{"id":1267,"date":"2009-09-01T09:32:22","date_gmt":"2009-09-01T14:32:22","guid":{"rendered":"http:\/\/www.coresecuritypatterns.com\/blogs\/?p=1267"},"modified":"2020-08-08T04:11:34","modified_gmt":"2020-08-08T04:11:34","slug":"java-card-30-deploying-and-running-web-applications-on-smartcard","status":"publish","type":"post","link":"https:\/\/websecuritypatterns.com\/blogs\/2009\/09\/01\/java-card-30-deploying-and-running-web-applications-on-smartcard\/","title":{"rendered":"Java Card 3.0: Deploying and Running "Web applications" on Smartcard."},"content":{"rendered":"

\"\"<\/a>Java Card technology has been a passion of mine for so long and I always tried my best to keep updated on Smart card technologies…… not just because of my role at Sun, I did get several opportunities to work closely with citizen-scale<\/em> Java Card deployments with multiple National ID, eID\/ICAO, US DoD\/CAC, PIV\/FIPS-201 cards and related Identity management projects.  It is always been quite adventurous everytime to experience a card issuance architecture and deployment scenario – right from applicant enrollment, demographic data provisioning, Biometrics\/PKI credentialing, adjudication\/background checks, post-issuance maintenance including card authentication\/verification\/usage and final retirement\/termination.  In the early 2000’s, I even had an opportunity to write couple of Java Card applets for a big 5 financial organization using Java Card 2.x and it is still exists on production (No kidding! one of them may be in your wallet). With all those experiences, I did have my own stumbling issues with programming Smartcards, where I pulled my hair-out on understanding those evil “Application Protocol Data Units” (APDU) based commands and responses. In my opinion, APDUs are quite complex to understand when you jump in unless you read the docs in-and-out beforehand and then test-driving APDUs are even more hard unless you have the luxury of having a debugging environment –  seriously, you may not want to experience those pains.  Havingsaid, now we can breathe a sigh of relief – I am bit late to experience the newer features of Java Card 3.0 –  It has introduced “network-centric” and “Java\/J2EE developer” friendly features that radically changed the way we originally designed, developed, deployed, and integrated Smartcard applications.  Interestingly, there are very compelling aspects about Java Card 3.0 technology –  As I digged with my little experience… here is my observations.  <\/p>\n

Understanding Java Card 3.0  <\/h2>\n
    \n
  1. A Smartcard can act as a “Personal Web Application Server”  or an user-centric miniature Java EE application server on a network.  Java Card 3.0 has introduced a Servlet container environment referred to as “Connected Edition” – which allows the smartcard applications can built as Java servlets (Web applications) using Servlet 2.4 APIs and deployed as a “WAR” file to the Web container running on a Java Card 3.0 compliant Smart card. This Servlet based deployment is an addition to existing Java card applet deployment model referred to as Classic Edition (exists with Java card 2.2.x). The Java Card clients access the applications using a Web browser (ex. http:\/\/localhost:8019\/myJavaCardServlet<\/a>).\n

  2. Java Card 3.0 supports 32-bit processor based Smartcards and handles more memory – upto 128k.<\/li>\n
  3. Enough with pain of understanding\/testing APDUs, now you can readily develop Java Servlet 2.4 API compliant Web applications and deploy them to a Smart card.<\/li>\n
  4. With Java Card 3.0, we can perform interact with using standards based communication with the card using HTTP\/HTTPS and also its supporting XML based protocols such as SOAP, REST etc.<\/li>\n
  5. Support for Java crypto APIs and additionally you can enable access control with the card similiar to performing container-managed authentication in Java EE – using SSL\/TLS mechanisms.\n
  6. Java Card 3.0 based Web applications can be developed, debugged and deployed using Netbeans 6.7.1 and up.<\/li>\n
  7. Smart card issuance (for Card holders) and updates using GCF can be done through Web based deployment model (via HTTP, TCP) – using both contact and contactless communication interfaces.<\/li>\n
  8. Other features include full Java language support (Java 1.6 features) including all data types (except float and double), multi-threading, garbage collection, XML parsing\/generation capabilities etc.<\/li>\n
  9. Allows Java developers to explore Java Card platform easily with strong potential for deploying security applications intended for National ID card schemes, passports and simplifying deployment of  “Match-to-card Biometrics”, “On-card” credential persistence and secure transaction based applications.<\/li>\n<\/ol>\n

