Method and apparatus for information carrier authentication

Method of authenticating an information carrier, the information carrier comprising an at least formerly writeable part comprising stored information, and a physical token arranged to supply a response upon receiving a challenge, the method comprising the following steps:

• applying a first challenge to the physical token resulting in a first response, and
• detecting the first response of the physical token resulting in a detected first response data,
• the method being characterized in that it further comprises the following steps:
• forming a first authentication data based on information derived from the detected first response data,
• reading a signed authentication data from the at least formerly writeable part of the information carrier,
• deriving a second authentication data from the signed authentication data, and
• authenticating the information carrier by verifying that the first authentication data matches the second authentication data.

An apparatus for authenticating an information carrier, the information carrier comprising an at least formerly writeable part comprising stored information, and a physical token arranged to supply a response upon receiving a challenge, the apparatus comprising:

• a challenge means arranged to apply a first challenge to the physical token resulting in a first response, and
• a detection means arranged to detect the first response of the physical token resulting in a detected first response data,
• the apparatus being characterized in that it further comprises:
• an authentication data generation means arranged to form a first authentication data based on information derived from the detected first response data,
• a reading means arranged to read a signed authentication data from the at least formerly writeable part of the information carrier,
• a derivation means arranged to derive a second authentication data from the signed authentication data, and
• an authentication means arranged to verify that the first authentication data matches the second authentication data.