I'm currently working on SLE4442 smart card. I'm trying to make a payment system. but the card has to be "copy-protected" what I mean here is that if that data on the card is copied as it's, this data is no more valid and it's only valid for this card.
my knowledge of cryptography is basic, I read about digital signature but it seems it doesn't prevent copying.
also for using 'PIN', my design allows users to have their cards PINs.
also if any book I can read about this, I'm open to suggestions.
SLE4442 is not the same as a SIM and doesn't have any crypto capabilities, so you can't get the card to sign a challenge. All you can use is its security code system, where you get 3 tries to enter a code or get locked out of the card.
Laundry systems use this kind of thing, no pin all data stored on the card, many not even encrypted :) I'll assume you aren't using this as a debit card kind of thing where you could phone home for a pin or extended verification.
Looking at the datasheet the only thing unique about the card could be the application identifier, and maybe the extended identification bytes that the factory pre-programs before shipping you the cards.
Due to security purposes every chip is irreversibly coded by a scheme. By this way fraud and misuse is excluded. The relevant data are programmed in the memory area from address 0 to 31. Afterwards the associated protection bits are programmed. As an example, figures 12 and 13 show ATR and Directory Data of Structure 1. When delivered, ATR header, ICM and ICT are programmed. Siemens programs also the AID. The AID (Application IDentifier) consists of 5 byte RID (Registered application provider IDentifier) administered by a national registration authority and of up to 11 byte PIX (Proprietary application Identifier eXtension). There are two possibilities: the customers AID or Siemens AID (only for sample quantities). Depending on the agreement between the customer and Siemens ICCF can be also programmed before delivery.
Perhaps you could use that ID along with an encryption scheme incorporating it to at least make it difficult to just read and write the data to a new card. Or even lazier you could assume that no one can buy blank cards with your ID on them to copy too.
Looking at it further though these seem pretty easy to emulate, I'm sure I could make a micro-controller that would behave exactly like this "smart" card and adjust those factory programmable values at will.
