Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client).

In order to do this I thought of the following scheme:

1.Tomcat (server) send to SmartCard (client) the request of his digital certificate (signed by CA).

2.Client enters PIN and selects an available certificate on the smart card, then the Applet sends his certificate (signed by CA) to Tomcat. Tomcat verifies the digital certificate and, if it is correct, sends the certificate back.

3.The applet verifies the certificate of the server, and, if the certificate is correct, sends a confirm to server. The server gives full access to the client to use the web application.

I have some questions:

1.Is this scheme feasible?

2.I would like to manage everything through my applet and when the client disconnects the smart card, he loses access to the server.

share|improve this question
    
I strongly suggest you do not try to recreate an authentication system. There are proven authentication systems ( i.e. the SmartCard API built into Java ) that should perform your required task. –  Ramhound Jul 30 '12 at 14:00
add comment

1 Answer

Take a look at the SmartCard API for Java

This specification describes the Java Smart Card I/O API defined by JSR 268. It defines a Java API for communication with Smart Cards using ISO/IEC 7816-4 APDUs. It thereby allows Java applications to interact with applications running on the Smart Card, to store and retrieve data on the card, etc.

The API is defined by classes in the package javax.smartcardio...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.