Smartcards with Webservice Interface 22. SIT-SmartCard Workshop 8./9. February 2012 Jan Eichholz
Agenda Benefits of a Webservice Interface for Smartcards The Service Access Layer out of ISO/IEC 24727 The Architecture of the G&D Webservice Smartcard Demo Conclusion
The BioP@ss Project The German part of the project is funded by the German Federal Ministry of Education and Research Project start: June 2008, February 2009 in Germany Project end: January 2011 National Partners: IFX, NXP European Partners: Gemalto (Project Lead), STM, OKSystem, Precise Biometrics, Compuworx, id3, CEA, NXP-F
IT- Infrastructure Vision einer Internet Smart Card Status Quo Networking TCP/IP, USB, HTTP, Bluetooth Operating System Windows, Linux, Palm Devices PCs, PDAs, Phones Applications Internet Smart Card Model Networking TCP/IP, USB, HTTP,.NET, Bluetooth Smart Card Devices PCs, PDAs, Phones Middleware Smart Card T=1 Proprietary JavaCard STARCOS Reader Telco, Payment Corporate ID Operating System Applications Windows, Linux, Palm Source: Dr. Walter Hinz, 2007 17. SIT-SmartCard Workshop Darmstadt, 07. Februar 2007 #4
Smartcards with APDU Interface Authentication Identification Data Access Application Interface Application Interface 7816-15 APDU APDU 7816-15 APDU APDU Generation Öffentliche Ordner Öffentliche Ordner
Smartcards with Webservice Interface Authentication Identification Data Access Application Interface Application Interface 7816-15 Webservice Öffentliche Ordner
Smart Home and M2M Infrastructure Smart Devices Application Server Smart Device Server Secure Data Monitoring JC3.0 Secure Data Smart Home Device Security Gateway Source: Sönke Schröder
Agenda Benefits of a Webservice Interface for Smartcards The Service Access Layer out of ISO/IEC 24727 The Architecture of the G&D Webservice Smartcard Demo Conclusion
ISO/IEC 24727 in a nutshell Testing ISO/IEC 24727-5 Architecture ISO/IEC 24727-1 Service Application Service Access Layer (SAL) ISO/IEC 24727-3 Generic Card Access Layer ISO/IEC 24727-2 Interface Device-API (IFD-API) ISO/IEC 24727-4 Auth. Protocols ISO/IEC 24727-6
Agenda Benefits of a Webservice Interface for Smartcards The Service Access Layer out of ISO/IEC 24727 The Architecture of the G&D Webservice Smartcard Demo Conclusion
G&D SAL-on-card architecture (Overview) APDU TCP/IP based communication Service Access Layer WebService instead of APDU communication Nearly no middleware necessary Simple Card Capability Discovery
The Protocol Stack XML / SOAP HTTP / HTTPS Streaming Interface BIP APDU TCP IPv4 / IPv6 EEM (Ethernet) T=0 / T=1 USB
JavaCard 3 Connected Servlets (HTTP communication) Multi-Threading Strings Extended APIs Garbage Collection eid-sallet SmartCard SALlet API SAL Servlet XML Parser SOAP Smart Card OS, Web Server Source: Oracle
SAL-Servlet: Communication flow On card eid-sallet SmartCard SALlet API SAL Servlet XML Parser SOAP Smart Card OS, Web Server
XML & SOAP Extension of the JavaCard API to support XML and SOAP XML & SOAP API according to definitions of Java Standard Edition (subset) Highly optimized with respect to performance, RAM and Flash consumption <env:envelope> <env:header/> <env:body> <CardApplicationConnect> <CardApplicationPath>eID-SALlet</CardApplicationPath> </CardApplicationConnect> </env:body> </env:envelope> SmartCard eid-sallet SALlet API SAL Servlet XML SOAP Parser Smart Card OS, Web Server
The SALlet-API Extension to the standard JavaCard API Allows the implementation of Webservice connected Applets (=SALlets) in an easy way Uses the objects out of ISO/IEC 24727 Card Applications Differential Identities Data Sets Access Control Lists SmartCard eid-sallet SALlet API SAL Servlet XML SOAP Parser Smart Card OS, Web Server
A sample SALlet DIDs and Access Rules //create a PIN-DID object DIDPIN did = new DIDPIN("DIDPIN", 1234, 3); add(did); //create access control list with security condition Vector<Short> actionsdidpin = new Vector<Short>(); actionsdidpin.addelement(action.dsi_read); actionsdidpin.addelement(action.dsi_write); AccessRule accessruledidpin = new AccessRule( new SecurityConditionDID(did), actionsdidpin); //attach access rules to data set dataset.addaccessrule(accessruledidpin); SmartCard eid-sallet SALlet API SAL Servlet XML SOAP Parser Smart Card OS, Web Server
Optimization of XML and SOAP Performance 10000 1000 time [sec.] 100 10 1 0,1 step I step II step III step IV step V step VI step VII step VIII development steps
Agenda Benefits of a Webservice Interface for Smartcards The Service Access Layer out of ISO/IEC 24727 The Architecture of the G&D Webservice Smartcard Demo Conclusion
DEMO
Agenda Benefits of a Webservice Interface for Smartcards The Service Access Layer out of ISO/IEC 24727 The Architecture of the G&D Webservice Smartcard Demo Conclusion
Conclusion The necessary Smartcard infrastructure can be reduced by using an high level interface on the Smartcard With the help of an addition to the JavaCard-API (SALlet-API) the development of SOAP-Applets is quite easy. The Demonstrator shows, that in principal the Webservice as Smartcard interface is possible, but The used JavaCard 3.0 connected platform is currently not mainstream The SOAP-binding is well used, due to specific context an optimized approach might be useful An implementation on top of the widely used JavaCard 3.0 classic platform is possible. IPv6 can offer a direct addressing of the Smartcard in the future, privacy aspects have to be considered!
Thank you for your Attention! Contact: Jan Eichholz Phone +49 89 4119-2684 email: Jan.Eichholz@gi-de.com Giesecke & Devrient GmbH Prinzregentenstr.159 81607 München