Government Identity Recognitions

EAL6+

Security Certification

ICAO

9303 eMRTD Compliant

PKI

Dual Auth Protocol

OTA

Remote Card Mgmt

Core Application Scenarios

Four Core Application Scenarios of
Java Card for Government Identity Recognition

The application of Java Card in the field of government identity recognition is primarily characterized by its high security, interoperability, and multi-application integration capabilities, making it a core technology in global e-government systems.

Electronic Identity Card (eID)

Java smart cards are widely used to issue national electronic ID cards — including China’s 2nd-generation ID chip and EU eID cards. The card securely stores the cardholder’s basic information (name, gender, ethnicity), biometrics (fingerprint, facial template), and digital certificates, supporting both offline verification and online identity authentication.

Electronic Passport (ePassport)

Based on the ICAO 9303 standard, the Java Card platform supports Machine Readable Travel Documents (eMRTD), encrypting passport holder information and biometrics within the chip to prevent forgery and tampering. At border crossings, NFC reading enables rapid passport clearance.

Digital Government Services

Across social security, taxation, and healthcare systems, Java smart cards serve as a unified identity authentication medium — enabling “one card, many uses”: online social security enquiries, healthcare settlement, secure login to government service platforms, and digital signatures ensuring the legal validity of administrative processes.

Secure Access Control

Government agencies and classified institutions use Java cards as access control cards or USB security keys. Combined with PKI infrastructure, they perform dual physical-and-logical authentication, preventing unauthorized access to sensitive facilities and information systems.

Technical Advantages

Core Technical Advantages of
Java Card for Government Identity Recognition

These four technical advantages establish a rock-solid, EAL6+-certified secure and trusted foundation for Java Card technology used in government identity verification; this enables a single card to support a wide range of government and public services, facilitates remote iterative upgrades, and comprehensively meets the security and service requirements of digital government.

Safety Certification

EAL6+ High-Assurance Protection

Supports EAL6+ security certification with side-channel attack resistance, key protection, and secure boot mechanisms. Hardware-level isolation ensures that biometric data, private keys, and certificates are never exposed outside the chip boundary.

Multi-Application Co-Existence

One Card — ID, Healthcare, Transit

A single card can simultaneously run multiple independent applications — identity, healthcare insurance, transit — without mutual interference. Each application operates within a Security Domain, enforcing strict data isolation between applets.

Remote Management

OTA Over-the-Air Card Updating

Through OTA (Over-The-Air) card issuance technology, security policies can be upgraded or new services added without replacing the physical card. This dramatically reduces the cost and operational overhead of national-scale ID re-issuance campaigns.

Mobile Extension

NFC Virtualization — Phone as eID

Supports virtualising eID onto mobile phone SIM cards or eSE secure elements via NFC, delivering a “phone as identity card” experience. Enables online real-name authentication, digital signature, and contactless government service access from any smartphone.

Architectural layers

Chip-Level Architecture:
Three-Layer Nested Security Design

The core of the Java Card for government identity recognition is an embedded secure chip based on Java smart card technology; it employs a three-layer architecture—comprising the physical layer, the secure chip layer, and the application layer—to achieve hardware isolation and functional decoupling.

01

PHYSICAL LAYER

Hardware Interface

ISO/IEC 7816-compliant contact or NFC contactless chip, fabricated from EMI-resistant silicon semiconductor substrate with tamper-evident physical packaging.

ISO 7816 contact interface
ISO 14443 NFC contactless
Anti-tamper encapsulation
EMI-resistant silicon substrate

02

SECURE CHIP LAYER

Secure Element (SE)

Integrates a secure processor (SE) running Java Card OS, supports EAL6+ certification, with key isolation, memory encryption, and side-channel attack countermeasures. All sensitive operations (signing, authentication) execute exclusively within this layer.

Java Card OS · EAL6+ certified
Key isolation & memory encryption
SPA / DPA / EMA attack defence
On-chip ECC · AES · SHA execution

03

APPLICATION LAYER

Applet Services

Multiple independent applets deployed on the card — eID identity application, digital certificate management, biometric template storage — each isolated by Security Domain with no cross-applet data access.

eID identity applet
Digital certificate (X.509)
Biometric template store
Security Domain isolation

Safety Protocol Procedures

Mutual Authentication and Digital
Signature Mechanisms‌

Identity verification for electronic ID cards relies on PKI (Public Key Infrastructure) and a two-way challenge-response protocol to ensure that “the card is in hand, the person is present, and the ID is genuine.”

Image Accordion #1

Image Accordion Content Goes Here! Click edit button to change this text.

Identity Authentication Flow

Terminal sends random challenge to the card

The government terminal (e.g. border kiosk, eService counter) sends a random challenge value (nonce) to the card, initiating the mutual authentication process.
Card signs the challenge with its private key

The card uses its built-in private key to digitally sign the challenge value, then returns the signature result and full certificate chain to the terminal.
Terminal verifies the certificate using CA public key

The terminal uses the CA (Certificate Authority) public key to verify the certificate's validity and the signature's authenticity — confirming the card is genuine.
Secure session established — service access granted

Both parties confirm mutual identity. A secure session is established and the requested government service is unlocked — ensuring "card in hand, person online, credential verified."

Digital Signature Flow (e-Seal)

User enters PIN code to unlock the card

The user inputs their PIN code at the terminal or device. The card verifies the PIN locally on-chip before enabling its signing capability.
System passes the document hash into the secure chip

The system computes a hash of the document to be signed and transmits it to the secure chip via a secure APDU command for processing.
Chip signs with the bound private key — key never leaves

The chip uses its bound private key to generate a digital signature. Crucially, the private key is never exposed outside the chip boundary at any point — it is generated and stored entirely on-chip.
Signature and certificate returned for third-party verification

The signature result and certificate are returned together to the system, enabling any authorized third party to verify authenticity and ensure the legal validity of the signed document or transaction.

Full-scenario coverage

Fixed Terminal · Mobile · Physical
Access — All Unified

Java Card-based electronic ID cards have enabled an integrated application that combines fixed and mobile terminals with physical access control systems.

Application Scenario	Implementation Method	Technology	User Experience
🏛 Government Portal Login Fixed Terminal	Insert USB card reader or NFC tap on government terminal	PKI Auth Digital Signature X.509 Cert	★ One-click login to unified government platform — replaces username and password entirely
🏢 Government Access Control Physical Security	Contactless card swipe or mobile NFC at secure facility entrance	Multi-app Isolation Biometric Match Dynamic Perm	★ Frictionless access, permissions dynamically issued and revoked remotely
📱 Mobile eID (Virtualized) Mobile First	eID embedded into phone SIM or TEE via SE/eSE secure element	OTA Issuance NFC Emulation eSE / SIM	★ Smartphone becomes identity card — supports online real-name auth and digital signing