Personal Security Device Field Revision via Atomic Application Replacement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing personal security devices (PSDs) often have factory-installed security mechanisms that can lead to unauthorized access when shared among users, and updating applications in the field is inefficient, as it does not support atomic transactions for system objects or properties, making it difficult to securely deploy new applications or update PSDs involving multiple system objects.
Innovation Solution
A system that uses a reader/writer coupled with an access module to replace factory security mechanisms with custom ones on PSDs, employing ISO/IEC 7816-13 application management commands for atomic replacement and authentication, ensuring secure access and reducing the risk of incomplete modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If factory security mechanisms are used in PSDs, then manufacturing and distribution is simplified, but security is compromised due to shared SMs among multiple users
Solution Approach 1:
The system performs preliminary authentication to detect factory SMs before the actual security customization process. This preliminary check enables the system to identify cards requiring customization and prepares the customization process in advance, ensuring that security mechanisms are properly customized before field deployment
Solution Approach 2:
The access module serves as an intermediary between the reader/writer and the PSD, mediating the security mechanism replacement process. It detects factory SMs, authenticates the card, and coordinates the atomic replacement operation, ensuring secure transition from factory to custom SMs
2Quantity of substance
If field updates are performed item by item, then memory space requirements are reduced, but update reliability deteriorates due to lack of atomic transactions
Solution Approach 1:
The system merges multiple update operations (application data, system objects, access keys) into a single atomic transaction using the ISO/IEC 7816-13 Application Management Request command. This consolidation ensures that all updates are applied together or not at all, preventing inconsistent states while managing memory efficiently through structured data packaging
3Reliability
If atomic replacement of security mechanisms is implemented, then security is improved through consistent updates, but device complexity increases due to transactional logic requirements
Solution Approach 1:
The PSD performs self-authentication and self-customization through the atomic replacement process. The card automatically detects factory SMs, authenticates itself with the access module, and executes the security mechanism replacement without requiring complex external transactional logic, thereby reducing overall system complexity while maintaining security consistency
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Atomically modifying a personal security device includes presenting the personal security device to a reader/writer coupled to an access module, the access module determining if the personal security device includes a factory security mechanism, and, if the personal security device includes a factory security mechanism, using the reader/writer and the access module to replace the factory security mechanism with another security mechanism. The access module may authenticate the personal security device in connection with replacing the factory security mechanism. Authenticating the personal security device may grant access to a user through a door controlled by the access module. Replacing the factory security mechanism may include replacing an application on the personal security device. An ISO/IEC 7816-13 application management request command may be used to replace the application.