First European Security Certificate for Pay-TV Cards MANUFACTURING

February 11, 1997 -- The first smartcard to gain an ITSEC certification for pay-TV applications was announced today by SGS-THOMSON Microelectronics and BULL. Developed for France Telecom, the card uses the PC2.3 version 2 operating system masked onto an SGS-THOMSON ST16SF48A high security chip and repeats the success that the two companies enjoyed recently when they participated in the world's first ever ITSEC security certification for a smartcard application. In both cases, the security certification was to ITSEC level E3 with Strength of Mechanisms "High", which means that the cards have been officially recognised as meeting the most demanding security targets normally required in commercial applications.

ITSEC (Information Technology Security Evaluation Criteria) is Europe's formal method of evaluating security in IT applications and it is applicable to components and systems of all sizes, from smartcard ICs to full-scale networks. To ensure consistent, objective results, ITSEC evaluations are performed by independent, accredited organizations that are governed by national agencies to ensure conformity with internationally agreed standards. The certification for the pay-TV smartcard was issued by SCSSI, the French national certification authority.

"Because it confirms that formal security evaluation is both feasible and appropriate for smartcard applications, this is an important achievement, not only for SGS-THOMSON and BULL but for the whole smartcard industry" said Michel Ugon, vice president of BULL Smart Cards, who added that the ITSEC certification allows BULL to offer pay-TV operators an access card backed by the best guarantee available today of security against pirating and other forms of fraud.

"BULL and SGS-THOMSON have now participated in two pioneering ITSEC evaluations covering two different smartcard applications and it is clear that ITSEC provides a highly effective framework for assessing the security of systems that use smartcard technology", noted Maurizio Felici, General Manager of SGS-THOMSON's smartcard division.

The first ITSEC certification for a smartcard application was granted in mid-1996 for a French bank card application. The chip used in the card was an SGS-THOMSON ST16601 containing ROM code developed by BULL CP8 TRANSAC and Philips Cartes et Systèmes. This was a milestone event because it confirmed that the very demanding security target could be achieved in a commercial application and the ITSEC methodology could be successfully applied to smartcard applications.

"We have learned some key lessons from these ITSEC evaluations, such as the importance of considering the overall system rather than the separate hardware and software components and the need to begin the security evaluation process as early as possible in the product development cycle", said Michel Ugon. In fact, potential vulnerabilities in the interface between the smartcard chip and the first layers of the operating system (the so-called "security kernel") were identified at an early stage of the security analysis phase, allowing the partners to develop special hardware and firmware features to reinforce the effectiveness of the securitymechanisms and meet the demanding security specification.

Following the initial certification, BULL and SGS-THOMSON have also set up a certification maintenance process with the SCSSI and an accredited evaluator. This is designed to facilitate the continuity of certification as new technologies or development environments are introduced. "Formal security evaluation schemes such as ITSEC are undeniably the way ahead for the smartcard industry. The certification maintenance scheme will make it simpler to evaluate derivative products, with or without a generic operating system, allowing lower costs to be achieved without compromising security", said Felici.

BULL is one of the world's top three manufacturers of electronic payment terminals (no. 1 in Europe) and a world leader in smartcard technology, with more than 1000 smartcard patents worldwide. Its electronic purse card is used by millions of consumers in many countries, while more than 60% of smartcards in the world use the company's CP8 operating system.

SGS-THOMSON Microelectronics is the world's leading supplier of integrated circuits designed to be embedded in cards and its cumulative shipments in this market exceed one billion units. Its smartcard products range from small protected memories for use in telephone prepayment cards to the most sophisticated devices with on-board cryptoprocessors.

For further information, please contact:

Martin Forrest, BULL UK Press Office.
Tel +44 181 479 2228
Dominique Mercier Chevalier, BULL Smart Cards Press Office
Tel + 33 1 39 66 4520

For more information about SGS-THOMSON, please contact :

Simon Loe
SGS-THOMSON Microelectronics
Tel.+33 4 50402558
"FRAM" is a registered trademark of Ramtron International Corporation.

Top