CIPURSE Certification Program

Transcription

1 Conformance Type Approval Process v1.0

2 Legal This document is copyright 2012 by the OSPT Alliance. 1. You may, without charge, copy (for internal purposes only) and share this document with your members, employees, and consultants (as appropriate). You may not modify or create derivative works of this document for external distribution. 2. The information given in this document shall in no event be regarded as a guarantee of conditions or characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any information regarding the application of the device, OSPT Alliance hereby disclaims any and all warranties and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual property rights of any third party. 3. CIPURSE, OSPT and the OSPT logo are registered trademarks of the OSPT Alliance in Germany and other territories. OSPT Alliance Prinzregenten str. 159 D Munich Germany Revision History Version Date Major changes since previous revision Nov Initial draft Mar First Public release 2

3 Table of Contents Legal... 2 Revision History Introduction Purpose Audience Terminology Process Description Overview of Conformance Testing Conformance Type Approval Process Definition of a CIPURSE-Certified product Prerequisite for Testing Conformance Type Approval Process Part A: Registration and configuration assessment Part B: Conformance Test Session Conformance Test Session overview Location Part C: CIPURSE Conformance Type Approval Part D: Deployment Vendor Support Appendix Product Registration Form PICC Implementation Conformance Statement CIPURSE Certified logo

4 1 Introduction 1.1 Purpose This document describes the process defined by the OSPT Alliance to control a product that is in compliance with the CIPURSE specifications. It defines the set of requirements and certification rules applicable to obtaining certification and maintaining a product as a certified CIPURSE product. It covers the following topics: Prerequisites Organization Confidentiality Registration forms Implementation Conformance Statement It also describes the relationship between the different participants (test house / certification authority / CIPURSE product vendor) during the certification process. 1.2 Audience This document is intended for: - OSPT Alliance members who want to obtain a CIPURSE Conformance Type Approval - Laboratories that are selected by the OSPT Alliance to perform conformance testing. 1.3 Terminology DUT IC ICS JCRE LOA NDA PICC PRF Device Under test Integrated Circuit Implementation Conformance Statement JavaCard Run-time Environment Letter Of Approval Non-Disclosure Agreement Proximity Integrated Circuit Card Product Registration Form 4

5 2 Process Description 2.1 Overview of Conformance Testing The Conformance Type Approval of a CIPURSE implementation is part of the global Certification Program managed by the OSPT Alliance. The purpose of conformance testing is to determine that the vendor implementation conforms to the individual requirements of the CIPURSE specifications. This compliance is evaluated according to the test plan defined by the OSPT Alliance, 1 CIPURSE Certification Program Conformance Test Plan. The Conformance Type Approval is currently applicable to an ISO/IEC contactless PICC product or any device supporting an ISO/IEC contactless interface (such as a key fob, a tag or an NFC card emulation terminal). Both RF interfaces, Type A and Type B, are supported. The next versions of the certification program may extend this scope to further activities such as digital testing, security evaluation or interoperability checking. As an example, interoperability checking will test whether end-to-end functionality between two devices is as required by the OSPT Standard. 2.2 Conformance Type Approval Process A Conformance Type Approval is processed in four parts, each managed by a separate entity. Figure 1: CIPURSE Conformance Type Approval process overview - Part A is managed by the Vendor. After contacting the Laboratory for product registration, the Vendor is responsible for preparing its product and documentation. See details in section Part B is managed by the Laboratory, which is responsible for conducting the test plan, according to its ISO/IEC accreditation. In the end, the laboratory prepares an official report. See details in section Part C is managed by the Laboratory and the OSPT Alliance. Based on the Laboratory report, the OSPT Alliance reviews the report and grants the final certificate by issuing a Letter of Approval. See details in section The OSPT Alliance reserves the right to update the Conformance Test Plan. 5

