Thales “medCompact” to certify to EAL3+ with ELinOS

Linux based card reader assures privacy for patient health data

embedded world – Nuremberg, February 26, 2008
Thales-e-Transactions announced today the availability of its “medCompact” card reader for the introduction of the electronic health insurance card (eGK) in Germany in July 2008. “medCompact” is based on the embedded Linux distribution ELinOS from SYSGO AG. The German legislator has put high demands on security to assure privacy and requires formal certification according to Common Criteria EAL 3+.

Thales-e-Transactions developed the “medCompact” card reader for the electronic health insurance card that will be introduced mid 2008 to the German market. The application is developed with SYSGO's ELinOS according to the requirements of Gematik, the organization responsible for introducing the health insurance card. At the heart of the device is an ARM9 based board from Atmel. ELinOS was enhanced with a Board Support Package and a bootloader for the Atmel board. To meet the security requirements, SYSGO provided additional features assuring privacy for patient data. Firstly, the Ethernet interface was protected by Open SSH to guarantee secure transmission of confidential information. To avoid tapping and misuse of data, ptrace and the serial interface were deactivated. Finally, a digital signature was added that detects modifi¬cations and averts corruption of data. This “qualified electronic signa¬ture” is valid only with formal acknowledgement according to SigG (Signaturgesetz) that has to be obtained from the responsible surveil¬lance agency (Bundesnetzagentur.). After completion, “medCompact” has to be certified formally according to Common Criteria EAL 3+. "For the development of our health insurance card terminal „medCompact“, we agreed on a standard operating system very quickly. With Windows Embedded CE, Common Criteria certification would have been difficult, because the source code is not freely available. Additionally, the development would have been much more complex. Hence, we decided to use Linux. With Linux we successfully developed a completely new, functional terminal within six months. This would have been unfeasible with a Microsoft operating system in such a short time. Collaboration with SYSGO was always pleasant and confidential. Even difficult problems, that you always have in complex projects under time pressure, were managed together in confidence.“ said Lothar Mawick, Leader Applications Thales e-Transactions.

About ELinOS
ELinOS is a Linux based development environment for the creation of intelligent devices. SYSGO brings 15+ years of field expertise to make an embedded Linux offering well suited for real industrial applications. The core of ELinOS is exten¬sively tested and qualified for a broad range of embedded platforms. Besides the widely-used x 86 versions, ELinOS also supports PowerPC-, ARM-, MIPS-, XScale, and SH-platforms.

About Thales
Thales is a leading international electronics and systems group, addressing defense, aerospace and security markets worldwide. Thales's leading-edge technology is supported by 22,000 R&D engineers who offer a capability unmatched in Europe to develop and deploy field-proven mission-critical information systems. To this end, the group's civil and military businesses develop in parallel and share a common base of technologies to serve a single objective: the security of people, property and nations. The group builds its growth on its unique multi-domestic strategy based on trusted partnerships with national customers and market players, while leveraging its global expertise to support local technology and industrial development. Thales employs 68,000 people in over 50 countries with revenues of more than EUR 12 billion in 2007.

Thales delivers user-friendly solutions that simplify and secure electronic card transactions. The company is a European leader in the field of secure electronic payment solutions, supplying fixed, portable and mobile payment terminals, as well as integrated EFT solutions, unattended payment devices and secured PIN pads for ATMs.