Chipcard Persistence Application for Secure Data Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for updating applications on chip cards often result in data loss, as outdated applications pose security risks and cannot be updated without replacing the entire application, including valuable data.
Innovation Solution
Implementing a chip card configuration with a persistence application for data management and a main application for processing, where the main application can selectively update its program logic without affecting stored data, ensuring only the main application has access to the persistence application's data, and using a signature verification key to ensure trustworthy updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire application is replaced during an update, then security risks are reduced, but data loss occurs
Solution Approach 1:
The application is divided into two separate security domains: a first security domain for the main application program logic and a second security domain for data management. This segmentation allows the main application to be updated independently without affecting the data stored in the persistent storage, thereby resolving the contradiction between security updates and data preservation.
Solution Approach 2:
A data management component acting as an intermediary is introduced between the main application and the persistent storage. This intermediary manages data access and persistence, allowing the main application to be replaced while the data management component remains intact and continues to protect the stored data.
2Reliability
If applications are isolated for security, then security is improved, but update capability deteriorates
Solution Approach 1:
The system is segmented into multiple security domains with distinct responsibilities. The first security domain contains the main application that can be updated, while the second security domain contains the data management component that remains stable. This segmentation enables updates while maintaining security isolation.
Solution Approach 2:
The data management component in the second security domain serves multiple applications across different security domains, providing universal data management capabilities. This allows the main application to be updated or replaced while the universal data management layer continues to function, maintaining both security and update capability.
3Device complexity
If application and data form a unit, then simplicity is maintained, but update flexibility is reduced
Solution Approach 1:
The traditional unified application structure is segmented into separate security domains: one for main application logic and another for data management. While this increases structural complexity, it provides the necessary update flexibility by allowing independent replacement of the main application without affecting the data layer.
Solution Approach 2:
An intermediary data management component is introduced that sits between the main application and persistent storage. This intermediary layer provides a standardized interface for data access, allowing the main application to be updated while maintaining a relatively simple data access model through the intermediary.
Data Source
Figure 1~2
Figure 3~4
AI summary
The invention relates to a smart card (100) with a storage medium. The smart card is configured such that applications (132) which are installed on the storage medium and which do not belong to the same security domain (SD1-SD5, SD8) are isolated from one another. At least one persistence application (202) and a main application (204) are installed on the storage medium. The persistence application (202) is assigned to a first security domain (SD8) and is protected from being accessed by means of any application (134) external to the smart card. The persistence application includes a program logic (210) for storing data (D8) on the storage medium (108) and for reading the stored data. The main application (204) is likewise assigned to the first security domain (SD8) and includes an interface (AI) for an application (134) external to the smart card and an additional interface (208) for exchanging the data (D8) with the persistence application. The main application includes a program logic (206) for processing the data (D8), said program logic being configured such that already processed data (D8) is transmitted to the persistence application via the additional interface (208) in order to be stored on the storage medium (108), and data to be processed is received by the persistence application via the additional interface (208).