System and method for browser based access to smart cards

• US 7,748,609 B2
• Filed: 08/31/2007
• Issued: 07/06/2010
• Est. Priority Date: 08/31/2007
• Status: Active Grant

• Current Assignee: Thales DIS USA, Inc. (Thales SA)
• Original Assignee: Gemalto, Inc. (Thales SA)
• Inventors: Sachdeva, Kapil, Krishna, Ksheerabdhi
• Primary Examiner(s): Lee; Michael G
• Assistant Examiner(s): CHEDEKEL, TABITHA F
• Application Number:
  US11/849,117
• Publication Number:
  US 20090064301A1
• Time in Patent Office: 1,040 Days
• Field of Search: 235/375, 726/9
• US Class Current: 235/376
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A client-side application extension executable on a host computer from within a web-browser having the capability of executing at least one web-browser add-on to provide a user access to a smart card, connected to the host computer having a smart card resource manager, via the web-browser. The web-browser extension has instructions to direct the central processing unit to access data on the smart card via a web-browser and platform independent interface module and a web-browser and platform dependent wrapper module connected to the web-browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart card and for transforming the function call into a corresponding call to the smart card resource manager.

Claims

1. A client-side application extension executable on a host computer, having a central processing unit and a random access memory, from within a browser having the capability of executing at least one browser add-on to provide a user access to a smart card, connected to the host computer having a smart card resource manager, via the browser, the browser extension comprising:

instructions to direct the central processing unit to access data on the smart card, the instructions executing in a first thread and comprising;

a browser and platform independent interface module providing a browser and platform independent application program interface allowing the host computer to execute the at least one browser add-on to invoke functions of the browser extension, the application program interface providing at least one function for accessing data on the smart card;

a browser and platform dependent wrapper module connected to the browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart card and for transforming the function call into a corresponding call to the smart card resource manager; and

a call-back function operable responsive to a response received from the smart card in response to a command sent to the smart card resource manager, wherein a function call to the smart card resource manager spawns a new thread for execution of the function call and directs the host computer to return control to the first thread at the call-back function upon conclusion of the execution of the command sent to the smart card resource manager.

2. The client-side application extension of claim 1 wherein the browser and platform independent interface module and browser and platform dependent wrapper module comprise instructions loaded by the host computer into the browser.

3. The client-side application extension of claim 1 wherein the browser and platform dependent wrapper module comprises browser and platform dependent instructions executable by the host computer to invoke platform specific smart card resource manager functions for accessing the smart card.

4. The client-side application extension of claim 1 wherein the browser and platform dependent wrapper module detects smart card events transmitted by the smart card resource manager.

5. The client-side application extension of claim 4 wherein the browser and platform independent wrapper module receives smart card events transmitted by the smart card resource manager via the browser and platform dependent wrapper module.

6. The client-side application extension of claim 5 wherein the smart card events include card insertion, card removal, begin transaction, end transaction.

7. The client-side application extension of claim 1 wherein the function calls include message transmission to the smart card and reception of corresponding response from the smart card.

8. The client-side application extension of claim 1 wherein the browser extension further comprises instructions to:

detect that a javascript downloaded from a website is attempting to interact with the smart card;

in response to detecting that the javascript downloaded from a website is attempting to interact with the smart card, obtain a user'"'"'s approval or disapproval of the interaction between the javascript and the smart card;

in response to the user'"'"'s approval, allow the interaction to proceed;

in response to the user'"'"'s disapproval, disallow the interaction from proceeding.

9. The client-side application extension of claim 8 wherein the browser extension further comprises instructions to:

in response to the user'"'"'s approval, adding the website to a list of websites allowed to interact with the smart card.

10. The client-side application extension of claim 8 wherein the browser extension further comprises instructions to:

to manage the list of websites allowed to interact with the smart card including code to remove websites from the list of websites allowed to interact with the smart card.

11. The client-side application extension of claim 8 wherein the browser extension further comprises instructions to:

in response to the user'"'"'s disapproval, adding the website to a list of websites not allowed to interact with the smart card.

12. The client-side application extension of claim 11 wherein the browser extension further comprises instructions to:

to manage the list of websites not allowed to interact with the smart card including code to remove websites from the list of websites not allowed to interact with the smart card.

13. The client-side application extension of claim 8 wherein the browser extension further comprises instructions to:

display a user interaction window to allow the user to indicate approval or disapproval for the interaction between the javascript and the smart card.

