Smart Card Authentication in Windows Mobile 6.5

Windows Mobile 6.5 handled smart card reader attachments through an adapted version of the desktop Personal Computer/Smart Card (PC/SC) framework integrated into the Windows Embedded CE 6.0 kernel, working directly with Microsoft’s Cryptographic Application Programming Interface (CryptoAPI). This architecture allowed rugged enterprise devices and PDAs to interface with external smart card readers via specialized hardware attachments, enabling high-security two-factor authentication, S/MIME email encryption, and secure network access using government and corporate credentials like CAC (Common Access Card) and PIV (Personal Identity Verification) cards.

Hardware Connection Methods

Because standard consumer devices running Windows Mobile 6.5 lacked built-in smart card slots, physical integration relied on enterprise-grade hardware solutions:

  • Snap-on Sleds and Expansion Jackets: Enterprise hardware vendors (such as Motorola/Symbol and Intermec) engineered rugged snap-on sleds or battery-pack jackets containing integrated smart card readers that interfaced via proprietary serial or multi-pin accessory ports.
  • SDIO and CompactFlash Slots: Readers built directly into Secure Digital Input Output (SDIO) or CompactFlash form factors allowed devices with expansion slots to accept smart card readers without bulky attachments.
  • Direct USB Connections: Certain industrial Windows Mobile devices featured USB host capabilities, allowing direct mini-USB connections to external smart card readers.
  • Wireless Connections: Bluetooth-enabled smart card readers functioned as separate peripherals, pairing with the device via wireless serial profiles.

Software Architecture and the PC/SC Subsystem

At the operating system level, Windows Mobile 6.5 utilized an implementation of the PC/SC workgroup standards adapted for mobile constraints.

  1. Device Drivers: The physical reader required a manufacturer-provided Stream Interface Driver (.dll), which exposed standard entry points (Init, Open, Read, Write, IOControl) to the Windows Mobile kernel.
  2. Smart Card Resource Manager: Sitting above the driver, the Smart Card Resource Manager (Winscard.dll) managed reader resources, tracked card insertion and removal states, and arbitrated access between multiple running applications and the card reader.

CryptoAPI and Cryptographic Service Providers (CSPs)

To make smart card credentials usable for operating system services, Windows Mobile 6.5 leveraged CryptoAPI:

  • Smart Card CSPs: Third-party security vendors (such as ActivIdentity, Gemalto, or Athena) provided proprietary Cryptographic Service Providers (CSPs). The CSP converted high-level cryptographic requests from applications into Application Protocol Data Units (APDUs) understood by the card chip.
  • Certificate Store Integration: When a user inserted a card and entered their Personal Identification Number (PIN), the CSP read the digital certificates from the smart card and propagated them into the Windows Mobile system certificate store (MY store).
  • Key Isolation: While the public certificates were cached locally in the device's temporary memory, private keys remained protected inside the cryptographic coprocessor of the smart card itself. Any operation requiring private key signing or decryption was offloaded to the card hardware.

High-Security Use Cases

Once the hardware and software layers were operational, Windows Mobile 6.5 leveraged the smart card for several high-security operations:

  • S/MIME Messaging: The integrated Pocket Outlook client used the imported certificates and smart card private keys to sign outgoing messages and decrypt incoming encrypted emails.
  • Network and VPN Access: Mobile Virtual Private Network (VPN) clients and 802.1x wireless security protocols utilized the client certificates on the card to authenticate the mobile worker against enterprise networks.
  • Secure Web Browsing: Pocket Internet Explorer (PIE) utilized client-side certificate authentication over Secure Sockets Layer/Transport Layer Security (SSL/TLS), prompting the user for their card PIN when accessing protected corporate or defense intranets.