Government Identity Recognition

EAL6+

Security Certification

ICAO

9303 eMRTD Compliant

PKI

Dual Auth Protocol

OTA

Remote Card Mgmt

CORE APPLICATION SCENARIOS

Four Pillars of Government
Identity Recognition

Java smart cards have become the core technology of global e-government systems, delivering high security, interoperability, and multi-application integration across national ID programs.

Electronic Identity Card (eID)

Java smart cards are widely used to issue national electronic ID cards — including China’s 2nd-generation ID chip and EU eID cards. The card securely stores the cardholder’s basic information (name, gender, ethnicity), biometrics (fingerprint, facial template), and digital certificates, supporting both offline verification and online identity authentication.

Electronic Passport (ePassport)

Based on the ICAO 9303 standard, the Java Card platform supports Machine Readable Travel Documents (eMRTD), encrypting passport holder information and biometrics within the chip to prevent forgery and tampering. At border crossings, NFC reading enables rapid passport clearance.

Digital Government Services

Across social security, taxation, and healthcare systems, Java smart cards serve as a unified identity authentication medium — enabling “one card, many uses”: online social security enquiries, healthcare settlement, secure login to government service platforms, and digital signatures ensuring the legal validity of administrative processes.

Secure Access Control

Government agencies and classified institutions use Java cards as access control cards or USB security keys. Combined with PKI infrastructure, they perform dual physical-and-logical authentication, preventing unauthorized access to sensitive facilities and information systems.

TECHNICAL ADVANTAGES

Why Java Card Leads
in Government Identity

Four core technical capabilities that make Java Card the globally preferred platform for national identity programs.

SECURITY CERTIFICATION

EAL6+ High-Assurance Protection

Supports EAL6+ security certification with side-channel attack resistance, key protection, and secure boot mechanisms. Hardware-level isolation ensures that biometric data, private keys, and certificates are never exposed outside the chip boundary.

EAL6+ CC
Side-channel Defense
Secure Boot

MULTI-APPLICATION CO-EXISTENCE

One Card — ID, Healthcare, Transit

A single card can simultaneously run multiple independent applications — identity, healthcare insurance, transit — without mutual interference. Each application operates within a Security Domain, enforcing strict data isolation between applets.

Security Domain
Applet Isolation
Multi-app Coexist

REMOTE MANAGEMENT

OTA Over-the-Air Card Updating

Through OTA (Over-The-Air) card issuance technology, security policies can be upgraded or new services added without replacing the physical card. This dramatically reduces the cost and operational overhead of national-scale ID re-issuance campaigns.

OTA Issuance
Remote Upgrade
No Card Recall

MOBILE EXTENSION

NFC Virtualization — Phone as eID

Supports virtualising eID onto mobile phone SIM cards or eSE secure elements via NFC, delivering a “phone as identity card” experience. Enables online real-name authentication, digital signature, and contactless government service access from any smartphone.

NFC Virtualization
SIM / eSE
Mobile eID

ARCHITECTURE

Chip-Level Architecture:
Three-Layer Nested Security Design

The core of an electronic ID card is an embedded secure chip based on the Java smart card platform, employing a Physical Layer — Secure Chip Layer — Application Layer three-tier architecture for hardware isolation and functional decoupling.

01

PHYSICAL LAYER

Hardware Interface

ISO/IEC 7816-compliant contact or NFC contactless chip, fabricated from EMI-resistant silicon semiconductor substrate with tamper-evident physical packaging.
  • ISO 7816 contact interface
  • ISO 14443 NFC contactless
  • Anti-tamper encapsulation
  • EMI-resistant silicon substrate

02

SECURE CHIP LAYER

Secure Element (SE)

Integrates a secure processor (SE) running Java Card OS, supports EAL6+ certification, with key isolation, memory encryption, and side-channel attack countermeasures. All sensitive operations (signing, authentication) execute exclusively within this layer.
  • Java Card OS · EAL6+ certified
  • Key isolation & memory encryption
  • SPA / DPA / EMA attack defence
  • On-chip ECC · AES · SHA execution

03

APPLICATION LAYER

Applet Services

Multiple independent applets deployed on the card — eID identity application, digital certificate management, biometric template storage — each isolated by Security Domain with no cross-applet data access.
  • eID identity applet
  • Digital certificate (X.509)
  • Biometric template store
  • Security Domain isolation

CORE APPLICATION SCENARIOS

Mutual Authentication and Digital
Signature Mechanisms‌

Identity verification for electronic ID cards relies on PKI (Public Key Infrastructure) and a two-way challenge-response protocol to ensure that “the card is in hand, the person is present, and the ID is genuine.”

Image Accordion #1

Image Accordion Content Goes Here! Click edit button to change this text.

Identity Authentication Flow

  • Terminal sends random challenge to the card

    The government terminal (e.g. border kiosk, eService counter) sends a random challenge value (nonce) to the card, initiating the mutual authentication process.

  • Card signs the challenge with its private key

    The card uses its built-in private key to digitally sign the challenge value, then returns the signature result and full certificate chain to the terminal.

  • Terminal verifies the certificate using CA public key

    The terminal uses the CA (Certificate Authority) public key to verify the certificate's validity and the signature's authenticity — confirming the card is genuine.

  • Secure session established — service access granted

    Both parties confirm mutual identity. A secure session is established and the requested government service is unlocked — ensuring "card in hand, person online, credential verified."

✅ Secure channel active · PKI · X.509 · ICAO BAC/PACE
Digital Signature Flow (e-Seal)

  • User enters PIN code to unlock the card

    The user inputs their PIN code at the terminal or device. The card verifies the PIN locally on-chip before enabling its signing capability.

  • System passes the document hash into the secure chip

    The system computes a hash of the document to be signed and transmits it to the secure chip via a secure APDU command for processing.

  • Chip signs with the bound private key — key never leaves

    The chip uses its bound private key to generate a digital signature. Crucially, the private key is never exposed outside the chip boundary at any point — it is generated and stored entirely on-chip.

  • Signature and certificate returned for third-party verification

    The signature result and certificate are returned together to the system, enabling any authorized third party to verify authenticity and ensure the legal validity of the signed document or transaction.

✅ Legally binding · eIDAS · GB/T 35114 compatible

FULL-SCENARIO COVERAGE

Fixed Terminal · Mobile · Physical
Access — All Unified

Java smart cards support a three-in-one integrated deployment spanning fixed government terminals, mobile devices, and physical access control systems.

Application Scenario Implementation Method Technology User Experience
🏛 Government Portal Login
Fixed Terminal 		Insert USB card reader or NFC tap on government terminal
PKI Auth Digital Signature X.509 Cert
★ One-click login to unified government platform — replaces username and password entirely
🏢 Government Access Control
Physical Security 		Contactless card swipe or mobile NFC at secure facility entrance
Multi-app Isolation Biometric Match Dynamic Perm
★ Frictionless access, permissions dynamically issued and revoked remotely
📱 Mobile eID (Virtualized)
Mobile First 		eID embedded into phone SIM or TEE via SE/eSE secure element
OTA Issuance NFC Emulation eSE / SIM
★ Smartphone becomes identity card — supports online real-name auth and digital signing
`

Related Products

Recommended Products

DCCO products matched to government identity recognition deployments.

NXP JCOP 4 P71 J3R180 180K

Recommended Products (2)

NXP JCOP 4 P71 J3R150

HDSC9872B-01

Recommended Products (4)

TMC THD89 Java Card