A User Centric Security Model for Tamper-Resistant Devices

1.2 A Brief History of Smart Cards
chip cards known as memory cards were based on xed logic and limited storage capacity.
However, later in the 1990s microprocessor cards emerged on the scene. These cards
can store and dynamically process information without relying on hard-wired xed logic,
as was the case in early chip cards. The German Post Oce conducted initial trials
of chip cards for their analogue mobile telephone network. The success of these trials
resulted in the deployment of the microprocessor cards in the GSM 4 networks. At the time,
telecommunication companies all over the world were rapidly adopting microprocessor
cards, mainly to prevent phone cloning. However, the banking networks of the time did
not embrace the new technology as quickly.
The development of smart cards coincided with another revolution in the eld of system
security. The discipline of cryptography was emerging from government and military secrecy.
The security provided by sophisticated (cryptographic) mathematical concepts, and
improved designs in hardware and software programming paved the way for the use of
cryptography in new technologies such as smart cards. This gave smart cards an edge
over magnetic stripe cards in the banking sector, and this was soon acknowledged [5].
As in the case of the initial innovation of chip card technology, French banks pioneered
the adoption of the smart cards as payment cards. After long negotiations and development,
the widespread adoption of smart cards in the banking sector came in 1994, when
Europay, MasterCard and Visa published their payment card specication (i.e. the EMV
specication [9]).
The initial attempts to have multiple functionality on a smart card were made in 1996 in
Austria with the introduction of a smart card, which allowed banking (e.g. POS services),
an electronic purse and optional value-added services [5]. However, this initiative cannot
be considered a true multi-application smart card, because it was a multi-functional smart
card [10] that had a single application with multiple functionality.
At the same time, another concept termed the generic soft mask [5] was taking centre
stage. In generic soft mask a card manufacturer implements a Smart Card Operating
System (SCOS) on a non-mutable memory of the smart card. This operating system is
independent of applications like banking or transport. To support these applications, the
card manufacturer implements the Application Programming Interfaces (APIs) to facilitate
individual application. These APIs were stored on the mutable memory rather than on a
non-mutable memory where traditionally the bulk of the SCOS was stored. This innovation
simplied the development of smart card applications: card manufacturers proposed using
generic soft masks for dierent types of applications. Implementing the concept of the
generic soft mask requires a minimum operating system and some customized Application
Programming Interfaces (APIs) for any particular application. The application developers
utilised these APIs to develop their applications.
4 Global System for Mobile Communication (GSM) is a standard for the mobile Telecom industry that
is developed and promoted by the GSM Association (GSMA).
21