6 - Part D is managed by the Vendor who deploys, maintains and guarantees a product that is in conformance with the certified product. See details in section Definition of a CIPURSE-Certified product A product can be called CIPURSE Certified if two requirements are met: A Conformance Type Approval based on the Conformance Test Plan is obtained A Letter of Approval is received from the OSPT Alliance The following types of devices are eligible for Conformance Type Approval: CIPURSE components (as illustrated in Figure 2): a packaged device, embedded IC, applet CIPURSE end-user product: PICC contactless card, handset A CIPURSE-Certified product can be based on the following CIPURSE compliant components. End-user Contactless Device Packaged Device Embedded IC Contactless card (PICC) Tag, Key Fob NFC handset... Inlay with or w/o Antenna Module NFC SIM, MicroSD... Hardware chip with pre-loaded CIPURSE Application Secure Element... Applet JavaCard CIPURSE Application Native Operating System with CIPURSE Application... Figure 2: CIPURSE-Certified devices 6

7 2.4 Prerequisite for Testing Before initiating Conformance Type Approval, the Vendor must fulfill the following prerequisites: Be registered as an OSPT Alliance Full Member. Details are available in the Members section of the OSPT Alliance web site. Ensure that the Device Under Test (DUT) is compatible with the ISO/IEC Standard Part 2:2010, Part 3:2011 and Part 4:

8 3 Conformance Type Approval Process The following flowchart illustrates the interactions between the vendor, the laboratory and the OSPT Alliance that are required to complete the Conformance Type Approval process: Figure 3: CIPURSE Conformance Type Approval process 8

9 3.1 Part A: Registration and configuration assessment The Vendor product registration is the entry point to certification for a Conformance Type Approval. The Vendor must complete the Product Registration Form described in Appendix 5.1. The Laboratory analyzes the document and provides the Vendor with a Product Registration Number (PRN), which uniquely identifies the certification session for the Vendor s CIPURSE product. In parallel, the Vendor needs to prepare the following items required by the Laboratory during certification: - 5 PICC card samples, 2 pre-configured as defined in the Conformance Test Plan applicable to this product - The Implementation Conformance Statement (ICS), which identifies the functionality to be evaluated and the tests that must be performed by the Laboratory (see ICS template in Appendix 5.2) - An optional non-disclosure agreement (NDA). The Laboratory also offers the Vendor several types of support materials to prepare a successful CIPURSE certification, detailed in section Part B: Conformance Test Session Conformance Test Session overview The CIPURSE Conformance Test Session is done as a single shot, which means that the samples are clearly identified and the tests performed only once. The Vendor does not participate in the test session. The session proceeds as follows: 1. To configure the Test Suite, the Laboratory analyzes the PICC Implementation Conformance Statement. 2. The Laboratory executes the test session in accordance with its ISO/IEC management system. 3. At the end of testing, the Laboratory prepares the test reports for the Vendor and for the OSPT Alliance. 2 In the case of a packaged CIPURSE device or Embedded CIPURSE IC, as defined in Figure 2, the DUT may be an evaluation board with a CIPURSE product. 9

10 3.2.2 Location For 2012, the OSPT Alliance has selected KEOLABS as the first official CIPURSE Laboratory. KEOLABS Impasse Grégoire XI Rue Eugène PIRON Salon de Provence FRANCE Phone: +33 (0) Commercial Contact name : Mr. Fabien POLLET cipurse_certification@keolabs.com 3.3 Part C: CIPURSE Conformance Type Approval After performing the Conformance Test, the Laboratory notifies the Vendor of a positive or negative result with the appropriate Conformance Test Report. The Vendor then decides on one of the following options and informs the Laboratory: i) Submission to the OSPT Alliance of the Conformance Test Report with the PICC Implementation Conformance Test. ii) Restarting the Certification with appropriate corrections. This is managed by the Laboratory and the Vendor with (at least) a new Product Registration Number for new DUTs and a new ICS document. iii) Cancellation of product certification. In this case, the Laboratory does not provide the Conformance Test Report to the OSPT Alliance. The OSPT Alliance reviews the documents and issues the Letter of Approval to the Vendor. 3.4 Part D: Deployment After issuing the Letter of Approval to the Vendor, the OSPT Alliance publishes the newly approved product or component on its web site at The Laboratory receives a copy of the Letter of Approval and archives the DUTs. The Vendor may apply the CIPURSE certified logo to its products during commercial deployment. The Vendor shall use the referenced CIPURSE certified logo as defined in Appendix 5.3. This logo is applicable to all CIPURSE products or components that are built exactly the same way as the DUT. 10

