There absolutely is a mechanism that exists for doing this: HTTPS.
(I know what you're thinking--read to the end of the post before you decide it is not what you want!)
First, HTTPS is merely HTTP built on top of SSL, so having an in depth understanding of SSL will be beneficial.
Normally, SSL connections used on the web are only concerned with authenticating the server. However, there is a way that the server can authenticate the client as well by being its own CA and issuing a certificate to the client. This feature was built into the SSL protocol as an optional step in the event that you want 2 way authentication (much like what you are requesting).
Here's a BROAD picture of how it works:
- The client initiates a connection with the server, requesting its certificate.
- The server responds by sending its certificate back to the client. An optional part of this step is that the server can also challenge the client by requesting a certificate. Most websites do not do this. This is what you want to enable on your site.
- The client authenticates the server's certificate is valid by using the CA's public key to decrypt the certificate (if the data matches, then it is known that the certificate had to come from the CA, as only the CA has the private key to generate certificates).
- The client sends a symmetric key to the server (encrypted using a public key within the server's certificate). If the server requested a certificate, the client also sends its certificate to the server.
- The server authenticates the client. Usually this occurs by the server itself assuming the role of the CA and determining that the certificate did in fact come from this server. This step only occurs if the server challenged the client.
- Using the encrypted symmetric key that the client sent, the server determines what the symmetric key wil be and sends a confirmation back to the client.
- At this point the handshake is done. All further correspondence occurs using a simple symmetric key encryption algorithm.
Now comes the question: How does the client get the certificate in the first place? First of all, you need a secure way to issue a certificate. You mentioned smart cards (which can be good. A simple jump drive is good too as long as you are certain it will not fall into the wrong hands). If we are talking CIA-level security, then there is no easy (or cheap) answer to how to distribute the certificate--you will have you use your own judgement and do your homework on this one.
Once the user has the certificate, every major operating system has mechanisms for installing the certificate so that your computer will be smart enough to respond automatically with the correct certificate. Finding information on how to do this shouldn't be tough (I did it before and don't remember too many problems finding information on the subject).
Unfortunately, I have only ever dealt with being a client when working with this, but these links (and anything else that shows up under a google search for "SSL Client Authentication") should help you out:
I assume that you already know that this will bring headaches to your clients, so only do this if you are 100% certain that a simple web login with the more basic HTTPS encryption is not what you want.
Best of luck, and hope this helps.