14. A method of operating a computer system to use a browser to access data stored in a smart card connected to the host computer, the host computer having a central processing unit and a random access memory, and a smart card resource manager, and the browser having the capability of executing at least one browser add-on comprising:

executing a browser application requesting access to data on the smart card via the smart card resource manager;

in response to a request by the browser application to access data on the smart card;

instantiating an interface object from a script module, the interface object providing at least one method for making access calls to a smart card resource manager interface browser extension;

making a call on a method of the interface object in a first thread;

in response to receiving a call on the method of the interface object, making a call on the smart card resource manager interface browser extension in a new thread for execution of the function call and directs the host computer to return control to the first thread at a specified call-back function upon conclusion of the execution of the command sent to the smart card resource manager wherein the call-back function is operable responsive to a response received from the smart card in response to a command sent to the smart card resource manager;

in response to receiving a call on the smart card resource manager interface browser extension, making a call from the smart card resource manager browser extension to the smart card resource manager;

receiving a response from the smart card resource manager; and

displaying a result indicative of the response from the smart card resource manager in a browser window thereby providing a user access to smart card data via the browser.

15. The method of operating a computer system to use a browser to access data stored in a smart card connected to the host computer of claim 14 wherein the smart card resource manager interface browser extension comprises browser and platform dependent instructions executable by the host computer to invoke platform specific smart card resource manager functions for accessing the smart card.

16. The method of operating a computer system to use a browser to access data stored in a smart card connected to the host computer of claim 14 further comprising:

detecting by the smart card resource manager interface browser extension smart card events transmitted by the smart card resource manager.

17. The method of operating a computer system to use a browser to access data stored in a smart card of claim 16 wherein the interface object receives smart card events transmitted by the smart card resource manager via the smart card resource manager interface browser extension.

18. The method of operating a computer system to use a browser to access data stored in a smart card of claim 17 wherein the smart card events include card insertion, card removal, begin transaction, end transaction.

19. The method of operating a computer system to use a browser to access data stored in a smart card of claim 14 wherein the method calls include message transmission to the smart card and reception of corresponding response from the smart card.

20. The method of operating a computer system to use a browser to access data stored in a smart card of claim 14 wherein the browser extension further comprises:

detecting that a javascript downloaded from a website is attempting to interact with the smart card;

in response to detecting that the javascript downloaded from a website is attempting to interact with the smart card, obtaining a user'"'"'s approval or disapproval of the interaction between the javascript and the smart card;

in response to the user'"'"'s approval, allowing the interaction to proceed;

in response to the user'"'"'s disapproval, disallowing the interaction from proceeding.

21. The method of operating a computer system of claim 20 further comprising:

in response to the user'"'"'s approval, adding the website to a list of websites allowed to interact with the smart card.

22. The method of operating a computer system to use a browser to access data stored in a smart card of claim 21 further comprising:

managing the list of websites allowed to interact with the smart card including selectively removing websites from the list of websites allowed to interact with the smart card.

23. The method of operating a computer system to use a browser to access data stored in a smart card of claim 20 further comprising:

in response to the user'"'"'s disapproval, adding the website to a list of websites not allowed to interact with the smart card.

24. The method of operating a computer system to use a browser to access data stored in a smart card of claim 23 further comprising:

managing the list of websites not allowed to interact with the smart card including removing websites from the list of websites not allowed to interact with the smart card.

25. The method of operating a computer system to use a browser to access data stored in a smart card of claim 20 further comprising:

displaying a user interaction window to allow the user to indicate approval or disapproval for the interaction between the javascript and the smart card.

26. A computer storage medium accessible as a server in a client-server relationship, having stored thereon instructions executable by a host computer connected to a smart card and having loaded thereon a smart card resource manager having instructions to enable the host computer to access the smart card, wherein when loaded onto the host computer, the instructions include instructions providing:

at least one browser and platform dependent wrapper module each with an interface to a browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart and for transforming the function call into a corresponding call to the smart card resource manager;

a browser and platform independent interface module providing a browser and platform independent application program interface allowing the host computer to execute the at least one browser add-on to invoke functions of the browser extension, the application program interface providing at least one function for accessing data on the smart card; and

a call-back function operable responsive to a response received from the smart card in response to a command sent to the smart card resource manager wherein a function call to the smart card resource manager spawns a new thread for execution of the function call and directs the host computer to return control to the first thread at the call-back function upon conclusion of the execution of the command sent to the smart card resource manager.

