Table Of Content

Smart Card Application Development Using Java Springer-V erlag Berlin Heidelberg GmbH Uwe Hansmann Martin S. Nicklous Thomas Schack Achim Schneider Frank Seliger Smart Card Application Development Using Java Second Edition With 98 Figures, 16 Tables and a Multi Function Smart Card , Springer Uwe Hansmann Martin S. Nicklous Thomas Schăck Achim Schneider Frank Seliger IBM Deutschland Entwicklung GmbH SchonaicherstraBe 220 71032 Boblingen, Germany Library of Congress Cataloging-in-Publication Data Smart card application development using Java: with 98 figures, 16 tables and a multi function smart card/Uwe Hansmann ... [et al.]. - 2. ed. p.cm. Includes bibliographical references and index. ISBN 978-3-540-43202-9 ISBN 978-3-642-55969-3 (eBook) DOI 10.1 007/978-3-642-55969-3 1. Java (computer program language) 2. Smart cards - Programming 1. Hansmann. Uwe,1970- QA76.73.J38 S597 2002 005.13 '3---<1c21 2002066929 ISBN 978-3-540-43202-9 This work is subject to copyright. Al! rights are reserved, whether the whole or part of the material is concemed, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German copyright law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. http://www.springer.de © Springer-Verlag Berlin Heidelberg 2000, 2002 Originally published by Springer-Verlag Berlin Heidelberg in 2002 Softcover reprint of the hardcover 2nd edition 2002 Any references in this publication to Web sites are provided for convenience only and do not in any manner serve as an endorsement of these sites. Springer-Verlag accepts no responsibility for the content or use of non-Springer-Verlag Web sites specifically mentioned in this publication or accessed through a Springer-Verlag Web site mentio ned in this publication. The use of general descriptive names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Cover design: KiinkelLopka , Heidelberg Typesetting: Camera-ready by the authors Printed on acid-free paper - SPIN: 10866335 33/3142 GF 543210 Foreword As we reach adolescence in the Internet era, we are now facing the dawn of the digital era - an era that will be marked not by pes and servers, but by computational capability that is embedded in all things around us. The simple user interfaces of the browser - which seemed revolutionary a few short years ago - will be replaced by more natural interactions that are more convenient to daily life. Whether in work or play, we will be able to interact with informa tion and applications in a highly personalized, yet adaptive way us ing whatever device they may be carrying. They will be able to in teract with these capabilities using a variety of modes - traditional visual based methods, voice based systems and new emerging multi modal technologies combining different access methodologies in one transaction. In the not too distant future, the networks will intro duce multi-lingual capabilities including dynamic translations and gaze recognition technologies that put context around where you are looking. Applications are increasingly moving to the network - self healing networks that are always on, fully connected. Access will be carried by service providers who in tum become the next generation of utility - much like electricity did a century before. This access will be managed across an interconnected web of wireless networks (both short and long range), broadband wireline networks and tradi tional dial up networks. Many business model issues and perhaps regulatory issues will have to be solved as this comes to pass, but it will happen. The next steps are so clear that they must. As these networks emerge and these devices come to fruition, we are facing a dilemma. How can we create a secure transactional ca pability across this new frontier? As devices increasingly become commodities, how can we transition security information from one device to the new one, without leaving the old device open to break in? Foreword -- V - The unfortunate incidents on September 11 th, 2001 have re minded us that security systems are fragile and must be rethought. New methods of identification must be developed - more secure, more robust than the last generation and easy to use. New advances in technologies, like smart cards, are paving the way to these new systems combining means of high security and privacy at the same time. Identification schemes need to be portable and totally reliable. Whether the application is embedded in SIM cards for Mobil phones, credit or debit cards, corporate or national identification cards, the next steps are clear. Michael D. Rhodin Vice President, Pervasive Computing IBM Corporation February 2002 VI • Foreword • • Foreword 1 to the First Edition Until recently, most books on smart cards needed to be divided into two distinct categories: One for North American readers, and the other for readers from all other parts of the world. The reason being that while the rest of the world has deployed hundreds of millions of smart cards for applications as diverse as telecommunications, banking, pay-television, health-care, or transportation, North Amer ica has deployed relatively few. This book marks the beginning of a new era when smart cards have outgrown their European cradle, and have attracted the talent and creativity of "heavyweights" in the US information technology industry. Its authors are employed by IBM and the technology they describe is based on a programming platform initiated by Sun Mi crosystems. This is a clear signal that smart cards are coming of age. Why this sudden interest by American companies in a technology that they have admittedly ignored or misunderstood for quite a long time? The answer has a lot to do with "e-words", company names ending in "dot com" and, above all, the promise of a new digital economy where consumers are connected pervasively to the Internet and happily spending their money online. Consumers are increasingly surrounded by Web-aware appli ances. As a result, personal computers will begin to fade as the pri mary point of access to the Internet. They will not go away, of