A smart card's integrated circuit chip provides both memory and computational capability. The entire smart card system is designed to be self contained which alleviates certain avenues of attack because it requires limited contact with potentially vulnerable or malicious external resources.
Smart cards go through distinct phases in their life cycle, from fabrication, to its active life, and finally to invalidation. The fabrication phase of a smart cards includes the creation and testing of the integrated circuit chip. The chip includes a "fabrication key" (KF) which protects the chip from fradulent modification until the next phase. When the chips reach card suppliers, they are mounted on a plastic card which often has a corporate logo or service mark on it. Here, the connections between the chip and printed circuit are made and the smart card can be unit tested. At this point, the KF is replaced by the KP, or "personalisation key" and a "personalisation lock" VPER is written to prevent modification to the KP. To further protect the integrity of the card, instructions which access physical memory are disabled, requiring logical memory addressing.
The next phase of a smart cards life begins when they reach card issuers. The issuers of the card personalize it so that the card now holds the card holder's identity, personal identification number (PIN) and other information. After the card is personalized, a "utilisation lock", or VUTIL, is written to indicate that the card is now active, and ready to be utilized by a card holder.
The final phase of a smart card's life--following that of utilisation--is invalidation. When an application writes an invalidation lock to an individual file or a master file (see Logical Structure), the card becomes invlaidated. All operations that would modify the card are disabled during this phase, although read instructions may remain active to allow for analysis of the card. A second method of entering this phase occurs when both the PIN and unblocking PIN are blocked--at this point, all operations are blocked including read instructions.
Physical structure of a smart card (Source: Philips DX smart card reference manual, 1995)
The International Standards Organization has specified the physical structure of smart cards in ISO standards 7810, 7816/1 and 7816/2. According to these standards, smart cards are made up of a plastic card measuring 85.60mm x 59.98mm x 0.80mm and contain an integrated circuit chip and printed circuit embedded on the card. The Specification for printed circuits used in smart cards is ISO 7816/3 and provides five connection points for power and data. Usually, these circuits contain a microprocessor, read only memory (ROM), nonstatic random access memory (RAM). Electrically erasable programmable read only memory (EEPROM) is also used to preserve state when power is removed.
Current circuit chips are made from silicon, similar to the microprocessors in personal computers. These chips are very inflexible and are easily broken, and are therefore limited in size to only a few millimeters. The physical interface which facilitates data exchange between this integrated circuit chip and a "card acceptor device" (CAD) is a bi-directional serial transmission line that operates at up to 9600 bits per second, and is also defined in ISO standard 7816/3.
Smart cars are designed to be minimalistic, and may require aditional resources--such as external power or an input/output method--to be useful. These requirements may result in security concerns which will be discussed in a later section.
Illustration of file structure, courtesy of http://home.hkstar.com/~alanchan/papers/smartCardSecurity/
Smart cards have a filesystem similar to most modern PC operating systems. There is a root file, or "Master File", which forms the base of a tree-hierarchy. The master file (MF) and dedicated files (DFs) contain the headers of all children nodes, both DFs and elementary files (EFs). Each file contains a header part and a body--an EF's body is the data which it holds. Different smart card operating systems handle files differently. Some may use fixed or variable length records, others simply use an offset and length to locate files.
There are multiple levels of access control for a smart card's file system, and vary between operating systems. Certain general levels include "Always" (ALW), "Card holder verifciation 1" (CHV1) and "Card holder verification 2" (CHV2), "Administrative" (ADM), and "Never" (NEV). "Always" and "Never" Allow access to the file without restrection and deny all access respectively. ADM leaves the allocation of access levels and their respective requirements for their fulfilment of an administrative authority. CHV1 allows access only when a valid CHV1 value is presented; likewise, CHV2 allows access only when a valid CHV2 value is presented. These two variables are tied to either of the two PINs which are usually stored as elementary files. To protect the variables CHV1 and CHV2 (the PIN and the unblockig PIN), each variable has associated with it a counter variable. Every time one of the variables is requested, its counter decrements by one. When the variable is entered correctly, its associated counter is reset to the highest allowed number of invalid attempts. If this counter ever reaches zero, the variable is no longer usable and all files requiring it are inaccessible. CHV1 can be "unblocked" with knowledge of CHV2, but if both variables are blocked, the card becomes invalidated. CHV2 and CHV1 are not hierarchile--e.g., if a user knows CHV2, they cannot use files requiring CHV1. In this way, a company could distribute a smart card and only allow access to the CHV1 to the end user, and allow only official representatives access to CHV2 (though this is by no means the only way, nor even the standard way, of dealing with these two variables).
Source:
http://home.hkstar.com/~alanchan/papers/smartCardSecurity/