    Try it yourself<\/h2>\n

    If you are curious to test drive Java Card 3.0 reference implementation especially using its “Connected Edition” to deploy Java Servlet based application to Smart card – Before you begin, make sure you obtain the list of pre-requistes :<\/p>\n

      \n
    1. Java Card Connected Development Kit 3.0.1<\/a><\/li>\n
    2. Netbeans 6.7.1<\/a><\/li>\n<\/ol>\n

      and then proceed with the following steps for deploying a “Hello World” Web application – creating Java card applications can’t get easier than this<\/span><\/em> :<\/p>\n

        \n
      1. Install the Java Card 3.0 plugins for Netbeans 6.7.1 – Go to Tools, Plugins and search for card to select plugins for “Java Card Projects” and “Java Card Console”.\n
        \n
        \n
        \"Installing<\/a><\/dt>\n
        Installing Java Card plugins for Netbeans<\/dd>\n<\/dl>\n

         <\/p>\n<\/div>\n<\/li>\n

      2. \n
         Go to Netbeans IDE,  Choose Project – “Java Card” and select Projects type “Web Project”. <\/div>\n

        \"Creating<\/a><\/li>\n

      3. \n
         Assign Project name\/location\/folder and then select “Manage Platforms” to assign the Java Card 3.0 runtime environment.   <\/div>\n
      4. \n
         To assign the Java Card runtime info, select “Manage Platforms” and choose “Platform type” to Java Card Platform.  <\/div>\n

      5. \n
         Select the location of your “Java Card 3.0 Connected Edition Dev kit” installation. <\/div>\n\"Select<\/a>\n

         <\/li>\n

      6. \n
         Define the default device (assuming your Smartcard) attributes and press “Finish”: <\/div>\n\"Select<\/a>\n

         <\/li>\n

      7. \n
         As a result, you should see the Netbeans console showing your “Java Card Platform” environment for test-driving your applications.    \"\"<\/a> <\/div>\n<\/li>\n
      8. \n
        With above steps complete, now you are ready to develop\/debug\/deploy your Java Card web applications…. here is my first “Hello World” Java Card Web application excercise.   \"\"<\/a>    <\/div>\n<\/li>\n
      9. \n
         Compile the application –  In the Projects window, right-click the project node and choose Build <\/strong>to build the project.    \"\"<\/a> <\/div>\n<\/li>\n
      10. \n
        To deploy and run the Web application from your target Smartcard device (in my case the JavaCard RI), In the Projects window, right-click the project node and choose Load\/Create Instance<\/strong> or just Run<\/strong> to run the application.  Netbeans will launch the browser, displaying the Hello world application prompting for your name….  and push the button to see – what happens !  \"\"<\/a>  <\/div>\n<\/li>\n<\/ol>\n

        Netbeans does all the magic for you – if something not working, no worries ! Like implementing anyother Web application in IDE,  it is now easy for you to painlessly debug and redeploy the application – I am sure, you’ll find deploying applications on Java Card is nolonger a mystery.<\/p>\n

        With Billions+ Java Cards already in use and so much demand for the Smartcard technology,  Java Card 3.0 promises beyond citizen IDs and can potentially act as your “Personal Web application server” on your wallet.<\/p>\n

        Thanks to Anki Nelaturu and Saqib Ahmad who introduced me to Java Card 3 with their JavaOne ’09 sessions. After playing with my first excercise on Java Card 3.0 RI, now I am chasing my friendly Smartcard vendors to loan me couple of Java Card 3.0 cards \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

        Java Card technology has been a passion of mine for so long and I always tried my best to keep updated on Smart card technologies…… not just because of my role at Sun, I did get several opportunities to work closely with citizen-scale Java Card deployments with multiple National ID, eID\/ICAO, US DoD\/CAC, PIV\/FIPS-201 cards and related Identity management projects.  It is always been quite adventurous everytime to experience a card issuance… Read more »<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2,5,21,6,8,11],"tags":[24,26,29,31,37,40,55,62,64],"class_list":["post-1267","post","type-post","status-publish","format-standard","hentry","category-biometrics","category-identity-management","category-java-security","category-main","category-pki-main","category-smartcards-pki","tag-biometrics-main","tag-cac","tag-eid","tag-fips-201","tag-j2ee","tag-java-security","tag-piv","tag-security","tag-smartcards"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/posts\/1267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/comments?post=1267"}],"version-history":[{"count":1,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/posts\/1267\/revisions"}],"predecessor-version":[{"id":2836,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/posts\/1267\/revisions\/2836"}],"wp:attachment":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/media?parent=1267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/categories?post=1267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/tags?post=1267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}