Smart Card Program Data Communication via Segmented Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing APDU protocol for communicating program data between a host computer and a smart card is inefficient, requiring significant memory and time for reassembling and processing CAP files, and lacks secure authentication mechanisms to detect tampering.
Innovation Solution
A system that disassembles program files into logical data units, computes fingerprints over payload portions, and uses authentication codes to securely commit data to memory, ensuring efficient communication and integrity verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the existing APDU protocol is used to communicate program data between host computer and smart card, then the communication can be established, but the memory requirements and processing time increase significantly
Solution Approach 1:
The patent divides the CAP file into multiple logical data units (LDUs), each containing specific program elements (classes, interfaces, methods). This segmentation allows the smart card to process and store only the necessary portions of the file, reducing memory requirements and enabling parallel processing of different LDUs, thereby improving overall processing speed.
Solution Approach 2:
The host computer performs preliminary actions by disassembling the CAP file into LDUs and computing fingerprints for authentication before transferring to the smart card. The smart card receives pre-processed data with authentication codes, eliminating the need for time-consuming reassembly and verification operations on the card itself, thus reducing processing time.
2Reliability
If the existing APDU protocol is used for program data communication, then data transfer is possible, but security authentication mechanisms are insufficient to detect tampering
Solution Approach 1:
The patent introduces fingerprints and authentication codes as intermediary elements that mediate between the host computer and smart card. The host computer computes a fingerprint over the CAP file contents and generates authentication codes using cryptographic keys. These intermediaries are transferred to the smart card, which verifies them to ensure data integrity and detect tampering, providing secure authentication without requiring complex verification protocols on the card.
3Productivity
If the CAP file is loaded directly onto the smart card without disassembly, then the loading process is simpler, but the reassembly and processing becomes more time-consuming
Solution Approach 1:
The patent segments the CAP file into logical data units that can be independently processed and transferred. This segmentation eliminates the time-consuming reassembly operation by ensuring data is already organized in the correct structure before loading, while maintaining simplicity in the loading process itself.
Solution Approach 2:
The host computer performs the disassembly and organization of CAP file data into LDUs with proper sequencing information before transfer to the smart card. This preliminary action eliminates the need for time-consuming reassembly operations on the smart card, significantly reducing loading time while maintaining simplicity in the card's processing operations.
Data Source
AI summary
A system for communicating program data between devices includes a first device configured to disassemble a program file comprising program data into at least one logical data unit, partition each logical data unit into at least one protocol data unit and compute a first fingerprint over the payload portion of the protocol data units. The first device is also configured to send the protocol data units and at least one member of the group comprising the first fingerprint and a first authentication code based on the first fingerprint to a second device. The second device is configured to compute a second fingerprint over the payload portion of the protocol data units and to commit the program to a memory based on whether the at least one member matches the second fingerprint or a second authentication code based on the second fingerprint.