Using ISO/IEC for mobile devices

Transcription

1 Using ISO/IEC for mobile devices Jan Eichholz, Giesecke & Devrient GmbH Dr. Detlef Hühnlein, secunet Security Networks AG Manuel Bach, Bundesamt für Sicherheit in der Informationstechnik Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 1

2 ISO/IEC for mobile devices Agenda ISO/IEC Using ISO/IEC for mobile devices with Mobile Signature Service in a Java Micro Edition environment Summary Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 2

3 ISO/IEC for mobile devices Agenda ISO/IEC Using ISO/IEC for mobile devices with Mobile Signature Service in a Java Micro Edition environment Summary Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 3

4 ISO/IEC architecture Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 4

5 Functions of the ISO Interface Card-application-service Access Initialize Terminate CardApplicationPath Connection-service CardApplicationConnect CardApplicationDisconnect CardApplicationStartSession CardApplicationEndSession Card-application service CardApplicationList CardApplicationCreate CardAppicationDelete CardApplicationServiceList CardApplicationServiceCreate CardApplicationServiceLoad CardApplicationServiceDelete CardApplicationServiceDescribe ExecuteAction Named data service DataSetList DataSetCreate DataSetSelect DataSetDelete DSIList DSICreate DSIDelete DSIRead DSIWrite Cryptographic service Encipher Decipher GetRandom Hash Sign VerifySignature VerifyCertificate Differential-identity service DIDList DIDCreate DIDGet DIDUpdate DIDDelete DIDAuthenticate Authorization service ACLList ACLModify Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 5

6 First ISO/IEC deployments e.g. Personal Identity Verification (PIV) e.g. European Citizen Card (ECC) e.g. Australian Drivers License Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 6

7 ecard-api-framework (BSI TR 03112, eid Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 7

8 ISO/IEC OASIS DSS (-X) eid OASIS OASIS DSS DSS (-X) (-X) ISO/IEC (CEN (CEN 15480) 15480) Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 8

9 Loyal Stack HBA egk HBA Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 9

10 Remote Loyal Stack (Internet Pharmacy) egk egk Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 10

11 Remote Loyal & ICC Stack (Citizen Services with meac) Browser Citizen Service Service-Access-Layer Service-Access-Layer Terminal-Layer Terminal-Layer meac Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 11

12 ISO/IEC for mobile devices Agenda ISO/IEC Using ISO/IEC for mobile devices with Mobile Signature Service in a Java Micro Edition environment Summary Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 12

13 Mobile Signature Service MSSP Specifies Web Service Interfaces between Application Providers (AP) and Mobile Signature Service Providers (MSSP) which allow to create digital signatures with mobile devices Standardized by ETSI TR (Business & Functional Requirements) TS (Web Service Interface) TR (Security Framework) TS (Specifications for Roaming in M-signature Services) Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 13

14 Mobile Signature Services Integration Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 14

15 Mapping ISO/IEC to ETSI [ISO24727] Part 3 CardApplication Path CardApplication StartSession DIDCreate / DIDUpdate DIDGet / [ETSI ] MSS_HandshakeReq MSS_RegistrationReq MSS_ProfileReq / MSS_StatusReq Note Besides path-information of regular cardapplications, CardApplication Path will also return a path to the virtual card-application for [ETSI ]. Using this function the AP and the MSSP agree on security mechanisms for further requests and responses. The keys of the mobile users are represented as Differential-Identites (DID). Consequently the creation of a DID corresponds to the registration of a user. DIDGet will be used to obtain information about a user profile and the status of a current transaction. DIDAuthenticate Sign MSS_SignatureReq MSS_SignatureReq Using the signing capability of the mobile device it is possible to design a challenge-response protocol for authentication. The signing capability of the mobile device may be also be used via the Sign function. As in [BSI-TR03112] the low level Sign function may be wrapped by a SignatureRequest according to [OASIS-DSS]. Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 15

16 ISO/IEC for mobile devices Agenda ISO/IEC Using ISO/IEC for mobile devices with Mobile Signature Services in a Java Micro Edition environment Summary Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 16

17 Java TM Micro Edition (JME) Started in Japan in 1999 Basic Standards (MIDP 1.0 and CLDC 1.0) available since 2000 First MIDP cell phones available since 2000 (e.g. Siemens SL45i) The Mobile Service Architecture defines a powerful platform Lot s of additional API s (SVG, M3G, MMAPI, BT, PIM, CHAPI, SIP, LOCATION, ) Deployed in over 2.1 billion mobile devices Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 17

18 JME Architecture Mobile Service Architecture (MSA) Umbrella JSR SIM access, Crypto, PKI XML, WebServices UI, pers. data, network, permissions, VM and basic APIs Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 18

19 Additional JSR s JSR 257 Contacless NFC, ISO/IEC Communication Service Connection communication SIP AMS I18N Paymnt. JSR 279 MSA Subset MSA WS SATSA CHAPI LBS PIM/FC 3D BT/ Obex SVG WMA MMAPI enhanced Web Services, SOAP, REST, Atom Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 19

20 The complete picture Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 20

21 MIDlet Integration of ISO/IEC Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 21

22 ISO/IEC for mobile devices Agenda ISO/IEC Using ISO/IEC for mobile devices with Mobile Signature Service in a Java Micro Edition environment Summary Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 22

23 Summary ISO/IEC about to become the global eid-standard MSS-based integration possible with arbitrary mobile devices, but requires additional infrastructure services (MSSP) JME offers the necessary functionality to integrate mobile devices into the ISO/IEC infrastructure NFC will push forward to integrate contactless communications into mobile devices In the mid-term, a JSR for a standardised JME interface to ISO/IEC would be beneficial Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 23

24 Deadline: Call for Papers - BIOSIG 2008 Biometric Border Control & Federated Identity Management September 11/12, 2008, Darmstadt Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 24

25 Thank you very much for your kind attention! Contact: Dr. Detlef Hühnlein secunet Security Networks AG Eichholz/Hühnlein/Bach Sicherheit 2008 Slide 25