Motorola Develops Internet Security Application for Industry’s First 32-bit Java/Visa Open Platform Card

SCHAUMBURG, Ill. (April 24, 2000) – Motorola (NYSE:MOT) announced today that it has begun shipping an Internet security application that works with its industry-leading 32-bit M-Smart Jupiter™ multi-application smart card platform based on Java Card™ 2.1 technology and Visa Open Platform 2.0 standards.

FLEXgate directly addresses the Internet community’s growing demand for increased network security and identity verification because it uses a smart card. Current Internet security and identities use keys and cryptographic techniques, but these keys are stored in the computer. The problem is data that is located inside the computer is becoming increasingly hard to protect. Leaving software keys in your computer is like leaving keys in your car – anyone who wants to can drive it. This is especially a problem in office environments. Motorola’s FLEXgate gets the “keys” and identities out of the computers and onto a smart card. This is more secure because the “keys” reside in the user’s card, and smart cards are designed specifically to protect the secrets inside them.

“This marks the first time users can get a true standards-based multi-application platform with everything they need for Internet security along with the capability to dynamically and securely add applications to the card going forward,” said Francois Dutray, Motorola’s vice president and general manager, Worldwide Smartcard Solutions Division. “This brings Internet security, a cornerstone application, to our high-performance 32-bit RISC Jupiter platform with Java Card™ 2.1 technology and Visa Open Platform 2.0. FLEXgate will appeal to anyone designing intranet, extranet, or user community security solutions.”

There are many uses for an Internet Security application. Increasingly, web site owners are expressing the need to control anyone who has access to their web site as well as the ability to identify and authenticate users of their Web site. As messages are transmitted across the Internet, users want to ensure that, in the event a message is intercepted, it can only be opened and read by the intended recipient. To do this, messages are encrypted at the sending end and decrypted at the receiving end using a key. One way of securing electronic communications and private information is with Motorola’s FLEXgate solution.

The name FLEXgate was chosen because the solution is flexible and because it provides a secure gate to the Internet. By using a smart card as a portable Security Token for user authentication instead of information stored on a hard drive, a user can take his smart card anywhere and still have the same secure access to the Internet. In order to perform a secure operation, the smart card requires that the user enter a PIN. This two-factor authentication provides an additional layer of security by combining a physical object controlled by the user (his smart card) with something only the user knows (his PIN).

Also inherent on the smart card is the ability to perform public or private key encryption. This removes all knowledge of key encryption from the browser, Middleware, hardware, or even the user and places it on a secure medium.

The high-performance Jupiter smart card adds to the security because it is the first card to provide a Secure Memory Management Unit (SMU) for hardware-based security separating multiple applications on a card.

FLEXgate is a complete PC software and smart card solution that works in conjunction with the user’s web browser to enhance security over the Internet. The FLEXgate solution to Internet Security has two major advantages. First, it is built using open standards, which allows FLEXgate to be a more open and portable architecture. Second, the underlying smart card used to store the digital certificates and private keys is a multi-application Java Card. This means that the smart card can be used for additional applications.

FLEXgate Features/Specifications The FLEXgate product, designed for use with Netscape Communicator™, combines PC resident software with a Java Card application that manages X.509v3 digital certificates and associated private keys in order to enhance the security of data transfers over internets and intranets. The FLEXgate product is intended for an end user who wishes to log into secure websites, sign, or decrypt email messages. It is made up of three main components: the PC resident software portion, or Middleware; a smart card reader; and an M-Smart Jupiter smart card containing the FLEXkey application.

The FLEXkey application is a Java applet located on the Jupiter smart card. FLEXkey complies with RSA’s PKCS #15 standard. PKCS #15 (version 1.0) is an RSA standard which defines a ‘card-edge’ API for storing digital credentials on a smart card.

These digital credentials, as used by the FLEXgate solution, include keys and X.509 certificates. FLEXgate is the first Java Card based Internet Security solution on the market to support PKCS #15. This is a major advantage since it standardizes the syntax used for storing digital credentials on smart cards and how the information is accessed. This ensures that the Security Token portion of the FLEXgate product is generic and portable – always a desirable feature. Likewise, by following the RSA PKCS #11 Cryptoki standard the FLEXgate Middleware provides a standardized API for applications to use.

The main features of the FLEXgate product are the ability to:

• Access secure Web sites using the SSL 3.0 Client Authentication protocol,
• Sign and decrypt email messages using the S/MIME protocol, 
• Store certificate/private key pairs on the Security Token.

The Middleware portion of the product is in the form of a Dynamic Link Library (DLL) that is used to provide PKCS#11 services to applications such as a web browser. The FLEXgate middleware uses a standard PC/SC driver as supplied by many smart card reader manufacturers to communicate to the smart card.

Instead of using proprietary commands Motorola’s offering uses ISO 7816 Part 4 and Part 8 commands for communicating between the Middleware and the Security Token. Motorola’s use of standards including ISO 7816 1,2, 3, 4, and 8, PKCS #11 and #15, and X.509, makes the FLEXgate solution a more open and portable architecture.

The FLEXgate kit includes one Jupiter MJ1000C smart card containing the FLEXgate applet, a CD-ROM containing the FLEXgate installer and Motorola software, and an HTML format user installation guide. The software runs on Windows NT® version 4.0 Service Pack 4 or higher and requires Netscape Communicator (version 4.5, 4.6 or 4.7).

About Motorola Inc. Motorola, Inc., with sales of $33.1 billion in 1999, is a global leader in providing embedded electronic and integrated communications solutions. Motorola’s Worldwide Smartcard Solutions Division (WSSD) provides complete multi-application smart card system solutions including smart cards, application development, and systems integration and operations management. The company’s platforms allow organizations to quickly deploy and build value-added smart card applications in areas such as transit, access control, campus, government, and healthcare.

FLEXgate and M-Smart Jupiter are marks of Motorola, Inc. Java and Java Card are both marks of Sun Microsystems, Inc. in the United States and in all other countries. Netscape Communicator is a registered mark of Netscape.