Accessing the smart card environment over the Web poses security risks and challenges. To mitigate these risks, The IDP uses a browser plugin named SConnect composed of a set of security mechanisms to protect end users. These measures include digital signature of the browser extension, enforcing HTTPS, user consent, server validation, and a connection key.