The Portuguese and the European Citizen Cards
Total Page:16
File Type:pdf, Size:1020Kb
Contributions to governmental eID platforms: The Portuguese and the European Citizen Cards Master’s Thesis Manuel Fernando V. Preliteiro Contributions to governmental eID platforms: The Portuguese and the European Citizen Cards THESIS regarding the research leading to the attainment of the degree of MASTER in Computer Science Engineering - Computation and Intelligent Systems by Manuel Fernando V. Preliteiro RELiablE And SEcure Computation Group Departamento de Informática MULTICERT Universidade da Beira Interior Rua Sidónio Pais Covilhã, Portugal Porto, Portugal www.di.ubi.pt www.multicert.com Copyright © 2009 by Manuel Fernando V. Preliteiro. All rights reserved. No part of this publication can be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the previous written permission of the author. Cover image: Universidade da Beira Interior Heraldry. Contributions to governmental eID platforms: The Portuguese and the European Citizen Cards Author: Manuel Fernando V. Preliteiro Student Id: m1244 Email: [email protected] Abstract This thesis presents two main levels contributions. The first contribution lies in the context of the STORK project. As a first step to the design of an integrated, uniform and secure European eID platform, a feasibility study was conducted and a small demonstrator was developed as a proof of concept. As a result of such task, several STORK deliverables were submitted along a contribution for the Porvoo Group regarding the current state of eID across Europe. This work also benefits the second contribution. Second, it is introduced a new middleware solution for the Portuguese Elec- tronic Citizen Card. This middleware should subsume the actual and official version. Its novelty lies in its ability to process foreign (European) eID cards and adapts its provided support and services (including the User Interface) in conformity. The validity of the proposed platform was ensured and proved by several successful case studies that MULTICERT can use and develop. Supervisors: Supervisor: Simão Melo de Sousa Co-Supervisor: Pedro Borges Dedication The Author would like to dedicate this work to several people and entities: • Prof Simão Melo de Sousa - Without whom this opportunity (and many others not related to this thesis) wouldn’t have presented itself • Universidade da Beira Interior - All the Authors knowledge as a Computer Science Engineer started in this great institution • MULTICERT - For the offer of the scholarship and unique conditions (access to hardware from several different countries and brands) for the production of this work • MULTICERT Team - As a thanks for the amazing work environment, high moral and spirits • Family and Friends - There is nothing better than after a good hard day of work go back to the people you love iii Declaration The work of this thesis was possible thanks to a scholarship provided to the author by MULTICERT and with the support of the RELEASE (RELiable And SEcure Computation Group) research group from Universidade da Beira Interior, both from Portugal. Although parts of this thesis are researches of works already done and published (being those parts properly referenced by the bibliography), no part of this thesis has been submitted elsewhere for any other degree or qualification and it is all the authors work, unless referenced to the contrary in the text. There are parts of this thesis that are based on joint research by the author and Austrian partners. The parts and partners are properly identified in the proper sections. v Acknowledgements Benefiting from the fact of writing this thesis while working in a company such as MULTICERT it was possible to also benefit from the know-how of many of the work colleagues. So, a big thanks is also due to the MULTICERT team, in particular Gonçalo Hermenegildo and Pedro Borges for their availability and guidance. Also, another huge thanks goes to the authors Austrian partners on the STORK projects (Mario Ivkovic, Thomas Zefferer), that also contributed with valuable knowledge, experience and advices. Manuel Fernando V. Preliteiro Covilhã, Portugal June 12, 2009 vii Contents Dedication iii Declaration v Acknowledgements vii Contents ix List of Figures xi List of Tables xiii Acronyms xv 1 Introduction 1 1.1 The Porvoo Group . 2 1.2 The STORK Project . 4 1.3 Middleware . 6 1.4 Objectives . 7 1.5 Contributions . 8 1.6 Organization and Parts Overview . 9 2 Key Concepts 11 2.1 eID . 11 2.2 Tag Length Value (TLV) . 17 2.3 Security Environments . 20 2.4 Extensible Markup Language (XML) . 22 3 Related Technologies 25 3.1 Smart Cards . 25 3.2 ECC . 31 ix CONTENTS CONTENTS 3.3 STORK project studied technologies . 36 3.4 PKCS#15 . 41 3.5 Graphical Interface Technologies . 44 3.6 Java . 50 4 Case Studies 51 4.1 Connecting to a smart card . 51 4.2 Portuguese eID . 52 4.3 PKCS#15 Compliant Smart Cards . 56 5 Minimal Footprint Middleware 59 5.1 Smart Card Abstraction Technologies Review . 61 5.2 Possible MFM Architecture . 62 5.3 Conclusion . 63 5.4 Demonstrator description . 64 6 Multiplatform Common and Adaptive Middleware 67 6.1 Planning . 68 6.2 Architecture . 69 6.3 Conclusion . 71 7 Porvoo Conferences 73 7.1 Notes . 73 7.2 Country updates . 75 7.3 Conclusions . 105 8 Results and Conclusions 107 8.1 Results . 107 8.2 Conclusion . 108 Bibliography 109 A Demonstrator Print Screens 113 B Bits and octets convention 117 B.1 . 117 B.2 . 117 C Multi Purpose Code 119 C.1 XML . 119 D Multiplatform Common and Adaptive Middleware: Working 121 D.1 Profile . 121 D.2 XML Description . 122 x List of Figures 1.1 Porvoo Group Logo . 3 1.2 STORK Logo . 4 1.3 Multi Card Middleware for Several Application . 6 1.4 Portuguese Middleware Architecture . 7 2.1 Identifier octet . 19 3.1 Smart card example . 26 3.2 Command APDU . 28 3.3 Response APDU . 29 3.4 Middleware Architecture . 34 4.1 Public Data . 53 4.2 Adress Data (test card) . 54 5.1 Smart card aware application model and OSI model . 60 5.2 Java Applet over OpenSC architecture . 62 5.3 Java Applet and ActiveX architecture . 63 5.4 Java Applet Solution . 64 6.1 Architecture . 68 A.1 Demonstrator Home Page . 113 A.2 Requesting permission to run the Java Applet . 114 A.3 Waiting for some smart card insertion . 114 A.4 The inserted card is not a supported eID . 115 A.5 Demonstrator recognizing the PT eID . 115 A.6 Demonstrator success page . 116 D.1 Public Personal Data . 122 D.2 Request PIN . 123 xi LIST OF FIGURES LIST OF FIGURES D.3 Protected Personal Data . 123 xii List of Tables 2.1 Encoding of class tag . 19 7.1 Porvoo Group Conferences . 74 7.2 Countries Present at the Porvoo Group Conferences . 76 xiii Acronyms ACD Application Capabilities Descriptor . 35 AID Applet Identifier . 122 AODF Authentication Object Directory File. .42 APDU Application Protocol Data Unit . 28 API Application Interface. .7 ASN.1 Abstract Syntax Notation One . 18 AT Authentication Template. 21 ATR Answer to Reset. .30 bps Bits Per Second . 43 CA Certificate Authority . 13 CC Citizen Card . 1 CCD Card Capabilities Descriptor . 35 xv Acronyms Acronyms CCT Cryptographic Checksum Template . 22 CDF Certificate Directory File . ..