forked from public/pysim
d9eef6fce7
Problem: When UICC/eUICC cards are deployed into the field it is often difficult to perform modifications to those cards. One important factor that makes after-deployment modifications often difficult is that the key material needed to perform the task must not be handed to the card holder due to security requirements. The presented Remote Card Procedure Framework solves this problem. It provides a so called Remote Card Procedure Client (RCPC), which is a lightwight software client which can be run by the card holder on the remote machine. With the RCPC, the card holder can access a so called Remote Card Procedure Server (RCPC), to which so called Remote Card Procedure Modules (RCPM) can subscribe and publish their functionality. With the RCPC, the card holder can browse the functionality offered by those connected modules and eventually the card holder may execute a certain procedure by passing a command to the RCPS. When a procedure is carried out, the RCPS automatically retrieves the required key material from a database or CSV file and passes those keys on to the selected RCPM. The RCPM can then use the key material to establish a secure channel to carry out the procedure. The procedure is then protected by a secure channel and the key material is never disclosed towards the card holder on the remote end. The framework is desinged in such a way that existing pySim APIs and functions can be used from the RCPM API user code. Also only minimal boilerplate code is required. The implementation also ships with a comprehensive example. Related: SYS#6959
41 lines
1.5 KiB
INI
41 lines
1.5 KiB
INI
# PYSIM_DIR passed to all components
|
|
PYSIM_DIR=../../../ # Points to the psyim top directory
|
|
|
|
# Verbosity switch passed to all components (comment-out to disable verbode mode)
|
|
#VERBOSE="--verbose"
|
|
|
|
# CSV column key to decrypt KIC, KID and KIK in csv_data.csv.encr
|
|
# (use encrypt_card_data.sh to regenerate csv_data.csv.encr from csv_data.csv)
|
|
CSV_COLUMN_KEY="00112233445566778899AABBCCDDEEFF"
|
|
|
|
# PCSC reader that the RCP Client shall use
|
|
PCSC_READER=0
|
|
|
|
# Since RCP Modules are custom implementations, they will most likely reside
|
|
# in a dedicated directory. This directory is passed together with PYSIM_DIR
|
|
# via PYTHONPATH to the module.
|
|
RCP_DIR=../
|
|
|
|
# CA of the certificates used in this example
|
|
CA_CERT="./certs/example_ssl_rcp_ca_cert.crt"
|
|
|
|
# Network interface where RCP Clients connect
|
|
RCPC_SERVER_PORT=8000
|
|
RCPC_SERVER_ADDR="127.0.0.1"
|
|
RCPC_SERVER_CERT="./certs/example_ssl_rcpc_rcps_cert.pem"
|
|
RCPC_SERVER_URI="wss://$RCPC_SERVER_ADDR:$RCPC_SERVER_PORT"
|
|
|
|
# Network interface where RCP Modules connect
|
|
RCPM_SERVER_PORT=8010
|
|
RCPM_SERVER_ADDR="127.0.0.1"
|
|
RCPM_SERVER_CERT="./certs/example_ssl_rcpm_rcps_cert.pem"
|
|
RCPM_SERVER_URI="wss://$RCPM_SERVER_ADDR:$RCPM_SERVER_PORT"
|
|
|
|
# Network interface where the (example) RCP Module binds its Command Server to.
|
|
# The command server is used by the RCP Server to run the command requested
|
|
# by the user. Each module needs a dedicated port. The address and port is
|
|
# automatically forwarded to the RCP Server.
|
|
RCPM_CMD_SERVER_PORT=8020
|
|
RCPM_CMD_SERVER_ADDR="127.0.0.1"
|
|
RCPM_CMD_SERVER_CERT="./certs/example_ssl_rcps_rcpm_cert.pem"
|