A method comprising: receiving, at a server device and from a client device, a request to authenticate the client device based on a smart card at the client device; in response to receiving the request, initiating an authentication session for the client device; generating a Personal Computer/Smart Card (PC/SC) layer connection between the server device and the client device; generating a virtual channel between the server device and the client device, wherein the virtual channel is at a higher communication level than the PC/SC layer connection: during the authentication session for the client device, determining that an operation during the authentication session uses one or more of a signature, a certificate, a list of certificates, or a decryption operation provided by the smart card at the client device; in response to the determining, sending, from the server device, to the client device, and via the virtual channel at the higher communication level than the PC/SC layer connection, a request for one or more of the signature, the certificate, the list of certificates, or the decryption operation provided by the smart card at the client device; and determining, via communications received by the server device via the virtual channel or the PC/SC layer connection, that the smart card at the client device was removed. receiving, at a server device and from a client device, a request to authenticate the client device based on a smart card at the client device; in response to receiving the request, initiating an authentication session for the client device; generating a Personal Computer/Smart Card (PC/SC) layer connection between the server device and the client device; generating a virtual channel between the server device and the client device, wherein the virtual channel is at a higher communication level than the PC/SC layer connection: during the authentication session for the client device, determining that an operation during the authentication session uses one or more of a signature, a certificate, a list of certificates, or a decryption operation provided by the smart card at the client device; in response to the determining, sending, from the server device, to the client device, and via the virtual channel at the higher communication level than the PC/SC layer connection, a request for one or more of the signature, the certificate, the list of certificates, or the decryption operation provided by the smart card at the client device; and determining, via communications received by the server device via the virtual channel or the PC/SC layer connection, that the smart card at the client device was removed. during the authentication session for the client device, determining that an operation during the authentication session uses one or more of a signature, a certificate, a list of certificates, or a decryption operation provided by the smart card at the client device; in response to the determining, sending, from the server device, to the client device, and via the virtual channel at the higher communication level than the PC/SC layer connection, a request for one or more of the signature, the certificate, the list of certificates, or the decryption operation provided by the smart card at the client device; and determining, via communications received by the server device via the virtual channel or the PC/SC layer connection, that the smart card at the client device was removed. <EOS>