Michael Hölzl, Endalkachew Asnake, Rene Mayrhofer, Michael Roland,
"Mobile Application to Java Card Applet Communication using a Password-authenticated Secure Channel"
: Proc. MoMM 2014: 12th International Conference on Advances in Mobile Computing and Multimedia, ACM Press, New York, NY, USA, Seite(n) 147-156, 2014, ISBN: 978-1-4503-3008-4
Original Titel:
Mobile Application to Java Card Applet Communication using a Password-authenticated Secure Channel
Sprache des Titels:
Englisch
Original Buchtitel:
Proc. MoMM 2014: 12th International Conference on Advances in Mobile Computing and Multimedia
Original Kurzfassung:
With the increasing popularity of security and privacy sensitive systems on mobile devices, such as mobile banking,
mobile credit cards, mobile ticketing, or mobile digital identities, challenges for the protection of personal and security
sensitive data of these use cases emerged. A common approach for the protection of sensitive data is to use additional
hardware such as smart cards or secure elements. The communication between such dedicated hardware and back-end
management systems uses strong cryptography. However,
the data transfer between applications on the mobile device
and so-called applets on the dedicated hardware is often
either unencrypted (and interceptable by malicious software)
or encrypted with static keys stored in applications. To
address this issue we present a solution for fine-grained secure application-to-applet communication based on Secure
Remote Password (SRP-6a), an authenticated key agreement
protocol, with a user-provided password at run-time. By
exploiting the Java Card cryptographic API and minor adaptations to the protocol, which do not affect the security, we
were able to implement this scheme on Java Cards with
reasonable computation time.