A UNIX Filesystem for Smartcards

CITI Technical Rep ort 98-8 SCFS: A UNIX Filesystem for Smartcards Naomaru Itoi [email protected] Peter Honeyman [email protected] Jim Rees [email protected] Abstract Smartcard software develop ers su er from the lack of a standard communication framework b etweenaworkstation and a smartcard. To address this problem, we extended the UNIX lesystem to provide access to smartcard storage, which enables us to use les in a smartcard as though normal UNIX les. Decemb er 3, 1998 Center for Information Technology Integration University of Michigan 519 West William Street Ann Arb or, MI 48103-4943 2 itoi 1 Intro duction On-chip software standards: JavaCard [14] and MULTOS [15]. Today, it is easy to purchase smartcards in rea- Although these standards provide abstrac- sonable prices, e.g., $5 - $20 for each. How- tions at a higher level than ISO-7816-4, it re- ever, smartcard software development is hard: mains a challenging task for develop ers to se- smartcard software develop ers have long suf- lect a standard, purchase all software and hard- fered from the lack of a user friendly stan- ware required, learn API and to ols, and nally dard communication proto col b etween appli- 1 implement software. Furthermore, those stan- cation software and a smartcard. The ISO- dards do not eliminate problems with interop- 7816 communication proto col [9] is so widely erability{ e.g., OCF limits the programming accepted that virtually all smartcards supp ort 2 language to Java; PC/SC is used only with it. However, the proto col is not a particularly Windows { and create their own API dep en- desirable one: dencies, b ecause software written for one stan- It is a primitive message passing proto- dard do es not run with another. We discuss col. Providing only read and write op- these issues in Section 5.1. erations for raw data, it do es not de ne Our solution to this problem is to embrace a higher interfaces such as UNIX les and classic, sophisticated API { the UNIX lesys- I/O streams. This hamp ers our abilityto tem { instead of inventing a new one. The build application software. UNIX lesystem API suits a smartcard well b ecause a smartcard is a passive device used Although all smartcards supp ort ISO- for secure storage: a smartcard stores data se- 7816, details of implementation of the pro- crets, and resp onds to requests from a work- to col di ers among vendors and typ es of station to read or write the data. It do es not smartcards. This requires software devel- initiate actions. This passivityischaracteristic op er to tailor their applications to sp eci c of storage devices such as hard disks. smartcards. In UNIX op erating systems that supp ort Di erences among smartcards range from vnodes equivalently, Virtual Filesystem, or trivial ones, such as di erent op co des, to VFS [11] [13], it is p ossible to write a virtual essential ones, such as di erent authen- lesystem that communicates with a sp ecial tication mechanisms, etc. For example, hardware device, e.g., a smartcard, and mount 3 the CLA byte of application class is 0x00 it in the UNIX lesystem name space. The in some smartcards Giesecke & Devrient mounted hardware device then b ecomes iden- STARCOS Version 2.1, while it is 0xc0 in tical to any UNIX lesystem hierarchy from others Schlumb erger MultiFlex. the p ersp ective of a user or application software. For example, if a smartcard is mounted To address the de ciencies of ISO-7816, on /smartcard, it is p ossible to use UNIX com- many new standards have b een prop osed. Ex- mands suchasls, cd, pwd, and cat, and system amples are: calls suchasopen, read, and write on les in General purp ose standards: Op en Card the smartcard. Framework OCF [2, 8] and PC/SC [3,4]. Wehave implemented a smartcard lesystem 4 or SCFS in the Op enBSD-2.2 kernel. With Sp ecial purp ose standards: PKCS 11 SCFS mounted, a user or an application can [12] for cryptography, EMV [5] and SET use les in a smartcard as she would normal for electronic commerce. UNIX les. 1 \Application software" is a program running on a The remainder of this pap er is organized as workstation that communicates with a smartcard. A follows. Section 2 describ es our goals and the program running on a smartcard is called \on-chip soft- design of SCFS. Section 3 details implementa- ware". 