Secure Internet Smartcards

Abstract

In this paper, we describe middleware that (1) enables secure communication between a host and a remote smartcard and (2) provides a unique name, regardless of card location. Smartcards have traditionally been isolated from computer networks, communicating exclusively with the host computers to which they are attached through a serial port. This era is ending, in part due to the flexibility and programmability of Java-Cards. Researchers are beginning to communicate with smartcards using Internet protocols. This work extends the Internet infrastructure to allow secure access to remote smartcards, communicating encrypted payloads over UDP/IP. Session key establishment uses a PIN-based encrypted key exchange called SPEKE. We describe two applications that use this infrastructure, Kerberos and SSH, discuss performance and security concerns, and highlight the security and convenience benefits of using Internet smartcards for personal key storage and cryptography.