A safe update mechanism for smart cards

Abstract

With the advent of the integration of smart card chips into national identity documents, the business model of replacing compromised smart cards becomes uneconomical. We propose a mechanism to safely apply updates to embedded systems, particularly high value smart cards, that are costly to replace. We identify the requirements for such a mechanism and describe how it can be implemented. Our mechanism achieves its properties at the expense of using moderately more nonvolatile memory to store program code than contemporary smart cards. We have developed a Common Criteria protection profile package to abstractly describe such a mechanism and summarize it in this paper. The mechanism and the abstract description can be a starting point for a practical realization in consumer products.