2 tion of SCFS. Readers not interested in im- Almost all smartcards supp ort ISO-7816-1, 2, and 3. Many supp ort ISO-7816-4 [17] 4 3 Op enBSD is a free, 4.4BSD-based op erating sys- For description of \CLA" and \application class", tem. http://www.openbsd.org please see Guthery and Jurgensen [6] or ISO-7816 [9] Smartcard Filesystem 3 plementation details maywant to skip Section UNIX lesystem. For example, without direc- 3. Performance evaluation in Section 4 shows tory entries, it is imp ossible to implement ls that the overhead of SCFS is small and do es prop erly. not substantially degrade the p erformance of Wehavetwochoices, with concomitant smartcard software. We discuss SCFS with a tradeo s: comparison to other standards in Section 5 . Dictate an internal format on a smartcard Future direction is in Section 6 and concluding to store information such as directory en- remarks are in Section 7. tries, length of a le, etc., in a le in a smartcard. This provides full functionality of UNIX lesystems. 2 Design Degrade functionality of SCFS. For example, no ls,nocat. 2.1 Design Goals We compromise b etween the twochoices. We Our goal is to provide a user friendly interface b elieve it is essential to b e able to determine a to access a smartcard. We de ne design goals smartcard's directory structure through UNIX as follows, although not all can b e achieved, for commands suchasls, so SCFS requires di- reasons outlined in Section 2.2: rectory structure information to b e stored in a smartcard. We also require a smartcard Files in a smartcard should b e indistin- guishable from other UNIX les. to store le lengths b ecause they are neces- sary to implement the read and write system A smartcard can b e accessed with any calls. Every directory or DF in ISO-7816 in UNIX system calls e.g., creat, open, a smartcard has a le called ff.fe containing read, and write. the requisite metadata. UNIX commands e.g., ls, cd, pwd, and 2.3 Design cat can b e used to access les in a smartcard. Inspired by Arla [18], SCFS is implemented as a kernel mo dule, xfs, that handles VFS requests, The smartcard VFS must b e able to access and a user daemon, scfsd, that communicates any smartcard that supp orts ISO-7816. with an ISO-7816 smartcard. Figure 1 shows the overview of the design. The smartcard VFS should hide details ab out a smartcard to users. ISO-7816 interface Smartcard Application SCFSD Security of a smartcard must b e preserved. UNIX Filesystem No smartcard les may b e cached in the interface User-level UNIX system b ecause a smartcard is a more secure place to store data see the Kernel end of Section 2.3. VFS XFS Figure 1: SCFS design 2.2 Design Problems Ahuge obstacle to achieving our goals is the absence of a standard way to request metadata When an application calls a VFS op eration information ab out les in a smartcard. Some e.g., read,orwrite to a smartcard le, the information essential for the UNIX lesystem kernel mo dule up calls scfsd to request service. 5 is simply not present in a smartcard, e.g., sends them to Scfsd creates ISO-7816 APDUs, le sizes, directory contents, and time stamps. 5 An Application Protocol Data Unit, or APDU, can Without such information, it is imp ossible to b e viewed as a framing proto col for messages passed implement the complete functionality of the from application software to a smartcard.[9]. 4 itoi a smartcard, gets returned data, and passes it 3.2 Kernel Mo dule xfs to the kernel mo dule. The kernel mo dule xfs implements a virtual Separation b etween xfs and scfsd allows us lesystem, the pioctl system call, and com- to use an existing ISO-7816 library [16] for han- munication with scfsd. dling the ISO-7816 proto col and dealing with The virtual lesystem consists of several its complex timing requirements. Kernel co de functions called by the kernel when a le in is minimized, making SCFS easy to debug and SCFS is accessed. For example, the core part p ort. of the read system call is implemented by the To absorb di erences among smartcards, xfs read vno de op eration in the xfs. SCFS requires some knowledge of a smart- We describ e some imp ortant vfs op erations, card b efore it is mounted, e.g., existence xfs mount and xfs root, and some im- of sp ecial APDUs, op co des used for AP- lookup, p ortant vno de op erations, i.e., xfs 6 DUs, ATRs they return, etc. The informa- xfs read, xfs write, xfs getattr and tion is stored in a SCFS con guration le, xfs readdir in Section 3.5. /usr/scfs/etc/scfs.scdb by default. Xfs is typically loaded into the kernel at b o ot SCFS automatically identi es a smartcard time.

Load more