFC tags: tags, stickers, cards, key fobs, clocks Supported Technologies: ISO A/B, Mifare Ultralight, Classic/Standard 1K/4K NXP DESFire, Sony Felica, Innovision Topaz, Jewel tag => NFC Forum Specs define how NFC Messages are stored SICHERHEITS-Fachkongress

11 NFC Device Operating Modes Peer-To-Peer Mode Bidirectional P2P connection to exchange data between devices Proximity triggered interactions Nexus S: Devices have to be placed back-to-back Technologies S-Beam (Samsung): NFC + Wifi direct Android Beam: NFC + Bluetooth Standard: SNEP (Simple NDEF Exchange Prot.) Applications Exchange of vcards (e.g. XING) Hand-over of Tickets & P2P Payment Web-page sharing, Youtube-video-sharing Application sharing Exchange of device info in order to establish a faster connection automatically (e.g. Bluetooth) Legic: 4000er Legic reader support P2P SICHERHEITS-Fachkongress

12 NFC Device Operating Modes Tag/Card Emulation Mode Device emulates a passive tag (typically a smart card) Device can emulate (contain) multiple smartcards Reader can t distinguish between real smartcard & tag emulation Android: Emulated tag can be read only if screen is on Examples Access to the farm shop (Legic key) Oyster-Card, London Visa paywave Payment System Google Wallet SICHERHEITS-Fachkongress

13 Mobile Access with NFC NFC Applications & Operating Modes What is NFC? NFC Architecture What is the Secure Element? NFC Access Systems How do we apply NFC to access solutions? NFC Summary Open Questions SICHERHEITS-Fachkongress

14 NFC Device Architecture Structure of a NFC device Host-Controller Application Execution Environment (AEE) Controls UI, Communication and peripheral devices (Phone OS) NFC-Controller Contactless Front-end (CLF) Converter between HF signal and digital data Secure Element Trusted Execution Environment (TEE) Secure environment to execute and store security relevant applications and data App 1 NFC Controller Host- Controller NFC API Antenna App 2 Secure Element SICHERHEITS-Fachkongress

15 Secure Element Secure Storage in NFC device Tamper-proof storage for sensible data (money, tickets, keys) Cryptographic operations (encryption, signatures) Secure environment for the execution of program code (sandbox model) May contain applications from different providers Must provide individual installation, maintenance and revocation Platforms SmartCard (Global Platform) JavaCard system APDU commands Legic Applet Payment Applet Card OS (JavaCard) Secure Storage Crypto HW (3DES, AES, RSA / RNG) SICHERHEITS-Fachkongress

16 Secure Element Java Card / Global Platform Well standardized platform (1997 / 1999) Applets are portable between NFC phones and smart cards Memory (very limited device) Immutable (ROM): 160 KB Mutable (EEPROM): 72 KB Volatile (RAM): 4 KB Communication / Security Communication with APDU (Application Protocol Data Unit) commands Data sent over the NFC interface should be max 1-2KB Secure Channel in order to install applications a secure key must be known Security Domains Hierarchy SICHERHEITS-Fachkongress

17 Secure Element Secure Element nonremovable removable emulated Embedded Hardware (Secure IC) UICC over SWP (Secure SIM) MicroSD- Card (Secure MC) Bluetooth Stickers Micro-USB Stickers SICHERHEITS-Fachkongress

18 Trusted Service Manager TSM TSM is a Trusted Third Party that brings the service providers together for the provisioning and life cycle management of SE related credentials in a secure manner. TSM Functions Data Preparation and personalization, Key-Management & Security Provision / Deletion of Applets OTA (Over-The-Air) Service Provider 1 MNO TSM 1 Service Provider 2 Service Provider TSM MNO TSM 1 Service Provider n MNO TSM 1 SICHERHEITS-Fachkongress

19 Mobile Access with NFC NFC Applications & Operating Modes What is NFC? NFC Architecture What is the Secure Element? NFC Access Systems How do we apply NFC to access solutions? NFC Summary Open Questions SICHERHEITS-Fachkongress

20 Mobile Access Typical Online Access Control Solution Source: SICHERHEITS-Fachkongress

21 Mobile Access Solution 1: Mobile Access Cards Access card can be emulated in a mobile device and distributed OTA Mifare 1K Mifare DESFire Advantages Existing infrastructure can be reused Several cards may be stored on a mobile device Access rights can be distributed over-the-air (e.g. for field workers) Disadvantage If mobile phone is not online, installed cards cannot be revoked No access if battery is down (device dependent) SICHERHEITS-Fachkongress

22 Mobile Access Solution 2: Mobile Access Rights Instead of the identification, the mobile device presents a ticket Advantages Works offline Access rights do not have to be revoked (as they are only valid for a short time frame) Disadvantage Access point has to be made more intelligent (for the verification of the tickets at the access point) Reference: SICHERHEITS-Fachkongress

23 Mobile Access Solution 3: Separate NFC Token The user identification or the access ticket is stored on a separate NFC token which contains a SE New access rights can be delivered over the mobile phone BLE / BT2.1 Advantages Works with devices which do not support NFC Disadvantage Needs a separate battery and has to be turned on for communication with the phone Access Server OTA SICHERHEITS-Fachkongress

24 Mobile Access Solution 4: Remote Card Actualization The information stored on a card could be updated using a mobile device New access rights could be delivered with push notifications Mobile device is only a proxy, a secure channel is established from the server to the mobile device Advantages Existing infrastructure can be reused Disadvantage We still need the cards SICHERHEITS-Fachkongress

25 Mobile Access with NFC NFC Applications & Operating Modes What is NFC? NFC Architecture What is the Secure Element? NFC Access Systems How do we apply NFC to access solutions? NFC Summary Open Questions SICHERHEITS-Fachkongress

26 Open Questions / Problems Secure Element Which SE do we choose? UICC-SE: Solution only works with selected MNOs Embedded-SE: How do we get access to the SE TSM: Who plays the role of the Service Provider TSM? Models beyond card emulation P2P between mobile device and access point Inverse reader mode (=> SE embedded in the access point) Host-based Card Emulation (Android 4.4 KitKat) Battery Problem What happens if the mobile device battery is down? Security Relay attacks could also be applied to access solutions M. Roland, J. Langer, and J. Scharinger: Applying Relay Attacks to Google Wallet, in Proceedings of the 5th International Workshop on Near Field Communication, IEEE, February Mobile device can be attacked with malware (man-in-the-middle) SICHERHEITS-Fachkongress