International Business Machines Corporation

Ernst-Michael Hamann

Robert Sulzmann

Narayanan Vasudevan

Jutta Kreyss

Klemens Klaffke

Thomas Schaeck

Michael Kaisser

The invention relates to the generation of digital signatures by the use of which the legally binding nature of a digital signature is enhanced. For this, an expanded digital signature is created which, in addition to the hash, contains other information, in particular information identifying the hardware and software environment used in generating the signature.

Digital signature

The present invention allows program specific configuration of several physical or logical readers, or other I/O devices, by using a configuration tool and a reader access layer. In an example embodiment, a configuration tool allows, a specifying access rights and priority rights for each single reader in conjunction with each single program. A reader access layer communicates with each program directly, calls up the reader access list for the requesting program, checks the access rights and the priority order for the available readers and returns a response to the requesting program containing information for accessing the active reader with the highest available priority. It secures previously defined access rights and access priorities between readers and programs defined in the reader access list remain unchanged independently when new readers are added.

System and method for accessing readers and other I/O devices by programs

A method for creating, storing and reading a new certificate type for certification of keys is provided. In the new certificate type, several certificates, containing a minimum quantity of redundant data fields, are collated to form one certificate and all redundant information on the certificates is eliminated. An embodiment of the new certificate type is the group certificate. The group certificate is used where several keys are to be issued at the same time for the same user by the same certification instance. By means of the group certificate, all redundant data elements are eliminated and all data elements for a set of several keys subject to certification are grouped into one certificate. This substantially reduces the memory requirement, and handling of the certificates is simplified for the communication partners. A further embodiment of the new certificate type is the basic and supplementary certificate combination. This form of certification is used where certificates are issued at different times for the same user by the same certification body. The memory requirement is consequently somewhat more than for group certificates, but greater flexibility is gained in use of the keys.

Certification of multiple keys with new base and supplementary certificate types

Virtual smart cards (VSC) are generated by a VSC control program with each VSC addressable by a unique identifier (ID). Using the VSC control program, personalized VSC data is accessed via a secure channel using the ID and a password. A real smart card is personalized by a personalization program that reads data from the VSC. Personalization data contained in the VSC may be tested in an application environment before a personalized real smart card is available.

System and method for personalization of smart cards

The present invention describes an improved communication architecture for smart card systems and an improved procedure for communication of the smart card applications using protected data carriers, particularly in the case where smart cards or smart card readers cannot be used. The improved communication architecture has a common virtual smart card interface between the respective smart card applications and the modules which facilitate access to the protected data carriers (smart cards). The modules allow access to either physical smart cards, virtual software smart cards or hardware smart cards. The common virtual smart card interface means that the application is completely independent of the respective module or the respective data carrier. Alternatively, the improved communication architecture additionally contains a virtual smart card adapter which communicates over the common virtual smart card interface with the respective smart card application. The different modules are attached to the smart card adapters and selected statically or dynamically by the smart card application. Virtual software smart cards which functionally imitate true physical smart cards can be linked over the virtual smart card adapter to communicate with a smart card application. This procedure is then particularly suited for when the smart card is lost or defective, the smart card reader cannot function, or for testing new smart card technologies.

System for accessing virtual smart cards for smart card application and data carrier

The invention refers to a procedure for storing data objects,in the memory,of a smart card,To do this, general and application-specific data objects are defined using freely selectable security characteristics and access rights, which are filed in the memory of a smart card which is divided into several application-specific memory areas,so that data objects with identical access conditions are located in one and the same memory area, irrespective of the application program,or smart card user,to which these data objects are allocated. All application programs and the smart card user can access the data objects irrespective of the corresponding access conditions. In this way, the re-issuing of smart cards in the case of later expansion of the file structure of the smart card for an application or the addition of extra applications is not necessary. The smart card user can allow any applications to store data on his smart card.

Growing community of inventors

Boeblingen, Germany

Ernst-Michael Hamann