27. The computer storage medium accessible as a server in a client-server relationship of claim 26 wherein the browser and platform independent interface module and browser and platform dependent wrapper module comprise instructions loaded by the host computer into the browser.

28. The computer storage medium accessible as a server in a client-server relationship of claim 26 wherein the browser and platform dependent wrapper module comprises browser and platform dependent instructions executable by the host computer to invoke platform specific smart card resource manager functions for accessing the smart card.

29. The computer storage medium accessible as a server in a client-server relationship of claim 26 wherein the browser and platform dependent wrapper module detects smart card events transmitted by the smart card resource manager.

30. The computer storage medium accessible as a server in a client-server relationship of claim 29 wherein the browser and platform independent wrapper module receives smart card events transmitted by the smart card resource manager via the browser and platform dependent wrapper module.

31. The computer storage medium accessible as a server in a client-server relationship of claim 30 wherein the smart card events include card insertion, card removal, begin transaction, end transaction.

32. The computer storage medium accessible as a server in a client-server relationship of claim 26 wherein the function calls include message transmission to the smart card and reception of corresponding response from the smart card.

33. The computer storage medium accessible as a server in a client-server relationship of claim 26 wherein the browser extension further comprises instructions to:

detect that a javascript downloaded from a website is attempting to interact with the smart card;

in response to detecting that the javascript downloaded from a website is attempting to interact with the smart card, obtain a user'"'"'s approval or disapproval of the interaction between the javascript and the smart card;

in response to the user'"'"'s approval, allow the interaction to proceed;

in response to the user'"'"'s disapproval, disallow the interaction from proceeding.

34. The computer storage medium accessible as a server in a client-server relationship of claim 33 wherein the browser extension further comprises instructions to:

in response to the user'"'"'s approval, adding the website to a list of websites allowed to interact with the smart card.

35. The computer storage medium accessible as a server in a client-server relationship of claim 34 wherein the browser extension further comprises instructions to:

to manage the list of websites allowed to interact with the smart card including code to remove websites from the list of websites allowed to interact with the smart card.

36. The computer storage medium accessible as a server in a client-server relationship of claim 33 wherein the browser extension further comprises instructions to:

in response to the user'"'"'s disapproval, adding the website to a list of websites not allowed to interact with the smart card.

37. The computer storage medium accessible as a server in a client-server relationship of claim 36 wherein the browser extension further comprises instructions to:

to manage the list of websites not allowed to interact with the smart card including code to remove websites from the list of websites not allowed to interact with the smart card.

38. The computer storage medium accessible as a server in a client-server relationship of claim 33 wherein the browser extension further comprises instructions to:

display a user interaction window to allow the user to indicate approval or disapproval for the interaction between the javascript and the smart card.

39. A client-side application extension executable on a host computer, having a central processing unit and a random access memory, from within a browser having the capability of executing at least one browser add-on to provide a user access to a smart card, connected to the host computer having a smart card resource manager, via the browser, the browser extension comprising:

instructions to direct the central processing unit to access data on the smart card executable in a first thread, the instructions comprising;

a browser and platform independent interface module providing a browser and platform independent application program interface allowing the host computer to execute the at least one browser add-on to invoke functions of the browser extension, the application program interface providing at least one function for accessing data on the smart card;

a browser and platform dependent wrapper module connected to the browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart card and for transforming the function call into a corresponding call to the smart card resource manager;

a connection module operable to cause the host computer to execute instructions of the smart card resource manager to establish a communications connection to the smart card;

a call-back function operable responsive to a response received from the smart card in response to a command sent to the smart card resource manager;

wherein execution of the connection module spawns a new thread for execution of the instructions of the smart card resource manager to establish a connection to the smart card and directs the host computer to return control to the first thread at the call-back function upon conclusion of the execution of the instructions of the smart card resource manager to establish a connection to the smart card.

