CSP in smart card-based development of mobile terminals and application (1)

1 Introduction

Since the mobile public network of extensive development and strong Universal PDA cell phones, mobile terminal as a solid online business access access Terminal servers are becoming more common.

However, mobile terminals via GPRS/CDMA mobile public network access service server exists quite a big security risk. In the absence of any security measures, a mobile terminal and Business Server for data transfer, can easily lead to data transmitted both wielded interception or tampering, if these data relate to commercially sensitive information, this will have on the interests of both tremendous losses. And, although compact mobile terminals, portable, easily lost and stolen, and unauthorized use of the device, an authorized user of unreasonable or malicious behavior, these are all poses a security threat. Thus, looking to the mobile terminal and Business Server process to increase security solution is a goal. IPSec VPN technology is widely used in the public network to establish a private tunnel, and then only in the tunnel on both sides of the data transfer. In this way, security is indeed will be improved, but if no smart card help, security will be compromised. Therefore, in this case, the design of a smart card-based IPSec VPN security of mobile access Terminal systems, this article focuses on the development of CSP in the system.

2 related background

2.1 smart card and PC/SC specifications

Smart card is a card with an embedded integrated circuit chip credit card size of plastic card, have a large amount of storage, data confidentiality, and strong anti-interference ability, storage, reliable, read-write device is simple, flexible, operation speed, ability to work offline, easy to carry.

This system uses a smart card is a special contains an exchange key pair, signing key pairs and certificates to provide encryption and decryption, authentication, and other services of the e-card.

PC/SC specifications is a set of integrated circuit card (ICC) and the personal computer system design specifications for interaction, enables smart cards to easily access WindoW platform.

Its main advantage is to let the application do not have to in order to communicate with smart card and to learn about the smart card reader, an application via PC/SC specifications and smart card reader communication, which then passed the ISO7816 and smart cards for communication to obtain services provided by the smart card, its transmission package structure is the TPDU.

2.2 Crypto API architecture and CSP

Crypto API is a Microsoft-provided a set of common interfaces, contains a series of functions, provides applications with encryption, digital signature, hash, and other security services, and applications do not have to care for their specific implementation.

Different vendors can develop independent encryption module, the module as a cryptographic service provider (CSP Cryptographic Service Provider), the complete key generation/Exchange, decryption, digital signing, certification and other services of a real module. The default CSP is the Microsoft RSA Based Provider, use RSA encryption algorithms. A system can load multiple CSP module, they are independent of each other. An application can use any CSP module without having to care about it's specific implementation, each CSP are on Crypto API to different implementations.

Crypto API architecture as shown in Figure 1.

You can see from Figure 1, it is divided into the application tier: System layer and cryptographic service provider layer.

At the application layer of the application through the Crypto API to invoke the CSP module offers various services.

3 hardware and software combination of CSP development

This article describes mobile security access Terminal systems in the development, use under WINCE WIND0w MOBILE 5.0 SDK.

The system consists of two layers, each independent of each other, in upper and lower to the upper dial provide CSP support, upper and lower layer through the system to consolidate. CSPs can implement based on software or hardware based, also can be based on a combination of hardware and software. C based on software, the use of the SP's key pair and algorithms related to the operating system, security is not high; and the implementation of hardware-based CSP although security is high, but expensive; and hardware-based CSP, because a key technology to generate and decryption operation and operating system, so its key management and encryption and decryption than software-based CSP safety have improved a great deal, and not much security as part of the relationship between the use of the software implementation, the cost ratio is based on the hardware implementation of the CSP reduces a lot can be said to be a compromise choice. This system uses CSP uses the combination of hardware and software, the programme aims to provide an SDIO smart card CSP. Hash, decryption, and other functions are not needed for hardware implementation, so these parts you can use the software. But WINCE system contains this part of the software implementation, so in design can make use of existing resources, only need the portion of the hard to achieve on the card, so that both improves performance without compromising security.

[1] [2] [3]