1
LEVERAGING UICC WITH OPEN MOBILE API
FOR SECURE APPLICATIONS AND SERVICES
4/13/2015
Ran Zhou
Motivation
2





Smartphones become the handheld computer and the
personal assistant
Growing market has attracted hackers to make the potential
for serious security threats on smartphones a reality
UICC serves as the security anchor in mobile networks
GSM Association: the UICC is the strategically best
alternative as a secure element for mobile devices [Sma09]
Interface is required to fill the gap between UICC applets
and mobile applications
4/13/2015
Solution Idea
3

SIMAlliance Open Mobile API: the communication channel
Dual Application Architecture: the basic architecture

An example: Smart OpenID

4/13/2015
Agenda
4






Motivation and Solution Idea
Basic Technologies
State of the Art
Smart OpenID
Implementation
Summary and Future Work
4/13/2015
Universal Integrated Circuit Card: UICC
5




The bearer of the subscriber’s identity in cellular networks
Secure element
secure storage, cryptographic functions
Secure channel
transmission between the UICC and the server with
authenticity, integrity, confidentiality
Wireless PKI
mobile network operator owns root certificate: becomes a
certificate authority
4/13/2015
Open Mobile API
6
Open Mobile API is established by SIMalliance as an open API between
secure element and the mobile applications
Open Mobile API
•
•
•
•
•
Crypto
Authentication
Secure Storage
PKCS#15
…
4/13/2015
Open Mobile API
7
4/13/2015
Agenda
8






Motivation and Solution Idea
Basic Technologies
State of the Art
Smart OpenID
Implementation
Summary and Future Work
4/13/2015
State of the Art
9




Financial applications
online-banking, contactless payment, tickets apps
Enterprise applications
secure Email, ERP, Software as a Service
Content protection applications
digital rights management, secure document
Authentication applications
generic bootstrapping architecture, public key infrastructure
4/13/2015
State of the Art
10





Malware
virus, Trojan horse, Spyware
Eavesdropping
traffic (password) on the network
Man-in-the-middle
attacker manipulates the transmitted data
Replay attacks
a valid data is maliciously repeated or delayed
Phishing
acquires data by masquerading as a trustworthy entity
4/13/2015
State of the Art
11




Private information is the main aim of the attacker, e.g.,
password, credit card number etc.
Anti-Malware, secure storage, digital certificate, transport
layer security, authentication etc.
Some countermeasures are unusual on smartphone
Existed protocols are vulnerable to different attacks
4/13/2015
Agenda
12






Motivation and Solution Idea
Basic Technologies
State of the Art
Smart OpenID
Implementation
Summary and Future Work
4/13/2015
OpenID
13
Relying
RelyingParty
Parties
Association session:
a shared symmetric key +
association handle
Authentication
response: signed with
the shared key
User
Device
OpenID Provider
Threats to OpenID
14





Malware
virus, Trojan horse, Spyware
Eavesdropping
password on the network
Man-in-the-middle
attacker captures the transmitted password, authentication
assertion, optionally alters it
Replay attacks
a valid authentication assertion is maliciously repeated
Phishing
acquire password by masquerading as an OP
4/13/2015
Smart OpenID: Concept
15


Authentication factor
 something the user knows: password
 something the user has: smart card
 something the user is: finger print
Using UICC as credential
 shares a long-term secret (LTS) with the server
 derives a key from the LTS and an one-time password
 PIN verification to activate the function
4/13/2015
Smart OpenID
16
Relying
RelyingParty
Parties
Association handle
+ derived key (symmetric)
Signed assertion
(with same derivated key)
User
Local authentication
(with PIN)
Local OP Provider =
Mobile Application
+ UICC Applet
Network OpenID Provider
Trust (long-term secret)
Smart OpenID
17



Long-term secret: 64 bytes
Association handle: less than 255 bytes
Key derivation functions: PBKDF2


use HMAC-SHA-1/HMAC-SHA-256 (hash-based message
authentication code) as underlying algorithm
configurable iteration count and derived key length
Security Analysis
18
Smart OpenID Authentication
Compromise
UC
User credential
compromise
PH1
Plaintext
Credential
phishing
PH2
DK Phishing
by mobile
application
CR
Derived key
phishing and
cryptanalysis
PH3
DK Phishing
by malicious
RP (Type 1)
MM
Man-in-themiddle attack
SN
Sniffing
PH4
DK Phishing
by malicious
RP (Type 2)
TH
Theft of
the UICC
PC
PIN
compromise
with Bruteforce attack
UK
Use of known
authentication
response
RP
Replay
attack
SW
Session
swapping
attack
Security Analysis : Phishing
19
Local OP = UICC App + Mobile App
UICC App
Mobile App
Browser
Malicious RP
Net OP
Auth Request (identifier)
Discovery and Association
Association (S, AH)
Derived Key S = PBKDF2-HMAC-SHA-1(LTS, AH, 64, 64)
Agenda
20






Motivation and Solution Idea
Basic Technologies
State of the Art
Smart OpenID
Implementation
Summary and Future Work
4/13/2015
Implementation
21

Platform
Android 2.3.5
Java Card UICC 2.2.1

Algorithms
key derivation function: PBKDF2-HMAC-SHA-1
signature: HMAC-SHA-1
4/13/2015
22
Demo
4/13/2015
Performance
23
Iteration : 64 rounds
AH: 240 bytes
Derived key length: 64 bytes
4/13/2015
Performance
24
Derived key length: 64 bytes
4/13/2015
Agenda
25






Motivation and Solution Idea
Basic Technologies
State of the Art
Smart OpenID
Implementation
Summary and Future Work
4/13/2015
Summary
26




UICC as secure element on smartphones
Dual Application Architecture with Open Mobile API
Improve existed protocols with the UICC
Other usages:




Digital certificate
Wireless PKI
NFC payment
…
4/13/2015
Future Work
27


Smart OpenID with HMAC-SHA-256
Implementation of other applications
4/13/2015
28
Thank you!
Questions?
4/13/2015
Bibliographie
29
[Sma09]
SmartTrust. The role of SIM OTA and the mobile operator in the NFC environment, 4 2009.
4/13/2015
Smartphone
30



Mobile phone
voice communication and messaging
Feature phone
digital camera, gaming, music and video streaming
Smartphone
modern operating system, high speed connectivity, thirdparty applications ...
4/13/2015
Access Control Module
31
4/13/2015
Security Analysis : Phishing
32
Local OP = UICC App + Mobile App
UICC App
Malicious App
Auth Request (assoc_handle)
Auth Response (signed assertion)
Mobile App
Browser
RP
NetOP
Security Analysis : Phishing
33
Local OP = UICC App + Mobile App
UICC App
Mobile App
Browser
Malicious RP
Auth Request (identifier)
Redirect to LocalOP (AH)
Auth Request (AH)
Auth Request (AH)
Auth Response (signed assertion)
Auth Request (sa)
Auth Request (sa)
Net OP