Multos Awarded Fifith ITSEC E6 High Security Rating

The fifth international MULTOS implementation has been awarded with the ITSEC E6 High classification, the worlds highest internationally-recognised security assurance level. The latest award, which was granted to Keycorp Limited of Sydney Australia for its MULTOS open multi-application smart card operating system implementation, further bolsters MULTOS? unique position as the only commercial product to be given this level of security and robustness. Keycorp implemented the operating system on the Infineon SLE 66 family of secure controller chips. After completing the classification within only 40% of the time taken for previous E6 approvals, the Certification Body, certified the project with an ITSEC E6 (High) assurance rating, the highest level offered by the scheme. The E6 rating removes the burden from card issuers of continuously assessing the sophistication of external threat and the level of security required to respond. No other commercial smart card has achieved this level of proof of correctness and assurance. Positioning The ITSEC security assurance scheme was a precursor to the EAL/Common Criteria scheme, defining much of the methodology used in that system. MULTOS continues to use the ITSEC criteria as it remains unique in achieving international agreement for interworking by all signatory countries for the higher assurance levels, which means an approval certificate awarded in one country is fully recognised in all others. Although ITSEC is primarily a software evaluation process, the level 5/6 certificates depend on, and are linked to a specific silicon chip and the devices ability to support the high security requirements of the software. As a result extensive penetration testing of the chip is undertaken to ensure that the physical and logical barriers it implements are sufficiently well implemented. The certificates are publicly available for inspection on the websites of the UK and Australian national certification bodies