11 4 Vendor Support The OSPT Alliance and its representative Laboratory propose two alternative procedures to help vendors prepare for a successful Conformance Test Session, at a fixed price negotiated by the OSPT Alliance. A. CIPURSE Conformance Debugging Session Debugging sessions execute part or all of the Conformance Test Plan or any specific tests defined by the Laboratory and the Vendor. B. CIPURSE Conformance Test Tool The CIPURSE Conformance Test Tool is a PC software application based on SCRIPTIS Framework (details on the KEOLABS web site). The OSPT Alliance has defined (with the Laboratory) two types of software tools to facilitate CIPURSE validation for the Vendor. 1) Software License for the CIPURSE Conformance Test Tool, Express edition With the Express edition, the Vendor can run the CIPURSE Conformance Test with a standard PC/SC smartcard reader and obtain final reports. This edition contains all of the Test Cases described in the CIPURSE Conformance Test Plan (functional part and anti-tearing part). Without an optional hardware extension, it is not possible to run the anti-tearing part of the Test Suite due to the hardware limitations of the standard PC/SC reader. 2) Software License for the CIPURSE Conformance Test Tool, Developer Edition With the Developer edition, the Vendor can debug and run the complete CIPURSE Conformance Test, build additional test scripts with the SCRIPTIS Framework (i.e. editing Test Campaign, creating and debugging Test Cases) and obtain final reports. This edition contains all of the Test Cases described in the CIPURSE Conformance Test Plan (functional part and anti-tearing part). Without an optional hardware extension, it is not possible to run the anti-tearing part of the Test Suite due to the hardware limitations of the standard PC/SC reader. As an option for each software license, the X-Core reader from SmartWare allows the anti-tearing part to be performed with an appropriate hardware. The OSPT Alliance has also negotiated a free maintenance period for these licenses while minor revisions of the CIPURSE specification and/or the CIPURSE Test Plan are being completed. 11

12 5 Appendix In the forms below, information in fields marked with an asterisk (*) will be used on the public OSPT Alliance web site and the certificate. 5.1 Product Registration Form Product Registration Number (to be assigned by the Laboratory based on the OSPT Member ID) Vendor Description Vendor Name * OSPT Member Date Product Description Commercial Product Name * Product Version * Type of CIPURSE product/component * (as shown in Figure 2: CIPURSE-Certified devices) Does this product contain any non- CIPURSE applications? If yes, provide a description of each application e.g., Applet with its Package AID, Chip, Module, Inlay, Card Component Inheritance Is this product based on a previously CIPURSE-certified component? * If yes, what is its Product Registration Number? * If yes, provide a brief description of the inheritance 12

13 5.2 PICC Implementation Conformance Statement ICS Reference Number (To be assigned by the Laboratory) Vendor Information Vendor Name Technical Contact Name Address Phone Fax Mail Product Information Product Registration Number Commercial Product Name Product Version PICC Sample General Information RF Protocol Type (A or B) Hardware revision Software revision For JavaCard implementation, referenced JCRE platform Sample identification Associated PICC Sample Identification Serial Numbers for each sample (byte 8-23 of EF.ID_INFO) # 1: # 2: # 3: # 4: # 5: PICC Additional Information Device supports the commands READ_FILE_ATTRIBUTES and UPDATE_FILE_ATTRIBUTES? Device supports the commands UPDATE_KEY and UPDATE_KEY_ATTRIBUTES? Device supports the commands ACTIVATE_FILE and DEACTIVATE_FILE? Device supports selection of ADFs using the File Identifier? Invalid CLA byte range value not supported by the Device 13

14 5.3 CIPURSE Certified logo Figure 4: CIPURSE Color version Figure 5: CIPURSE Black & white version 14