Smart Card Applications and Mobility in a World of Short Distance Communication

The CASTING project is concerned with the application of smart card technology in combination with short distance wireless communication. This report focuses on secure access to Web pages, meaning that the right person has access to his or her personal Web pages in a manner that respects integrity, authenticity and confidentiality. This requires authentication of users, which is achieved by providing users with public-key certificates and the corresponding private keys, stored in a mobile device. The mobile device contains a smart card that stores the user’s certificate and the user’s private key and executes the necessary operations to convince the remote Web server about the identity of the local user. The client application that is adapted for user authentication is Netscape, version 4.7x. The Web server used is Apache, extended with the Apache-SSL module. The long distance link between Web server and Netscape is secured with the SSL/TLS protocol. The Web server is configured to ask for user authentication, which is provided by the user’s mobile security device. This device is accessible wirelessly via a short distance link that is in turn secured via the SECTUS protocol. Netscape is adapted with a custom security module that implements the PKCS #11 interface. The CASTING project is part of a cooperation between the Distributed Systems Group at ETH Zurich and Swisscom AG Bern, Corporate Technology. This report describes phase 2 of the CASTING project. Phase 1 was done by researchers at EPFL and focused on protocols for secure spontaneous connections. The work described in this report was done at ETH Zurich and funded by Swisscom. Contact persons are Prof. Friedemann Mattern at ETH Zurich, and Karin Busch and Michael Deichmann at Swisscom.