Abstract
Smart cards have provided security services in many domains over the past two decades. They should be able to offer security services to the Internet and prevent online identity theft as well. Having developed a smart-card-based solution for preventing identity theft, we have found that it is very difficult to push it to the consumer market. A common critical requirement from both users and service providers is that smart card tokens must be plug-and-play without any software installation. However, conventional smart cards require installations of device drivers and middleware on host computers. The key to solving this problem is to develop a new communication framework for smart cards. This paper presents such a framework that enables USB smart cards to be plug-and-play. We leverage pre-installed device drivers present in all modern computer operating systems. A USB smart card emulates such devices to communicate with its client software, which resides on the smart card and runs on the host computer. The client software enables the smart card to use a web browser for its human interface and to support web applications. All communications among smart card services, the web browser, and remote web servers are secured using TLS.