Profiles and Scripting Tokyo - January 2003

1
Profiles and ScriptingTokyo - January 2003

Christophe Biehlmann christophe_biehlmann_at_datacard
.com
2
GlobalPlatform Architecture Overview
Card Profiles Database
Information supplied by the chip indexes the
correct card profile.
Application profiles are retrieved that match the
desired components
Application Profiles Database
Smart Card Data
10101010
The correct smart card data is created from the
issuers data streamUsing the same GP methods as
personalization.
The GlobalPlatform Interpreter checks the
information within the profiles against each
other and executes the script to process keys,
data and chip commands
3
Where do Profiles Come From?
Card Profiles are generated by the smart card
manufacturer
Application Profiles are generated by the
application developer
Applications are generated by the application
developer
Key Profiles are generated by the application
developer and/or under the control of the issuer
Experts in their specific area can produce and
exchange GlobalPlatform profiles that may be used
in the processing of smart cards
4
What Is Inside of a Profile?
Identification Information
Identification Information
Identification Information
Key Information
Application Information
Chip and O/S Information
Usage
Keys
Applications Information
Data
Transport Key
Conflict Rules
Scripts
Key Parts
Conflict Rules
Card Profile Application Profile Key Profile
The profiles are constructed as XML documents to
aid in interoperability and use in automated
processing
5
Card Profile Components

• Unique Identifier ( OID )
• Open Description ( textual )
• Revision -Version -Date/time -By

Identification Information

• Name of Manufacturer
• Speed
• Protocol Supported
• Voltage
• OS
• OS Version

• Key Type and Algorithm
• Rom Size
• Ram Size
• Flash Size
• E2 Size

Chip and O/S Information
Applications Information

• Application Identifier Label State Security
  Information Resources consumed

Conflict Rules

• Source
• target
• Rule

Card Profile
6
Key Profile Components
Identification Information
Key Information
Usage
Transport Key
Key Parts
Key Profile
7
Application Profile Components

• General Information ( Developer, Owner, Provider
  )
• Resources Required
• Life Cycle States
• Reference to Binary Files

• Name
• Key Profile Reference

• Name
• Length
• Tag
• External Source
• Need to Audit

10101100100111001001011000111010100001010100011
1

• Name
• Start Cycle
• End Cycle
• Security Needed
• Script Code

Application Profile
8
How Are Scripts Used With Profiles?

• Name
• Start Cycle
• End Cycle
• Security Needed
• Script Code

• International standard ECMA Script
• Platform independent
• A Java Script with predefined objects
• Java Script is an interpreted language
• Runs like any other programming language
• Carries out the actions such as loading
• applications, personalizing cards or creating
  data

Application Profile
The scripts are used to perform the complex
functions required to process the smart card
operations. The developer creates the script
once and it can be exchanged and run on any
compatible system.
9
What Does A Script Fragment Do And Why?
Script Fragments are created for specific roles
Examples of fragments created for different roles
are
Data Generation
Load Application
Personalization
Verification
Script Fragments allow different actors to play
multiple roles. The overall flexibility is based
off of the business requirements. Restrictions
could be enforced to block some combinations,
such as initialization and personalization by the
same actor.
9
10
Predefined Objects
Card Object
Reset() SendAPDU() SetBaudRate() SetVcc() SetPPS()
These objects and their methods have been created
specifically for smart card processing. This
list is a portion of the available objects and
methods and it is likely this list will grow over
time
10
11
A Sample Overview
ltCard Profile ID01 gt ... ltCardManufacturerProdu
ctgt ltChipgt ltPlatformgt ...
ltApplicationInstancesgt ltAppInstance AID10
ProfileID03 gt ltAppInstance AID11
ProfileID02 SD10 gt ...
ltApplication Profile ID 02 gt
ltApplicationInfo TypeGP SubTypeAPP gt
lt/ApplicationInfogt ltScriptFragment Name
Persogt this.select() this.securityDomain.o
penSecureChannel() this.sendApdu(...) ...
lt/ScriptFragment gt ...
3
4
11