FAQs - smartcards and biometrics

December 2004 Access Control & Identity Management

1. What is a smartcard ID?

A smartcard includes an embedded computer chip that can be either a microprocessor with internal memory or a memory chip alone. The card connects to a reader with direct physical contact or with a remote contactless electromagnetic interface. With an embedded microprocessor, smartcards have the unique ability to store large amounts of data, carry out their own on-card functions (eg, encryption and digital signatures) and interact intelligently with a smartcard reader. A smartcard ID can combine several ID technologies, including the embedded chip, visual security markings, a magnetic stripe, a bar code and/or an optical stripe. Smartcards are used worldwide in financial, telecommunications, transit, healthcare, secure identification and other applications.

2. Why is a smartcard the ideal alternative for a privacy-sensitive secure personal ID system?

A smartcard is the only alternative that can securely combine several applications and technologies onto one card, providing both convenience and security while minimising the need to present personal, private information. With a smartcard-based system, there is no technical requirement to have a central database system that observes all requests for services. Because the smartcard is an active device (a small computer), the card is able to give only that information that is required for the specific service at the time the card is presented.

3. Are privacy rights of individuals at risk as we move closer to a standardised identification system?

Yes. There are potential impacts on privacy with any new identification system, particularly one that relies on large interconnected data bases. It is prudent that privacy concerns be kept in the forefront during the design of identification/security systems. But, as mentioned previously, a smartcard-based system does not require a central database of information and can have an active interaction with the information requestor. Services and participant information can be distributed to those points where the service takes place. The unique ability of the smartcard to verify the authenticity and authority of the service request allows it to be the best guardian of the card owner's personal information.

4. How does this white paper define privacy?

Privacy is a broad topic, one that invokes differing definitions often coloured by cultural, political, and economic factors. To many people, privacy is that imaginary protective bubble surrounding our personal lives. It is an insulating barrier between ourselves, and those we care about, and the outside world. To others privacy might include a sense of secrecy, an ability to carry out our daily activities without the knowledge of others. And to some privacy can even mean outright anonymity, where we are able to remain nameless or unrecognisable in our dealings with other individuals or entities. The white paper defines a 'privacy-sensitive' secure ID system as one that has technology, policies and processes in place to protect the individual's personal information and that provides the ability for the individual to control who has access to the personal information used by the secure ID system.

5. What are examples of ID system implementations that use smartcards and biometrics today?

There are numerous government ID systems implemented worldwide that are using smartcard and biometric technology, including:

* US Department of Defense Common Access Card - with photo, biometrics (fingerprint), and smartcard chip.

* Malaysia's national ID (Government multipurpose card) - with photo, biometrics (fingerprint) and smartcard chip.

* Spain's social security card - with biometrics and smartcard chip.

* Netherlands' 'Privium' automated border crossing system - with photo, biometrics (iris) and smartcard chip.

* Brunei's national ID - with photo, biometrics (fingerprint) and smartcard chip.

* UK's Asylum Seekers Card - with photo, biometrics (fingerprint) and smartcard chip.

6. Are biometric systems alone not enough to prove an individual's identity as they pass through critical check points such as airports or border crossings?

They may be, but having only a face, fingerprint, or other biometric available for identification requires a large, very fast and as yet undefined infrastructure. Having a smart ID device, which supports existing authentication infrastructures and which can compare the biometric at the point of interaction, allows much more flexible identity authentication with less impact on privacy. This is because it is not necessary to record who passed a security point, only to verify the identity of whoever it was had been previously authenticated. A combined smartcard and biometrics ID system also delivers the highest security, supporting two- or three-factor authentication.

7. How is a biometric template created on a smartcard, and what stops someone from overwriting the card with his/her own biometric?

A biometric template is an encrypted hash of the actual biometric itself. Once created, the template is digitally signed and locked onto the card by the issuing authority. Any attempt to overwrite would not be authenticated by the issuing authority as the smartcard prevents modifications of its memory by anyone who is not correctly authenticated.

Smart Card Alliance


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Facial access control for ministry
Issue 1 2020, ZKTeco , Access Control & Identity Management
The Ministry of Culture in Saudi Arabia has adopted ZKTeco’s facial recognition technology and fingerprint biometrics to manage access control into its building.

New Door Pilot app from dormakaba
Issue 1 2020, dormakaba South Africa , Access Control & Identity Management
With new dormakaba Door Pilot, automated doors can also now be operated on the basis of remote control technologies. The system, comprising the Door Pilot app for smartphones and a Wi-Fi interface for ...

Identity lifestyle
Issue 1 2020, Suprema , Access Control & Identity Management
Once the technology of the future, biometrics has quietly snuck into our daily lives through smartphones and access controls into our places of work.

Securing BP’s new head office
Issue 1 2020, ISF SFP , Access Control & Identity Management
ISF SFP was awarded the contract to secure the first development phase for Oxford Parks, the new head office for BP South Africa.

Combining aesthetics and access control
Issue 1 2020, Turnstar Systems , Access Control & Identity Management
Prestigious law firm Bowman Gilfillan recently upgraded its physical security with the addition of four Turnstar Speedgate Express access control lanes.

Video doorbells from Ring
Issue 1 2020 , Access Control & Identity Management
Ring has a number of video doorbells available in South Africa that run off batteries or power and enable users to answer their doors from anywhere.

Centurion to unveil new product
Issue 1 2020, Centurion Systems , Access Control & Identity Management
Centurion Systems will be hosting its third Access Automation Expo this year, with dates confirmed for Durban, Johannesburg and Cape Town.

Looking ahead with mobile access technologies
Access & Identity Management Handbook 2020, Technews Publishing, HID Global, dormakaba South Africa, Salto Systems Africa, Suprema, Gallagher , Access Control & Identity Management, Integrated Solutions
Given the broad use of smartphones around the world and the numerous technologies packed into these devices, it was only a matter of time before the access control industry developed technology that would ...

Mobile access is more secure than card systems
Access & Identity Management Handbook 2020 , Access Control & Identity Management
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new technology.

This is the future. This is what we do.
Access & Identity Management Handbook 2020, ZKTeco , Access Control & Identity Management
ZKTeco has created a unique range of visible light facial recognition products combined with a flexible Android platform.