course, but cellular phones, set-top boxes, video games, and even cars will outnumber them as network-connected consumer devices. Dear reader - and consumer, are you going to identify yourself to your car, your TV set top box, and your phone by punching in pass words all day long? Not very likely. If you own a GSM or PCS phone, a smart card chip is already hidden inside your handset to provide strong authentication to the network operator. If you watch satellite TV, chances are that your set-top box uses a smart card to hold your subscription rights se curely. And in a couple of years, your car will recognize you by your Foreword 1 to the First Edition -- VII - smart ignition key, which will hold your preferences for seat and mirror adjustments, and favorite radio stations. Granted, you will not spend your day inserting plastic cards into slots either. Smart card technology will remain mostly hidden from you, seamlessly integrated into the products of your everyday life. This book explains how such integration is possible. It teaches us about developing smart card applications in "Internet time", mean ing in weeks instead of months. It shows us the merits of using open, inclusive, proven standards developed by industry consortia to ad vance the state of the technology. It is about crossing the chasm between the early adopters of smart card technology (mostly Euro pean and Asian telecommunication operators and banks) and the in cumbent deployers of information infrastructure technology (mostly American IT companies). It is somewhat ironic that you can find many of the technical foundations of this book somewhere on the World Wide Web be cause of the very principles guiding the authors in their development work. However, this book goes beyond the basic technology foun dations: You will find here a wealth of detailed diagrams as well as examples and information on design rationales and tradeoffs. Smart cards remain a relatively under-documented subject and it was in dispensable that the OpenCardsM and Java™ technologies explained here, be preceded and integrated with a detailed explanation of ex isting smart card hardware and software platforms, as well as exist ing smart card standards. Like with most other technologies, the devil is in the details. You will find here the tools to chase the devil out of successful imple mentations of smart card capable products. Patrice Peyret Director, Sun Microsystems Inc. Consumer & Embedded Platforms August 1999 V/II • Foreword 1 to the First Edition • • Foreword 2 to the First Edition Computers that understand voice and handwriting ... intelligent cars ... computers that are as small as a walkman - these aren't pictures of the future, but reality. The theme behind this is e-business, and a wide variety of e-business products, technologies and services dem onstrate its leading role on the way to e-society. And pervasive computing is a key factor. It refers to the idea of computer intelli gence in everyday devices that give customers convenient access to data and services, and the ability to conduct e-business at any time, from any location. In the next five to ten years there will be over one million businesses and one billion people using one trillion mobile and network devices to communicate worldwide. In the new world of pervasive computing, relevant, customized information will always be within easy reach, ready to be acted on immediately. This convenient access and ability to take action will be provided to users by a new generation of smart devices - embed ded with powerful microprocessors - that connect to the network for data and services. These devices - smartphones, screenphones, personal digital as sistants, kiosks, smart machines and other Internet appliances - will be simple and intuitive to use. Processes that now take a number of commands to run on a PC will require only the push of a button, a spoken request, or a hand-written command. A number of technology innovations are helping to make sure this happens. For example, IBM's record-setting, high-capacity miniature hard drives and the extension of its leading virtual ma chine and compiler implementations into the space of embedded computers are steps towards reusing applications across different devices, such as embedded computing devices and smart cards. In this networked world, smart cards will play a major role. The smart card is the ultimate device for carrying data, it is extremely se cure, and it has a familiar shape, that of the widely used and known credit card. The power of a smart card, and with the possibility of an integrated cryptographic engine at that, is tremendous. Foreword 2 to the First Edition • IX • • The key characteristics for smart cards in today's world are secu rity, ease of use, mobility, and multi-functionality. They are thus geared/predestined to become the next major IT platform. And they are going to revolutionize the business world over the next few years. Many smart- card applications are today being implemented - from citizen ID cards to health cards, elec tronic purse cards, and network access cards. It is widely accepted that nearly all organizations will sooner or later need to assimilate smart cards into their routine business processes. This book is the first to describe - besides the pure smart card technology - the complete end-to-end system approach. The com plete scenario, from the standards involved to the programming ca pabilities required, is dealt with, and in a way that is easy to under stand. This book complements the smart-card application suite. It was written to enable readers to take over an active role in the software development of smart-card applications without the necessity of having to go into the bits and bytes of the card itself. I'd like to thank the authors for this new approach in addressing smart-card-related technology, and I wish all the readers much fun in developing their first application! Sabine Schilg Business Line Manager IBM Pervasive Computing Solutions August 1999 x • Foreword 2 to the First Edition • •