Gemplus–Delivering security–i.e. ensuring access is granted only for authorized usage by authorized cardholders–is the fundamental attribute of smart cards. The effectiveness of smart cards in delivering security is one of the reasons they have been so widely adopted, especially in financial services and mobile phones, why the growth of smart cards has been explosive, and why their usage is expected to expand rapidly for other applications such as personal identity cards, health, transport and access to pay TV/entertainment.

As in any field, security standards do not stand still. There will always be those who for fraudulent, ethical or experimental reasons seek to break security shields. As in any field, it is also true that the notion of eternal security against every conceivable (and inconceivable) situation may be impracticable and that there is a trade-off between the last fraction of a percent security and cost.

That said, Gemplus is a global leader in smart cards and, from its launch, has devoted substantial research to imagining, devising and protecting against attacks on security. It has consequently been aware of such attacks for some time, and has implemented effective countermeasures notably against side channel and fault attacks.

Two articles have appeared in the press recently focusing on two different types of smart card attacks. They have generated considerable interest in the media. The two attacks and the issues surrounding each are distinct.

The first article appeared in the WSJE on 7 May and focussed on side channel attacks. These are nothing new in the smart card industry and do not represent a new and additional security risk for GSM SIM cards. This attack affects early type SIMs which use what is considered (by the industry) to be an outdated algorithm (COMP128-1). The GSM Association has recommended against using this algorithm in current generation SIM cards and many operators no longer use it. In addition, Gemplus has effective countermeasures against many types of side-channel attacks.

The WSJE article actually states “its impact on consumers is expected to be limited.” The article also points out that “IBM has an interest sounding the alarm. It developed technology to protect against the kind of hacker attack it is outlining and will offer to license that to cellphone makers.”

The light attack publicized by Cambridge University researchers is a type of fault attack, which has been widely studied for years, but about which Gemplus is also well aware. An article appeared in the New York Times on 13 May, describing the research and quoting the researchers as saying that this vulnerability may pose a big problem for the industry, and that the industry will need to add countermeasures to increase the card’s security.

Some claim that this attack is more serious than the one publicized by IBM. The attack presented shows how a fault can be generated, but not how sensitive information can actually be recovered. This is not straightforward. The attacker must adapt his or her attack to any one of more than 60 chips designs used in smart cards.

Recent products benefit from the most advanced countermeasures, but earlier products in the field may prove vulnerable.

Smart cards remain the most efficient and cost-effective device to protect privacy and security of access to digital information and electronic transactions. It has proven, over many years and with broad use, to offer the strongest security at the most competitive price.

Key Messages

Security is a never-ending battle. Attacks are an expected event in the security industry, but academic review must not be confused with real-life hacking.

For Gemplus, security is a fundamental priority. It is a world leader in smart cards, thanks to its lead in anticipating security attacks and developing hardware and software solutions.

Gemplus defines and implements countermeasures that keep real-world fraud at far lower levels than systems based on any competing technology.

Different applications require different levels of security. Smart cards and their surrounding infrastructure will offer different levels of security according to such requirements and to cost / benefit trade-offs associated with total system security. Security should indeed be considered from a global viewpoint.

An aspect to bear in mind is that, in the banking world, each credit card is issued with an expiry date that enables the bank to ensure that,every two years, their clients receive the latest technology with which to safe guard their personal data. There is no such protocol in the telecom world, but this would ensure that all end-users were always one step ahead of the hackers. As the role of the SIM expands to support and enable secure mobile data services, the security technology developed and tested in Gemplus R&D laboratories today will likely become the de facto standard for next generation cards.

The type of attacks given recent publicity have been known to Gemplus for a number of years.

About Gemplus

Gemplus helps its clients offer an exceptional range of portable, personalized solutions that bring security and convenience to people’s lives. These include mobile Internet access, inter-operable banking facilities, e-commerce and a wealth of other applications.

Gemplus is the only completely dedicated, truly global player in the Smart Card industry, with the largest R&D team, unrivalled experience, and an outstanding track record of technological innovation.

In 2001, Gemplus was the world number one in smart card shipments according to Gartner-Dataquest, IDC, Frost and Sullivan, Datamonitor and The Nilson Report.

Gemplus trades its shares on Euronext Paris S.A. First Market and on the NASDAQ Stock Market as GEMP in the form of ADSs. Its revenue in 2001 was 1.0 billion Euros.

Gemplus: Beyond Smart http://www.gemplus.com