Towards a secure Cloud of Secure Elements concepts and experiments with NFC mobiles

This paper introduces an innovative concept dealing with Cloud of Secure Elements (CSE), remotely accessed from NFC enable smartphones. The Near Field Communication (NFC) technology enables proximity and mobile applications dealing with payment, ticketing or access control. The idea behind CSE is to host credentials in connected mobiles, which establish secure sessions with secure elements stored in dedicated grids, thanks to secure NFC proxies. We analyze the properties, such as security, naming, localization, and caching needed by relay protocols used for communication between mobiles and Grid of Secure Elements (GoSE). We present an experimental platform comprising a NFC Android mobile, a NFC proxy, and a grid. Finally observed performances are analyzed and discussed in order to build up an improved version from this first platform.

[1]  S. B. Guthery.  Java card: Internet computing on a smart card , 1997 .

[2]  Pascal Urien.  LLCPS: A new security framework based on TLS for NFC P2P applications in the Internet of Things , 2013, 2013 IEEE 10th Consumer Communications and Networking Conference (CCNC).

[3]  D. Mazzocchi,et al.  OPEN-NPP: An Open Source Library to Enable P2P over NFC , 2012, 2012 4th International Workshop on Near Field Communication.

[4]  Pascal Urien,et al.  An Innovative Solution for Cloud Computing Authentication: Grids of EAP-TLS Smart Cards , 2010, 2010 Fifth International Conference on Digital Telecommunications.

[5]  Gerhard P. Hancke,et al.  Practical NFC Peer-to-Peer Relay Attack Using Mobile Phones , 2010, RFIDSec.

[6]  Richard J. Lipton,et al.  On the Importance of Eliminating Errors in Cryptographic Computations , 2015, Journal of Cryptology.

[7]  Michael Roland,et al.  Applying recent secure element relay attack scenarios to the real world: Google Wallet Relay Attack , 2012, ArXiv.

[8]  Juan Manuel González Nieto,et al.  Detecting relay attacks with timing-based protocols , 2007, ASIACCS '07.

[9]  Siva Sai Yerubandi,et al.  Differential Power Analysis , 2002 .

[10]  Gerhard P. Hancke,et al.  A Practical Relay Attack on ISO 14443 Proximity Cards , 2005 .

[11]  David M'Raïhi,et al.  Cryptographic smart cards , 1996, IEEE Micro.

[12]  Christophe Bidan.  Cartes à puce , 2004 .

[13]  Gustavus J. Simmons,et al.  The Smart Card: A Standardized Security Device Dedicated to Public Cryptology , 1992 .

[14]  Michael Roland.  Software Card Emulation in NFC-enabled Mobile Phones: Great Advantage or Security Nightmare? , 2012 .

[15]  Pascal Urien.  An OPENID Identity Service for Android, Based on USIM Secure Elements , 2012, MobiCASE.