Smart Card Plug-and-Play and Windows 7

Plug-and-Play is a feature in Windows that enables the automatic self-configuring of devices.

When you plug a device into your PC and Windows knows the identity of the device and tries to retrieve the driver for the device, that is Plug-and-Play.

One of the smaller features in Windows that will likely never see any press is the support of Plug-and-Play with Smart cards.

Historically Smart cards have been tightly integrated with each application using libraries like PKCS #11 or Cryptographic Service Providers.

There are many problems with this approach, for one they seldom lead to true application interoperability, that is without a ton of scenario and application specific work on behalf of each and every application.

The main reason behind the need for the application specific work is the interface contracts for libraries like this are designed for generic cryptographic extensibility and not the narrow capabilities of a smart card.

In simple terms, a smart card can do a handful of things but one of these libraries must do dozens if not hundred of things.

In the Windows XP SP2 timeframe Microsoft introduced a new provider model for Smart Cards was, its was called a Smart Card Mini driver; support for this concept was made available for Windows 2000 and up platforms via a downloadable package.

In this model smart cards vendors only need to expose the minimal set of things the card can actually do in their middleware, the rest of the work necessary to work well in applications is handled by a higher-layer.

In the Windows VISTA time-frame a certification test-suite was also provided, with this suite vendors could test their cards to get an idea if they would work in common Windows scenarios and ensure they meet a basic quality bar.

As a result of completing that test suite successfully vendors can include the "Designed for.." logo's on their marketing materials and distribute the drivers via Windows Update.

Windows 7 builds on this by being able to automatically detect which drivers are appropriate for a given smart card and install them (with no user interaction!).

For users most users this means when they insert their smart cards they "just work", if they pay close attention when they insert a smart card during a interactive session they will see a bubble:

image

If they click on that bubble they will see the "Driver Software Installation" dialog, beginning searching for device drivers:

 image

This dialog will change to show the driver was installed:

 image

From that point on when the card is inserted the right driver will be automatically loaded for the device, when the user goes into Device Manager they will see a new Smart Cards node:

image

Another side affect of this is that Smart cards now can take advantage of the improved driver installation facilities in Windows 7, this means that Smart card drivers can be installed before there is a interactive session and by standard (non-administrative) users.

This feature is important for a number of reasons, one of which is that the number one complaint for Smart card deployments is the need to deploy complex proprietary middleware to use them.

A variation on that middleware deployment problem is relation to National ID cards, its one thing for a enterprise to need to deploy middleware for a smart card its another entirely for a government who wants to use smart cards for citizen to government commerce, now for Windows 7 they have a solution to that problem.

Print | posted on Sunday, November 30, 2008 6:48 PM

Feedback


Gravatar

 re: Smart Card Plug-and-Play and Windows 7 3/23/2009 1:21 AM Mike

Is it possible to use a java Applet in order to interact with those mini drivers, do I have all rights to manage de Smart Card?


Gravatar

# re: Smart Card Plug-and-Play and Windows 7 3/23/2009 5:45 AM Ryan M. Hurst

Technically you can call Win32 APIs from Java, its been quite a while since I did any Java but I have done this before; I recall making a wrapper for the APIs that ran, this applet used that wrapper but I think it ran at full trust to do this.

You would not want to call the mini-driver directl with such an approach, think of the MD as a driver; you would want to call the smart card resource manager APIs or even higher level APIs like CNG and CryptoAPI.


Gravatar

 re: Smart Card Plug-and-Play and Windows 7 6/17/2009 12:37 AM Sebastian Neff

What can I do, if Windows 7 doesn't find any driver for my Smartcard in Windows Update? Where can I get the driver for my Smartcard?


Gravatar

 re: Smart Card Plug-and-Play and Windows 7 6/17/2009 12:37 AM Sebastian Neff

What can I do, if Windows 7 doesn't find any driver for my Smartcard in Windows Update? Where can I get the driver for my Smartcard?


Gravatar

# re: Smart Card Plug-and-Play and Windows 7 6/17/2009 6:49 AM Ryan

You will need to reach out to the issuer of your card looking for a driver, some vendors have drivers but charge for them (crazy I know), others do not yet have drivers but instead have complicated midleware applications they would like applications to be re-writen to (national ID cards often fall into this catagory).

If your card works, and you do not want to see the new device pop-up/no driver on the device node you can disable smart card plug-and-play via group policy (gpedit.msc).


Gravatar

 re: Smart Card Plug-and-Play and Windows 7 8/12/2009 11:53 AM andy

Like Sebastian i see the smart card reader which has installed ok in DM and i also see smart card which tells me it can;t find the driver. So being a novice at this smart card stuff, well if i load the Smart card SDK i can still write to the smart card, and i still have my terminal program running on the pc which communicates with the SC so why do i need device manager to install the SC as well, confused.


Gravatar

# re: Smart Card Plug-and-Play and Windows 7 10/19/2009 11:59 AM Scott Thompson

Instead of wasting your money buying smartcards that need drivers and readers; you should really look into the GoldKey. It has everything you need for only $99 each. You can also add data vaults to keep all your proprietary information stored off site and able to access from anywhere you and your GoldKey are. Best of all and just announcing to the public soon...it is the single FIPS approved, HSPD-12 accepted, PKI tool that has AES-256 encryption on the market that is already preloaded into the new Windows 7 operating system.

Never buy Windows 7 without a GoldKey !!


Gravatar

 re: Smart Card Plug-and-Play and Windows 7 10/21/2009 8:58 AM Gib

How can I disable the Smartcard plug and play function of Windows 7 so I can use activcard gold (middleware) directly?


 re: Smart Card Plug-and-Play and Windows 7 12/8/2009 8:00 PM Peter Grace

Old topic I know, but, I recently purchased a couple ACS ACOS 5 cryptocards to fiddle with smart card login at home. Woe be to those who assume that the CSP will work in Windows 7 x64! Drivers are currently not available.

I am posting because I'd like to query people who are using smart cards currently to let me know what card types they're using and for what purpose. I picked one that sounded good and I'm paying for it now.

I see the blog post mentions the Gemalto .NET smart card. Is this a "good" card insofar as it's worked in every box you've plugged it into?

Title  
Name  
Email
Url
Comments   
Please add 3 and 5 and type the answer here: