On the road to Bandol

The next generation is getting closer than ever, with e forecast release in Q1 2008. Some demos were already present at Cartes, on both Gemalto and Oberthur booths. No major breakthrough in terms of cards, as both of them have been using USB tokens, about which they were not that talkative. The focus, in both cases, was on the things that they were able to do. And in both cases, they were showing how smart cards will soon be real Internet devices, and how all technologies will then be available.

Gemalto was very much in the Microsoft world, and their demo was based on both Java and .NET. On the part I saw for the Java part, they were showing how you can use UPnP with a card, and then discover all the content on the card, in their case in a media player. The demo then included streaming a video from the token, which illustrates the kind of bandwidth that can be attained with USB, as long as you don’t do too much processing. Then, they used WebDAV in order to show that it was possible to look at the card’s content just like a remote file system. The final part of the demo was a game of reversi, played between a Java-based card and a .Net card. I don’t recall which technology was used there, but it worked very smoothly, and the interface coming from the card was partly based on Sliverlight, proving once again that all Web technologies can be used with these cards (even those from Microsoft).

Oberthur’s demo was very different, and more aimed at developers. They were showing some e-banking demo, with which the authentication was performed by the card. They were not only showing the execution of the demo, but also the making of it, or at least a glimpse of the source code in Eclipse, using a special plug-in that manages Java Card. The interesting thing is here that their source code was a JSP page, and not a servlet. Of course, the servlet code is here generated off-card, and then loaded. But still, JSP is far more readable than a standard servlet.

Another interesting thing, Gemalto and Oberthur have different ways to mix the content from a smart card with the content from another site on the same page. Gemalto has been using a site that appears to be on the smart card but gets content from elsewhere using JavaScript (see their JavaOne 2007 slides for more details), while Oberthur simply embeds the smart card content in a specific frame. I could spend a lot of time comparing both approaches, but this is not the point here. My point is now that there is some hope that somebody will do something really interesting with this technology, as it can leverage all Web technologies, and can easily be integrated in other applications.