R 2011

APDUPlay 1.0

ŠVENDA, Petr

Basic information

Original name

APDUPlay 1.0

Authors

ŠVENDA, Petr (203 Czech Republic, guarantor, belonging to the institution)

Edition

2011

Other information

Language

English

Type of outcome

Software

Field of Study

10201 Computer sciences, information science, bioinformatics

Country of publisher

Czech Republic

Confidentiality degree

není předmětem státního či obchodního tajemství

References:

RIV identification code

RIV/00216224:14330/11:00056811

Organization unit

Faculty of Informatics

Keywords in English

smart card; logging; packet manipulation; security

Technical parameters

Platforma: MS Windows, Jazyk: C++
Změněno: 18/4/2012 10:56, RNDr. Pavel Šmerk, Ph.D.

Abstract

V originále

Security evaluation of implementation of cryptographic protocols between application and smart card may require tampering with communication channel, redirection to different device or capture and analysis of transported traffic. By introduction of random or patterned faults, implementation robustness can be tested. If the traffic is redirected to measurement device SCSAT04 (extended oscilloscope developed on VUT Brno), power analysis of smart card can be performed. Both operations are not currently supported by ordinary software applications commonly used with PC/SC interface and therefore own application APDUPlay was implemented to facilitate this task. APDUPlay works as transparent proxy between application and smart card by introduction of additional layer into PC/SC subsystem on MS Windows XP/Vista/7 platform. The project APDUPlay allows to log and manipulate communication realized via PC/SC interface and is providing following functionality: 1) Log content and additional information about exchanged PC/SC communication, visualize and prepare for further processing 2) Manipulate communication in real time based on predefined rules 3) Redirect communication via socket to other device/computer The project was developed to support security evaluation and testing of smart card applications both on data level (apdu packet visualization and manipulation to test correctness of implementation of security functions) and side channel level (power analysis consumption potentially resulting in code reverse engineering and cryptographic secret exposure).

Links

LA09016, research and development project
Name: Účast ČR v European Research Consortium for Informatics and Mathematics (ERCIM) (Acronym: ERCIM)
Investor: Ministry of Education, Youth and Sports of the CR, Czech Republic membership in the European Research Consortium for Informatics and Mathematics