Integration of Java Card to Internet

1
Integration of Java Card to Internet

• By
• Satish Devane(99429401)

Guide Prof. D. B. Phatak
2
Introduction

• Increase in use of smart card
• 50 increase in Europe (approx)
• 30 increase in US (approx)
• India
• Petrocard (Hindustan Petroleum)
• Milk card (Rajasthan)
• Driving License(Gujarat)

3
Introduction

• Use in Payment system e-commerce
• Lack, acceptance of Security features
• Standards
• Project SMARS (IIT Bombay)
• Preparation of standards in Indian scenario
• Too complex
• Adopting EMV

4
Introduction

• Previous work
• Comparison of multi-application platform
• Multos
• Javacard
• Microsoftcard
• OCAPI
• considering
• Platform, security, application loading

5
Issues in Smartcard

• Operating System Platform
• Development Tools
• Security
• Integration with Global IT
• Processor
• Memory

6
Issues in Smartcard

• Operating System Platform
• Need of Modular Configurable OS
• Why not Open Source OS Like Linux?
• Security
• Development Tools
• Formal modeling
• Automatic code generation
• Testing and Verification

7
Issues in Smartcard

• Security
• Biometrics
• Cryptography
• Faster algorithms with reduced code
• Integration with Global IT
• To avail Services of external world to export
  services of smartcard to external world

8
Selection.

• Java Card Platform
• Open platform
• Code portability
• Built in security features
• Already used in IT
• Availability of API

9
Java Card Platform

• Work with 7816 standards

• R/W/U/E binary
• R/W/A/U record
• Get/Put data
• Select file
• Verify
• Internal/External authenticate
• Get Challenge

10
Java Card. How it works?

• Operation

11
Java Card Platform..

• Methods
• install (APDU apdu)
• deselect()
• select()
• process(APDU apdu)

12
Example

• Railway Reservation
• Presently with single application
• Aim
• E_Purse, one application (with EMV stand.)
• Reservation application
• Dynamic load from reservation server(secure)
• Payment transaction(EMV)
• Keep reservation applet till end of travel date
• Discard and free space ? (Feature not available
  today)

13
Issues in Java Card

• No standards for applet down load (VOP)
• No standards for communicating with selected
  applet (proprietary protocol)
• Byte code verification(on card/off card)
• Code compaction on card
• File management with garbage collection
• Incomplete Transaction (application should take
  care)

14
Solution.

• Integrating with Internet
• Interoperability issues
• Shares card services by out side world
• And outside services will be used by card
• Known standards
• Interact with global IT

15
Server on card citi

• Implement HTTP Server
• TCP/IP stack

Request from Client
Smart Card System
Smart card Web Card
Reader
Application Process APDU APDU To/T1 Encapsulated
TCP/IP
16
Assumption Limitation

• Only one connection at a time
• Files on the card are referred by two byte hence
  GET request const of GET followed by space and
  two char of file name
• No PUT and other request

17
NextWith XML scripts

• Communication stack
• Encapsulate TCP/IP to APDU
• Software Interface comm. stack
• Extract TCP/IP from APDU
• HTTP Server
• Extract the request method
• GET POST with URI
• If protected file return FORM
• Get authentication
• XML Script Parser
• Control communication session

18
Server

• Server can be implemented as
• HTTP proxy server
• Terminal implements HTTP
• TCP Server
• Tunnel software on system encapsulate TCP/IP
• packet in APDU
• Protocol gateway
• Terminal translate TCP/IP in some other protocol

19
File system

• No dir/ls command to see files/services in card
• Additional file system needed over 7816 system
  which assigns name to file

20
Future Work

• To develop XML based Services to explore Java
  Card.
• Use of Multi-application Smartcard in Indian
  Application Environment
• Incomplete Transaction due to
• Power failure
• Mishandling