40. A method of operating a computer system to use a browser to access data stored in a smart card connected to the host computer, the host computer having a central processing unit and a random access memory, and a smart card resource manager, and the browser having the capability of executing at least one browser add-comprising:

executing a browser application requesting access to data on the smart card via the smart card resource manager;

in response to a request by the browser application to access data on the smart card;

instantiating an interface object from a script module, the interface object providing at least one method for making access calls to a smart card resource manager interface browser extension;

making a call in a first thread on a method of the interface object to access data on the smart card;

in response to receiving a call on the method of the interface object to access data on the smart card, making a call on the smart card resource manager interface browser extension;

in response to receiving a call on the smart card resource manager interface browser extension, making a call from the smart card resource manager browser extension to the smart card resource manager by spawning a new thread for execution of the function call and directing the host computer to return control to the first thread at a specified call-back function upon conclusion of the execution of the command sent to the smart card resource manager wherein the call-back function is operable responsive to a response received from the smart card in response to a command sent to the smart card resource manager;

receiving a response from the smart card resource manager; and

displaying a result indicative of the response from the smart card resource manager in a browser window thereby providing a user access to smart card data via the browser.

41. A computer storage medium accessible as a server in a client-server relationship, having stored thereon instructions executable by a host computer connected to a smart card and having loaded thereon a smart card resource manager having instructions to enable the host computer to access the smart card, wherein when loaded onto the host computer, the instructions include instructions providing:

at least one browser and platform dependent wrapper module each with an interface to a browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart and for transforming the function call into a corresponding call to the smart card resource manager;

a browser and platform independent interface module providing a browser and platform independent application program interface allowing the host computer to execute the at least one browser add-on to invoke functions of the browser extension, the application program interface providing at least one function for accessing data on the smart card;

a connection module operable to cause the host computer to execute instructions of the smart card resource manager to establish a communications connection to the smart card; and

a call-back function operable responsive to a response received from the smart card in response to a command sent to the smart card resource manager;

wherein the instructions to enable the host computer to access the smart card are executable in a first thread and wherein execution of the connection module spawns a new thread for execution of the instructions of the smart card resource manager to establish a connection to the smart card and directs the host computer to return control to the first thread at the call-back function upon conclusion of the execution of the instructions of the smart card resource manager to establish a connection to the smart card.

42. A client-side application extension executable on a host computer, having a central processing unit and a random access memory, from within a browser having the capability of executing at least one browser add-on to provide a user access to a smart card, connected to the host computer having a smart card resource manager, via the browser, the browser extension comprising:

instructions to direct the central processing unit to access data on the smart card, the instructions comprising;

a browser and platform independent interface module providing a browser and platform independent application program interface allowing the host computer to execute the at least one browser add-on to invoke functions of the browser extension, the application program interface providing at least one function for accessing data on the smart card;

a browser and platform dependent wrapper module connected to the browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart card and for transforming the function call into a corresponding call to the smart card resource manager; and

an on-demand driver module for obtaining an appropriate smart-card driver browser extension corresponding to a smart card connected to the host computer, the on-demand driver module comprising instructions to cause the host computer to;

obtain an identifying string from the smart card and transmitting the identifying string to a smart-card driver server;

obtain from the smart-card driver server a first response indicating whether a driver for the smart card is available, wherein the response indicating whether a driver for the smart card is available includes a further identifying command from the smart-card driver server;

instructions to direct the smart card to execute the further identifying command;

instructions to receive a response from the smart card to the further identifying command;

instructions to transmit the response from the smart card to the smart-card driver server; and

instructions to receive a second response from the smart card driver server including a driver for the smart card or a response message with a further command to be executed by the smart card to identify the smart card.

43. The client-side application extension of claim 42 wherein the first response includes a driver browser add-in corresponding to the smart card.

44. The client-side application extension of claim 42 wherein the first response includes an indication that the smart card cannot be conclusively identified and a command for the smart card to execute wherein the expected response from the smart card conclusively determines the identity of the card.

45. The client-side application extension of claim 42 further comprising instructions to cause the host computer to repeat the steps of transmitting the smart card response, receiving responses from the smart card driver server with either a driver for the smart card or a response message with a further command to be executed by the smart card to identify the smart card until a smart card driver browser extension is received or until the response message from the smart card driver server responds with a message that the smart card is not supported.

