Secure access module



A Secure Access Module (SAM), also known as a Secure Application Module, is a piece of cryptographic hardware typically used by smart card card readers to perform mutual key authentication. SAMs can be used to manage access in a variety of contexts, such as public transport fare collection and point of sale devices.

Formats

 * Removable SAM: This form factor resembles a standard Subscriber Identification Module (SIM) card. It plugs into a dedicated SAM slot within the smart card reader.


 * Embedded SAM: This form factor integrates the SAM functionality directly onto the printed circuit board (PCB) of the reader system. The SAM component is typically housed within a secure enclosure soldered onto the PCB.

Components
A typical smart card reader system generally consists of the following key components:


 * Microcontroller (MCU): This acts as the central processing unit (CPU) of the reader system. It manages various tasks such as protocol handling, data flow control, and data interpretation.
 * Reader Integrated Circuit (Reader IC): This specialized chip facilitates communication between the SAM and the contactless smart card using radio frequency (RF) interface protocols.

Integration and functionality
By integrating a SAM into the reader system, the security functionalities are centralized and offloaded from the MCU. The SAM assumes responsibility for:


 * Key Management: Secure storage and management of cryptographic keys, including master keys and application keys derived from them.
 * Cryptography: Performing various cryptographic operations such as encryption, decryption, and digital signing to ensure data confidentiality and integrity.
 * Mutual Authentication: Facilitating a two-way authentication process between the smart card and the reader system to verify the legitimacy of both parties before allowing any communication to proceed.


 * Secure Messaging: Enabling secure communication between the SAM and the host system by encrypting and authenticating data packets.

SAMs can be deployed in any of the following applications:


 * Generate application keys based on master keys
 * Store and secure master keys
 * Perform cryptographic functions with smart cards
 * Use as a secure encryption device
 * Perform mutual authentication
 * Generate session keys
 * Perform secure messaging