I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard “IDGo 300” (client).
In order to do this I thought of the following scheme:
1.Tomcat (server) send to SmartCard (client) the request of his digital certificate (signed by CA).
2.Client enters PIN and selects an available certificate on the smart card, then the Applet sends his certificate (signed by CA) to Tomcat. Tomcat verifies the digital certificate and, if it is correct, sends the certificate back.
3.The applet verifies the certificate of the server, and, if the certificate is correct, sends a confirm to server.
The server gives full access to the client to use the web application.
I have some questions:
1.Is this scheme feasible?
2.I would like to manage everything through my applet and when the client disconnects the smart card, he loses access to the server.
1
Take a look at the SmartCard API for Java
This specification describes the Java Smart Card I/O API defined by JSR 268. It defines a Java API for communication with Smart Cards using ISO/IEC 7816-4 APDUs. It thereby allows Java applications to interact with applications running on the Smart Card, to store and retrieve data on the card, etc.
The API is defined by classes in the package
javax.smartcardio…
0