46. A method of operating a computer system to use a browser to access data stored in a smart card connected to the host computer, the host computer having a central processing unit and a random access memory, and a smart card resource manager, and the browser having the capability of executing at least one browser add-comprising:

executing a browser application requesting access to data on the smart card via the smart card resource manager;

in response to a request by the browser application to access data on the smart card;

instantiating an interface object from a script module, the interface object providing at least one method for making access calls to a smart card resource manager interface browser extension;

making a call on a method of the interface object;

in response to receiving a call on the method of the interface object, making a call on the smart card resource manager interface browser extension;

in response to receiving a call on the smart card resource manager interface browser extension, making a call from the smart card resource manager browser extension to the smart card resource manager;

receiving a response from the smart card resource manager;

displaying a result indicative of the response from the smart card resource manager in a browser window thereby providing a user access to smart card data via the browser;

obtaining an identifying string from the smart card and transmitting the identifying string to a smart-card driver server;

obtaining from the smart-card driver server a first response indicating whether a driver for the smart card is available;

in response to the response indicating whether a driver for the smart card is available includes a further identifying command from the smart-card driver server, executing the instructions to direct the smart card to execute the further identifying command;

receiving a response from the smart card to the further identifying command;

transmitting the response from the smart card to the smart-card driver server; and

receiving a second response from the smart card driver server including a driver for the smart card or a response message with a further command to be executed by the smart card to identify the smart card.

47. The method of operating a computer system to use a browser to access data stored in a smart card of claim 46 wherein the first response includes a driver browser add-in corresponding to the smart card.

48. The method of operating a computer system to use a browser to access data stored in a smart card of claim 46 wherein the first response includes an indication that the smart card cannot be conclusively identified and a command for the smart card to execute wherein the expected response from the smart card conclusively determines the identity of the card.

49. The method of operating a computer system to use a browser to access data stored in a smart card of claim 46 further comprising repeating the steps of transmitting the smart card response, receiving responses from the smart card driver server with either a driver for the smart card or a response message with a further command to be executed by the smart card to identify the smart card until a smart card driver browser extension is received or until the response message from the smart card driver server responds with a message that the smart card is not supported.

50. A computer storage medium accessible as a server in a client-server relationship, having stored thereon instructions executable by a host computer connected to a smart card and having loaded thereon a smart card resource manager having instructions to enable the host computer to access the smart card, wherein when loaded onto the host computer, the instructions include instructions providing:

at least one browser and platform dependent wrapper module each with an interface to a browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart and for transforming the function call into a corresponding call to the smart card resource manager;

a browser and platform independent interface module providing a browser and platform independent application program interface allowing the host computer to execute the at least one browser add-on to invoke functions of the browser extension, the application program interface providing at least one function for accessing data on the smart card;

an on-demand driver module for obtaining an appropriate smart-card driver browser extension corresponding to a smart card connected to the host computer, the on-demand driver module comprising instructions to cause the host computer to;

obtain an identifying string from the smart card and transmitting the identifying string to a smart-card driver server;

obtain from the smart-card driver server a first response indicating whether a driver for the smart card is available;

wherein the response indicating whether a driver for the smart card is available includes a further identifying command from the smart-card driver server;

instructions to direct the smart card to execute the further identifying command;

instructions to receive a response from the smart card to the further identifying command;

instructions to transmit the response from the smart card to the smart-card driver server; and

instructions to receive a second response from the smart card driver server including a driver for the smart card or a response message with a further command to be executed by the smart card to identify the smart card.

51. The computer storage medium accessible as a server in a client-server relationship of claim 50 wherein the first response includes a driver browser add-in corresponding to the smart card.

52. The computer storage medium accessible as a server in a client-server relationship of claim 50 wherein the first response includes an indication that the smart card cannot be conclusively identified and a command for the smart card to execute wherein the expected response from the smart card conclusively determines the identity of the card.

53. The computer storage medium accessible as a server in a client-server relationship of claim 50, the on-demand driver module further comprising:

wherein the response indicating whether a driver for the smart card is available includes a further identifying command from the smart-card driver server;

instructions to direct the smart card to execute the further identifying command;

instructions to receive a response from the smart card to the further identifying command;

instructions to transmit the response from the smart card to the smart-card driver server; and

instructions to receive a second response from the smart card driver server including a driver for the smart card or a response message with a further command to be executed by the smart card to identify the smart card.

54. The computer storage medium accessible as a server in a client-server relationship of claim 53 further comprising instructions to cause the host computer to repeat the steps of transmitting the smart card response, receiving responses from the smart card driver server with either a driver for the smart card or a response message with a further command to be executed by the smart card to identify the smart card until a smart card driver browser extension is received or until the response message from the smart card driver server responds with a message that the smart card is not supported.