FAQs - smartcards and biometrics

December 2004 Access Control & Identity Management, Security Services & Risk Management

1. What is a smartcard ID?

A smartcard includes an embedded computer chip that can be either a microprocessor with internal memory or a memory chip alone. The card connects to a reader with direct physical contact or with a remote contactless electromagnetic interface. With an embedded microprocessor, smartcards have the unique ability to store large amounts of data, carry out their own on-card functions (eg, encryption and digital signatures) and interact intelligently with a smartcard reader. A smartcard ID can combine several ID technologies, including the embedded chip, visual security markings, a magnetic stripe, a bar code and/or an optical stripe. Smartcards are used worldwide in financial, telecommunications, transit, healthcare, secure identification and other applications.

2. Why is a smartcard the ideal alternative for a privacy-sensitive secure personal ID system?

A smartcard is the only alternative that can securely combine several applications and technologies onto one card, providing both convenience and security while minimising the need to present personal, private information. With a smartcard-based system, there is no technical requirement to have a central database system that observes all requests for services. Because the smartcard is an active device (a small computer), the card is able to give only that information that is required for the specific service at the time the card is presented.

3. Are privacy rights of individuals at risk as we move closer to a standardised identification system?

Yes. There are potential impacts on privacy with any new identification system, particularly one that relies on large interconnected data bases. It is prudent that privacy concerns be kept in the forefront during the design of identification/security systems. But, as mentioned previously, a smartcard-based system does not require a central database of information and can have an active interaction with the information requestor. Services and participant information can be distributed to those points where the service takes place. The unique ability of the smartcard to verify the authenticity and authority of the service request allows it to be the best guardian of the card owner's personal information.

4. How does this white paper define privacy?

Privacy is a broad topic, one that invokes differing definitions often coloured by cultural, political, and economic factors. To many people, privacy is that imaginary protective bubble surrounding our personal lives. It is an insulating barrier between ourselves, and those we care about, and the outside world. To others privacy might include a sense of secrecy, an ability to carry out our daily activities without the knowledge of others. And to some privacy can even mean outright anonymity, where we are able to remain nameless or unrecognisable in our dealings with other individuals or entities. The white paper defines a 'privacy-sensitive' secure ID system as one that has technology, policies and processes in place to protect the individual's personal information and that provides the ability for the individual to control who has access to the personal information used by the secure ID system.

5. What are examples of ID system implementations that use smartcards and biometrics today?

There are numerous government ID systems implemented worldwide that are using smartcard and biometric technology, including:

* US Department of Defense Common Access Card - with photo, biometrics (fingerprint), and smartcard chip.

* Malaysia's national ID (Government multipurpose card) - with photo, biometrics (fingerprint) and smartcard chip.

* Spain's social security card - with biometrics and smartcard chip.

* Netherlands' 'Privium' automated border crossing system - with photo, biometrics (iris) and smartcard chip.

* Brunei's national ID - with photo, biometrics (fingerprint) and smartcard chip.

* UK's Asylum Seekers Card - with photo, biometrics (fingerprint) and smartcard chip.

6. Are biometric systems alone not enough to prove an individual's identity as they pass through critical check points such as airports or border crossings?

They may be, but having only a face, fingerprint, or other biometric available for identification requires a large, very fast and as yet undefined infrastructure. Having a smart ID device, which supports existing authentication infrastructures and which can compare the biometric at the point of interaction, allows much more flexible identity authentication with less impact on privacy. This is because it is not necessary to record who passed a security point, only to verify the identity of whoever it was had been previously authenticated. A combined smartcard and biometrics ID system also delivers the highest security, supporting two- or three-factor authentication.

7. How is a biometric template created on a smartcard, and what stops someone from overwriting the card with his/her own biometric?

A biometric template is an encrypted hash of the actual biometric itself. Once created, the template is digitally signed and locked onto the card by the issuing authority. Any attempt to overwrite would not be authenticated by the issuing authority as the smartcard prevents modifications of its memory by anyone who is not correctly authenticated.

Smart Card Alliance

www.smartcardalliance.org





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Look before you leap into a back-up power solution
Editor's Choice Security Services & Risk Management
Before you rush into purchasing a back-up power solution, you need to take a considered and long-term view of how to get yourself as close to grid independence as possible.

Read more...
All-mobile people management solution with facial recognition
Editor's Choice Integrated Solutions Security Services & Risk Management Products
The new mobile Incident Desk People Management platform with facial recognition combines identification data on suppliers, staff, sub-contractors and even people on watch lists, for less than the cost of traditional service management tools.

Read more...
Passion, drive and hard work
Technews Publishing Editor's Choice CCTV, Surveillance & Remote Monitoring Security Services & Risk Management
Colleen Glaeser is a leader in the security market, having made her mark in the male-dominated security industry through determination and hard work, along with a vision of making the world a safer place.

Read more...
Are you your insider threat?
Technews Publishing Editor's Choice Security Services & Risk Management Commercial (Industry)
Insider threats are a critical aspect of risk management today, but what happens when it is the owner of the company acting fraudulently and making sure none of his staff can catch him?

Read more...
Powder coating provides durable finish
Turnstar Systems Access Control & Identity Management Industrial (Industry)
Turnstar’s powder coating line provides corrosion resistance, high-quality surface finishing and a long-term environment-friendly impact for all access control components the company manufactures.

Read more...
Local makes lekker parking bay management technology
Access Control & Identity Management
South African born-and-bred technology platform Parket builds a seamless bridge between supply and the ever-increasing, but fluid – and often temporary – demand for parking bays.

Read more...
Local innovation continues
BoomGate Systems Access Control & Identity Management
While having local manufacturing facilities presents its own set challenges in South Africa, Boomgate Systems makes full use of its in-house local manufacturing and R&D.

Read more...
CathexisVision integrated with Suprema’s BioStar2
Technews Publishing News Access Control & Identity Management Integrated Solutions
This integration uses BioStar2 access control events to trigger automated actions on the CathexisVision system, including alerts, recording a camera and commands such as locking and unlocking doors, and clearing an alarm.

Read more...
Trackforce Valiant acquires TrackTik Software
News Integrated Solutions Security Services & Risk Management
Trackforce Valiant, a provider of security workforce management solutions, announced the acquisition of TrackTik Software, a cloud-based security workforce management provider.

Read more...
Maximise parking lot security
Hikvision South Africa Access Control & Identity Management
Hikvision has created its range of TandemVu PTZ cameras which provide wide-angle and close-up visibility of incidents, real-time alerts for security teams, and sound and light alarm deterrents in commercial parking spaces.

Read more...