Introduction

The need for security and enhanced privacy is increasing as electronic forms of identification replace face-to-face and paper-based ones. The emergence of the global Internet and the expansion of the corporate network to include access by customers and suppliers from outside the firewall have accelerated the demand for solutions based on public key cryptography technology.

A few examples of the kinds of services that public key cryptography technology enables are secure channel communications over a public network, digital signatures to ensure image integrity and confidentiality, authentication of a client to a server (and vice versa), and the use of smart cards for strong authentication.

The Microsoft Windows operating system platform is smart card–enabled and is the best and most cost-effective computing platform for developing and deploying smart card solutions.

What Is a Smart Card?

A smart card is a small, tamperproof computer. The smart card itself contains a CPU and some non-volatile storage. In most cards, some of the storage is tamperproof while the rest is accessible to any application that can talk to the card. This capability makes it possible for the card to keep some secrets, such as the private keys associated with any certificates it holds. The card itself actually performs its own cryptographic operations.

Although smart cards are often compared to hard drives, they’re “secured drives with a brain”—they store and process information. Smart cards are storage devices with the core mechanics to facilitate communication with a reader or coupler. They have file-system configurations and the ability to be partitioned into public and private spaces that can be made available or locked. They also have segregated areas for protected information, such as certificates, e-purses, and entire operating systems. In addition to traditional data storage states, such as read-only and read/write, some vendors are working with sub states best described as “add only” and “update only.”

Smart cards currently come in two forms, contact and contactless.

Contact cards require a reader to facilitate the bidirectional connection. The card must be inserted into a device that touches the contact points on the card, which facilitate communication with the card’s chip. Contact cards come in 3-volt and 5-volt models, as do current desktop CPUs. Contact card readers are commonly built into company or vendor-owned buildings and assets, cellular phones, handheld devices, stand-alone devices that connect to a computer desktop’s serial or Universal Serial Bus (USB) port, laptop card slots, and keyboards.

Contactless cards use proximity couplers to get information to and from the card’s chip. An antenna is wound around the circumference of the card and activated when the card is radiated in a specific distance from the coupler. The configuration of the card’s antenna and the coupler facilitate connected states from a couple of centimeters to a couple of feet. The bidirectional transmission is encoded and can be encrypted by using a combination of a card vendor’s hard-coded chip algorithms; randomly generated session numbers; and the card holder’s certificate, secret key, or personal identification number (PIN). The sophistication of the connection can facilitate separate and discrete connections with multiple cards should they be within range of the coupler. Because contactless cards don’t require physical contact with a reader, the usability range is expanded tremendously.

International standards govern the physical characteristics of smart cards. For example, the size of a card is covered by International Organization for Standardization (ISO) 7810. ISO 7816 and subsequent standards cover manufacturing parameters, physical and electrical characteristics, location of the contact points, communication protocols, data storage, and more. Data layout and format, however, can vary from vendor to vendor.

In addition to physical and manufacturing standards, an increasing number of standards exist for specific vendor applications. Credit card vendors, cellular phone vendors, Unites States and European banks, credit agencies, and debit agencies are examples of organizations that are tailoring smart card applications and procedures geared exclusively to the services they offer and the companies with which they do business.

The two largest vendors of operating systems for smart cards are MAOSCO (an industry consortium) and Microsoft. More information about the MAOSCO consortium and the MULTOS operating system for smart cards is available from http://www.multos.com.

The Microsoft Windows for Smart Cards operating system is a component-based architecture that supports multiple card chips and platforms. It’s extensible and supported by a growing number of card manufacturers and vendors. Developers can integrate the application programming interfaces (APIs) and the associated toolkit into environments that are already familiar to them. You can obtain cards that are compliant with Windows for Smart Cards from a variety of sources. You can develop smart card applications by using systems such as Microsoft Visual Basic and Microsoft Visual C++. Internally, Microsoft is working with Windows for Smart Cards–compliant third-party vendors to provide enterprise management tools that are compatible with Microsoft Windows 2000 and later operating systems. These will provide additional administrative features, such as the ability to remotely reset PINs.

A number of vendors are providing support and other standards for Windows for Smart Cards. Sun Microsystems has published and currently maintains specifications for both Windows for Smart Cards and a “Java Card.” Gemplus and Schlumberger also support Windows for Smart Cards, in addition to their own card operating system, the “Java Card” specification.

Why a Smart Card?

Smart cards are a key component of the public key infrastructure (PKI) that Microsoft is integrating into the Windows platform because smart cards enhance software-only solutions, such as client authentication, logon, and secure email. Smart cards are a point of convergence for public key certificates and associated keys because they:

	Provide tamper-resistant storage for protecting private keys and other forms of personal information
	Isolate security-critical computations, involving authentication, digital signatures, and key exchange from other parts of the system that don’t have a need to know
	Enable portability of credentials and other private information between computers at work, at home, or on the road

The smart card has become an integral part of the Windows platform because smart cards provide new and desirable features as revolutionary to the computer industry as the introduction of the mouse or CD-ROM