PC
/ SC compatible device driver for WINDOWS
Part 1.
Common ideology of PC/SC in MS WINDOWS.
PC/SC - what is it?
If you are interested to know what PC/SC exactly
is, please visit PC/SC
Workgroup . It contains a lot of information on this subject,
additionally you can check MSDN , it also has several articles
regarding PC/SC . And one more hint: DDK contains several smartcard
related samples - check them thoroughly if you really want to
start the development of your own PS/SC device driver from scratch.
It will not be an easy task, such a driver has its own internal
structure (the driver is linked with smclib) what is not always
obvious. In case if you do not have a solid experience on this
subject, you should get the information from somewhere else.
DDK is the best place to start. I do not think, that it makes
sense to publish here the part of the PC/SC specification, below
you can find simple explanation what it is at least as I understand
it.
I did not plan to create fully functional PC/SC device driver,
working with SC reader and real
SC(smartcard). As you know the
existence of such a driver (IFD
handler) with certain degree of approximation will allow your
device (SC reader for instance
(IFD,
interface device)) be seen and accessable in OS through the
standard Microsoft smartcard components.You may ask: "What
can it be good for?" First of all it is needed if you want
to use secure token (it does not matter, what token(dongle)
do you plan to use, USB, parallel port or even serial port based
one) by way of SC + SC
reader. And believe me, this task is not less compex than creation
of device driver for real SC reader.
Ok, now everything is clear.
This picture demonstrates common ideology of PC/SC in MS WINDOWS
(MSDN).

About used terminalogy:
- ICC - integrated circuit cards;
- IFD handler - handler of interface
device (simpy speaking - driver);
- IFD - interface device (SC
reader + any auxilary equipment);
- Resource Manager - service,
responsible for managing and controlling all application access
to any smart card inserted into any reader attached to a Windows-based
computer. The Resource Manager provides a given application
with a virtual direct connection to the requested smart card.
(MSDN);
- Service Providers - cryptographic
(CSP) and noncryptographic(SCSP) service providers (one or
more, for all SC installed in
OS).Usually this is a SC specific
software part, necesary for management of this type of SI
It may be needed if you try to use your own device. In this
case you could want to add some additional functionality,
like random number generation, and so on.
So, as you can see this architecture allows to hide
real nature of your device and other device specific things, like
used communication interface, SC
specific functionality (because it can be expanded or modified
inside of the correspondent SP). And main andvantage for Application
is its ability to work with different devices without knowledge
about their implemenation's details, vendor specific API and other
unpleasent things, occuring when the clearly defined interface
between application and device is absent. Simple example: you
developed a commercial product with PC/SC support included. Part
of the data (sensitive information, keys, certificates) can be
stored in PC/SC aware device, thus your product does not limit
of the range of the used devices - ANY if it has necessary functionality
and supports mentioned standard. The best example is SSH/PGP and
many other products. It can work witn many external secure devices,
created by different vendors.
So, one more time - if your PC/SC IFD handler satisfies
certain conditions then any of our IFD can be considered by OS
as a SC reader with SC.
It's excellent, is't it? Why? Because in this case we are able
to develop lots of different interesting projects, like SmartCard
Logon (GINA support), replacement of SC
+ SC reader for different applications
(in cases when our device's functionality may satisfy application
requirements. And it goes without saying, this is the way to replace
SC + SC
reader with low-cost secure tokens (But sometimes the price of
it can be compared with a pair of SC
+ SC reader). Though I have to admit,
this is the very moment when arguments about comparison between
real SCs and external secure tokens(dongles)
are coming from (What is better and why, what range of tasks etc).
But we will try to save our time and just continue ...
Now it is time to give some details about current state of the
market of secure tokens (IMHO). There are many firms, dealing
with producing secure tokens, but I'd like to tell about two biggest
secure token's manufacturers: Aladdin
and Rainbow.(I
personally worked with the mentioned and other products (tokens
and token specific software) and like all of them.)
Aladdin eToken R2. Token contains simple
MCU (CY63141) and supports next certifications and standarts:
PKCS#11 v2.01, CAPI (Microsoft Crypto API), APDU level commands
PC/SC, X.509 v3 certificate storage, SSL v3, IPSec/IKE. eToken
R2 can be used with different applications: Windows 2000 Smartcard
network logon, CheckPoint SecuRemote VPN client,RAS Dialup /
RADIUS, Solution partner's NT logon, PC security and file encryption
support, e-commerce, e-banking, e-mail communications, and so
on. There are lots of commercial applications, using PC/S interface.
Rainbow iKey1000. This token does not use smartcard chip
as well, although is able to execute tasks, which previously
were done with usage of smartcards. Remarkably, all PKI functions
are performed within a "Security Module", embedded
within the iKey 1000 Series Windows Client Software. Details
can be found here.
I should admit, this key is my favorite. It has smartcard compatible
file system and all necessary software in order to be successful
on the market of relatively cheap secure tokens (There are more
powerful, more secure tokens but they cost more). The token
can be accessed through : Microsoft Crypto API (MS CAPI), other
PKI systems via a Crypto API based on PKCS#11, PC/SC interface.
And it makes no sense to speak about such powerful
tokens like Aladdin eToken Pro, Rainbow iKey2000,
iKey3000 - this is an absolutelly different category. All
of them contain real smartcard chips, therefore they can be used
in all ICC aware applications, and be an excellent replacement
of smartcards and readers.
Conclusion: PC/SC driver is a very important part of software
package for smartcards and smartcard compatible secure tokens.
And I hope this project can be useful for all people who are interesting
in it. I consciously do not publish this project under GPL in
order to escape any limitations regarding usage of the project
and its parts in any way. Herewith I release this project into
public domain.
|
|
|
|