* Question

What is the test principle of COS functional test?

* Answer

The test principle of a COS (Chip Operating System) functional test revolves around verifying that the smart card or secure chip’s embedded operating system (COS) performs correctly according to its functional specifications. This involves testing how the COS handles command execution, file management, security mechanisms, and data integrity through standardized communication protocols (usually APDU commands).

What is COS?

COS (Chip Operating System) is the firmware that runs on smart cards, SIM cards, secure elements (SE), and other embedded security chips. It manages:

File systems (EF, DF, MF)

Cryptographic operations

User authentication

Communication protocols (ISO 7816, GlobalPlatform)

Test Principle of COS Functional Testing

1. Command-Response Validation (APDU Testing)

Principle: Send specific Application Protocol Data Units (APDUs) to the card and verify the correctness of responses.

APDU Command: The host sends a request (e.g., SELECT FILE, READ BINARY).

APDU Response: The card replies with data and a status word (e.g., 9000 = success).

Test checks whether:

The command is correctly processed.

The response content and status code are valid.

2. File System Operation Testing

Principle: Verify that COS properly manages its internal file system.

Tests include:

File selection (MF, DF, EF)

File creation, deletion

Reading and writing to files

Access condition enforcement (read/write protections)

3. Security Mechanism Verification

Principle: Ensure the COS enforces security rules like:

PIN/PUK authentication

Key-based authentication

Secure messaging (MAC/encryption)

Access rights and role-based controls

Also involves:

Testing failed login attempts

PIN retry counters

Session timeout behavior

4. Crypto Functionality Test

Principle: If the COS includes cryptographic features (e.g., AES, DES, RSA), functional tests validate:

Key generation

Digital signature and verification

Encryption and decryption

Hashing operations

Outputs are compared against known-good cryptographic values.

5. Protocol Compliance and Error Handling

Principle: Test whether the COS:

Adheres to standards (ISO 7816, GlobalPlatform, ISO/IEC 14443, etc.)

Responds correctly to invalid or malformed APDUs

Handles protocol-level exceptions gracefully

Summary Table

Tools Commonly Used

Card reader with ISO 7816 interface

APDU script engines (e.g., GlobalPlatformPro, JCIDE)

COS Test Suites developed per project specifications

Simulators or emulators for pre-silicon testing